2017年9月5日星期二

Re-enjoying the ActiveX (and others) Fun in Chinese Customized Browsers

TLDR: Running Chinese customized browsers could be like running IE6 on Windows XP (from security point of view), lots of proven-effective exploit mitigations could be disabled by simple tricks e.g. hosting webpage via IP address.


Background

When I was just jumping into vulnerability research many years ago, I had quite a lot of fun in ActiveX. For example, I found a remote code execution vulnerability (w/ working exploit) in the very-popular Alibaba's Alipay ActiveX control, among many others. I found them mostly through HD Moore’s AxMan fuzzing tool, I'm sure many security researchers had similar fun in the old days.:-)

Today, ActiveX isn't a hot security topic, mostly because the modern Internet Explorer  (IE11) has put several security enhancement features which limit the attack surface of ActiveX - the most significant one in my opinion is the “ActiveX preapproved list”, as it allows only a few number of “pre-defined” ActiveX objects to be loaded without user's permission. Another one is the IE sandbox (Protected Mode or Enhanced Protected Mode), the IE sandbox was not designed for ActiveX but as a generic solution it mitigates all code execution issues inside the browser’s rendering process.

Months ago, I “re-researched” the ActiveX stuff while digging into Microsoft Office (in case you don’t know, ActiveX is still very much supported on Microsoft Office). I thought it's better to understand the whole ActiveX attack surface on browsers first. However, as said, IE11 has a “preapproved list” so it makes not that convenient for testing, instead, I found it might be interesting to try a Chinese customized browser which usually comes with the IE engine.

The 360 Browser

I chose the 360 Browser since it’s the most popular one in China ((PS: Back to 2015, the author disclosed that the 360 Browser and the Baidu Browser had a significant security risk in its way of running Flash content)). The 360 Browser is basically a dual IE + Chrome engine with a customized UI among other features. When the user visits a webpage, the 360 Browser's main process will determine which engine to load but usually it will try using the Chrome engine first (since the Chrome engine is more secure and faster). However, there’re few interesting tricks I’ve seen which are able to “force” the 360 Browser to run with the IE engine. One trick is that if we use IP address (rather than domain name) to access the webpage, the 360 Browser will run in IE mode.

When running in IE mode, users may think they are just like using IE to browser the web, enjoying the same level of security of IE. However, it’s totally (unfortunately) not the case. Let me explain one by one.
  • The first, there isn't the “ActiveX preapproved list” feature, which is very important to limit the ActiveX attack surface. Without such a feature, almost all COM dlls on your system could be loaded in the 360 Browser process (360se.exe) (except those are in the IE killbit list, of course). If the ActiveX control is marked as "safe for initializing " and/or "safe for scripting", the ActiveX control could be initialized and/or run in the 360 Browser process.

    It means that the ActiveX attack surface is back to *that big* like the old days (think about that you’re using IE6 on Windows XP). How big it could be? For example, a clean Windows 10 OS could have as many as 5300 CLSIDs which means quite a lot of ActiveX object could be exploited, even, it doesn't consider third-party software which usually register many new ActiveX controls.

  • The second (and it actually surprised me), is that the DEP is in fact not set correctly for the content process of 360 Browser. If you look at the Process Explore screenshot later, the content 360se.exe process is NOT set to “DEP permanent”, which means the DEP status could be changed during runtime. And indeed, a simple “ActiveX loading” html page is enough to disable the DEP. I specifically put a debugger attaching on the content process and confirmed that all the heap bytes are executable even the memory page is not marked as executable.

  • The third "crazy" thing is that the IE sandbox (PM/EPM) is totally disabled. It means if the attacker get code execution in the content process (and who would think it’s hard to get code execution when you have a pretty wide ActiveX attack surface and DEP+ASLR is totally not working?), it’s basically a “game over”.

