2017年7月17日星期一

"Bypassing" Microsoft's Patch for CVE-2017-0199

Background

If you have followed my research on the infamous CVE-2017-0199 zero-day attack, you may know we (w/ my colleague Bing) did a presentation titled “Moniker Magic: Running Scripts Directly in Microsoft Office” at the SYSCAN360 security conference on May 31th in Seattle, WA. The slides are available at https://sites.google.com/site/zerodayresearch/Moniker_Magic_final.pdf. During the presentation, we explained the background of the CVE-2017-0199 (there’re actually 2 bugs/variants under the same CVE-ID, including the “secret” one that was reported by myself in January), the root cause of the two vulnerabilities, as well as how Microsoft addressed them.

The Microsoft patch actually leverages a mechanism on the Windows level, which is called "COM Activation Filter". The patch filters out 2 dangerous CLSIDs (a CLSID is an identifier of a COM object) leveraged in the 2 variants, respectively. However, the whole "features" aren't changed at all. It means that if someone finds another (the 3rd) dangerous COM object, with some modifications of the original PoC, he/she is able to achieve remote code execution once again. We expressed our concerns at the conference as well as during personal conversations with Microsoft security folks.

The story didn't end there, in fact, there's indeed such a variant, it's reported to Microsoft just on the day before our presentation (May 30), I have kept the secret during the conference (sorry for the infosec friends:-)). As the new patch has been released on Patch Tuesday last week, let’s talk about it.

If you haven't applied the new patch yet, you're highly recommended to do so right now.

The Details

The new variant leverages the Composite Moniker. According to MSDN,

"A composite moniker is a moniker that is a composition of other monikers and can determine the relation between the parts. This lets you assemble the complete path to an object given two or more monikers that are the equivalent of partial paths."

The following picture shows the stream of the Composite Moniker used in our PoC.



As we explained in our presentation, the stream of the moniker is actually the same as the so-called "MonikerStream" in the "\x01Ole" stream in the RTF-style PoC, it means that if you fill the above stream in the "MonikerStream" position, a Composite Moniker will be called in place.

When we put the sample test.sct file as we used in our “PPSX Script Moniker” bug (see our slide 30) in the right place (here we put it on the “C:\temp\test.sct” on local machine, but it could be put on remote computer via various protocols such as SMB share), and ran the modified RTF file, we got a beautiful calc.exe popping up on the latest Windows 10 + Office 2016 environment (before the July Patch Tuesday, of course).


How it worked? Well, the Composite Moniker is really a complex place but I’m going to try to explain a little bit. As we know, a Composite Moniker means there’re 2 or more Monikers working together. In our PoC, the Composite Moniker contains 2 monikers, a File Moniker and a so-called "new" Moniker. We could easily find out the CLSIDs in the stream.

{00000309-0000-0000-C000-000000000046} -> Composite Moniker (position 0)
{00000303-0000-0000-C000-000000000046} -> File Moniker (position 0x14)
{ECABAFC6-7F19-11D2-978E-0000F8757E2A} -> “new” Moniker (position 0xA1)

When binding the Composite Moniker, the binding process starts from the right-side Moniker to the left-side Moniker, while the left-side Moniker is held in the “pmkToLeft” parameter of the “IMoniker::BindToObject()” method.

HRESULT BindToObject(
  [in]  IBindCtx *pbc,
  [in]  IMoniker *pmkToLeft,
  [in]  REFIID   riidResult,
  [out] void     **ppvResult
);

When binding the “new” Moniker, it obtains the left-side moniker via the “pmkToLeft” parameter. In this case, the left-side Moniker is the File Moniker. So, it uses the File Moniker to initialize an object determined by the extension name ".sct". If we look into our Windows Registry, we could easily figure out the CLSID of the object is "{06290BD2-48AA-11D2-8432-006008C3FBFC}", progid is "scriptletfile". So the "scriptletfile" object is created and initialized by the content of the test.sct. This is a typical File Moniker binding process.

The “new” Moniker queries the IClassFactory interface to communicate with the returned object. Since the “scriptletfile” object has the IClassFactory interface exposed, the method IClassFactory::CreateInstance() is called. The "scriptletfile" object's IClassFactory::CreateInstance() implementation starts the scripting environment and runs our scripts, so this is the problem.

So, in an easier-to-understand “script” language, the logic looks like the following:

new (object persisted in “\\127.0.0.1\C$\temp\test.sct”)

Here is the call stack when calc.exe is being popped up, note the highlighted key functions.

0013cad8 67d5d248 kernel32!CreateProcessW
0013cb60 67d5d54a wshom!CWshShell::CreateShortcut+0x161
0013cbc0 750bcc68 wshom!CWshShell::Exec+0x19a
0013cbe0 750bcae2 OLEAUT32!DispCallFunc+0x165
0013cc70 67d601c7 OLEAUT32!CTypeInfo2::Invoke+0x23f
0013cca0 67d5b055 wshom!CDispatch::Invoke+0x5c
0013cccc 67115424 wshom!CWshExec::Invoke+0x29
0013cd10 6711505b jscript!IDispatchInvoke2+0x8d
0013ce08 67117622 jscript!VAR::InvokeByName+0x389
0013ce54 671175d6 jscript!VAR::InvokeDispName+0x3e
0013ce80 671144a7 jscript!VAR::InvokeByDispID+0x310a
0013d278 671148ff jscript!CScriptRuntime::Run+0x12b9
0013d374 67114783 jscript!ScrFncObj::CallWithFrameOnStack+0x15f
0013d3cc 67114cc3 jscript!ScrFncObj::Call+0x7b
0013d470 67123797 jscript!CSession::Execute+0x23d
0013d4bc 67120899 jscript!COleScript::ExecutePendingScripts+0x16b
0013d4d8 6ec2831f jscript!COleScript::SetScriptState+0x51
0013d4e8 6ec28464 scrobj!ScriptEngine::Activate+0x1a
0013d500 6ec299d3 scrobj!ComScriptlet::Inner::StartEngines+0x6e
0013d550 6ec2986e scrobj!ComScriptlet::Inner::Init+0x156
0013d560 6ec2980b scrobj!ComScriptlet::New+0x3f
0013d580 6ec297d0 scrobj!ComScriptletConstructor::CreateScriptletFromNode+0x26
0013d5a0 6ec33b7e scrobj!ComScriptletConstructor::Create+0x4c
0013d5cc 6ec22946 scrobj!ComScriptletFactory::CreateInstanceWithContext+0x115
0013d5e8 6f2264be scrobj!ComScriptletFactory::CreateInstance+0x19
0013d63c 766bb5dd comsvcs!CNewMoniker::BindToObject+0x14f
0013d670 767240c9 ole32!CCompositeMoniker::BindToObject+0x105 [d:\w7rtm\com\ole32\com\moniker2\ccompmon.cxx @ 1104]
0013d6dc 5fc737a6 ole32!CDefLink::BindToSource+0x14e [d:\w7rtm\com\ole32\ole232\stdimpl\deflink.cpp @ 4611]
0013d720 5f7cdad1 wwlib!wdGetApplicationObject+0x68f70

