rcp client - Path Traversal/Arb File write
"DeFrancesco, Joey - 0551 - MITLL" <[email protected]> Mon, 15 Jun 2026 12:52:53 +0000
| Newsgroups | gmane.comp.gnu.inetutils.bugs |
|---|---|
| Message-ID | <SA1P110MB1342FBA2FC3062803E506DA2B8E6A@SA1P110MB1342.NAMP110.PROD.OUTLOOK.COM> |
--_004_SA1P110MB1342FBA2FC3062803E506DA2B8E6ASA1P110MB1342NAMP_
Content-Type: multipart/alternative;
boundary="_000_SA1P110MB1342FBA2FC3062803E506DA2B8E6ASA1P110MB1342NAMP_"
--_000_SA1P110MB1342FBA2FC3062803E506DA2B8E6ASA1P110MB1342NAMP_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
I have found/validated a vulnerability described in rcp-writeup.md. I have =
supplied the PoC.py in two forms. Both are attached in compressed zip.
Summary
rcp's receive path (sink()) concatenates the server-supplied filename direc=
tly into the local destination path without any validation:
/* src/rcp.c:1011-1017 */
need =3D strlen (targ) + strlen (cp) + 250;
if (need > cursize)
{
if (!(namebuf =3D malloc (need)))
run_err ("%s", strerror (errno));
}
snprintf (namebuf, need, "%s%s%s", targ, *targ ? "/" : "", cp);
cp points into the wire-protocol record and is never checked for ../ or emb=
edded /. A malicious or MITM'd server sends a C record whose filename escap=
es the target directory:
C0644 34 ../evil.txt\n
rcp opens and writes the file at the resolved path =97 silently, no error.
DeFrancesco, Joey
[email protected]
MIT Lincoln Labs =96 Cyber Physical Systems
--_000_SA1P110MB1342FBA2FC3062803E506DA2B8E6ASA1P110MB1342NAMP_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
</head>
<body>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
I have found/validated a vulnerability described in rcp-writeup.md. I have =
supplied the PoC.py in two forms. Both are attached in compressed zip=
.</div>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<h2 class=3D"code-line" id=3D"summary" style=3D"direction: ltr; text-align:=
left; text-indent: 0px; line-height: 1.25; text-transform: none; backgroun=
d-color: rgb(40, 44, 52); margin-top: 24px; margin-bottom: 16px; padding-bo=
ttom: 0.3em; border-bottom: medium; font-family: -apple-system, system-ui, =
"Segoe WPC", "Segoe UI", system-ui, Ubuntu, "Droid=
Sans", sans-serif; font-size: 24px; font-weight: 600; color: rgb(240,=
240, 240);">
Summary</h2>
<p class=3D"code-line" style=3D"direction: ltr; text-align: left; text-inde=
nt: 0px; text-transform: none; background-color: rgb(40, 44, 52); margin-to=
p: 0px; margin-bottom: 16px;">
<span style=3D"font-family: "Fira Code", Menlo, Monaco, "Cou=
rier New", monospace; font-size: 14px; color: white; background-color:=
rgb(58, 63, 75); line-height: 1.357em;"><code style=3D"font-family: "=
Fira Code", Menlo, Monaco, "Courier New", monospace;">rcp</c=
ode></span><span style=3D"font-family: -apple-system, system-ui, "Sego=
e WPC", "Segoe UI", system-ui, Ubuntu, "Droid Sans"=
;, sans-serif; font-size: 14px; color: rgb(171, 178, 191);">'s
receive path (</span><span style=3D"font-family: "Fira Code", Me=
nlo, Monaco, "Courier New", monospace; font-size: 14px; color: wh=
ite; background-color: rgb(58, 63, 75); line-height: 1.357em;"><code style=
=3D"font-family: "Fira Code", Menlo, Monaco, "Courier New&qu=
ot;, monospace;">sink()</code></span><span style=3D"font-family: -apple-sys=
tem, system-ui, "Segoe WPC", "Segoe UI", system-ui, Ubu=
ntu, "Droid Sans", sans-serif; font-size: 14px; color: rgb(171, 1=
78, 191);">)
concatenates the server-supplied filename directly into the local destinat=
ion path without any validation:</span></p>
<pre style=3D"background-color: rgb(49, 54, 63); margin-top: 0px; margin-bo=
ttom: 16px; padding: 16px; border-width: 2.4px; border-style: none; border-=
color: rgb(0, 0, 0); border-radius: 3px;"><div style=3D"text-align: left; t=
ext-indent: 0px; line-height: 1.45; white-space: pre-wrap; text-transform: =
none; font-family: "Fira Code", Menlo, Monaco, "Courier New&=
quot;, monospace; font-size: 14px;"><span style=3D"color: rgb(92, 99, 112);=
"><code style=3D"font-family: "Fira Code", Menlo, Monaco, "C=
ourier New", monospace; display: inline;"><i>/* src/rcp.c:1011-1017 */=
</i></code></span><span style=3D"color: rgb(171, 178, 191);"><code style=3D=
"font-family: "Fira Code", Menlo, Monaco, "Courier New"=
, monospace; display: inline;">=0A=
need =3D </code></span><span style=3D"color: rgb(230, 192, 123);"><code sty=
le=3D"font-family: "Fira Code", Menlo, Monaco, "Courier New&=
quot;, monospace; display: inline;">strlen</code></span><span style=3D"colo=
r: rgb(171, 178, 191);"><code style=3D"font-family: "Fira Code", =
Menlo, Monaco, "Courier New", monospace; display: inline;"> (targ=
) + </code></span><span style=3D"color: rgb(230, 192, 123);"><code style=3D=
"font-family: "Fira Code", Menlo, Monaco, "Courier New"=
, monospace; display: inline;">strlen</code></span><span style=3D"color: rg=
