26 lines
641 B
C
26 lines
641 B
C
/*
|
|
Description: Simulate behavior of CVE-2025-32463 - sudo EoP via chroot.
|
|
Possible future CTF challenge? :)
|
|
gcc -Wall -o chwoot-demo chwoot-demo.c
|
|
cp 4755 chwoot-demo
|
|
mv chwoot-demo /usr/bin
|
|
Then get a root shell as a low priv user
|
|
*/
|
|
#include <fcntl.h>
|
|
#include <unistd.h>
|
|
#include <sys/types.h>
|
|
#include <grp.h>
|
|
#include <netdb.h>
|
|
|
|
int main() {
|
|
chdir("/tmp/stage");
|
|
int saved_root = open("/",O_RDONLY);
|
|
int saved_cwd = open(".",O_RDONLY);
|
|
chroot("/tmp/stage");
|
|
chdir("/");
|
|
gethostbyname("woot");
|
|
fchdir(saved_root);
|
|
chroot(".");
|
|
fchdir(saved_cwd);
|
|
getgrnam("got root?");
|
|
}
|