Why it bypassed Microsoft's patch?

As we explained in our presentation, the Microsoft's April Patch banned two objects in Office, they are:

{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B} -> the “htafile” object
{06290BD3-48AA-11D2-8432-006008C3FBFC} -> the “script” object

They didn't ban any of the CLSIDs used in our new PoC.:-) While the "{06290BD3-48AA-11D2-8432-006008C3FBFC}" is very close to the "{06290BD2-48AA-11D2-8432-006008C3FBFC}", they are still not the same one. The banned one is “script” object, which, when being bind, would find and run scripts for us nicely. However, the “scriptletfile” object could also do the same work with a little help from the “new” Moniker.

Some Thoughts

There's some of my personal thoughts around this, the first is absolutely this new variant strongly demonstrates this is an “open” attack surface, and Microsoft's work wasn’t done very well. While I prefer not to judge Microsoft's patching strategy why they didn’t touch the features as they may have their own considerations (compatibility, user experience, etc), it's a clear proof that the patching strategy is weak, or weaker than I expected. The patching strategy is very similar to the ActiveX "killbit" solution when in the old days ActiveX vulnerabilities were very popular. It's an "easy fix" - people find a vulnerable object, we kill the it, people find another, we kill another, easy but not proactive, I'd say.

Also, it's the reason why I personally prefer to say the "RTF URL Moniker" issue, the "PPSX Script Moniker" issue, and this one, are separated bugs and should be assigned with different CVE-IDs (though Microsoft has assigned a new CVE-ID, CVE-2017-8570, for this variant). Microsoft putting them under a same CVE has caused confusions - we didn't assign all the ActiveX vulnerabilities as one CVE-ID, right?

Stay secure.

137 条评论:

  1. I tried to replace the stream in 2017-0199 with the stream in image. The size also I padded with 00. But when I try to open the rtf nothing happens. I am not able to reproduce the exploitation

    回复删除
  2. Hey nice post, nice finding too!!

    Microsoft has some VERY odd politics regarding bugs patching, bugs classification, separation of different issues, etc. This Office HTA bug was written in a post at MS web site. If you check the acknowledgments section you will see my name (first they removed 1 week after the post without even warning me...ignored my e-mails but then with some external help I managed them to write it back. But, my name has to do with the Wordpad issue (no it´s NOT the HTA, it has to do with unsafe ActiveX security bypass allowing JScript to run in the classic local zone of IE...inside Wordpad ;) ) Also they patched an Excel issue which btw I posted a PoC a month ago :
    https://packetstormsecurity.com/files/144459/Microsoft-Excel-Remote-Code-Execution.html
    The Excel issue is indeed in OLE functionality but is specifically to Excel, because the "DDESERVER" parameter of linked objects allow for local file execution with parameters. For people not to get confused I put something simple like 'cmd.exe /c calc'. Different bugs, reported at different times but patched all together in the same month. Basicly they have thrown them all at the same bag and wrote a generic report. "Vulnerability in Windows API" ... They really should be more transparent with their custommers. And talking about scripts execution inside Office apps:

    https://packetstormsecurity.com/files/author/10641/

    2 PoCs involving the recently "deceased" Word 2007. You probably have already seen the one from 2015! It was funny because MS didn´t know how to properly patch it and left the vulnerable ActiveX enabled. They did similar to what you said about vulnerable ActiveX...just killbit them and that´s it...The difference in my case, is that they "quarantined" the vuln by just enabling the 'LOCALMACHINE_LOCKDOWN' IE feature to Word, Excel and Powerpoint 2007/2010, meaning if you somehow manage to defeat it you will run code just fine again (This has already happened before...1 vuln in HTML Help Control back in 2004, and a vuln I found myself back in 2007: The Active Desktop feature of Windows 2003/XP and below bypasses it and IE 6 even allowed web pages to add web pages to the Active Desktop through "javascript:external.AddDesktopComponent()". When combined to an input validation issue in URLs, attackers could inject arbitrary HTML/Script code in a local file 'desktop.htt', resulting in Cross zone and app scripting. Oh and the best (or worst) part was that it was persistent: If you refreshed the desktop the injected script would run. Upon re-starting the OS, too. And...it was (at least until 2015) undetected to programs that showed auto-start programs, like "Autoruns". Keep up the nice posts ;)

    - Eduardo Braun Prado

    回复删除
  3. PS: The HTA bug worked up to May´s patch, (1 extra month for the bad guys) only on Windows 10 with Office 2016 :P

    回复删除
  4. I was looking that kind of helpful blog on the google and finally i found your blog with valuable information that i really wanted...you have done good job on this blog...Thank you......microsoft customer support number | microsoft customer care number usa | Microsoft Customer care Support number | microsoft customer service toll free number | microsoft customer support

    回复删除
  5. The antithesis to Linksys WRT 3200 ACM does not boast flash design. it pulls wireless router that is aimed at PC enthusiasts. it gives strong control over network connections, the WRT 3200 ACM is covered.
    Apple Airport Technical Support

    回复删除
  6. it is good article thanks for sharing this blog it give lots of information. clipping path

    回复删除
  7. Nice blog, absolutely such an amazing for the informative purpose. Microsoft provides a different kind of new features and functions. For any information visit Microsoft Contact Number

    回复删除

  8. The Elite Service Offer the well prepared and memorable Escorts in Karachi  All these Hot look Charming Models are genuine high profile Females and Very friendly to provide Escort Service with full of fun and naughty adventure. They are best and Independent Karachi Escorts with Lovely Behavior and booking call us.