b(171, 178, 191);"><code style=3D"font-family: "Fira Code", Menlo=
, Monaco, "Courier New", monospace; display: inline;"> (cp) + </c=
ode></span><span style=3D"color: rgb(209, 154, 102);"><code style=3D"font-f=
amily: "Fira Code", Menlo, Monaco, "Courier New", monos=
pace; display: inline;">250</code></span><span style=3D"color: rgb(171, 178=
, 191);"><code style=3D"font-family: "Fira Code", Menlo, Monaco, =
"Courier New", monospace; display: inline;">;=0A=
</code></span><span style=3D"color: rgb(198, 120, 221);"><code style=3D"fon=
t-family: "Fira Code", Menlo, Monaco, "Courier New", mo=
nospace; display: inline;">if</code></span><span style=3D"color: rgb(171, 1=
78, 191);"><code style=3D"font-family: "Fira Code", Menlo, Monaco=
, "Courier New", monospace; display: inline;"> (need > cursize=
)=0A=
{=0A=
</code></span><span style=3D"color: rgb(198, 120, 221)=
;"><code style=3D"font-family: "Fira Code", Menlo, Monaco, "=
Courier New", monospace; display: inline;">if</code></span><span style=
=3D"color: rgb(171, 178, 191);"><code style=3D"font-family: "Fira Code=
", Menlo, Monaco, "Courier New", monospace; display: inline;=
"> (!(namebuf =3D </code></span><span style=3D"color: rgb(230, 192, 123);">=
<code style=3D"font-family: "Fira Code", Menlo, Monaco, "Cou=
rier New", monospace; display: inline;">malloc</code></span><span styl=
e=3D"color: rgb(171, 178, 191);"><code style=3D"font-family: "Fira Cod=
e", Menlo, Monaco, "Courier New", monospace; display: inline=
;"> (need)))=0A=
run_err (</code></span><span style=3D"color: rg=
b(152, 195, 121);"><code style=3D"font-family: "Fira Code", Menlo=
, Monaco, "Courier New", monospace; display: inline;">"%s&qu=
ot;</code></span><span style=3D"color: rgb(171, 178, 191);"><code style=3D"=
font-family: "Fira Code", Menlo, Monaco, "Courier New",=
monospace; display: inline;">, strerror (errno));=0A=
}=0A=
</code></span><span style=3D"color: rgb(230, 192, 123);"><code style=3D"fon=
t-family: "Fira Code", Menlo, Monaco, "Courier New", mo=
nospace; display: inline;">snprintf</code></span><span style=3D"color: rgb(=
171, 178, 191);"><code style=3D"font-family: "Fira Code", Menlo, =
Monaco, "Courier New", monospace; display: inline;"> (namebuf, ne=
ed, </code></span><span style=3D"color: rgb(152, 195, 121);"><code style=3D=
"font-family: "Fira Code", Menlo, Monaco, "Courier New"=
, monospace; display: inline;">"%s%s%s"</code></span><span style=
=3D"color: rgb(171, 178, 191);"><code style=3D"font-family: "Fira Code=
", Menlo, Monaco, "Courier New", monospace; display: inline;=
">, targ, *targ ? </code></span><span style=3D"color: rgb(152, 195, 121);">=
<code style=3D"font-family: "Fira Code", Menlo, Monaco, "Cou=
rier New", monospace; display: inline;">"/"</code></span><sp=
an style=3D"color: rgb(171, 178, 191);"><code style=3D"font-family: "F=
ira Code", Menlo, Monaco, "Courier New", monospace; display:=
inline;"> : </code></span><span style=3D"color: rgb(152, 195, 121);"><code=
style=3D"font-family: "Fira Code", Menlo, Monaco, "Courier =
New", monospace; display: inline;">""</code></span><span sty=
le=3D"color: rgb(171, 178, 191);"><code style=3D"font-family: "Fira Co=
de", Menlo, Monaco, "Courier New", monospace; display: inlin=
e;">, cp);=0A=
</code></span></div></pre>
<p class=3D"code-line" style=3D"direction: ltr; text-align: left; text-inde=
nt: 0px; text-transform: none; background-color: rgb(40, 44, 52); margin-to=
p: 0px; margin-bottom: 16px;">
<span style=3D"font-family: "Fira Code", Menlo, Monaco, "Cou=
rier New", monospace; font-size: 14px; color: white; background-color:=
rgb(58, 63, 75); line-height: 1.357em;"><code style=3D"font-family: "=
Fira Code", Menlo, Monaco, "Courier New", monospace;">cp</co=
de></span><span style=3D"font-family: -apple-system, system-ui, "Segoe=
WPC", "Segoe UI", system-ui, Ubuntu, "Droid Sans"=
, sans-serif; font-size: 14px; color: rgb(171, 178, 191);"> points
into the wire-protocol record and is never checked for </span><span style=
=3D"font-family: "Fira Code", Menlo, Monaco, "Courier New&qu=
ot;, monospace; font-size: 14px; color: white; background-color: rgb(58, 63=
, 75); line-height: 1.357em;"><code style=3D"font-family: "Fira Code&q=
uot;, Menlo, Monaco, "Courier New", monospace;">../</code></span>=
<span style=3D"font-family: -apple-system, system-ui, "Segoe WPC"=
, "Segoe UI", system-ui, Ubuntu, "Droid Sans", sans-ser=
if; font-size: 14px; color: rgb(171, 178, 191);"> or
embedded </span><span style=3D"font-family: "Fira Code", Menlo, =
Monaco, "Courier New", monospace; font-size: 14px; color: white; =
background-color: rgb(58, 63, 75); line-height: 1.357em;"><code style=3D"fo=
nt-family: "Fira Code", Menlo, Monaco, "Courier New", m=
onospace;">/</code></span><span style=3D"font-family: -apple-system, system=
-ui, "Segoe WPC", "Segoe UI", system-ui, Ubuntu, "=
Droid Sans", sans-serif; font-size: 14px; color: rgb(171, 178, 191);">=
.