The following screenshot shows all the crazy things. The “DEP” but no “permanent” suggests the DEP isn’t working well. The Integrity level of the content process is “Medium” (as well as the webpage property showing “Protected Mode: Off”) shows the IE sandbox is disabled.


Tested on 360 Browser 8.1.1.250 running on Windows 10 64bit, full updated as of March 22, 2017.

The QQ Browser

Even I used the 360 Browser as a main testing target, this is a generic (and serious) problem in most (if not all) Chinese customized browsers when they turn to the IE mode. Similar problems could be easily identified on other Chinese customized browsers. For example, the Tencent’s QQ Browser, is also a dual IE + Chrome engine browser, and when you visit an URL where the server is IP address, the QQ Browser will also turn to IE mode. The author has identified the similar problems when the QQ Browser is running in IE mode:  1)the ActiveX “preapproved list” is not enforced 2)also the IE sandbox is disabled (showing in the following screenshot).



As far as I have seen, different than the 360 Browser, the DEP of QQ Browser’s content process is set correctly. However, it really doesn’t make much difference considering there’s no ActiveX “preapproved list” - an attacker could easily find a non-ASLR COM dll to defeat ASLR+DEP.

For example, if the victim has the QQ installed (which is also very popular in China), the attacker could host a webpage containing the following line:

<html><object classid="clsid:03766B5E-BD09-44db-8F92-510517AC2155"/></html>

When the QQ Browser visits the webpage, a non-ASLR dll named “RICHED20.DLL” will be loaded at a fixed address 0x3970000, which allows the attacker to easily defeat ASLR+DEP.



The issues were tested on QQ Browser version 9.5.4 (10632), full updated as of March 22, 2015.

Conclusion

As we have seen, the Chinese customized browsers basically disabled all the important/effective security features on IE when they’re running in IE mode. They didn’t enforce the ActiveX “preapproved list”. On 360 Browser, DEP is not working correctly, while on QQ Browser it’s easy to find a non-ASLR module to defeat ASLR+DEP due to the ActiveX “preapproved list” is not enforced. Also, they all disabled the IE sandbox.

It’s like the users (of the browsers) are running IE6 on Windows XP.

Disclosure & Vendor Solutions/Mitigations

After noting the issues in March, the author has worked with the 2 leading vendors in China, Qihoo 360 and Tencent, helping them resolve or mitigate the issues described above in the last several months (the author would highlight that the issues are common in other Chinese customized browsers as well but let's try address them for the leading ones first). The issues are reported to Qihoo 360 and Tencent on the same day, March 23rd, 2017. Following are solutions/mitigations I received from their security response teams (please note the author didn’t test or verify the solutions).

For 360 Browser, I was told that they have quickly addressed the “DEP disabled” issue. For the other 2 issues, in their “se8” version, they have added 2 setting options, to control enabling the IE Protected Mode and receiving promoted warnings when ActiveX control is loaded. They have provided me the following screenshot.


For their new “se9” version, the setting options look like the following.



Users should be noted that the offered options are not enabled by default, users who have concerns about the issues need to enable the options by themselves.

For Tencent QQ Browser, according to their feedback, they quickly addressed the “ActiveX control loading” issue with some Cloud technology, they haven’t addressed the “no Protected Mode” issue (they did mention they plan to address it in future releases). 

Future Thoughts

I could understand a bit that these terrible “security feature disabling” decisions are due to compatibility considerations in order to make the browsers work well when visiting Chinese legacy websites, I still remember that one of the popular banks in China requires users to use IE and install their ActiveX control in order to login their online bank service. But, certainly, as the leading vendors in China, there are pretty a lot of things to do to put security first while also handling compatibility issues well.

Disclaimer: this blog post serves as the pure purpose of raising awareness of security issues and it represents the author’s personal views only.


