Dirty...What?

This is Max Kellermann's proof of concept for Dirty Pipe, but modified to overwrite the root password field in /etc/passwd and restore it after obtaining a root shell.

Note: I claim no credit for finding this vulnerability or writing the proof of concept. This exploit is simply a small modification of Kellermann's proof of concept to allow quick and easy exploitation. Please read the original article on this extremely interesting vulnerability at https://dirtypipe.cm4all.com/ when you have a chance. It really deserves your attention to understand it well.

Usage

1. Compile with ./compile.sh (assuming gcc is installed)
2. Run ./exploit and it will open a root shell

Privilege Escalation

If you get this error message:

1. Log in as root with the password polesupdls.
2. Then restore /etc/passwd by running mv /tmp/passwd.bak /etc/passwd