A malicious or MITM'd server sends a </span><span style=3D"font-family: &q=
uot;Fira Code", Menlo, Monaco, "Courier New", monospace; fon=
t-size: 14px; color: white; background-color: rgb(58, 63, 75); line-height:=
1.357em;"><code style=3D"font-family: "Fira Code", Menlo, Monaco=
, "Courier New", monospace;">C</code></span><span style=3D"font-f=
amily: -apple-system, system-ui, "Segoe WPC", "Segoe UI"=
;, system-ui, Ubuntu, "Droid Sans", sans-serif; font-size: 14px; =
color: rgb(171, 178, 191);"> record
whose filename escapes the target directory:</span></p>
<pre style=3D"background-color: rgb(49, 54, 63); margin-top: 0px; margin-bo=
ttom: 16px; padding: 16px; border-width: 2.4px; border-style: none; border-=
color: rgb(0, 0, 0); border-radius: 3px;"><div style=3D"text-align: left; t=
ext-indent: 0px; line-height: 1.45; white-space: pre-wrap; text-transform: =
none; font-family: "Fira Code", Menlo, Monaco, "Courier New&=
quot;, monospace; font-size: 14px; color: rgb(171, 178, 191);"><code style=
=3D"font-family: "Fira Code", Menlo, Monaco, "Courier New&qu=
ot;, monospace; display: inline;">C0644 34 ../evil.txt\n=0A=
</code></div></pre>
<p class=3D"code-line" style=3D"direction: ltr; text-align: left; text-inde=
nt: 0px; text-transform: none; background-color: rgb(40, 44, 52); margin-to=
p: 0px; margin-bottom: 16px;">
<span style=3D"font-family: "Fira Code", Menlo, Monaco, "Cou=
rier New", monospace; font-size: 14px; color: white; background-color:=
rgb(58, 63, 75); line-height: 1.357em;"><code style=3D"font-family: "=
Fira Code", Menlo, Monaco, "Courier New", monospace;">rcp</c=
ode></span><span style=3D"font-family: -apple-system, system-ui, "Sego=
e WPC", "Segoe UI", system-ui, Ubuntu, "Droid Sans"=
;, sans-serif; font-size: 14px; color: rgb(171, 178, 191);"> opens
and writes the file at the resolved path =97 silently, no error.</span></p=
>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id=3D"ms-outlook-mobile-signature" style=3D"color: inherit; background=
-color: inherit;">
<div class=3D"MsoNormal" style=3D"color: rgb(68, 114, 196);"><b>DeFrancesco=
, Joey</b></div>
<div class=3D"MsoNormal" style=3D"color: rgb(68, 114, 196);"><b>joseph.defr=
[email protected]</b></div>
<div class=3D"MsoNormal" style=3D"color: rgb(68, 114, 196);"><b>MIT Lincoln=
Labs =96 Cyber Physical Systems</b></div>
</div>
</body>
</html>
--_000_SA1P110MB1342FBA2FC3062803E506DA2B8E6ASA1P110MB1342NAMP_--
--_004_SA1P110MB1342FBA2FC3062803E506DA2B8E6ASA1P110MB1342NAMP_
Content-Type: application/zip; name="rcp.zip"