57 条评论:

  1. 回复
    1. Haifei'S Random Thoughts: Re-Enjoying The Activex (And Others) Fun In Chinese Customized Browsers >>>>> Download Now

      >>>>> Download Full

      Haifei'S Random Thoughts: Re-Enjoying The Activex (And Others) Fun In Chinese Customized Browsers >>>>> Download LINK

      >>>>> Download Now

      Haifei'S Random Thoughts: Re-Enjoying The Activex (And Others) Fun In Chinese Customized Browsers >>>>> Download Full

      >>>>> Download LINK Qj

      删除
  2. The Genuine service provider  will give you more satisfaction and they provide fun and Entertainment You just need to call us and you will find the best Escorts in Karachi these superior models are Upper Class Profiles Girls they will give you real Pleasure then no any other karachi Escorts  can give you call us for more information about our service in Karachi DHA Defense.

    回复删除
  3. Adobe is regarded as the best application for completing different tasks. If you want to deal with some unknown errors, connect the technical team at Adobe Help Number UK for the best fixation method.

    回复删除
  4. Kolkata escorts Composing aptitudes are constantly required to deliver astounding data, which you've demonstrated from this article. You may have adapted such uncommon written work ability after a part of training and perusing. I am enlivened a considerable measure from you and even began a claim blog to take after your impressions.
    kolkata Escorts
    Kolkata call girls photos
    Escorts in kolkata
    kolkata call girls
    independent kolkata escorts
    kolkata Escorts
    Kolkata escorts services
    Escorts in kolkata
    Escorts Services in Kolkata
    Kolkata Escorts
    Kolkata call girls
    Escorts in Kolkata
    Kolkata independent escorts
    Independent Kolkata escorts
    Kolkata Escorts
    Escorts in Kolkata

    回复删除
  5. Beautiful Sizzling Girls high class Hyderabad escort agency, we present to you a young student escort Kriti Apte who will win your heart and mind. Kriti Apte is beautiful, intelligent, warm and charming to add to her list of great attributes. Not only is this youthful Italian model a feast for the eyes, she is sensual temptation in a slender and playful package.
    hyderabad escorts

    hyderabad escorts services

    escorts in hyderabad

    independent hyderabad escorts services

    Hyderabad call Girls

    Pune Escorts

    Pune Escorts Services

    Pune Call Girls

    Call Girls In Pune

    Escorts In Pune

    Pune Escorts services

    回复删除
  6. kolkata Escorts
    Escorts in Kolkata
    independent escorts in Kolkata
    Virgin Girls For The Men Seeking Regularly New Call Girls
    It doesn’t really matter if you some romantic sex or have been when you have met your call girls for the first time. The actuality is that it is easy to lose the end and become lazy in bed when the time passes. All married man and women have been victims of the syndrome of the end of the honeymoon and turn up to cheap VIP Kolkata escorts, but we shouldn’t feel guilty about it. The specialists are here to remind us and to give us some advices on how with a little bit of effort and the company of High Profile escorts in Kolkata we can come back to our golden ages and to still enjoy the romance and sex with our loved one.

    回复删除
  7. Pune Escorts

    Independent Pune Escorts Services

    gorgeous call girl in pune escorts

    Pune Escorts Services

    Female Escorts In Pune

    Cheap Rate Call Girl In Pune Escorts

    Hi Friends, Welcome to my site, I am occupational spanking model / call girls and schoolgirl from pune. I am Curvy escorts young Girl Pune Ritu Saini is an alluring and sure Busty and Brunette Escort who wants to fill in as an Escort for Pune Escorts Imperial office. Swinger escorts Paddington region Ritu Saini has a stunning figure and she is a dress size 12 with an extensive bust of a 36F glass. Female escorts Pune is an agreeable Pune Escorts Girl with a lot of certainty and experience to impart to new and standard customers. As should be obvious from her photographs she looks delightful wearing unmentionables and provocative dresses. It has a pretty appearance and a sweet grin. Pune call young lady It is based closest to Paddington Tube station and she is accessible for daytime and night Incall escort and Outcall escort occupations.

