Script started on 2025-05-31 15:53:23+02:00 [COMMAND="gdb /bin/sh" TERM="xterm-kitty" TTY="/dev/pts/5" COLUMNS="240" LINES="60"] GNU gdb (GDB) 16.3 Copyright (C) 2024 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-pc-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: . Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... pwndbg: loaded 190 pwndbg commands. Type pwndbg [filter] for a list. pwndbg: created 13 GDB functions (can be used with print/break). Type help function to see them. Reading symbols from /bin/sh... (No debugging symbols found in /bin/sh) ------- tip of the day (disable with set show-tips off) ------- If your program has multiple threads they will be displayed in the context display or using the context threads command [?2004hpwndbg> arstastart [?2004l Temporary breakpoint 1 at 0x1b920 [Thread debugging using libthread_db enabled] Using host libthread_db library "/usr/lib/libthread_db.so.1". Temporary breakpoint 1, 0x000055555556f920 in main () LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA ─────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags on / show-compact-regs off ]────────────────────────────────────────────────────────────────────────────────────────────── RAX  0x55555556f920 (main) ◂— endbr64  RBX  0x7fffffffe2b8 —▸ 0x7fffffffe676 ◂— '/usr/bin/sh' RCX  0x55555565aad8 —▸ 0x555555571470 ◂— endbr64  RDX  0x7fffffffe2c8 —▸ 0x7fffffffe682 ◂— 'XAUTHORITY=/home/lamb/.Xauthority' RDI  1 RSI  0x7fffffffe2b8 —▸ 0x7fffffffe676 ◂— '/usr/bin/sh' R8  0 R9  0x7ffff7fcae00 (_dl_fini) ◂— endbr64  R10  0x7fffffffdee0 ◂— 0x800000 R11  0x206 R12  0 R13  0x7fffffffe2c8 —▸ 0x7fffffffe682 ◂— 'XAUTHORITY=/home/lamb/.Xauthority' R14  0x7ffff7ffd000 (_rtld_global) —▸ 0x7ffff7ffe310 —▸ 0x555555554000 ◂— 0x10102464c457f R15  0x55555565aad8 —▸ 0x555555571470 ◂— endbr64  RBP  1 RSP  0x7fffffffe1a8 —▸ 0x7ffff7d7852e (__libc_start_call_main+126) ◂— mov edi, eax RIP  0x55555556f920 (main) ◂— endbr64  EFLAGS 0x246 [ cf PF af ZF sf IF df of ac ] ──────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────────────────────── ► 0x55555556f920 
 endbr64  0x55555556f924   push r15 0x55555556f926   push r14 0x55555556f928   push r13 0x55555556f92a   push r12 0x55555556f92c   push rbp 0x55555556f92d   push rbx 0x55555556f92e   sub rsp, 0x168 RSP => 0x7fffffffe010 (0x7fffffffe178 - 0x168) 0x55555556f935   mov dword ptr [rsp + 0xc], edi [0x7fffffffe01c] <= 1 0x55555556f939   lea rdi, [rip + 0xf6920] RDI => 0x555555666260 (top_level) ◂— 0 0x55555556f940   mov qword ptr [rsp], rsi [0x7fffffffe010] <= 0x7fffffffe2b8 —▸ 0x7fffffffe676 ◂— '/usr/bin/sh' ───────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]──────────────────────────────────────────────────────────────────────────────────────────────────────────────────── 00:0000│ rsp 0x7fffffffe1a8 —▸ 0x7ffff7d7852e (__libc_start_call_main+126) ◂— mov edi, eax 01:0008│   0x7fffffffe1b0 —▸ 0x7fffffffe2a0 —▸ 0x7fffffffe2a8 ◂— 0x3c /* '<' */ 02:0010│   0x7fffffffe1b8 —▸ 0x55555556f920 (main) ◂— endbr64  03:0018│   0x7fffffffe1c0 ◂— 0x155554040 04:0020│   0x7fffffffe1c8 —▸ 0x7fffffffe2b8 —▸ 0x7fffffffe676 ◂— '/usr/bin/sh' 05:0028│   0x7fffffffe1d0 —▸ 0x7fffffffe2b8 —▸ 0x7fffffffe676 ◂— '/usr/bin/sh' 06:0030│   0x7fffffffe1d8 ◂— 0x1ebb254f19ad1af5 07:0038│   0x7fffffffe1e0 ◂— 0 ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]────────────────────────────────────────────────────────────────────────────────────────────────────────────────── ► 0 0x55555556f920 main 1 0x7ffff7d7852e __libc_start_call_main+126 2 0x7ffff7d785ea __libc_start_main+138 3 0x5555555713f5 _start+37 ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── [?2004hpwndbg> checksec [?2004l File: /usr/bin/bash Arch: amd64 RELRO: Full RELRO Stack: Canary found NX: NX enabled PIE: PIE enabled SHSTK: Enabled IBT: Enabled [?2004hpwndbg> quit [?2004l Script done on 2025-05-31 15:53:28+02:00 [COMMAND_EXIT_CODE="0"]