Random IRC quote :      <matalaz> ggonzalez, quiero debugarlo porque quiero ver si me entra por ese driver
Yo sólo quería dar de alta el puto ADSL…lo juro.
Nueva vulnerabilidad en productos de Symantec

WinPcap NPF.SYS Privilege Elevation Vulnerability

Hola,

Idefense acaba de publicar un advisory relativo a una escalada de privilegios en Winpcap descubierta porcoco 48bits, aunque ya se sabía que existían otras situaciones inseguras cuando se utilizaba el driver de Winpcap (otros usuarios logeados en la máquina podían usar el device para sniffar tráfico), esta vez el fallo permite una escalada de privilegios a nivel kernel debido a una falta de validacion sobre la dirección del buffer de destino cuando se utiliza la IOCTL «IOCTL_BIOCGSTATS», os dejo el exploit (PoC) y el análisis de la vulnerabilidad aquí.

Actualizado: El advisory ha sido actualizado, había un «bug» en las versiones afectadas, la última versión de WinPcap afectada por la vulnerabilidad no es la 4.1, sino la 4.0, 4.0.1 (estable) está actualizada. Perdón por el malentendido y gracias a Gianluca de WinPcap por avisarme de mi bug 🙂

Un saludo,

Mario

Por: Mario Ballano | 07/10/07 | 48Bits advisories - 48Bits exploits | Trackback | Comentarios [RSS 2.0]

12 Comentarios para “WinPcap NPF.SYS Privilege Elevation Vulnerability”

  1. Secunio
    Comment por Secunio | 07/10/07 at 1:06 pm

    El segundo apellido de Mario es Bárcena.

    Mario+Ballano+Bárcena .

    ASCII -> M=77d B=66d B=66d

    77-6-666

    El día 77 de Junio el mundo se acabará.

    ¡¡ES EL ANTICRISTO!!

  2. Mario Ballano
    Comment por Mario Ballano | 07/10/07 at 1:44 pm

    envia ANTICRISTO al 9999 xD

  3. raingarden9
    Comment por raingarden9 | 07/10/07 at 1:46 pm

    Errors while compiling on Visual C++ 2003:

    npfxpl.obj : error LNK2019: unresolved external symbol __imp__RegQueryValueExA@24 referenced in function _GetNpfDevice
    npfxpl.obj : error LNK2019: unresolved external symbol __imp__RegOpenKeyExA@20 referenced in function _GetNpfDevice
    npfxpl.exe : fatal error LNK1120: 2 unresolved externals

    Any chance to release compiled version?

  4. Mario Ballano
    Comment por Mario Ballano | 07/10/07 at 2:18 pm

    you must link it with advapi32.lib, you can do it in your project options, anyway in Visual Studio you can add the following pragma to the code :

    #pragma comment(lib, «advapi.lib»)

    Cheers,

  5. raingarden9
    Comment por raingarden9 | 07/10/07 at 2:36 pm

    Mario,

    thank you very much for suggestion. Now it compiles without errors. Keep on doing great work…

    Cheers,

  6. nimda
    Comment por nimda | 07/29/07 at 6:41 pm

    The dev-c++ translation makes a mistake:
    Compiler: Default compiler
    Executing gcc.exe…
    gcc.exe «C:\Documents and Settings\Administrator\My Documents\npfxpl.c» -o «C:\Documents and Settings\Administrator\My Documents\npfxpl.exe» -I»C:\Dev-Cpp\include» -L»C:\Dev-Cpp\lib»
    C:\Documents and Settings\Administrator\My Documents\npfxpl.c:254: warning: `naked’ attribute directive ignored
    C:\Documents and Settings\Administrator\My Documents\npfxpl.c: In function `ShellCode’:
    C:\Documents and Settings\Administrator\My Documents\npfxpl.c:257: error: syntax error before «int»
    C:\Documents and Settings\Administrator\My Documents\npfxpl.c:280: error: syntax error before ‘{‘ token

    Execution terminated

    Why?

  7. Mario Ballano
    Comment por Mario Ballano | 07/30/07 at 10:54 am

    Hi nimda,

    You can’t compile the exploit under gcc 🙁 , that’s cause i’m using assembler inline with intel syntax and some VC specific attributes like __declspec(naked) which i think that under gcc should be something __attribute__ ((naked)). Anyway you can translate it to compile under gcc.

    Cheers,

    Mario

  8. nimda
    Comment por nimda | 07/31/07 at 12:39 am

    1：C:\Program Files\Microsoft Visual Studio 8\vc\bin>cl npfxpl.c
    Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 14.00.50727.42 for 80×86
    Copyright (C) Microsoft Corporation. All rights reserved.

    npfxpl.c
    C:\Dev-Cpp\include\stdarg.h(6) : fatal error C1021: invalid preprocessor command ‘include_next’

    2：C:\Program Files\Microsoft Visual C++ Toolkit 2003>cl npfxpl.c
    Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 13.10.3077 for 80×86
    Copyright (C) Microsoft Corporation 1984-2002. All rights reserved.

    npfxpl.c
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winnt.h(3035) : warni
    ng C4103: ‘c:\program files\microsoft visual c++ toolkit 2003\include\winnt.h’ :
    used #pragma pack to change alignment
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winnt.h(3327) : warni
    ng C4103: ‘c:\program files\microsoft visual c++ toolkit 2003\include\winnt.h’ :
    used #pragma pack to change alignment
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winnt.h(3423) : warni
    ng C4068: unknown pragma
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winnt.h(3428) : warni
    ng C4068: unknown pragma
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1252) : err
    or C2054: expected ‘(‘ to follow ‘DECLSPEC_NORETURN’
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1252) : err
    or C2085: ‘ExitProcess’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1253) : err
    or C2061: syntax error : identifier ‘DECLSPEC_NORETURN’
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1313) : err
    or C2054: expected ‘(‘ to follow ‘DECLSPEC_NORETURN’
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1313) : err
    or C2085: ‘FreeLibraryAndExitThread’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1317) : err
    or C2085: ‘FreeResource’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1319) : err
    or C2085: ‘FreeSid’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1320) : err
    or C2085: ‘GetAce’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1321) : err
    or C2085: ‘GetAclInformation’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1322) : err
    or C2085: ‘GetAtomNameA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1323) : err
    or C2085: ‘GetAtomNameW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1324) : err
    or C2085: ‘GetBinaryTypeA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1325) : err
    or C2085: ‘GetBinaryTypeW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1326) : err
    or C2085: ‘GetCommandLineA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1327) : err
    or C2085: ‘GetCommandLineW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1328) : err
    or C2085: ‘GetCommConfig’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1329) : err
    or C2085: ‘GetCommMask’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1330) : err
    or C2085: ‘GetCommModemStatus’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1331) : err
    or C2085: ‘GetCommProperties’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1332) : err
    or C2085: ‘GetCommState’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1333) : err
    or C2085: ‘GetCommTimeouts’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1334) : err
    or C2085: ‘GetCompressedFileSizeA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1335) : err
    or C2085: ‘GetCompressedFileSizeW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1336) : err
    or C2085: ‘GetComputerNameA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1337) : err
    or C2085: ‘GetComputerNameW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1345) : err
    or C2085: ‘GetCurrentDirectoryA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1346) : err
    or C2085: ‘GetCurrentDirectoryW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1347) : err
    or C2085: ‘GetCurrentHwProfileA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1348) : err
    or C2085: ‘GetCurrentHwProfileW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1349) : err
    or C2085: ‘GetCurrentProcess’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1350) : err
    or C2085: ‘GetCurrentProcessId’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1351) : err
    or C2085: ‘GetCurrentThread’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1352) : err
    or C2085: ‘GetCurrentThreadId’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1354) : err
    or C2085: ‘GetDefaultCommConfigA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1355) : err
    or C2085: ‘GetDefaultCommConfigW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1356) : err
    or C2085: ‘GetDiskFreeSpaceA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1357) : err
    or C2085: ‘GetDiskFreeSpaceW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1358) : err
    or C2085: ‘GetDiskFreeSpaceExA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1359) : err
    or C2085: ‘GetDiskFreeSpaceExW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1364) : err
    or C2085: ‘GetDriveTypeA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1365) : err
    or C2085: ‘GetDriveTypeW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1366) : err
    or C2085: ‘GetEnvironmentStrings’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1367) : err
    or C2085: ‘GetEnvironmentStringsA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1368) : err
    or C2085: ‘GetEnvironmentStringsW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1369) : err
    or C2085: ‘GetEnvironmentVariableA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1370) : err
    or C2085: ‘GetEnvironmentVariableW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1371) : err
    or C2085: ‘GetExitCodeProcess’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1372) : err
    or C2085: ‘GetExitCodeThread’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1373) : err
    or C2085: ‘GetFileAttributesA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1374) : err
    or C2085: ‘GetFileAttributesW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1375) : err
    or C2085: ‘GetFileAttributesExA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1376) : err
    or C2085: ‘GetFileAttributesExW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1377) : err
    or C2085: ‘GetFileInformationByHandle’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1378) : err
    or C2085: ‘GetFileSecurityA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1379) : err
    or C2085: ‘GetFileSecurityW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1380) : err
    or C2085: ‘GetFileSize’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1384) : err
    or C2085: ‘GetFileTime’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1385) : err
    or C2085: ‘GetFileType’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1387) : err
    or C2085: ‘GetFullPathNameA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1388) : err
    or C2085: ‘GetFullPathNameW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1389) : err
    or C2085: ‘GetHandleInformation’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1390) : err
    or C2085: ‘GetKernelObjectSecurity’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1391) : err
    or C2085: ‘GetLastError’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1392) : err
    or C2085: ‘GetLengthSid’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1393) : err
    or C2085: ‘GetLocalTime’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1394) : err
    or C2085: ‘GetLogicalDrives’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1395) : err
    or C2085: ‘GetLogicalDriveStringsA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1396) : err
    or C2085: ‘GetLogicalDriveStringsW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1401) : err
    or C2085: ‘GetMailslotInfo’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1402) : err
    or C2085: ‘GetModuleFileNameA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1403) : err
    or C2085: ‘GetModuleFileNameW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1404) : err
    or C2085: ‘GetModuleHandleA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1405) : err
    or C2085: ‘GetModuleHandleW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1410) : err
    or C2085: ‘GetNamedPipeHandleStateA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1411) : err
    or C2085: ‘GetNamedPipeHandleStateW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1412) : err
    or C2085: ‘GetNamedPipeInfo’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1416) : err
    or C2085: ‘GetNumberOfEventLogRecords’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1417) : err
    or C2085: ‘GetOldestEventLogRecord’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1418) : err
    or C2085: ‘GetOverlappedResult’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1419) : err
    or C2085: ‘GetPriorityClass’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1420) : err
    or C2085: ‘GetPrivateObjectSecurity’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1421) : err
    or C2085: ‘GetPrivateProfileIntA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1422) : err
    or C2085: ‘GetPrivateProfileIntW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1423) : err
    or C2085: ‘GetPrivateProfileSectionA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1424) : err
    or C2085: ‘GetPrivateProfileSectionW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1425) : err
    or C2085: ‘GetPrivateProfileSectionNamesA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1426) : err
    or C2085: ‘GetPrivateProfileSectionNamesW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1427) : err
    or C2085: ‘GetPrivateProfileStringA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1428) : err
    or C2085: ‘GetPrivateProfileStringW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1429) : err
    or C2085: ‘GetPrivateProfileStructA’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1430) : err
    or C2085: ‘GetPrivateProfileStructW’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1431) : err
    or C2085: ‘GetProcAddress’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1432) : err
    or C2085: ‘GetProcessAffinityMask’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1436) : err
    or C2085: ‘GetProcessHeap’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1437) : err
    or C2085: ‘GetProcessHeaps’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1444) : err
    or C2085: ‘GetProcessPriorityBoost’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1445) : err
    or C2085: ‘GetProcessShutdownParameters’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1446) : err
    or C2085: ‘GetProcessTimes’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1447) : err
    or C2085: ‘GetProcessVersion’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1448) : err
    or C2085: ‘GetProcessWindowStation’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1449) : err
    or C2085: ‘GetProcessWorkingSetSize’ : not in formal parameter list
    C:\Program Files\Microsoft Visual C++ Toolkit 2003\include\winbase.h(1449) : fat
    al error C1003: error count exceeds 100; stopping compilation