    回复删除
  8. If you are going to hire call girls in Bangalore, you should not forget confirming whether they offer customized adult services or not.
    Bangalore Escort
    Bangalore Escorts
    Bangalore escorts services
    call girls in Bangalore
    Escorts in Bangalore


    回复删除
  9. Have you worked your fingers to the bone but still unable to restore authenticator app from a digital key backup in Binance? Do you have solutions Binance Support NUmber and ways to get rid of such errors? If no, you don’t have to worry at all and try out the best services given by a talented and elite bunch of executives by dialing a Binance support phone number +1877-330-7540 which is the easiest medium to deal with the errors in split seconds. You can take step-wise advise from the counselors and avail the perfect solution to your problems immediately.

    回复删除
  10. Chandigarh escort organizations go under the characterization of adult energy and people have turned towards them to get a break from the common involved and tiring timetable.
    Follow us:-

    Jalandhar Escorts

    Jalandhar Call Girls

    Shimla Escorts

    Shimla call Girls

    Jammu Escorts

    Jammu Call Girls

    回复删除
  11. All Dehradun escorts pictures are real and girl which you will see at your door will be exactly the same lady, which you booked and saw in our gallery. We guarantee it. So you can enjoy spending time in privacy with a lovely girl.
    Follow us:-

    Jalandhar Escorts

    Jalandhar Call Girls

    Jalandhar Escorts Service

    Shimla Escorts

    Shimla Call Girls

    回复删除
  12. At some point of time, users feel the need of taking help from the customer support team to avail solutions. Blockchain account consists of issues like login error, sign in error, sign up error, password error, etc. To deal with each of the error, the team is there to assist you. All you can do is to make a call on Blockchain support number which is functional and users can contact the team anytime to Blockchain Support NUmber avail solutions from the professionals. The team is always there to serve you at the earliest stage by helping and providing assistance to users.

    回复删除
  13. Sometimes a situation arises when users are unable to deal with Binance two-factor authentication failure error and need solution to deal with them. If you are unable to deal with any kind of errors and looking for solutions, you can directly contact the team anytime to Binance Support Number get satisfactory solutions. Always talk to the team anytime via calling on Binance support number so that you can eliminate your error immediately without taking any help from the professionals who are there.

    回复删除
  14. Having trouble in dealing with Bitcoin cash errors in Blockchain account? Looking for solution to deal with it so that you can continue your work. If you are unable to deal with such issues and need solution from the professionals who are always active and hold years of experience. To deal with such errors, users can contact the team of skilled Blockchain Support NUmber professionals by dealing with solutions. You can call on Blockchain support number which is functional all the time for assistance. Talk to the team for productive results.

    回复删除
  15. Sometimes a situation arises when users are unable to deal with Gemini two-factor authentication failure error and need solution to deal with them. If you are unable to deal with any kind of errors and looking Gemini Support Number for solutions, you can directly contact the team anytime to get satisfactory solutions. Always talk to the team anytime via calling on Gemini support number so that you can eliminate your error immediately without taking any help from the professionals who are there.

    回复删除
  16. My name is Arpita Jain. I run my independent Mumbai Escorts . I am an independent Mumbai escort girl. My service charge is low according the current market price. My service is super, because I know very well the personal requirement of my each customer. I am comfortable to provide my Mumbai Escorts Service at your home or in Hotel. Visit- http://www.arpitajain.org/ Call- +91 9OO4458359
    Visit The Links Below And Have A Look At My Various Mumbai Escort Services-
    Mumbai Escorts
    Juhu Escorts
    Mumbai Call Girls
    Escort Service In Mumbai
    Andheri Escorts
    Bandra Escorts

    回复删除
  17. My name is Arpita Jain. I run my independent Mumbai Escorts . I am an independent Mumbai escort girl. My service charge is low according the current market price. My service is super, because I know very well the personal requirement of my each customer. I am comfortable to provide my Mumbai Escorts Service at your home or in Hotel. Visit- http://www.arpitajain.org/ Call- +91 9OO4458359

