lazenca0x0@ubuntu:~/Exploit/OneGadgets$ objdump -M intel -d /lib/x86_64-linux-gnu/libc-2.23.so |grep -C8 18cd57
4524f: 31 d2 xor edx,edx
45251: bf 03 00 00 00 mov edi,0x3
45256: e8 95 04 ff ff call 356f0 <__sigaction@@GLIBC_2.2.5>
4525b: 31 d2 xor edx,edx
4525d: 4c 89 e6 mov rsi,r12
45260: bf 02 00 00 00 mov edi,0x2
45265: e8 b6 04 ff ff call 35720 <sigprocmask@@GLIBC_2.2.5>
4526a: 48 8b 05 47 ec 37 00 mov rax,QWORD PTR [rip+0x37ec47] # 3c3eb8 <_IO_file_jumps@@GLIBC_2.2.5+0x7d8>
45271: 48 8d 3d df 7a 14 00 lea rdi,[rip+0x147adf] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
45278: 48 8d 74 24 30 lea rsi,[rsp+0x30]
4527d: c7 05 19 12 38 00 00 mov DWORD PTR [rip+0x381219],0x0 # 3c64a0 <__abort_msg@@GLIBC_PRIVATE+0x8c0>
45284: 00 00 00
45287: c7 05 13 12 38 00 00 mov DWORD PTR [rip+0x381213],0x0 # 3c64a4 <__abort_msg@@GLIBC_PRIVATE+0x8c4>
4528e: 00 00 00
45291: 48 8b 10 mov rdx,QWORD PTR [rax]
45294: e8 d7 74 08 00 call cc770 <execve@@GLIBC_2.2.5>
45299: bf 7f 00 00 00 mov edi,0x7f
--
6f58c: 74 0c je 6f59a <_IO_proc_open@@GLIBC_2.2.5+0x2fa>
6f58e: 89 f0 mov eax,esi
6f590: 0f 05 syscall
6f592: 48 3d 00 f0 ff ff cmp rax,0xfffffffffffff000
6f598: 77 4a ja 6f5e4 <_IO_proc_open@@GLIBC_2.2.5+0x344>
6f59a: 48 8b 92 e8 00 00 00 mov rdx,QWORD PTR [rdx+0xe8]
6f5a1: 48 85 d2 test rdx,rdx
6f5a4: 75 e0 jne 6f586 <_IO_proc_open@@GLIBC_2.2.5+0x2e6>
6f5a6: 48 8d 3d aa d7 11 00 lea rdi,[rip+0x11d7aa] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
6f5ad: 48 8d 15 a0 d7 11 00 lea rdx,[rip+0x11d7a0] # 18cd54 <_libc_intl_domainname@@GLIBC_2.2.5+0x194>
6f5b4: 48 8d 35 a1 d7 11 00 lea rsi,[rip+0x11d7a1] # 18cd5c <_libc_intl_domainname@@GLIBC_2.2.5+0x19c>
6f5bb: 45 31 c0 xor r8d,r8d
6f5be: 4c 89 e1 mov rcx,r12
6f5c1: 31 c0 xor eax,eax
6f5c3: e8 58 d4 05 00 call cca20 <execl@@GLIBC_2.2.5>
6f5c8: bf 7f 00 00 00 mov edi,0x7f
6f5cd: e8 3e d1 05 00 call cc710 <_exit@@GLIBC_2.2.5>
--
cce0d: 49 81 fd 00 10 00 00 cmp r13,0x1000
cce14: 0f 87 ad 02 00 00 ja cd0c7 <execvpe@@GLIBC_2.11+0x367>
cce1a: 49 83 c5 1e add r13,0x1e
cce1e: 49 83 e5 f0 and r13,0xfffffffffffffff0
cce22: 4c 29 ec sub rsp,r13
cce25: 45 31 ed xor r13d,r13d
cce28: 48 8d 4c 24 0f lea rcx,[rsp+0xf]
