Skip to content

Instantly share code, notes, and snippets.

@DanielG
Created June 5, 2014 13:00
Show Gist options
  • Save DanielG/3f3df82b1087ef45f696 to your computer and use it in GitHub Desktop.
Save DanielG/3f3df82b1087ef45f696 to your computer and use it in GitHub Desktop.
execve("/usr/bin/ruby", ["ruby", "/root/test.rb"], [/* 3 vars */]) = 0
brk(0) = 0x1704000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9865fb0000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=7983, ...}) = 0
mmap(NULL, 7983, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f9865fae000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/usr/lib/libruby1.8.so.1.8", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000\211\1\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=944800, ...}) = 0
mmap(NULL, 3164288, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f9865a8b000
mprotect(0x7f9865b6e000, 2093056, PROT_NONE) = 0
mmap(0x7f9865d6d000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xe2000) = 0x7f9865d6d000
mmap(0x7f9865d72000, 120960, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9865d72000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\30\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1815224, ...}) = 0
mmap(NULL, 3929304, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f98656cb000
mprotect(0x7f9865880000, 2097152, PROT_NONE) = 0
mmap(0x7f9865a80000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b5000) = 0x7f9865a80000
mmap(0x7f9865a86000, 17624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9865a86000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200l\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=135366, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9865fad000
mmap(NULL, 2212904, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f98654ae000
mprotect(0x7f98654c6000, 2093056, PROT_NONE) = 0
mmap(0x7f98656c5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17000) = 0x7f98656c5000
mmap(0x7f98656c7000, 13352, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f98656c7000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/librt.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340!\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=31752, ...}) = 0
mmap(NULL, 2128984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f98652a6000
mprotect(0x7f98652ad000, 2093056, PROT_NONE) = 0
mmap(0x7f98654ac000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7f98654ac000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=14768, ...}) = 0
mmap(NULL, 2109704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f98650a2000
mprotect(0x7f98650a4000, 2097152, PROT_NONE) = 0
mmap(0x7f98652a4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f98652a4000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libcrypt.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\n\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=43288, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9865fac000
mmap(NULL, 2327040, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f9864e69000
mprotect(0x7f9864e72000, 2097152, PROT_NONE) = 0
mmap(0x7f9865072000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9000) = 0x7f9865072000
mmap(0x7f9865074000, 184832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9865074000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libm.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0pU\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=1030512, ...}) = 0
mmap(NULL, 3125544, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f9864b6d000
mprotect(0x7f9864c68000, 2093056, PROT_NONE) = 0
mmap(0x7f9864e67000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xfa000) = 0x7f9864e67000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9865fab000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9865faa000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9865fa9000
arch_prctl(ARCH_SET_FS, 0x7f9865faa700) = 0
mprotect(0x7f9865a80000, 16384, PROT_READ) = 0
mprotect(0x7f9864e67000, 4096, PROT_READ) = 0
mprotect(0x7f9865072000, 4096, PROT_READ) = 0
mprotect(0x7f98652a4000, 4096, PROT_READ) = 0
mprotect(0x7f98656c5000, 4096, PROT_READ) = 0
mprotect(0x7f98654ac000, 4096, PROT_READ) = 0
mprotect(0x7f9865d6d000, 8192, PROT_READ) = 0
mprotect(0x600000, 4096, PROT_READ) = 0
mprotect(0x7f9865fb2000, 4096, PROT_READ) = 0
munmap(0x7f9865fae000, 7983) = 0
set_tid_address(0x7f9865faa9d0) = 7
set_robust_list(0x7f9865faa9e0, 0x18) = 0
futex(0x7fff1b53eccc, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 7f9865faa700) = -1 EAGAIN (Resource temporarily unavailable)
rt_sigaction(SIGRTMIN, {0x7f98654b4750, [], SA_RESTORER|SA_SIGINFO, 0x7f98654bdcb0}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {0x7f98654b47e0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f98654bdcb0}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0
getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0
brk(0) = 0x1704000
brk(0x1725000) = 0x1725000
mmap(NULL, 401408, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9865f47000
open("/dev/urandom", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_NOFOLLOW) = 3
fstat(3, {st_mode=S_IFCHR|0666, st_rdev=makedev(1, 9), ...}) = 0
read(3, "\323\24\377N\337\302\36\344\25\234\224\260\213\275\224\310\25\222\3\227g\332\223\r\344\3753\237\226b\0\1", 32) = 32
close(3) = 0
brk(0x1746000) = 0x1746000
brk(0x1767000) = 0x1767000
rt_sigaction(SIGINT, {0x7f9865b20bc0, [], SA_RESTORER, 0x7f98657014a0}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGHUP, {0x7f9865b20bc0, [], SA_RESTORER, 0x7f98657014a0}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGQUIT, {0x7f9865b20bc0, [], SA_RESTORER, 0x7f98657014a0}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGTERM, {0x7f9865b20bc0, [], SA_RESTORER, 0x7f98657014a0}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGALRM, {0x7f9865b20bc0, [], SA_RESTORER, 0x7f98657014a0}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGUSR1, {0x7f9865b20bc0, [], SA_RESTORER, 0x7f98657014a0}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGUSR2, {0x7f9865b20bc0, [], SA_RESTORER, 0x7f98657014a0}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGBUS, {0x7f9865b20670, [], SA_RESTORER, 0x7f98657014a0}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGSEGV, {0x7f9865b20b10, [], SA_RESTORER, 0x7f98657014a0}, {SIG_DFL, [], 0}, 8) = 0
rt_sigaction(SIGPIPE, {0x7f9865b204b0, [], SA_RESTORER, 0x7f98657014a0}, {SIG_DFL, [], 0}, 8) = 0
rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [], 8) = 0
rt_sigaction(SIGCHLD, {SIG_DFL, [], SA_RESTORER, 0x7f98657014a0}, {SIG_DFL, [], 0}, 8) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
geteuid() = 0
getegid() = 0
getuid() = 0
geteuid() = 0
getgid() = 0
getegid() = 0
open("/root/test.rb", O_RDONLY) = 3
close(3) = 0
open("/root/test.rb", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=47, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9865faf000
read(3, "#!/usr/bin/env ruby\n$stderr.writ"..., 4096) = 47
read(3, "", 4096) = 0
close(3) = 0
munmap(0x7f9865faf000, 4096) = 0
fstat(0, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
fstat(0, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9865faf000
read(0, "hello world\n", 4096) = 12
read(0, "", 4096) = 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment