how-to-get-root.cpp

// trapni@starfall [~] > cat blah.cc
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

int main()
{
        // EUID is 0 already (because binary's setuid bit is set and binary's uid=0).
        // Now we can use that to set UID to 0.
        setuid(0);

        // Proof:
        printf("uid=%d, euid=%d, gid=%d\n", getuid(), geteuid(), getgid());

        return EXIT_SUCCESS;
}

// trapni@starfall [~] > gcc -o blah blah.cc
// trapni@starfall [~] > sudo chown root:root ./blah
// trapni@starfall [~] > sudo chmod 04755 blah
// trapni@starfall [~] > ./blah
// uid=0, euid=0, gid=1008
// trapni@starfall [~] >