[*] Binary protection state of telnetd

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function printf tear down of telnetd

sb zero, (v0)

b 0x401230

addiu s2, v0, 1

lw t9, -sym.imp.atoi(gp)

lw a0, (s0)

jalr t9

nop

lw gp, 0x18(sp)

b 0x401230

sw v0, 0x160(sp)

lw t9, -sym.imp.strdup(gp)

lw a0, (s0)

jalr t9

nop

lw gp, 0x18(sp)

b 0x401230

sw v0, 0x2290(s6)

lw t9, -sym.imp.strdup(gp)

lw a0, (s0)

jalr t9

nop

lw gp, 0x18(sp)

b 0x401230

nop

lw v0, -0x7f70(gp)

lw t9, -sym.imp.fprintf(gp)

lw a0, (v0)

lw a2, (s4)

lui a1, 0x40

jalr t9

addiu a1, a1, 0x203c

lw gp, 0x18(sp)

nop

lw t9, -sym.imp.exit(gp)

b 0x4013cc

addiu a0, zero, 1

lui v1, 0x41

lw v0, 0x2290(v1)

nop

bnez v0, 0x40138c

lui s0, 0x41

lui v0, 0x40

addiu v0, v0, 0x208c

sw v0, 0x2290(v1)

lw t9, -sym.imp.access(gp)

lw a0, 0x2290(s0)

jalr t9

addiu a1, zero, 1

lw gp, 0x18(sp)

bgez v0, 0x4013d4

lui v1, 0x41

lw t9, -sym.imp.printf(gp)

lw a1, 0x2290(s0)

lui a0, 0x40

jalr t9

addiu a0, a0, 0x2094

lw gp, 0x18(sp)

addiu a0, zero, -1

lw t9, -sym.imp.exit(gp)

nop

jalr t9

nop

lw v0, 0x2290(s0)

beqz s1, 0x4013ec

sw v0, 0x2294(v1)

addiu v0, v1, 0x2294

sw s2, 8(v0)

sw s1, 4(v0)

lw t9, -sym.imp.socket(gp)

lui v0, 0x41

sw zero, 0x22c8(v0)

addiu a0, zero, 2

--

sw zero, 4(a0)

beqz s3, 0x401520

sw zero, 8(a0)

lw t9, -sym.imp.strncpy(gp)

addiu s0, sp, 0x40

move a0, s0

move a1, s3

jalr t9

addiu a2, zero, 0x10

lui v0, 0x40

lw gp, 0x18(sp)

addiu s6, v0, 0x20b0

move s1, zero

addiu s5, zero, 0x20

addiu s2, zero, 5

lw t9, -sym.imp.setsockopt(gp)

sw s5, 0x10(sp)

move a0, s4

ori a1, zero, 0xffff

addiu a2, zero, 0x19

jalr t9

move a3, s0

lw gp, 0x18(sp)

bgez v0, 0x401520

move a0, s6

lw t9, -sym.imp.printf(gp)

nop

jalr t9

move a1, s3

lw gp, 0x18(sp)

addiu a0, zero, 3

lw t9, -sym.imp.sleep(gp)

nop

jalr t9

addiu s1, s1, 1

lw gp, 0x18(sp)

bne s1, s2, 0x4014a8

lui a0, 0x40

lw t9, -sym.imp.perror(gp)

addiu a0, a0, 0x20c8

jalr t9

nop

lw gp, 0x18(sp)

b 0x401c34

addiu v0, zero, 1

lw t9, -sym.imp.bind(gp)

[*] Function printf used 3 times telnetd