cce2d: 48 83 e1 f0 and rcx,0xfffffffffffffff0
cce31: 48 8d 05 1f ff 0b 00 lea rax,[rip+0xbff1f] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
cce38: 41 83 ff 01 cmp r15d,0x1
cce3c: 4c 89 71 08 mov QWORD PTR [rcx+0x8],r14
cce40: 48 89 01 mov QWORD PTR [rcx],rax
cce43: 0f 84 aa 02 00 00 je cd0f3 <execvpe@@GLIBC_2.11+0x393>
cce49: 41 8d 47 fe lea eax,[r15-0x2]
cce4d: 4d 63 ff movsxd r15,r15d
cce50: 48 89 4d c8 mov QWORD PTR [rbp-0x38],rcx
cce54: 4a 8d 34 fd 00 00 00 lea rsi,[r15*8+0x0]
--
cd053: 48 81 ff 00 10 00 00 cmp rdi,0x1000
cd05a: 0f 87 35 01 00 00 ja cd195 <execvpe@@GLIBC_2.11+0x435>
cd060: 49 83 c5 1e add r13,0x1e
cd064: 49 83 e5 f0 and r13,0xfffffffffffffff0
cd068: 4c 29 ec sub rsp,r13
cd06b: 48 8d 44 24 0f lea rax,[rsp+0xf]
cd070: 48 83 e0 f0 and rax,0xfffffffffffffff0
cd074: 48 89 45 c0 mov QWORD PTR [rbp-0x40],rax
cd078: 48 8d 0d d8 fc 0b 00 lea rcx,[rip+0xbfcd8] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
cd07f: 83 fe 01 cmp esi,0x1
cd082: 4c 89 78 08 mov QWORD PTR [rax+0x8],r15
cd086: 48 89 08 mov QWORD PTR [rax],rcx
cd089: 48 89 c1 mov rcx,rax
cd08c: 0f 84 36 01 00 00 je cd1c8 <execvpe@@GLIBC_2.11+0x468>
cd092: 8d 46 fe lea eax,[rsi-0x2]
cd095: 49 89 cf mov r15,rcx
cd098: 48 8d 14 c5 08 00 00 lea rdx,[rax*8+0x8]
--
cd0d1: 0f 85 43 fd ff ff jne cce1a <execvpe@@GLIBC_2.11+0xba>
cd0d7: 4c 89 ef mov rdi,r13
cd0da: e8 c1 27 f5 ff call 1f8a0 <*ABS*+0x8fa00@plt+0x10>
cd0df: 48 85 c0 test rax,rax
cd0e2: 49 89 c5 mov r13,rax
cd0e5: 48 89 c1 mov rcx,rax
cd0e8: 0f 85 43 fd ff ff jne cce31 <execvpe@@GLIBC_2.11+0xd1>
cd0ee: e9 ba fc ff ff jmp ccdad <execvpe@@GLIBC_2.11+0x4d>
cd0f3: 48 8d 3d 5d fc 0b 00 lea rdi,[rip+0xbfc5d] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
cd0fa: e9 81 fd ff ff jmp cce80 <execvpe@@GLIBC_2.11+0x120>
cd0ff: 48 89 c7 mov rdi,rax
cd102: 48 89 55 c0 mov QWORD PTR [rbp-0x40],rdx
cd106: 4c 89 45 c8 mov QWORD PTR [rbp-0x38],r8
cd10a: e8 61 79 04 00 call 114a70 <__libc_alloca_cutoff@@GLIBC_PRIVATE>
cd10f: 85 c0 test eax,eax
cd111: 4c 8b 45 c8 mov r8,QWORD PTR [rbp-0x38]
cd115: 48 8b 55 c0 mov rdx,QWORD PTR [rbp-0x40]
--
cd1ab: 89 75 b0 mov DWORD PTR [rbp-0x50],esi
cd1ae: e8 ed 26 f5 ff call 1f8a0 <*ABS*+0x8fa00@plt+0x10>