    C:\Program Files\Microsoft Visual C++ Toolkit 2003>

    why？

  9. Mario Ballano
    Comment por Mario Ballano | 07/31/07 at 10:49 am

    Those errors are happening inside the windows header files, you are making some mistake, but i don’t know what. You have two options:

    – Build the exploit from the scratch in order to be gcc compliant.
    – Use VC.

    Cheers,

  10. nimda
    Comment por nimda | 08/02/07 at 7:52 pm

    #pragma comment(lib, “advapi.lib”)
    “advapi.lib”How can this document from obtain？

  11. nimda
    Comment por nimda | 08/04/07 at 8:20 pm

    Translates successfully

    THX Mario

  12. mybook
    Comment por mybook | 03/16/10 at 4:37 am

    The darkmoon fair comes to Mulgore or Elwyn forest once a month. There are no guards so it is possible to attend the other wow power leveling factions fair. wow power leveling THe muglore 1 is forest fair is next to Goldshire.
    The fair comes with many fun and exciting options. You can exchange items for tickets which you can buy thigns with. You world of warcraft gold can use a massive cannon which fires you into the air a long way. potent ale very cheaply. And last but not 重庆二手交易 least you can giveto combine into an epic trinket.
    The Epic gold in wow Neck:
    A good gear could mean Victory wow gold eu or Death when you fight someone or something (PvP, PvE, Grind, Instances).
    For wow gold cheap a “little” favor or whit a little work you can have an Epic Trinket!
    The “Male” wow cheap gold classes could profit mostly (DD Warrior, DD Paladin, Rogues or Hunters too) from the First one:

Se han cerrado los comentarios

48Bits Blog is proudly powered by WordPress & equiX.
Code is Poetry | CSS | XHTML