    Visit The Links Below And Have A Look At My Various Mumbai Escort Services-
    Mumbai Escorts
    Juhu Escorts
    Mumbai Call Girls
    Escort Service In Mumbai
    Andheri Escorts
    Bandra Escorts

    回复删除
  18. Looking for assistance to deal with issues that occur during the process of Binance account verification? If you are a first-time user or have no knowledge to deal with errors or to carry out process in Binance exchange, instead of wasting your time, you should contact the team who is ready to help you. Call on Binance support number which is functional and all the time. To contact with the professionals to discuss your issues, you should talk to them and get verified Binance Support Number solutions from the team in no time. The team always serve helping hand so talk to them regarding your troubles. They will always come up with solutions to fix issues.

    回复删除
  19. Are you having bitcoin errors in Blockchain account and are you looking for solutions to deal with errors? You have reached the right place where all your issues will be resolved by the team who is always there for you. You can always take help from the professionals who’re there to support you via calling on Blockchain support number which is always ready to support you. Reaching them and discussing your Blockchain Support Number error is a right decision. You can contact them anytime to avail fruitful solutions which are applicable and easy to execute.

    回复删除
  20. Thanks for such a wonderful job, seriously this is amazing information giving site..!!!!
    clipping path services



    回复删除
  21. Peau Jeune

    Site officiel (Magasinez maintenant) :- https://www.dietarycafe.com/peau-jeune-avis-fr/

    Visitez maintenant plus d'informations:-

    https://www.completefoods.co/diy/recipes/peau-jeune-2
    https://sites.google.com/site/dietarycafe/peau-jeune
    https://medium.com/@dietarycafe/peau-jeune-avis-d89c0665a2ee
    https://dietarycafe.blogspot.com/2019/11/peau-jeune.html
    http://thedietarycafe.over-blog.com/peau-jeune

    En fait, je n'ai pas remarqué autant que cela touche sur les soins de la peau. Certains de mes clients sont tellement contrariés par rapport à Glowing Skin. Comme nous le savons, voici ma solution sans effort à ce dilemme. Nous pourrions tous nous imaginer comme ça.

    回复删除
  22. It's very difficult to stumble upon the right essay service for your college needs. That's why reddit lovers prefer https://www.reddit.com/r/HomeworkCentral/comments/e8ez8r/best_essay_writing_service_reddit_20192020/

    回复删除
  23. Have you ever encountered Blockchain customer care +1 (855) 942-0545 United States withdrawal forked coin error in your Blockchain account? If you have bene under this error and unable to fix it, here we are there to help you at the moment. To end this error in immediate basis, you can always take help from the team of elite professionals who are there to assist you. You can always call on Blockchain customer service number which is functional and provide you the route Blockchain Customer Service Number where you can get all answers related to queries in nick of time. Contact the team anytime for accessible results.

    回复删除
  24. Binance ID verification process requires your personal information including photograph, ID proof and residential address and this process takes a few days to get activated. With verified account, traders are able to exceed their daily withdrawal limit automatically. If you are facing error while executing the ID verification process, you can always take help from Binance Customer Service Number the team of elite professionals who are there to assist you. You can always call on Binance customer service number which is functional and the team is ready to assist so that you don’t encounter any trouble while working on the Binance exchange.

    回复删除
  25. there are many men who are single and you can book them all you have to do is hire Mumbai Escort for fun.

    回复删除
  26. Is Binance two-factor authentication unable to work and need guidance to resolve this error on priority basis? Binance 2fa is considered the main feature that safe guard your account from unwanted troubles. Whenever you come across such issues which are unable to fix by you and you need helping hand, feel free to get in touch Binance Customer Service Number with the team experts over Binance customer service number which is always applicable and the team is there to handle troubles. Connect with them to get rid of troubles which can be easily resolved.