    回复删除
  9. No matter whether you are using Adobe Creative Cloud or any of its application, it is necessary for you to keep the software updated for its smooth functioning. Update also allows you to use all the features of Adobe in correct manner. Dial us at Adobe Helpline Number UK, if you have any issue in updating Adobe.
    Adobe Help Number UK

    回复删除
  10. I was badly stuck with Microsoft technologies and features this blog gave me a proper view of all these things thanks for sharing this.
    Microsoft online Support

    回复删除
  11. Thanks for sharing nice information with us. I would like to bookmark the page so I can come here again to read you. Thanks for your wonderful job.
    Clipping Path | Shadow Creation | Vector Conversion | Product Photo Editing

    回复删除
  12. Colors, composition, it looks stunning! We really like your photos, especially the first one. Thanks for sharing this images.
    remove background from photo

    回复删除
  13. Nice post. I learn something new and challenging on websites I stumbleupon on a daily basis. It’s always helpful to read through content and post the relevant content… http://ClippingPathIndie.com

    回复删除
  14. Nice.
    https://www.graphic-aid.com/clipping-path
    https://www.graphic-aid.com/
    https://www.graphic-aid.com/neck-joint-service

    回复删除
  15. Hy, i am Madhvi Kapour and I read your post Its very great ideas and concepts. I am waiting for your next post.

    If you are looking for high-profile, Escorts and model escorts in Puna you are at right place.

    For more Information call directly my manager Rihan Walia no face call and message accepted, please intrested person call.

    Call and Whatsup number - 9168151778

    Pune escorts

    回复删除
  16. hi dear,this is very good and helpful article thanks for shearing.

    回复删除
  17. Gemini is very popular around the world. One of the reasons for its popularity is that it's accessible on many platforms such as mobile app, tabs, laptops. But sometimes users are unable to use Gemini on mobile apps properly. If you ever encounter such an issue, dial Gemini support phone number to seek an advanced assistance to help Gemini Support Number you out in this regard. The experts at Gemini help you understand the issue and guide you step by step so that you can be relieved of the miseries that you are facing.

    回复删除
  18. Are you interested in trading and want to join Blockchain for your future trading endeavours? Are you receiving an error while uploading the photo ID in Blockchain? Do you want to get rid of it? If yes, then contact Blockchain customer service by dialing Blockchain helpline number. The representative at blockchain Customer Service number provides seamless solution to each and every problem of your and Blockchain Support NUmber help understand step by step process easily. To end this trouble, you can contact Support team and avail the best possible solutions from the professionals in no time.

    回复删除
  19. Are you associated with Binance for all your online trading? Do you carry out transactions frequently? Have you run into a problem where the transaction is done with wrong address in Binance? You must straight away get in touch with an expert at Binance, if this is the case. This issue must Binance Support Number be tackled with an advanced assistance of an experienced professional. The team of coordinators tackles the problems proactively to provide you with instant solutions. Dial Binance support number to avail outstanding service.

    回复删除
  20. Are you dealing with insufficient transaction in your Gemini account? Such errors cannot be cured by normal users as it requires proper knowledge about Gemini. If you want to fix this transaction error feel free to call on Gemini support number and get in touch with the experts. They are always there to guide you at every step. The highly-skilled professionals are active and provide you with the best in business service. They can fix any sort of Gemini issues in no time.

    回复删除
  21. thanks for the information on staying secure online. buycubii.com

    回复删除
  22. Microsoft certifications are most important and popular now a days. Get your Microsoft certifications with Validquestions

    回复删除

  23. Cryptopia is an all-in-one kind of exchange and trading site focused around cryptocurrencies. One of the main benefits might be the ability to transfer bitcoin and other currencies between users free of charge, as it’s being passed through Cryptopia Exchange rather than along the blockchain. It also offers a range of features that you might find useful, including, its very secure and fast, you can also get in touch with Cryptopia customer service phone number 1-833-228-1682. Cryptopia contact phone number|Cryptopia call support number|Exchange Cryptopia.
    Visit: https://cryptocallsupport.com/cryptopia-customer-service-number/



    回复删除
  24. This is a very good blog! Your writing is very good, I have followed for some time. I will be back again..

    回复删除
  25. Toko Otomotif : alat teknik, perkakas bengkel, alat safety, alat ukur, mesin perkakas, scanner mobil, alat servis motor, alat cuci mobil, mesin las.

    回复删除
  26. You’re a very skilled blogger. I have joined your feed and look forward to seeking more of your fantastic post. Also, I have shared your web site in my social networks!
    Norton.com/setup

    回复删除


  27. Great important post, where you make the main focus, really makes me happy for its necessary of importance.

    回复删除
  28. How to Utilize Rapid Fast Keto Boost
    No difficult and fast guidelines for the usage of this product. This natural product is simple to ingest with out getting any atypical flavor. Rapid Fast Keto Boost Take pills in someday is the exceptional or extra powerful dose for weight loss. Use it with Luke warm water or be a herbal to get rapid effects. Skip all dangerous or junk food or begin taking natural or natural food for the exceptional consequences.
    Read More >>> https://www.completefoods.co/diy/recipes/where-to-buy-rapid-fast-keto-boost

    回复删除
  29. What is Keto Fit Pro?