Content-Description: rcp.zip
Content-Disposition: attachment; filename="rcp.zip"; size=9127;
creation-date="Mon, 15 Jun 2026 12:52:49 GMT";
modification-date="Mon, 15 Jun 2026 12:52:49 GMT"
Content-Transfer-Encoding: base64
UEsDBBQAAAAAAC9Gz1wAAAAAAAAAAAAAAAAEACAAcmNwL3V4CwABBPYBAAAEFAAAAFVUDQAH2/Qv
atv0L2rb9C9qUEsDBBQACAAIAC9Gz1wAAAAAAAAAAAAAAAAOACAAX19NQUNPU1gvLl9yY3B1eAsA
AQT2AQAABBQAAABVVA0AB9v0L2rb9C9q//QvamNgFWNnYGJg8E1MVvAPVohQgAKQGAMnEBsxMDCy
AWkgn9GCgSjgGBISBGGBdWwB4hY0JUxQcQ8GBv7k/Fy9xIKCnFS93MTkHIj8HyC2YWAQRcgVliYW
JeaVZOalMnA4lEpac7ze7FG43ydxjsxsptvEuQsdFOobGFgYWpslGqWlGZklWjtnFOXnplpbOhoZ
W7g6O+qaOzka65o4GVjoOrqZuui6mpm4GZlbOjlaWjoxAABQSwcIowu5H7IAAAA4AQAAUEsDBBQA
CAAIAIM+z1wAAAAAAAAAAAAAAAASACAAcmNwL3JjcC13cml0ZXVwLm1kdXgLAAEE9gEAAAQUAAAA
VVQNAAdn5y9q3fQvatv0L2qtV+tu48YV/s+nOOtFY0kxRXt3s0W18RaKbMdGfYPkXbRIA3NEjqyp
KQ47M5Ks1gmC/ugDFIs+Sh/IT9LvzJCSjGRRBKgsmyZnzmXO5TsfX5LJqh5dCzelGyMW0lhR0EIJ
+lAuRKFy4WROI2mwEo/mVVUo3J+oQpZiJqOo0xnoWaVLWbpep0MptKWUYVPpiLDKO/2CNVmCxW7W
O9g/+G1KrdSq8r7VTtt+36AQ1vJG74lbe5KQMGOFe7OiCXTR0ignvchIYo9yK5Y6Pfv21D/szyFu
5F/nysicVy7hG7Uuzm4uSBua4UiZ0nNL1h+pHUVxHEfRy5c0ms9msBJF/gy7FloyqRaSKvZoy91M
lxmiUuLXkpvKWlVsm+hMmujkcCJzxYpU6bTfWugMh8qldQrySpdB+1K5qZ47EuWK6qhjrQdf0jSL
kg49i95BzCGkThKVEuYOyToDi9Rywty16cv1fVbx3auv9t9FakItv/s9ZXNj1d9kOyJ8/u7/EvH6
ixZ7PZ5PoBKBgq9Bpt1u17uIzLy8lcZQa+c3dmePLeEOgW3hUup2+53f+UNky8rg1Gw16NwjVrVH
kOMfyLK3e9ThC/2edpId6tEOnsPrd3xwnJ6LqdLQYzchXCKocWW005kuOEna5AhcTsrCBBJB2VRm
95wH+JV2u0mKzEdyNpZ5jqdpknapv1UJ2MXlsZvXicSlzC0JSgdpo3851VZuEittJqo6++y/dBRy
rc0qZC0a7L9984ZevyE4IBeq6LoH9+eyPpfvEl3J0nrPfU0Hbb7GhfP/G2l1sYDLvkaefvpElh1A
QSGYmnzgu5sCHkpEJZ9nErGit/s4Bio1t9yjIycrOvAqxnNV5Nz0nY53dCzsNOom2DpRd3Mj6Ysv
EJt7GTytRV95UeTe+3WtB9vC1QrFW76mj/OiHEorhcmmSbaQseF4qkxaLt0EUt1qRXGMG+omdUU3
Zo4fKoQPZ0UbVOiE1gLapBHjQrZ7tbXou873OKXvSqS7VE4JrgCRq1JaS/3BH2hi9IxCq/rtI+RS
lXd1Hns03t1ODBy4XWPNLcKnJ5ynXS/K0OWTBGPjVa0UuelR4maVl610dtv9vJ7GA8fmxivOsZ4g
m6tCizyKvvvyexpcXZ6cDS+Oj3yE1wgHeOFIWJX/vMBe+BbzOEm/whcWGujSMVJzGK4urodXF2cj
mP7mTzQcXNN1/+aUbob9j8fDUf98N4pQgPPCHW58zBilD7kcNyY8pjFcHT6H+JDZm3VNVxUqw1Kn
w4C8PgyJsV5I4DQXlmLvuEfrI3NI5IPwELqcSoOi9O1cNwZAwW3V/6leNuVJS23ubWg0ih3FOX0N
k+9TBonGkinhfI3dDdbPNALOQnML9bBZkrHTPLKVWJZsj3RZ9+ZMYw5xgrp05nwV2jU+0RqfQj06
1CC1hFcWWQ10cu0u3dTOGlkVIqsBAIoKb9MPBUahsL8SymD8eLywCOW93x6tDTWzZs/DF5f8cwAL
yjZZa7CsiwkJ3HQcsQgoUEILzyWgIrygXOCgpcdumT8DG1HEkAGWCOdEdu9BKrRpeCADrBI9ffoJ
3/7wOjm6HMF3FGR49PTv/xBNgDXhvK0b1OBXB282w+Z/fp4+/SNCpgxDk+2RzxwQx6lZDMB2vcSX
3o9Jrpcl95xNfp3uz6+GGRGw5OvyPYMJf62dJgIURBtM2Pz2Xq7s/8tioA58wnpcNGEGVRmNTgm2