    回复删除
  27. Are you facing unusual error in login to the Blockchain account? If you are surrounded by troubles that can create trouble you and need to be fixed on immediate basis, you can always take help from the team members who are always there to handle all troubles. You can always call on Blockchain customer service number number which is always active and the team is functional to assist you at every step. Connect Blockchain Customer Service Number with the team members and avail results which can be easily executed and help in eliminating troubles from the roots.

    回复删除
  28. Facing errors while creating 18778462817 the Binance exchange account is quite normal for users who are new and don’t hold the knowledge about the crypto industry. If you want to create account on the Binance exchange and looking for remedies that are required to create account hassle-free, you can always call on Binance customer care number which is always functional and the team is ready to guide you at every step. You can always Binance Customer Service Number contact with the team anytime for quality remedies that are easy to execute. Connect with them get result-driven remedies from the elite professionals.

    回复删除
  29. Very nice post to read..

    Understanding the reason for your stress, our Chandigarh escorts babes furnish the best session to the clients maintaining the ethics of sensual services.
    Follow us:_
    Chandigarh escorts service
    Chandigarh escorts
    Chandigarh independent escorts

    Chandigarh escorts
    Call girls in Chandigarh
    Independent escorts in Chandigarh

    Escorts service in Chandigarh
    VIP Chandigarh escorts

    回复删除
  30. Thanks for provide great informatic and looking beautiful blog, really nice required information & the things i never imagined and i would request, wright more blog and blog post like that for us. Thanks you once agian

    name change procedure in ghaziabad
    name change procedure delhi
    name change procedure gurgaon
    name change in faridabad
    name change in noida
    name change
    name change in india
    name change procedure in bangalore
    name change procedure in rajasthan
    name change procedure in maharashtra

    回复删除
  31. Surbhi Rana Zirakpur Escorts service offers genuine and high-profile model, college girls, Russian and housewife. Make yourself satisfy with Escorts Service In Zirakpur at the best rate.
    Escort Service in Zirakpur
    Zirakpur Escorts
    Zirakpur Escort
    Zirakpur Escorts
    Zirakpur Escort Service
    Escorts in Zirakpur
    Zirakpur Escorts
    Zirakpur Call Girls

    回复删除
  32. kolkata goes with is evident best mix Just an overall number of improved Incredible Class Call Young ladies, who can fill in as your mates during from a general viewpoint such a cutoff
    Kolkata escorts
    Kolkata independent escorts
    park street escorts
    salt lake escorts

    回复删除
  33. Hi this is Nandini Divekar Escorts Services in the Pune.This provides the best Escort services in Pune.
    Pune Escorts
    Pune escorts services

    回复删除
  34. Dehradun escort girls are highly talented in entertaining their clients. They are not only beautiful, but also educated and so, you can take them to any corporate event without any hesitation.

    Dehradun escorts
    Mussoorie escorts
    Haridwar escorts
    Rishikesh escorts
    Manali escorts

    回复删除
  35. We are the most reliable Chandigarh escorts service agency serving the different categories of premium clients. We are the one-stop destination for all our elite customers looking for trusted, confidential, and good dating companionship in Chandigarh.

    Chandigarh Escorts
    Mohali Escorts
    Zirakpur Escorts
    Panchkula Escorts
    Amritsar Escorts
    Chandigarh Call Girls

    回复删除
  36. I am Isha Basu from City. I provide all types of escorts service in City. Please book me to enjoy all your erotic fantasies anywhere in City. I am available in all major locations in City. I love going on a long drive. I am very Expert and I provide all services.
    Gonda Escorts $$
    Mainpuri Escorts $$
    Lalitpur Escorts $$
    Etah Escorts $$
    Deoria Escorts $$
    Ujhani Escorts $$
    Ghazipur Escorts $$
    Sultanpur Escorts $$
    Azamgarh Escorts $$
    Bijnor Escorts $$

    回复删除
  37. Kolkata Escorts| Book Online +919851292343 Call Girls
    Kolkata Escorts Book Escorts Online in Red Roof Hotels in Kolkata Call Girls, by Independent Escorts in Kolkata Most safe and secure Kolkata Escorts Service.
    Kolkata Escorts
    Park Street Escorts
    Dharmatala Escorts
    Salt Lake Escorts
    New Town Escorts
    Ballygange Escorts

    回复删除
  38. this is useful, Please visit apnigiftshop for best quality products & participate in amazon quiz and win amazing prices,...