    Keto Fit Pro is the terrific Keto Fit Pro weight reduction product which uses the precept of a ketogenic diet regime. To burn your extra fats brief and correctly, this supplementis the composed of BHB ketones which improve the method of ketosis that sheds extra weight with out issues.
    Read News >> https://sites.google.com/site/ketofitpronew/

    回复删除
  30. Second Prime Montezuma's Secret, the brand new supplement uses all-natural ingredients to unlock your potential and help you in enjoying better pleasure on the bed. Aside from boosting your sexual pleasure, this formula also increases energy, stamina, mental clarity, and also treats stress and anxiety disorders. montezumas secret

    回复删除
  31. What is Keto Twenty One?


    Keto Twenty One is the notable weight reduction product which uses the principle of a ketogenic healthy Keto Twenty One eating plan. To burn your extra fat brief and successfully, this supplementis the composed of BHB ketones which enhance the method of ketosis that sheds more weight with out problems.
    Read More >>> https://www.completefoods.co/diy/recipes/what-is-keto-twenty-one

    回复删除
  32. should and should not consume in your program. his decade, took center stage when it comes to ing. With the entry of s, carbohydrates and good fats almost became a thing of the past. is the program making raves today. But is there really a link between and ? To clear the issue, here are the truths behind and . Nature Crave Keto helps you curb your appetite. Studies show that helps you lose body by decrease your fondness for food. Eating more than. enough in your would satiate your hunger more than . And .

    回复删除
  33. Benefits Of Debbiesmiracles
    Supports weight reduction

    Debbiesmiracles This slimming product promotes weight reduction. Debbiesmiracles professional causes weight loss due to its potential to burn a chief quantity of fat within the stomach, suppress appetency, or even block carbs. With these kinds of alternatives, clients could be properly on their way to experiencing the outcomes they’re attempting to find.

    Weight loss and upkeep

    This weight reduction complement can do fast weight reduction. Limiting the variety of exceptional molecule to ketonemia ends up in a prime decrease in body fat along with an increase or retention of muscle tissues.

    READ MORE >>>> https://debbiesmiracles.com/
    https://www.quora.com/unanswered/Is-debbiesmiracles-guide-about-health-tips
    https://www.pinterest.com/pin/592223419736594950/

    回复删除
  34. Sharktankpedia Thanks to your time. In case of any inquiry or the query, you just make a remark we genuinely give you brief reaction.
    It’s quite unlikely for everybody who wishes to shed pounds to be oblivious of ketosis or the hype it has generated inside the international in recent times.


    READ MORE >>>>> https://sharktankpedia.org/

    https://www.pinterest.com/pin/592223419736595384

    https://www.quora.com/unanswered/Is-Sharktankpedia-Pills-Platform-Trusty

    回复删除
  35. Governmenthorizons What are the benefits of Governmenthorizons?
    Using Governmenthorizons reasons short assimilation of fats due to the fact this product could be very beneficial in improving the digestion method.
    It is free from any components or chemical substances that’s why there are not any aspects of Governmenthorizons.


    READ MORE >>>> https://www.governmenthorizons.org/

    https://www.quora.com/unanswered/Are-there-any-side-effects-og-governmenthorizons-blog

    https://www.pinterest.com/pin/587719820108868139

    回复删除
  36. Autobodycu What is Autobodycu Diet?
    Autobodycu Diet is not anything brief of a boon for nowadays’s populace wherein more than 60% of humans are laid low with obesity. It has hit the marketplace like a hurricane and is refusing to get calm. The media is frenzied over Autobodycu Diet and it has grow to be the medical doctor’s favorite right away. Within this type of few days of its release, it has become the main nutritional supplement and gone viral throughout the whole United States marketplace. Everyone which include the stars is speakme about this complement and it seems to see no halt. The purpose in the back of it becoming the number one satisfactory promoting product is stated to be its precise running system that helps you to achieve weight loss quick. The FDA has verified its trustworthiness by certifying it is to be absolutely secure.


    READ MORE >>>>> https://www.autobodycu.org/

    https://www.pinterest.com/pin/618963542524583629

    https://www.quora.com/unanswered/Can-Autobodycu-Help-About-Fitness-Tips

    回复删除

  37. Amazin Brain Hilarious clips of your favorite celebrities singing in Amazin Brain clips from The Late Late Show with James Corden. Amazin Brain equipment maker Singing Machine designed a microphone that makes you're feeling like you're internet hosting your personal episode of the popular James Corden show. The May 20, 2015 episode, which followed the finale of Late Present with David Letterman, was the very best rated episode of The Late Late Present within the history of the franchise with an audience of four million viewers and a score of two.5., despite starting 20 minutes late because of Letterman's present running over its scheduled finish time. Conan in Cuba: Conan 'Brien becomes the primary American late-evening host to do a show in The Fitness Supplement in additional than 50 years. With James Corden, Paul McCartney. Roomy, stylish, and featuring the Amazin Brain emblem entrance and middle, this Amazin Brain Neon Brand Canvas Tote Bag will quickly change into your go-to accent. Corden's Amazin Brain by the streets of London with pop singer Adele, a sketch which featured on his speak present in January 2016, Amazin Brain was the biggest YouTube viral video of 2016.
    https://www.thefitnesssupplement.com/
    https://www.thefitnesssupplement.com/amazin-brain/

    回复删除
  38. Poker online situs terbaik yang kini dapat dimainkan seperti Bandar Poker yang menyediakan beberapa situs lainnya seperti http://62.171.128.49/hondaqq/ , kemudian http://62.171.128.49/gesitqq/, http://62.171.128.49/gelangqq/, dan http://62.171.128.49/seniqq. yang paling akhir yaitu http://62.171.128.49/pokerwalet/. Jangan lupa mendaftar di panenqq