aBPXCllWlpsdrX286UXOKYqgRBqM427ICrSlkw+OOPy+TDBbuD/umFz5Sg4lgakJetJYjfzW81fJ
+eumfEhkGeNwhkJX5V8gtTVlQx1amqk8ZtYgZlvVdDar0OVR1P8lrieall3oe65rTjiaxyiw1ALI
wMO4CGRM82ExgGO6QpkH8fTHX0xLSk///Nd2mDiG4QA/E+cxZ7J0z98gIOxckM8YL+SDzOahabhT
EMpC36nymZrMYM1mRlXOokXnuYZlyo2uYlXiiXQZ4oFWZDfhjgqYyhlq2GwDPVt59/NhLFeaScQU
MYA9YKTh4rcgOv7aZflFirTPbSAWvmWWglUXKw4pkrtJxol6iKKh9PljQvo5estE2AmMYY81nqNY
WQkjgOsUqFcKRKnfDuAm+JgM/INFNnSYRbe47llZz9o9EhPHfK7iMIAzgw0oO4ULYkOWvCceZfnJ
IDlaj3rwY2a1KLZsapgM79FustumF4d0+eH83Lfa4yNT2GxWhfWdbnenTYeHtL+1Wm4vJyCor8MW
xqlAnzekeMMgHQGSxGTjZI886/XsloXkA6ZJ6/iPZze3J/2z8w/DY7/wQ+jVPlsGkkHZRD2gjxxY
rfVJDsQRfSyahCDYg4/H8av9g9/Fbw8ODnrEb0aTlZ8QTfrYpXXAnunjwNWvbFxrCDSgnk6gdTOm
M10paaNWGpuUE5PniuvTNyB7WvlSKTwXu2OOHXKSHq0nENu1zyYINy1o0DPX/cxHVfsOKALhYNI0
nt8xrb3C0blRU7t5z9zjAsJp8uhCrIg1denbyw/YLh3asrD1W2l4OTANf+RT+84QRQjNw7MeKHDa
6DGQwEc6kqF3uSUfo8fYf+pL/cFjSgPJTSExksUkrjsE1kxDzs07P6xI3GGh7sfQBsHLMV4MEe/H
6L9QSwcIYc4E4bwHAACaDwAAUEsDBBQACAAIAIM+z1wAAAAAAAAAAAAAAAAdACAAX19NQUNPU1gv
cmNwLy5fcmNwLXdyaXRldXAubWR1eAsAAQT2AQAABBQAAABVVA0AB2fnL2rd9C9q//QvamNgFWNn
YGJg8E1MVvAPVohQgAKQGAMnEBsB8SIgBvGvMBAFHENCgqBMkI4ZQGyDpoQRIS6anJ+rl1hQkJOq
V1iaWJSYV5KZl8pQqG9gYGFobZZolJZmZJZo7ZxRlJ+bam3paGRs4ersqGvu5Gisa+JkYKHr6Gbq
outqZuJmZG7p5Ghp6cQAAFBLBwhNYKJlhwAAANQAAABQSwMEFAAIAAgAgz7PXAAAAAAAAAAAAAAA
AB4AIAByY3AvcG9jX2V4dGVuZGVkX3ZhbGlkYXRpb24ucHl1eAsAAQT2AQAABBQAAABVVA0AB2fn
L2qY8i9qhfIvatVZW28buRV+1684GQObUWON5FvTqtGijqw0RjZ2IDuLpo4xoGYoa+q5CCRHttbQ
Yp/6XLRb9GV/nX9Jz+GQMyNZdry7QRcRElsmeQ7P5TsXkhtP2rkU7VGUtnk6g+lcTbJ0p+E4TmNw
rXga8hBmLI5CpqIshXEm4C9H7yFKucpVFEsQwRSmTE1ACTbjQrIYXCmCNo57QXers/W82Wiccqkk
EucCKUM+Jb6pAqYUCy5BBjxlIsokqAyCLB1HIgE14TDL45QLNoriSM0hko0Lnua4NbA0hDRDBpCl
vJWNx8CEisYsUN1GA6DPJIetLrxkMgrA89pQk676uCwWnIVzuycPm5Z4uwsHHOUURE0M7tC7SR6r
qBXzGY+By4BNeUm9g9QgeJCJEMIIv6hMzOss3OQSxyHLlYxCDoqJC65gFjF4evDUUJbcdrtwEuFu
TKEvWI4OEtF3PPQv+VzClYgUB3fYH0CUTNEAEPIkSyVuRg5D2w9zdJvIEmQ7zUBkGdqIFDCuhm/R
yEMuORPBpB3MeEtILmZRwCX5sD3NAp8bJPgVErzpHFotcr7XNu7WoGmgFJlAz4iLKUNO9u9M2m8y
Cy65Kv/KR1OR4WbV/Lz8qngyHUcxRwAdvh0cvz+FHux5ncaw/85/eXi0P/yAA04pAO7e2IDbH3/A
f4BcVRZkMUx4jH6UZvyL+NdohHxMMJih6dGnLtlsE9Jm4blRPka9R2ht+utqghaCmKcujjfhBaTF
KvoEkzy9xLVE7xE/N4VWubZZrovGOpz08oqaPoJFCMHB8auBEJlwx04QZ5JwOFYYHDeW1aJ9ky5g
NFdcOhVbEvRZr2CrBwVmDZHSeKPQMcNU4KPrfBmlly59wUzExHzTxISPYWK0RnSd4KDSGaeloBXC
i2rR13AVYRJiBl5ThuHFJMVcKglLnmPMJcVsE4I4MlbhyqsoXDOy/8p/f3T410274uS4/8Y/OR0O
9t82LRNPcqWihGMMuwadxRzBmZiXwPbekZZuaZWzuppOSzn0M3TqKsMzcNrO+WZJI1UYpT0U26N4
SDO3uTSHQtw/yYXo1aU5fDeo5rU7/XEoe6ci58V4oQfx07Nu8fcGpUmZJxxTeKQiTGOUPDEbSwn7
/Td6DWXz3hJwydpbBQMmMbGoYg3B9+N1p4Naj50RC0ueyKkLN7jmiVg4dcxoTqSDQY7EjOSTvsUe
WnOWcFzD5nHGwhpqcCXVCejbnPzMLtKFBJNEjClaVxx1lZEIEjQem8CTSMkSOxNUGFHfQ5n7nd/v
7hb4txsu4MZKsfiYOh5Pgyy01isQk4Ysjt2CTfNBi1URuGFl0XIVcacB9QirkjwtWrzGrnWJrAp3
Jgy/mjiFSJgQIGHiEmVRE6asiIQIqeuY4Bh2qQZPzV/4nxRc8c2A6j6qlWBMYDEjP0hEFfUb5J8Q
c1CqR8e4QEOkHs01WQdo9kIHJeZVHrsHj/w64FMFNuhNMG+Wya5ZcZiilcv9bFDUig2mPcyeWKy/
qDLzQO0hXbb8EfVPftm31PJz5UFsjvgsij11rUwbJHWwVX2PbpFKj6lkioC3ld3DRoi+u1PBx9F1
z6Etgi3furFojHrYPnjUZHp/z6LURRaYMos5p/knmkzYJccdpVuMWgdPUQQsVmvpCxUxo2RjEt7s
aBMDhZJe0YVR2UWWlkCcNapqYjL+p2qZia7lvEX2W5WkymEVhY2cssR4VyxSrgFtr6xAej67rKnM
ryNsvl1rjKaOKZ1A7BBKIUZO06PoxSDGNGL2r+ffDBsQS9CoQLLth9gnfxoj62BCyXYFJvJn4WTb
4mTDIiXCDKmIts3ao3Yx2MYybtv4GJWvLSky6Hp8sFVosWKv0epyhotHq4tHDwF49Kvgywx4tz8J
XjzFkHfunGE+L3wNgre/UATv+CUGPwHj8kynW01CtAZyqDu2APfGMoBoqiC9fL77WdDe+bwpUIu4
lkdNB2eFhqRbJaozROooJQUfgCAehTWbYqGFIK+di38hGE3c6waidMztDz/aVuQqimMojtm6sSs3
Jl00ceiX/dzIOeg839uDzopXSbbVNsOSPbZ/W9vAacEe08EdtIxqyw2c0f4ou4Ir/lRw6wlnRdkK
i9o0ZCymHbI2mGverEWw2WuAtMQ8SlNUoGT8a9owgCUzoYr6gqnYYfCLmrQVYXEtsjLd5P+9Y7zT
Mj4m9aFlfUx/tcCLJIGlHnkFJ/Kc/1Cm1L5dky71+KNyphGGOJjdNpdySi2P7vpSTuhSCmNW31ah
xdemUf3b3mjpC6wovcAtzHUgF08lnJy8hmk+irHxQo50Pli5+PIKYw05HggKui7kGEcg8lSCviMI
sgRtnUQYB/4kk6rbZukcvm+H2VVKesqi/J9wMdMYwc6gC3iu63TgRfq1KZoeKtVe2dvsLPNYdetC
k6RFg4Hnle/XksLtP/4FdB2FfqIb0GF/YDR5zTGKrzgkESEJwYutjLnSoOoAkyzhOpmhKWZZhPDO
8mBClhNkg8ImdQs/psrsVg2UdUh3yUK2g9IIsDoVMLVr1peVcvrBMlauQgqSUj5Uy8Y4SBhbvyFJ
tkptKTYhwZN4r5M973Qe7q0qCmfFc44JT+tvGtSVA1e3eLi9t7f1R9jHT3/n6DvW34r/dnC4dXQ6
2KOxQ9g/PcX0Nhj6bwYfYJoFfy5v0OkStfU5WrMNeEXXvNZliKWUo4afwPH6hm7dcqwJdeV/s9au
LsQD/V15OMeMQPXkNz9Zf9ZDen//ZHCChjzTFnCd4smDrhJrjx6689IvBDhx97P2kG/uDg3HbeJI
LyFgDxEVz6UnkKbeYd2JcJnhjmZo+7V1zyBLot7boC9z3SWu1SPJPbm3tMR95QqZnpuKljDMBqZm
6YcMahPto4a3Ly7yBPP3Oz1TXe2G2DuKaEq8es5972ePeDFzavewxe4eC0OfmW1dRz+9oCooKkMn
9GqPIJjsuGIzJnrOu/3T1yb/IillasNM/yJ20jVRaV4AqpZDpwRa4SHTWmMjsc5g1Cp37Jw9OdfK
EOE4y9OQGlRDsfiY6iqZp13A8yE9sF3kWOG++gooPdtsKnQVJcnOzoskjwaK2YjHm9qY2AanVE01
3GvdlYhSkqAMCLjRRAuUgMgWtUeIpcauSECbhf17yLxScWmNVEzlJJbTPz56dTh8OzhwyEaYvHiM
gHOOjk/9amqZdp7QL6Q9e3a+THXWOl9eaxWh7zdIuMCfeusF6FYBbkjSujqmBx3oX/qKVAK/q2Cp
wCuGO2N0DIbD4+H9m5Mv9RK0IK/vZzzksSm92rruknOyy9ojUsGuPC/IPEmYOR8UU87tf/7pwO9g
7w8Gk3HsU59MkYXduDjbPi8ChDxu9m2uRwVatFpTaU9X0mT425/+vWz425/+69xBD1qXCNDU69Gz
XurysVg/8iQPiW03+pgWw72bknjR1m8HdvnC3B5XkGrasLRWWkW/8+37b44Gw/2Xh98cnn6oKPEg
KTI0KtLZB/aZzp62FSsjuFNnXxhqi661cdT36RnD96neOr5P2dD3nUKEIjU2/gdQSwcIxfWWU2MK