    回复删除
  39. Thanks for taking time for sharing this article, it was excellent and very informative. Its really very useful of all of users. I found a lot of informative stuff in your article. Keep it up.
    Parallels Desktop Crack

    Crack Software

    Crack Software

    回复删除
  40. Everyone loves it when people get together and share opinions. Great blog, continue the good work!

    Camtasia Studio Crack

    Cracked Software

    Pc License Keys

    回复删除
  41. This article is out of the roof. Wow! Wonderful. Great Post!
    https://www.aarinkaur.com/
    https://www.aarinkaur.com/Contact-Mumbai-Escorts-Aarin.html
    https://www.aarinkaur.com/Mumbai-Escorts-Rate-Card.html
    https://www.aarinkaur.com/Mumbai-Escorts-Location.html
    https://www.aarinkaur.com/Mumbai-Escorts-Location.html

    回复删除
  42. I have read several excellent stuff here. Definitely value bookmarking for revisiting. I surprise how much attempt you set to create this type of fantastic informative web site.
    Bitdefender Total Security Crack
    AOMEI Backupper Pro Crack
    Youtube By Click Premium Crack
    EaseUS Partition Master Crack
    uTorrent Pro Crack
    MS Office Crack

    回复删除
  43. Call Girls in Himachal Pradesh offer escort service and erotic massage. Independent Himachal Pradesh and call girls from escort agencies are waiting you.
    Ghumarwin Escorts ==>
    Daulatpur Escorts ==>
    Dalhousie Escorts ==>
    Chaupal Escorts ==>
    Chamba Escorts ==>
    Bhuntar Escorts ==>
    Baddi Escorts ==>
    Arki Escorts ==>
    Dhanaulti Escorts ==>
    Lansdowne Escorts ==>

    回复删除
  44. Hi there lads, the perfect independent call girl awaits you, me. My agency is StreetGirls and I am the 22-year-old VIP lover who is going to make all your problems away and entertain you this fine night. I consider myself very sensual, cheerful, smiling and I am waiting for you to come and enjoy me. I am a very seductive woman who knows the ways to get to pleasure. I will have all the patience with you, the respect for who you are and towards your body.
    Call girls for party
    Hotel call girls
    Model
    Incall girls
    Outcall girls
    Escort service
    Female call girls service
    Erotic massage
    Call girls number
    Call girl number

    回复删除
  45. The highly improved glass beads price in india merger is a blend of three appearances: round, pin, and diagonal. Large glass beads price in India is also known as Jewelers Mix. Each of the Large glass beads price in India does a different job buffing elements to a mirror-bright finish in the shortest amount of time. We are attempting a comprehensive selection of huge glass beads price in India with the customization available, based on enhanced industrial understanding and information. Glass beads price is used for sandblasting, cleaning, and iron accessories of huge fixtures, among other things. Glass beads price in India is the only shot integration you will ever require.

    回复删除
  46. Haifei'S Random Thoughts: Re-Enjoying The Activex (And Others) Fun In Chinese Customized Browsers >>>>> Download Now

    >>>>> Download Full

    Haifei'S Random Thoughts: Re-Enjoying The Activex (And Others) Fun In Chinese Customized Browsers >>>>> Download LINK

    >>>>> Download Now

    Haifei'S Random Thoughts: Re-Enjoying The Activex (And Others) Fun In Chinese Customized Browsers >>>>> Download Full

    >>>>> Download LINK Vx

    回复删除