Script started on 2025-05-31 15:53:23+02:00 [COMMAND="gdb /bin/sh" TERM="xterm-kitty" TTY="/dev/pts/5" COLUMNS="240" LINES="60"] GNU gdb (GDB) 16.3 Copyright (C) 2024 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-pc-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... pwndbg: loaded 190 pwndbg commands. Type pwndbg [filter] for a list. pwndbg: created 13 GDB functions (can be used with print/break). Type help function to see them. Reading symbols from /bin/sh... (No debugging symbols found in /bin/sh) ------- tip of the day (disable with set show-tips off) ------- If your program has multiple threads they will be displayed in the context display or using the context threads command pwndbg> arstastart Temporary breakpoint 1 at 0x1b920 [Thread debugging using libthread_db enabled] Using host libthread_db library "/usr/lib/libthread_db.so.1". Temporary breakpoint 1, 0x000055555556f920 in main () LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA ─────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags on / show-compact-regs off ]────────────────────────────────────────────────────────────────────────────────────────────── RAX 0x55555556f920 (main) ◂— endbr64 RBX 0x7fffffffe2b8 —▸ 0x7fffffffe676 ◂— '/usr/bin/sh' RCX 0x55555565aad8 —▸ 0x555555571470 ◂— endbr64 RDX 0x7fffffffe2c8 —▸ 0x7fffffffe682 ◂— 'XAUTHORITY=/home/lamb/.Xauthority' RDI 1 RSI 0x7fffffffe2b8 —▸ 0x7fffffffe676 ◂— '/usr/bin/sh' R8 0 R9 0x7ffff7fcae00 (_dl_fini) ◂— endbr64 R10 0x7fffffffdee0 ◂— 0x800000 R11 0x206 R12 0 R13 0x7fffffffe2c8 —▸ 0x7fffffffe682 ◂— 'XAUTHORITY=/home/lamb/.Xauthority' R14 0x7ffff7ffd000 (_rtld_global) —▸ 0x7ffff7ffe310 —▸ 0x555555554000 ◂— 0x10102464c457f R15 0x55555565aad8 —▸ 0x555555571470 ◂— endbr64 RBP 1 RSP 0x7fffffffe1a8 —▸ 0x7ffff7d7852e (__libc_start_call_main+126) ◂— mov edi, eax RIP 0x55555556f920 (main) ◂— endbr64 EFLAGS 0x246 [ cf PF af ZF sf IF df of ac ] ──────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────────────────────── ► 0x55555556f920 <main> endbr64 0x55555556f924 <main+4> push r15 0x55555556f926 <main+6> push r14 0x55555556f928 <main+8> push r13 0x55555556f92a <main+10> push r12 0x55555556f92c <main+12> push rbp 0x55555556f92d <main+13> push rbx 0x55555556f92e <main+14> sub rsp, 0x168 RSP => 0x7fffffffe010 (0x7fffffffe178 - 0x168) 0x55555556f935 <main+21> mov dword ptr [rsp + 0xc], edi [0x7fffffffe01c] <= 1 0x55555556f939 <main+25> lea rdi, [rip + 0xf6920] RDI => 0x555555666260 (top_level) ◂— 0 0x55555556f940 <main+32> mov qword ptr [rsp], rsi [0x7fffffffe010] <= 0x7fffffffe2b8 —▸ 0x7fffffffe676 ◂— '/usr/bin/sh' ───────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────────────────────────────────────────────────────────────────────────── 00:0000│ rsp 0x7fffffffe1a8 —▸ 0x7ffff7d7852e (__libc_start_call_main+126) ◂— mov edi, eax 01:0008│ 0x7fffffffe1b0 —▸ 0x7fffffffe2a0 —▸ 0x7fffffffe2a8 ◂— 0x3c /* '<' */ 02:0010│ 0x7fffffffe1b8 —▸ 0x55555556f920 (main) ◂— endbr64 03:0018│ 0x7fffffffe1c0 ◂— 0x155554040 04:0020│ 0x7fffffffe1c8 —▸ 0x7fffffffe2b8 —▸ 0x7fffffffe676 ◂— '/usr/bin/sh' 05:0028│ 0x7fffffffe1d0 —▸ 0x7fffffffe2b8 —▸ 0x7fffffffe676 ◂— '/usr/bin/sh' 06:0030│ 0x7fffffffe1d8 ◂— 0x1ebb254f19ad1af5 07:0038│ 0x7fffffffe1e0 ◂— 0 ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]────────────────────────────────────────────────────────────────────────────────────────────────────────────────── ► 0 0x55555556f920 main 1 0x7ffff7d7852e __libc_start_call_main+126 2 0x7ffff7d785ea __libc_start_main+138 3 0x5555555713f5 _start+37 ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── pwndbg> checksec File: /usr/bin/bash Arch: amd64 RELRO: Full RELRO Stack: Canary found NX: NX enabled PIE: PIE enabled SHSTK: Enabled IBT: Enabled pwndbg> quit Script done on 2025-05-31 15:53:28+02:00 [COMMAND_EXIT_CODE="0"]