#!/bin/bash

function args() {
        declare -a ARGS=()
        man=$(man $1 | cut -d' ' -f8 | grep -F "-" | cut -d',' -f1 | cut -d'=' -f1 | cut -d'[' -f1)
        for arg in ${man}
        do
                ARGS+=($arg)
        done

        for i in "${ARGS[@]}"
        do
                fuzz $1 $i
        done
}

function fuzz() {
        CMD=$(perl -e "alarm 3; exec @ARGV" "$1 $2 id")
        if echo $CMD | grep -q "uid=1000"
        then
                echo "[+] Success: $1 $2 id" | tee -a ~/arg_results.txt
        fi
}

function bins() {
        funcs=$(ls $1 | grep -Ev "sh|bash|dash|rbash|tmux|screen|zsh")
        for f in $funcs
        do
                args $f
        done
}

bins "/bin"
bins "/usr/bin"