    回复删除
  39. We regard the trust which our customers have had on us and our Top Escorts in Islamabad thus complying with that we have held their names,
    we are extremely satisfied with our Islamabad Escorts achievements

    回复删除
  40. Surgenx Keto
    Although from the start it appears as if surgenX keto supplements are bolstered by piles of awesome science, a more critical look shows that a ton of the logical articles utilized on the locales allude to the advantages of endogenous ketosis or surgenX keto esters, not surgenX keto salts.
    http://ketoismiracle.com/surgenx-keto

    回复删除
  41. ketovatru review
    Thusly, perhaps essentially skip there. In any case, we’ll give you some understanding. We don’t think this thing is as solid as it could be. In like manner, that recommends we aren’t sure it legitimizes spending your justified cash on. Once more, you can at present get it in the event that you need to. Regardless, we aren’t sure the Instant Keto Cost is bolstered.
    http://ketoismiracle.com/ketovatru-review

    回复删除
  42. sexy girls with big boobs can fuck you have if you want to be sucked by a real women then book Pune Escort to day.

    回复删除
  43. We regard the trust which our customers have had on us and our Top Escorts in Islamabad thus complying with that we have held their names,
    we are extremely satisfied with our Islamabad Escorts achievements

    回复删除
  44. Geek Squad Support helps those customers who face technical issues in own gadgets anytime and unable to sort out at this place Geek Squad Support Team Aid your issues by manually or through the software on Remote. Call on (+1)855-554-9777 for technical issues in Gadgets.

    回复删除
  45. Scandal Full Episodes
    I honestly don't feel sorry for Boniswa, I'll never forgive her for what she's doing to Chumani!! 😤😤Thembeka and Mthunzi must finish her..after that Thembeka must finish MthunziTibi is just too sweet he gets straight to my heart Tibi’s PRAYER, got me emotional 😭 Watching from Botswana 🇧🇼Stokkies must learn to shut it, his face-PRICELESS!! Xolile and Romeo have literally had the longest honeymoon 🙄 they should be back Xolile and romeo's child is very lucky to be born into 2 rich families😇😇Xolile is hella annoying🙄 everything is about her,her,her,her,sheeeeshRomeo can never do wrong in his mother's eyes😂 I wish I had a mom like Grace😏 I could get away with a lot guys did yall

    回复删除
  46. i am browsing this website dailly , and get nice facts from here all the time .

    回复删除

  47. Final Verdict:
    Bioviderma Serum Bioviderma Serum is a brilliant item that may be executed with out professional remedy to perform glowing, exquisite, and highly-priced sparkle sensitive pores and pores and skin. Everyday use of this non-oily beauty contact up serum certifications to assist, hydrate and saturate the pores and pores and pores and pores and pores and skin from lower to the top dermal layer of pores and skin.


    SHOP NOW >>>>> https://www.completefoods.co/diy/recipes/bioviderma-serum-does-it-really-work-read-review-before-buy

    https://sites.google.com/site/biovidermaserum/

    回复删除
  48. Final Verdicts
    Ultra Pure 360 Keto You are lucky enough from all individuals who in no way have the idea of the Ultra Pure 360 Keto. You might be capable of get the entire information or more knowledge concerning this product. This weight loss method has all that which may additionally never present in another supplement. This makes the individual dwelling at once or never get again the higher fats ratio in life. This 100% herbal composition based supplement will offers you all that which you have inside the desires so never be too overdue.


    READ MORE >>>>> https://www.completefoods.co/diy/recipes/ultra-pure-360-keto-reviews-price-side-effects-buy

    http://ultrapure360keto.mystrikingly.com/

    回复删除
  49. Advanced Keto Plus Is it Legit or Scam?
    First of all, the product has 100% natural ingredients, which means it is safe to use. It has NO side effects. The company that owns this formula is very famous in the country. They have thousands of users and getting positive feedbacks. This formula is NOT A SCAM. It is 100% legit product. The support is very cooperative and friendly. You will have the best supplement at your doorstep after you submit the application form.


    READ MORE >>> https://sites.google.com/site/advancedketoplusweb/

    https://www.completefoods.co/diy/recipes/advanced-keto-plus-review-level-up-with-fat-burning

    回复删除
  50. Thank you for sharing this informative content.Quickbooks Desktop Support Number help him to contact support for any help. Quickbooks is a accounting Software to easily confirm the account management to help them. In every manner Quickbooks is a powerful acounting Software to measure and help in business. You can need need any type of assistance
    How to Create & Delete Budget in QuickBooks Desktop

    回复删除
  51. Novum Health Keto Within such a few days of its launch, it has become the leading dietary supplement and gone viral across the entire United States market. Everyone including the celebrities is talking about this supplement and it seems to see no halt. The reason behind it becoming the number one best selling product is said to be its unique working formula that lets you achieve weight loss quickly. The FDA has proven its trustworthiness by certifying it is to be fully safe.

    READ MORE >>> https://sites.google.com/site/novumhealthketo/

    https://www.completefoods.co/diy/recipes/novum-health-keto-most-used-diet-supplement-of-the-year

    回复删除
  52. Primal Grow Pro My Final Opinion
    The experience of using Primal Grow Pro have turn out to be amazing. I admit that in spite of trying such a whole lot of subjects, not anything helped me besides this complement. I perception I become sincerely getting old as even doing day by day artwork changed into tough for me. Due to my terrible sexual overall performance, my love lifestyles become getting depressing. But now, I appearance and revel in wonderful manner to this wonderful answer.


    READ MORE >>> http://primalgrowpropill.mystrikingly.com/

    https://sites.google.com/site/primalgrowpropill/

    回复删除
  53. Slim Naturals What are the pros of Slim Naturals?
    Devoid of all toxics and such substance.
    No chemical carcinogens are used in this.
    Certified as fully safe and good by FDA.