cd1b3: 48 85 c0 test rax,rax
cd1b6: 48 89 45 c0 mov QWORD PTR [rbp-0x40],rax
cd1ba: 74 1b je cd1d7 <execvpe@@GLIBC_2.11+0x477>
cd1bc: 48 89 45 a0 mov QWORD PTR [rbp-0x60],rax
cd1c0: 8b 75 b0 mov esi,DWORD PTR [rbp-0x50]
cd1c3: e9 b0 fe ff ff jmp cd078 <execvpe@@GLIBC_2.11+0x318>
cd1c8: 48 8d 3d 88 fb 0b 00 lea rdi,[rip+0xbfb88] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
cd1cf: 48 89 c6 mov rsi,rax
cd1d2: e9 38 fe ff ff jmp cd00f <execvpe@@GLIBC_2.11+0x2af>
cd1d7: 48 c7 45 a0 00 00 00 mov QWORD PTR [rbp-0x60],0x0
cd1de: 00
cd1df: e9 f0 fd ff ff jmp ccfd4 <execvpe@@GLIBC_2.11+0x274>
cd1e4: 66 2e 0f 1f 84 00 00 nop WORD PTR cs:[rax+rax*1+0x0]
cd1eb: 00 00 00
cd1ee: 66 90 xchg ax,ax
--
f018f: e9 c9 fc ff ff jmp efe5d <gai_strerror@@GLIBC_2.2.5+0x52d>
f0194: 85 ed test ebp,ebp
f0196: 0f 85 28 01 00 00 jne f02c4 <gai_strerror@@GLIBC_2.2.5+0x994>
f019c: 8b 44 24 2c mov eax,DWORD PTR [rsp+0x2c]
f01a0: 48 c7 44 24 68 00 00 mov QWORD PTR [rsp+0x68],0x0
f01a7: 00 00
f01a9: 83 e0 10 and eax,0x10
f01ac: 89 44 24 28 mov DWORD PTR [rsp+0x28],eax
f01b0: 48 8d 05 a0 cb 09 00 lea rax,[rip+0x9cba0] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
f01b7: 48 89 44 24 50 mov QWORD PTR [rsp+0x50],rax
f01bc: 48 8d 05 91 cb 09 00 lea rax,[rip+0x9cb91] # 18cd54 <_libc_intl_domainname@@GLIBC_2.2.5+0x194>
f01c3: 48 89 44 24 58 mov QWORD PTR [rsp+0x58],rax
f01c8: 48 8b 44 24 20 mov rax,QWORD PTR [rsp+0x20]
f01cd: 48 89 44 24 60 mov QWORD PTR [rsp+0x60],rax
f01d2: 8b 7c 24 44 mov edi,DWORD PTR [rsp+0x44]
f01d6: 83 ff 01 cmp edi,0x1
f01d9: 0f 84 32 01 00 00 je f0311 <gai_strerror@@GLIBC_2.2.5+0x9e1>
--
f0289: 00
f028a: e9 ce fb ff ff jmp efe5d <gai_strerror@@GLIBC_2.2.5+0x52d>
f028f: 48 8d 3d f1 e3 09 00 lea rdi,[rip+0x9e3f1] # 18e687 <_libc_intl_domainname@@GLIBC_2.2.5+0x1ac7>
f0296: e8 65 9a f4 ff call 39d00 <unsetenv@@GLIBC_2.2.5>
f029b: 8b 7c 24 40 mov edi,DWORD PTR [rsp+0x40]
f029f: e8 3c 76 00 00 call f78e0 <__close@@GLIBC_2.2.5>
f02a4: 48 8b 05 0d 3c 2d 00 mov rax,QWORD PTR [rip+0x2d3c0d] # 3c3eb8 <_IO_file_jumps@@GLIBC_2.2.5+0x7d8>
f02ab: 48 8d 74 24 50 lea rsi,[rsp+0x50]
f02b0: 48 8d 3d a0 ca 09 00 lea rdi,[rip+0x9caa0] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