AAA6IAAAUEsDBBQACAAIAIM+z1wAAAAAAAAAAAAAAAApACAAX19NQUNPU1gvcmNwLy5fcG9jX2V4
dGVuZGVkX3ZhbGlkYXRpb24ucHl1eAsAAQT2AQAABBQAAABVVA0AB2fnL2qY8i9q//QvamNgFWNn
YGJg8E1MVvAPVohQgAKQGAMnEBsB8SIgBvGvMBAFHENCgqBMkI4ZQGyDpoQRIS6anJ+rl1hQkJOq
V1iaWJSYV5KZl8pQqG9gYGFobZZolJZmZJZo7ZxRlJ+bam3paGRs4ersqGvu5Gisa+JkYKHr6Gbq
outqZuJmZG7p5Ghp6cQAAFBLBwhNYKJlhwAAANQAAABQSwMEFAAIAAgAgz7PXAAAAAAAAAAAAAAA
AAoAIAByY3AvUG9DLnB5dXgLAAEE9gEAAAQUAAAAVVQNAAdn5y9qmPIvaoXyL2qtWG1v28gR/s5f
MWHQC3mRKDuXy6Fq1UKnyD3j4hfYStJDLiBW5NLak0Syu0vbquGin/oDiv7C+yWd2V2+SJadtqgM
WBQ5Ozsvzzwzy+fPBpWSg7nIBzy/hnKjF0X+jef7vndeTIbwp9P3IHKuKy1WCmRSQrISPNdQMr0A
Ldk1l4qt4FowUFzir76qyhJlUsjEiudszT3vQ7XKuWRzsRJ6MwQlkwGqipLh4cHhd/Dr3/8FSuTL
IISkyBOmcZXmCvSC7+r0ap2QCskTvdqgdbowoqsiQUOMXTcC/+UFXLOVSJkWRT70PMCPykuJC7KA
dMyrrAc552kP/N8o+vN7oJm86sHX9AV/BH/gwxB8vJ+U4e88bwxrVJmIolJQSDg5np28SJ2RkLAc
L/MUGLyYvAC0r5Ap3CwKxZtYkIeaiVx5fhShcrT9RgptBVBnpZVIufGHTODaOVrITeR5s4VQIGxk
2qzwv1QCPaWsFBlMPkz7rw4Of9t/c3h4CIFCw3HlOMtQC0+HJoci30lsgPHGp8CuyDZdZwjmlVhp
yGSxBlVUMuGhN1kxpYYUzPNtCAyAybnA33JjvLGOeeNKL4w4nBY5x6igtRK3Cih4FMQ2ojaOoXe8
LlmiadFHE5ttvQpYHYHrYinyK6hwIfz6j3+iMQKBuIKLydSk234CHl1FUKBqG+q/DSKlFgOGhhVS
/JWn8ZJvVI/uz5layCT0vPeKXfGhUeJqArAeonIDn/p9ikw0cDH67HnnstBFUqxgzpLllSyqPLVL
SbCv64z5DieYTy6uuQ/rIuURfFzw3PqCUdGU4Ru26Zm16JgyirIUDjCXOhV5WLs/FxYaiG50GeOT
q7KQGgLJ1zCCy9nb49P46Pjd9PQMEUBaPnLSiJlMllyXTEisOAQgoYxBKYsSjdvWmixYnnPUvmAa
1kLKQlqDbuiGVIsUy0xiBrEQUcE1YhcDqckjVXK2NIaSJzeolCRsnOrijQzReGJtDEe8l0wqXv8u
VH1lLW5+VXPUlHDVPt80l5qvS0KJh2kZ//TubPwWYzH3J2cn5xdnJ8eX07fw/U8IkHM4H89+gNnF
+MP04nL87ufc96aXk/H51MZsfDLFhT7aHjcQj3HbIov0rfa92fHJ9Oz9DGW+jQ5ws5RnlNjrmN8i
dgOyeOjsjuwXcs2Q2CqE/h9gvsGKsyBBGjIm+i6wVDpYzAHeD+H3uKiBcrKo8iXKkr6INgty6Dey
YSMnMsyKtuLDTiEgIJlAAEzPjqaUyiDzkY5ym20kdiQqpIBMIwzuaq33g7v83prrtzuQzS9HdgeL
dGQSmdP9OhZVHpdFElAAsbtg8WI4tLTOF8XK2qXXJfpT5yxaL1O6DkrJM3E7MtFHJbHb2TJijOjB
RYWKiOujXwqRB6gHSdw+d8JcJazkjwiH8ODzHIieVvwa4V6VlvOsQqvutjQEGhtq29HY7tWDHRBZ
Y1B6zbC+hVRB60Vom5JpSZiLT19/NrViwwXYeO7a6N07t7rCHwu5VEiVHIww+rVPatb0ESvVbL9P
eOrcBCxvFN7y+h6pFCF/efx22mlO4ZYW59LzDsnUvLGHtJBAnKBlGJmsU+SkmlKcqppYIpo9YpKH
OfbWNTcDyQvsG8SLA/yP7fMJ+lPy2qzutXpG2yVqONHdGR/F70+P/9yrJS7PJj/Gl7OL6fgk3FIX
Ka61WHPcPHCs0CS2SGiLhq+ic+TYPGjK6FObX4RvX/v0P3VTiEP6SxpCPveaNcbZUe1BZAaLIgi3
BNCUL0hwKUddu47Pp+1zwwRxlqrRTFbc3rc+N0qNSJ1tjcXdLH4Ol5qXcDisZzoaiXBqyYWm1iw5
Q/txT8MpzSpmktEl0CZZhy3t4OTBqVGQMFHmz7cHBxitzK/yGqnNRqQe7lD0GQK90WBRaqB+Ydtw
use08eRHN/QYF3znZ8e9V0M76rXDy6Qe+GicbcY9ywyqm9D5pmWaRm2zYITe4GR4t0MjHRcWaCaX
RnBy8Ob1a8vVrtmF93BX67rHnhbxPMEpIwh3ImCr/RJdoAHKWo71bnVHEplalEH4rOGIHcDnKdZn