    What are the cons of Slim Naturals?
    Complete natured ban for children.
    Alcohol surely need some avoidance.


    READ MORE >>> https://sites.google.com/site/slimnaturalsweb/

    https://www.completefoods.co/diy/recipes/slim-naturals-completely-safe-weight-loss-formula

    回复删除
  54. Magnolia Keto No need to take this product if you are above than the 60 years or less than the 18 years.
    Add some natural food with the Gain from Magnolia Keto in your day to get the most accurate results.
    Make sure that you are taking the real or the legit product as I described above.
    No need to go at any local store this supplement is just at the online store. Otherwise, you can get more adverse effects.


    READ MORE >>> http://magnoliaketo.mystrikingly.com/

    https://sites.google.com/site/magnoliaketonew/

    回复删除
  55. Trim Fast Keto Benefits Of Trim Fast Keto
    Indeed, from the usage of this enhancement, you may get a huge variety of blessings, and few of them are referenced below;

    Give the client’s a floor-breaking ketosis country.
    Attempts to hold up the fat misfortune method into your body.
    Utilizing it will make your yearning level lower and manipulate it.
    It will make your fats as gas to your body vitality advent.


    Visit Official Website >>> https://www.facebook.com/Trim-Fast-Keto-100740301581169/

    https://sites.google.com/site/trimfastketoofficialweb/

    https://utah.instructure.com/eportfolios/36127/Home/Trim_Fast_Keto_Pills_Reviews

    回复删除
  56. Biolife Keto Biolife Keto Pour?
    C'est un mélange d'ingrédients naturels.
    Il est exempt de produits chimiques.
    Il ne contient aucun effet secondaire.
    Facilement accessible en ligne.
    Pas besoin de prescription médicale.
    Une utilisation régulière vous donnera des résultats précis.


    READ MORE >>> https://sites.google.com/site/biolifeketonew/

    https://www.completefoods.co/diy/recipes/biolife-keto-vous-voulez-couper-votre-graisse-corporelle

    回复删除
  57. Realtone Keto Benefits of Realtone Keto?
    The benefits of Realtone Keto are given below.
    It will assist you in weight reduction. If you’re already adhering to a diet or a workout program, you may take advantage of this supplement to get the results quicker.
    The supplement also enables you to feel good about your self and keeps you healthy.
    It keeps you active during the day and gives you an additional boost of energy.


    READ MORE >>> http://realtoneketonew.mystrikingly.com/

    https://sites.google.com/site/realtoneketonew/

    回复删除
  58. Biolife Keto Non accessible sur le marché local
    Déconseillé aux moins de 18 ans
    Il n'est pas prévu pour les propriétés de guérison ou de verdict ou pour tout problème de santé
    Il doit avoir besoin des conseils d'un médecin avant son utilisation


    READ MORE >>> https://sites.google.com/site/biolifeketofr/

    https://www.completefoods.co/diy/recipes/biolife-keto-une-mthode-plus-simple-pour-perdre-du-poids

    回复删除
  59. Keto Lyte Caffeine
    The formula does contain a small amount of caffeine. This helps to boost the metabolism of the body and improves your focus and attention.

    HCA
    Hydroxy citric acid is another useful weight loss ingredient. This ingredient promotes fat burning in the body. It also controls your appetite.


    READ MORE >>> https://sites.google.com/site/ketolyte2020/

    https://www.completefoods.co/diy/recipes/keto-lyte-the-best-way-to-undergo-rapid-weight-loss

    回复删除
  60. VidaGenex Keto Burn VidaGenex Keto Burn Precautions?
    People need to take some precautions before choosing VidaGenex Keto Burn. These are as follows.

    People who are using another supplement should not use it.
    Those who are on medication for some disease must consult the doctor before using the supplement.


    READ MORE >>> https://sites.google.com/site/vidagenexketoburnweb/

    https://www.completefoods.co/diy/recipes/vidagenex-keto-burn-update-2020-11-things-you-need-to-know

    回复删除
  61. Biogenix RX Additionally, it will assist to reinforce a while.
    Some humans are Concerned about the Thing that utilising this product may additionally damage their health, however it isn't accurate as it simply has an effect for your pee and leaves your penis even more excellent.


    READ MORE >>> http://biogenixrxnew.mystrikingly.com/

    https://tryf82.wixsite.com/biogenixrx

    回复删除

  62. Ginseng Blend: Vitrexotin
    This extract is useful in improving the first-rate of semen and hold you longer in the mattress room. It makes your dick so thick and tough the usage of durable erection energy on a bed.

    Maca Root:
    It is each great essential and vital extract that permits to growth the scale of the penis. Additionally, it complements self belief degree so you can apprehend more delight within Vitrexotin the mattress room. It is likewise beneficial for growing muscle corporations that receives rid of fats layers at the mattress.

    回复删除
  63. Ultra Trim Keto With Ultra Trim Keto, you do not need to get any surgery to overcome the high-fat areas take this supplement regularly for the 60 days or results will be in front of you people.

    This weight loss supplement is made with 100% natural ingredients, or due to the natural composition, it will surely help in the weight reduction.

    BHB salts are the most important for the rapid ketosis or that salts are the best for fat burning aim. So this supplement is based on these salts or help in the ketosis procedures.


    READ MORE >>> https://sites.google.com/site/ultratrimketo2020/

    https://www.completefoods.co/diy/recipes/ultra-trim-keto-1-ketogenic-weight-loss-pills

    回复删除
  64. Pure Sol Keto What is Pure Sol Keto?
    This product is the most phenomenal one in the curbing of fat loss and also it has such powerful ingredients in it which when combined together play a great role so that whatever results that have been achieved and slimness that has been provided to your body are not short-lived and that they stay with you for a great amount of time. You will be freed from the need to use weight loss supplements as well as other medicines for the same purpose at any time in the future that is to come.


    READ MORE >>> http://puresolketo-2020.mystrikingly.com/

    https://sites.google.com/site/puresolketo2020/

    回复删除
  65. Our Windows app development company in India has worked with global clients, organizations, ISVs, businesses to create unique and excellent Windows applications in cost-effective ways with 100% money back guarantee.

    回复删除
  66. Nice & Informative Blog ! Facing QuickBooks Error 15241? Don’t worry, dial us at 1(844)514-7111 for instant resolution of issues. QuickBooks Error 15241 or Could not initialize license Properties arrives while any of the company files is either missing or damaged.
    Fix QuickBooks Error code 15241

    回复删除
  67. By dialing on our QuickBooks Error Support Phone Number 1-833-325-0220 and you will be responded back with customer-oriented results.

    回复删除
  68. QuickBooks provide Premier Support for QuickBooks User to make QuickBooks more easy and fruitful.
    Dial QuickBooks Premier Support Phone Number 1-844-908-0801
    QuickBooks Premier Support Phone Number

    回复删除
  69. Nice Blog!
    Fix QuickBooks error with Our QuickBooks expert Dial on Our toll free Number For instant and Quick Solution.
    Click Here to Know How to fix QuickBooks error code 1904 1-844-908-0801

    回复删除

  70. Nice Blog!
    Fix QuickBooks error with Our QuickBooks expert Dial on Our toll free Number For instant and Quick Solution.
    Click Here to Know Quickbooks Support Number+1-855-511-6911

    回复删除

  71. informative! Worried about QuickBooks Support ? if you are not able to fix QuickBooks Problem, get in touch with QuickBooks expert for instant solution
    Best Accounting Software for Small Business -Quickbooks Desktop Mac 2020

    回复删除
  72. nice post!
    Worried about QuickBooks error?Get in touch with QuickBooks expert for instant solution.
    Dial QuickBooks Support Phone Number Alaska 1-844-908-0801

    回复删除
  73. Having trouble in QuickBooks POS? Just connect with our QuickBooks Customer Service Phone Number 1-833-325-0220 to resolve your issues. Here, Our dedicated QuickBooks specialists will address your Qb problems.

    回复删除
  74. It’s very informative and you are obviously very knowledgeable in this area. You have opened my eyes to varying views on this topic with interesting and solid content and call us :- 1-855-511-6911 Quickbooks Enterprise Support Number

    回复删除

  75. Mediator Łódź
    Adwokat Łódź




    Gilotyna
    Lutownica transformatorowa
    Gilotyna
    Taxi Zgierz
    <a href="http://przemyslawbuda.pl>Mechanik Łódź </a>

    http://zdz-lodz.pl

    http://zdz-lodz.site

    http://przemyslawbuda.pl

    http://taxi-zgierz.pl

    回复删除
  76. Well Explained & Informative Blog !
    The experts here solve all problems of QuickBooks with instant solutions. To procure our service, get in touch with experts.
    QuickBooks Proadvisor Support Phone Number 1-855-6OO-4O6O.
    QuickBooks Pro Support Phone Number 1-855-6OO-4O6O.

    回复删除
  77. Lockdown is running in the whole country due to coronavirus, in such an environment we are committed to provide the best solutions for QuickBooks Support Phone Number.
    Contact QuickBooks Pos Support Phone Number to get in touch.
    Dial : 1-844-908-0801

    回复删除
  78. Lockdown is running in the whole country due to coronavirus, in such an environment we are committed to provide the best solutions for QuickBooks Support Phone Number.
    Click Here to Know How to install diagnostic tool to get in touch.
    Dial : 1-844-908-0801

    回复删除
  79. Lockdown is running in the whole country due to coronavirus, in such an environment we are committed to provide the best solutions for QuickBooks Support Phone Number.
    Click Here to Know How to fix QuickBooks error 1522 to get in touch.
    Dial : 1-844-908-0801

    回复删除
  80. Nice Blog !
    While being surrounded by such frightful coronavirus emergency when the whole world has been affected by this pandemic, still our diligent QB technicians are working by 24*7, day and night to support you. By connecting to our QuickBooks Payroll Support Phone Number 1-855-6OO-4O6O.

    回复删除
  81. Lockdown is running in the whole country due to coronavirus, in such an environment we are committed to provide the best solutions for QuickBooks Support Phone Number.
    Contact QuickBooks support Phone Number Idaho to get in touch.
    Dial QuickBooks Toll free Number : 1-844-908-0801

    回复删除
  82. Nice & Informative Blog !
    QuickBooks Error 6000 normally persists when a user tries to open a company file. Firewall is blocking the connection between the two computers, corrupted.our QuickBooks Customer Sevice Number 1-855-6OO-4O6O executives persistently working to support you by 24*7, round-the-clock!!

    回复删除
  83. We will give you the best administrations you anticipate from a Call Girls in Islamabad; you can welcome them to join your move gathering or conference as well. She will satisfy your life in Islamabad.
    Escorts in Islamabad

    Islamabad Escorts

    Call Girls in Islamabad

    回复删除

  84. Lockdown is running in the whole country due to coronavirus, in such an environment we are committed to provide the best solutions for QuickBooks Support Phone Number.
    Know how to fix QuickBooks Payroll server error to get in touch.
    Dial : 1-844-908-0801

    回复删除
  85. If dealing with QuickBooks Desktop Error 6189 816, fix it by calling our QuickBooks experts at 1-855-6OO-4O6O. QuickBooks error 6189 816 occurs when a user attempts to open or access a Company file from a network device in a multi-user mode.

    回复删除
  86. Nice Blog !
    Stuck with QuickBooks Payroll Error ps032? Don’t worry, place a call at 1-855-6OO-4O6O for instant aid. Few things which you need to know about Qb payroll error ps032.If you need help of experts to resolve the QuickBooks Payroll Error ps032, then immediately contact us at 1-855-6OO-4O6O.