f02b7: 48 8b 10 mov rdx,QWORD PTR [rax]
f02ba: e8 b1 c4 fd ff call cc770 <execve@@GLIBC_2.2.5>
f02bf: e8 fc 6b f4 ff call 36ec0 <abort@@GLIBC_2.2.5>
f02c4: 48 8d 05 8c ca 09 00 lea rax,[rip+0x9ca8c] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
f02cb: 48 c7 44 24 68 00 00 mov QWORD PTR [rsp+0x68],0x0
f02d2: 00 00
f02d4: 48 89 44 24 50 mov QWORD PTR [rsp+0x50],rax
f02d9: 48 8b 44 24 20 mov rax,QWORD PTR [rsp+0x20]
f02de: 48 89 44 24 60 mov QWORD PTR [rsp+0x60],rax
f02e3: 48 8d 05 a1 e3 09 00 lea rax,[rip+0x9e3a1] # 18e68b <_libc_intl_domainname@@GLIBC_2.2.5+0x1acb>
f02ea: 48 89 44 24 58 mov QWORD PTR [rsp+0x58],rax
f02ef: e9 de fe ff ff jmp f01d2 <gai_strerror@@GLIBC_2.2.5+0x8a2>
--
f0fa8: e9 f0 f8 ff ff jmp f089d <gai_strerror@@GLIBC_2.2.5+0xf6d>
f0fad: 85 db test ebx,ebx
f0faf: 0f 85 47 01 00 00 jne f10fc <gai_strerror@@GLIBC_2.2.5+0x17cc>
f0fb5: 8b 44 24 4c mov eax,DWORD PTR [rsp+0x4c]
f0fb9: 48 c7 84 24 88 00 00 mov QWORD PTR [rsp+0x88],0x0
f0fc0: 00 00 00 00 00
f0fc5: 83 e0 10 and eax,0x10
f0fc8: 89 44 24 2c mov DWORD PTR [rsp+0x2c],eax
f0fcc: 48 8d 05 84 bd 09 00 lea rax,[rip+0x9bd84] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
f0fd3: 48 89 44 24 70 mov QWORD PTR [rsp+0x70],rax
f0fd8: 48 8d 05 75 bd 09 00 lea rax,[rip+0x9bd75] # 18cd54 <_libc_intl_domainname@@GLIBC_2.2.5+0x194>
f0fdf: 48 89 44 24 78 mov QWORD PTR [rsp+0x78],rax
f0fe4: 48 8b 44 24 40 mov rax,QWORD PTR [rsp+0x40]
f0fe9: 48 89 84 24 80 00 00 mov QWORD PTR [rsp+0x80],rax
f0ff0: 00
f0ff1: 8b 7c 24 64 mov edi,DWORD PTR [rsp+0x64]
f0ff5: 83 ff 01 cmp edi,0x1
--
f10da: 48 39 d0 cmp rax,rdx
f10dd: 0f 85 ba f7 ff ff jne f089d <gai_strerror@@GLIBC_2.2.5+0xf6d>
f10e3: 8b 54 24 5c mov edx,DWORD PTR [rsp+0x5c]
f10e7: b8 05 00 00 00 mov eax,0x5
f10ec: 85 d2 test edx,edx
f10ee: 0f 44 44 24 2c cmove eax,DWORD PTR [rsp+0x2c]
f10f3: 89 44 24 2c mov DWORD PTR [rsp+0x2c],eax
f10f7: e9 a1 f7 ff ff jmp f089d <gai_strerror@@GLIBC_2.2.5+0xf6d>
f10fc: 48 8d 05 54 bc 09 00 lea rax,[rip+0x9bc54] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
f1103: 48 c7 84 24 88 00 00 mov QWORD PTR [rsp+0x88],0x0
f110a: 00 00 00 00 00
f110f: 48 89 44 24 70 mov QWORD PTR [rsp+0x70],rax