YKUfBuebJvcEd1v4hjYDpu1oazsqxp44NHQTA0Zd/b8A0cCB9u2TGaS+B1fYFx8BhQ3JEdlJ8rgW
M+X8YPoBGe4BxWsHipJtVgVLbdd8PHx1yh5Ljd7NrNFHM77bYI8J3zoTsMUjNuWSBmPEo3YHBzO2
WZ+QNyXHiTGnOjbYf8JUF9mH+70ZYveWa0EnNndgUwrJ/SlVU8TlQ03fDY0RDizUHUwV4gGB7kzr
6grIescpZJOFjh0/VBvKLUqiz5eQxG8TXmL3cGzvCL3XzErhtroSkWfbHNYsnZLQHMOJ5uxJfaj1
A+HmPYxHzaBt8oskumFCB27v0XYz+ZKBPRibYsDgW4PpnMCHD8H17DM0BxZOkgTte6oahPUIR+nI
9ocd05YCk7fP3A5BmHVYtuah/RVRUoMwSrnhIbOhwsmOlyscXPytodWu2Al0x2wajpwM3NmLJ+12
Q+kRW+Ghwg0T/X4fJguOhIHor/Bwizc8t3890/FbobQKtuq9k386wlN1jgxPbIthA5dzP3Re7wR/
T6W//AyTs9Oj44sTPJjUncOcnHGL9nXAzquAZ/5DVXRtTuQP57ZHpCfWDxR3Hj3C+/uN9238Rq35
Cb0ZGFEE2yOTeStDmBxtv/TxH2SJRo06SafI0hkdo01I0gpPCalgV3mhtEiwX2eFt2tYE9F+Z4g1
wcxrZY/FZU9MDMuagXrohIiIMP7kXY8uqMGqXtO3acAh/Nyw1dIcMFq40MqMTvit8H6I2193WyeL
ZsssD2t7/+cy21Ni3b33llc3RHXKT89mcZN2J7Fda+YIuGbogAuEOdiTzfUhPxrLq2qNoT43T9qZ
GAf9BEFoMOObd5Bk13/xuhEpcgtqod8ZYK0dEUvTmDkD2q1982rH73VsyRg57DdvezoP11yzaybR
yPHsh879BV+VI98aXHQPdIFTN2xfHoV+d7pGixSl1dpovshKVc/Z7lxfA0QocjkgiYh07ef6jgHd
SqhXfYH4Tdrp8nvqcZ03hhkeZfXwP1wM6DFyTCauKsnhq6+ADsNPraV7yMI6eOVcL8w06N4pNB57
W7IHhsOXwBGC1No9D3/HMWEijmk+9OOYMBnHvg2VBaj3b1BLBwjBeb4+TQkAAAQXAABQSwMEFAAI
AAgAgz7PXAAAAAAAAAAAAAAAABUAIABfX01BQ09TWC9yY3AvLl9Qb0MucHl1eAsAAQT2AQAABBQA
AABVVA0AB2fnL2qY8i9q//QvamNgFWNnYGJg8E1MVvAPVohQgAKQGAMnEBsB8SIgBvGvMBAFHENC
gqBMkI4ZQGyDpoQRIS6anJ+rl1hQkJOqV1iaWJSYV5KZl8pQqG9gYGFobZZolJZmZJZo7ZxRlJ+b
am3paGRs4ersqGvu5Gisa+JkYKHr6GbqoutqZuJmZG7p5Ghp6cQAAFBLBwhNYKJlhwAAANQAAABQ
SwECFAMUAAAAAAAvRs9cAAAAAAAAAAAAAAAABAAYAAAAAAAAAAAA7UEAAAAAcmNwL3V4CwABBPYB
AAAEFAAAAFVUBQAB2/QvalBLAQIUAxQACAAIAC9Gz1yjC7kfsgAAADgBAAAOABgAAAAAAAAAAADt
gUIAAABfX01BQ09TWC8uX3JjcHV4CwABBPYBAAAEFAAAAFVUBQAB2/QvalBLAQIUAxQACAAIAIM+
z1xhzgThvAcAAJoPAAASABgAAAAAAAAAAADkgVABAAByY3AvcmNwLXdyaXRldXAubWR1eAsAAQT2
AQAABBQAAABVVAUAAWfnL2pQSwECFAMUAAgACACDPs9cTWCiZYcAAADUAAAAHQAYAAAAAAAAAAAA
5IFsCQAAX19NQUNPU1gvcmNwLy5fcmNwLXdyaXRldXAubWR1eAsAAQT2AQAABBQAAABVVAUAAWfn
L2pQSwECFAMUAAgACACDPs9cxfWWU2MKAAA6IAAAHgAYAAAAAAAAAAAA5IFeCgAAcmNwL3BvY19l
eHRlbmRlZF92YWxpZGF0aW9uLnB5dXgLAAEE9gEAAAQUAAAAVVQFAAFn5y9qUEsBAhQDFAAIAAgA
gz7PXE1gomWHAAAA1AAAACkAGAAAAAAAAAAAAOSBLRUAAF9fTUFDT1NYL3JjcC8uX3BvY19leHRl
bmRlZF92YWxpZGF0aW9uLnB5dXgLAAEE9gEAAAQUAAAAVVQFAAFn5y9qUEsBAhQDFAAIAAgAgz7P
XMF5vj5NCQAABBcAAAoAGAAAAAAAAAAAAOSBKxYAAHJjcC9Qb0MucHl1eAsAAQT2AQAABBQAAABV
VAUAAWfnL2pQSwECFAMUAAgACACDPs9cTWCiZYcAAADUAAAAFQAYAAAAAAAAAAAA5IHQHwAAX19N
QUNPU1gvcmNwLy5fUG9DLnB5dXgLAAEE9gEAAAQUAAAAVVQFAAFn5y9qUEsFBgAAAAAIAAgA1wIA
ALogAAAAAA==
--_004_SA1P110MB1342FBA2FC3062803E506DA2B8E6ASA1P110MB1342NAMP_--