    回复删除
  87. Web smoothing out infers the way toward making a site persistently detectable on a web crawler's outcomes page. To explain, a faltering SEO reasoning will put an affiliation's site at the head of the rundown on a Google search page, thusly improving the probability that individuals will visit the site.




    https://5euros.eu/service/93964/rediger-un-business-plan-euplet-et-aussi-vos-documents-eumerciaux

    回复删除
  88. Our call young ladies are genuinely flawless, hot and erotic. Their sweet nature makes them one of the most VIP administration and they leave their customers totally fulfilled.

    Escorts in Islamabad

    Islamabad Escorts

    Call Girls in Islamabad

    回复删除
  89. More than a site, we are building a successful and redid propelled procedure.
    We urge, we support, we co-pilot ...
    Our main responsibility is to gain a result as per your objectives.



    creation site internet blois tribu and co

    回复删除
  90. I love your blog.. vdry pleasant hues and topic. Did you make this site ourself or did you recruit somebody to do it for you? Plz answer ass I'm looking also structure my own bpog and would likme to discover where u got this from. much appreciated о



    Situs Pkv Games Online Terpercaya

    回复删除
  91. Struggling with Quickbooks Enterprise Support Phone Number ? Fix it by dialling us at 1-855-511-6911. The error usually arrives due to improper installation of QuickBooks upgrading.

    回复删除
  92. It’s obvious some patients with herpes are being enslaved to the antiviral and other supplementary Orthodox medicine just to help suppress the virus and not a cure. I have been with the virus since 2015 until I was introduced by a blogger who also narrated her story online on how she was cured of Genital Herpes after using Dr Sikies Herbal Medicine. This is a year and 2 weeks since I was delivered from genital Herpes. All thanks to God for using this Great herbalist to heal me. I have promised to keep telling good things about Dr Sikies. Please feel free to share Your problems with him and don’t forget to tell him I did refer you to Him. Thanks. Write him on mail Drsikies@gmail.com He deals with Alzheimer virus, Cancer, HIV, Herpes, Genital, warts, ALS, BV, UTI, Virginal infection, Genital, Wart, HPV, Hepatitis A/B, Good luck, HSV, Pregnancy, Ex back.  

    here is his website:https://drsikiesherbalcure.weebly.com 

    you can reach me via mail:anitalawson515@gmail.com

    回复删除
  93. whatever kind of issues users are preoccupied with. They can get effective Instant Solution ✆ QuickBooks Payroll Support Phone Number by dialling us QuickBooks Payroll Support Phone Number at |+1(844)233-3033 For More Visit: https://247quikbooks-support.com/quickbooks-payroll-support-phone-number/

    回复删除
  94. If confronting any sort of technical glitch in the software. Resolve it by calling on QuickBooks POS Support Number|+1(844)233-3033. Our learned & Experienced QuickBooks professionals are always presented to offer technical help. For More Visit: https://247quikbooks-support.com/quickbooks-pos-support-phone-number-usa/

    回复删除
  95. Well explained and informative blog. In these challenging times, we urge you to stay home and stay safe and dial +1(844)233-3033 QuickBooks Support Phone Number whenever you face any technical issue in QuickBooks. For more details visit:https://247quikbooks-support.com/quickbooks-technical-support-phone-number/

    回复删除
  96. Our QuickBooks Pro Support Phone Number +1(844)233-3033, for further queries and get them addressed simultaneously. Our technicians are available by 24*7, round-the-clock. So, Why Delay? Call right now!! Read More: https://247quikbooks-support.com/quickbooks-pos-support-phone-number-usa/

    回复删除
  97. Your advertising budget is also very important. It depends on the promotion channels we use and on what date.
    As you can see, managing SEM campaigns requires knowledge and experience.




    Website builder in costa rica

    回复删除
  98. Drudge Media is a leading Wordpress Development company offering best and affordable Wordpress Development Services in India with full satisfaction services. Hire our WordPress developers for eCommerce, custom website design, PSD, HTML to WordPress migration Services.

    回复删除
  99. Get Your Error and Problem Solve With QuickBooks Expert 24*7 live.
    Dial QuickBooks support Phone Number Florida to get in touch for
    More Details Dial : 1-844-514-7111

    回复删除
  100. Thanks for Informative blog, it is pretty good and impressed me a lot.If you buy online medicine like Buy Tramadol 100 mg Online or Buy Ambien 10mg Onlinethan Visit us.

    回复删除
  101. Great Article! Thanks for sharing this types of article is very helpful for us!. In this article we will also tell you how you can buy Tramadol 200mg online.

    Order Tramadol 200mg Cash on Delivery
    Buy Tramadol 200mg Cash on Delivery

    回复删除

  102. Information is pretty good and impressed me a lot. This article is quite in-depth and gives a good overview of the topic. If you are looking for buy online medicine like TapenTadol Extended Release Pill Online than contact us.

    回复删除
  103. Great Article! Thanks for sharing this types of article is very helpful for us! Xanax is also used to treat panic disorders with or without fear of places and situations that can cause panic than order

    xanax Cash on Delivery
    xanax COD

    回复删除
  104. Awesome information about topics.Graymen Technologie offers Website Designing Company in India & USA are best way to increase your online business through attractive website.

    回复删除
  105. if you ever run into any type of complicated technical errors & issues in the software, directly reach out to our QuickBooks Support Phone Number Mississipp +1(844)233-3033, and dispose of all your worries. No matter how tricky & composite error codes you have, you will be furnished with optimum deliverances.

    回复删除
  106. Thanks for Informative blog, it is pretty good and impressed me a lot.If you buy online medicine like Buy Tramadol 100 mg Online or Buy Ambien 10mg Onlinethan Visit us.

    回复删除
  107. Nice Blog!
    Facing error while using QuickBooks get instant solution with our QuickBooks experts.Dial +1-(855)533-6333 QuickBooks Support Phone Number
    click here :- https://tinyurl.com/yy33sxqb

    回复删除