f1114: 48 8b 44 24 40 mov rax,QWORD PTR [rsp+0x40]
f1119: 48 89 84 24 80 00 00 mov QWORD PTR [rsp+0x80],rax
f1120: 00
f1121: 48 8d 05 63 d5 09 00 lea rax,[rip+0x9d563] # 18e68b <_libc_intl_domainname@@GLIBC_2.2.5+0x1acb>
f1128: 48 89 44 24 78 mov QWORD PTR [rsp+0x78],rax
f112d: e9 bf fe ff ff jmp f0ff1 <gai_strerror@@GLIBC_2.2.5+0x16c1>
f1132: 48 8d 3d 4e d5 09 00 lea rdi,[rip+0x9d54e] # 18e687 <_libc_intl_domainname@@GLIBC_2.2.5+0x1ac7>
f1139: e8 c2 8b f4 ff call 39d00 <unsetenv@@GLIBC_2.2.5>
f113e: 8b 7c 24 60 mov edi,DWORD PTR [rsp+0x60]
f1142: e8 99 67 00 00 call f78e0 <__close@@GLIBC_2.2.5>
f1147: 48 8b 05 6a 2d 2d 00 mov rax,QWORD PTR [rip+0x2d2d6a] # 3c3eb8 <_IO_file_jumps@@GLIBC_2.2.5+0x7d8>
f114e: 48 8d 74 24 70 lea rsi,[rsp+0x70]
f1153: 48 8d 3d fd bb 09 00 lea rdi,[rip+0x9bbfd] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
f115a: 48 8b 10 mov rdx,QWORD PTR [rax]
f115d: e8 0e b6 fd ff call cc770 <execve@@GLIBC_2.2.5>
f1162: e8 59 5d f4 ff call 36ec0 <abort@@GLIBC_2.2.5>
f1167: 49 8b 3f mov rdi,QWORD PTR [r15]
f116a: 48 89 4c 24 10 mov QWORD PTR [rsp+0x10],rcx
f116f: e8 34 e7 f2 ff call 1f8a8 <*ABS*+0x8fa00@plt+0x18>
f1174: 48 8b 44 24 18 mov rax,QWORD PTR [rsp+0x18]
f1179: 48 c7 00 00 00 00 00 mov QWORD PTR [rax],0x0
--
f625e: eb 02 jmp f6262 <posix_spawnp@@GLIBC_2.15+0x2d2>
f6260: 89 ca mov edx,ecx
f6262: 48 83 c0 08 add rax,0x8
f6266: 8d 4a 01 lea ecx,[rdx+0x1]
f6269: 48 83 78 f8 00 cmp QWORD PTR [rax-0x8],0x0
f626e: 75 f0 jne f6260 <posix_spawnp@@GLIBC_2.15+0x2d0>
f6270: 8d 42 02 lea eax,[rdx+0x2]
f6273: 48 89 e3 mov rbx,rsp
f6276: 48 8d 3d da 6a 09 00 lea rdi,[rip+0x96ada] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
f627d: 48 98 cdqe
f627f: 48 8d 04 c5 16 00 00 lea rax,[rax*8+0x16]
f6286: 00
f6287: 48 83 e0 f0 and rax,0xfffffffffffffff0
f628b: 48 29 c4 sub rsp,rax
f628e: 48 8b 85 e0 fe ff ff mov rax,QWORD PTR [rbp-0x120]
f6295: 4c 8d 64 24 07 lea r12,[rsp+0x7]
f629a: 49 c1 ec 03 shr r12,0x3
--
f6626: 75 f0 jne f6618 <posix_spawnp@@GLIBC_2.15+0x688>
f6628: 8d 42 02 lea eax,[rdx+0x2]
f662b: 48 89 a5 f0 fe ff ff mov QWORD PTR [rbp-0x110],rsp
f6632: 48 98 cdqe
f6634: 48 8d 04 c5 16 00 00 lea rax,[rax*8+0x16]
f663b: 00
f663c: 48 83 e0 f0 and rax,0xfffffffffffffff0
f6640: 48 29 c4 sub rsp,rax
f6643: 48 8d 05 0d 67 09 00 lea rax,[rip+0x9670d] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
f664a: 4c 8d 44 24 07 lea r8,[rsp+0x7]
f664f: 4c 89 c3 mov rbx,r8
f6652: 48 c1 eb 03 shr rbx,0x3
f6656: 83 fe 01 cmp esi,0x1
f6659: 48 8d 0c dd 00 00 00 lea rcx,[rbx*8+0x0]
f6660: 00
f6661: 48 89 04 dd 00 00 00 mov QWORD PTR [rbx*8+0x0],rax
f6668: 00
--
f66cb: 48 8b a5 f0 fe ff ff mov rsp,QWORD PTR [rbp-0x110]
f66d2: 64 8b 00 mov eax,DWORD PTR fs:[rax]
f66d5: e9 a6 fe ff ff jmp f6580 <posix_spawnp@@GLIBC_2.15+0x5f0>
f66da: 66 0f 1f 44 00 00 nop WORD PTR [rax+rax*1+0x0]
f66e0: 83 f8 02 cmp eax,0x2
f66e3: 0f 84 b0 fe ff ff je f6599 <posix_spawnp@@GLIBC_2.15+0x609>
f66e9: e9 92 fa ff ff jmp f6180 <posix_spawnp@@GLIBC_2.15+0x1f0>
f66ee: 66 90 xchg ax,ax
f66f0: 48 8d 3d 60 66 09 00 lea rdi,[rip+0x96660] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
f66f7: eb bc jmp f66b5 <posix_spawnp@@GLIBC_2.15+0x725>
f66f9: 31 d2 xor edx,edx
f66fb: 31 f6 xor esi,esi
f66fd: 31 ff xor edi,edi
f66ff: e8 dc 21 ff ff call e88e0 <confstr@@GLIBC_2.2.5>
f6704: 48 8d 48 1f lea rcx,[rax+0x1f]
f6708: 48 89 c2 mov rdx,rax
f670b: 31 ff xor edi,edi
--
ff890: 74 14 je ff8a6 <endttyent@@GLIBC_2.2.5+0xc6>
ff892: 4c 8b 6c 24 30 mov r13,QWORD PTR [rsp+0x30]
ff897: 48 b8 fd ff ff ff ff movabs rax,0x5ffffffffffffffd
ff89e: ff ff 5f
ff8a1: 49 39 c5 cmp r13,rax
ff8a4: 76 3a jbe ff8e0 <endttyent@@GLIBC_2.2.5+0x100>
ff8a6: 48 89 ef mov rdi,rbp
ff8a9: e8 b2 d9 f6 ff call 6d260 <_IO_fclose@@GLIBC_2.2.5>
ff8ae: 48 8d 05 a2 d4 08 00 lea rax,[rip+0x8d4a2] # 18cd57 <_libc_intl_domainname@@GLIBC_2.2.5+0x197>
ff8b5: 48 89 05 44 78 2c 00 mov QWORD PTR [rip+0x2c7844],rax # 3c7100 <__curbrk@@GLIBC_2.2.5+0x1a8>
ff8bc: 48 8d 05 1f f0 08 00 lea rax,[rip+0x8f01f] # 18e8e2 <_libc_intl_domainname@@GLIBC_2.2.5+0x1d22>
ff8c3: 48 89 05 3e 78 2c 00 mov QWORD PTR [rip+0x2c783e],rax # 3c7108 <__curbrk@@GLIBC_2.2.5+0x1b0>
ff8ca: 48 81 c4 98 00 00 00 add rsp,0x98
ff8d1: 48 8d 05 28 78 2c 00 lea rax,[rip+0x2c7828] # 3c7100 <__curbrk@@GLIBC_2.2.5+0x1a8>
ff8d8: 5b pop rbx
ff8d9: 5d pop rbp
ff8da: 41 5c pop r12
lazenca0x0@ubuntu:~/Exploit/OneGadgets$ |