|
|
1.1 root 1: #include <stdio.h>
2: #include <pwd.h>
3:
4: struct passwd *pwd,*getpwnam();
5: char *crypt();
6: char *getpass();
7:
8: main(argc,argv)
9: int argc;
10: char **argv;
11: {
12: char *nptr;
13: char *password;
14: int badsw = 0;
15: char *shell = "/bin/sh";
16:
17: if(argc > 1)
18: nptr = argv[1];
19: else
20: nptr = "root";
21: if((pwd=getpwnam(nptr)) == NULL) {
22: printf("Unknown id: %s\n",nptr);
23: exit(1);
24: }
25: if(pwd->pw_passwd[0] == '\0' || getuid() == 0)
26: goto ok;
27: password = getpass("Password:");
28: if(badsw || (strcmp(pwd->pw_passwd, crypt(password, pwd->pw_passwd)) != 0)) {
29: bad:
30: printf("Sorry\n");
31: if(pwd->pw_uid == 0) {
32: FILE *console = fopen("/dev/console", "w");
33: if (console != NULL) {
34: fprintf(console, "BADSU: %s %s\r\n", getlogin(), ttyname(2));
35: fclose(console);
36: }
37: }
38: exit(2);
39: }
40: if(pwd->pw_uid == 0 && badroot(getgid(),getuid()))
41: goto bad;
42:
43: ok:
44: endpwent();
45: if(pwd->pw_uid == 0) {
46: FILE *console = fopen("/dev/console", "w");
47: if (console != NULL) {
48: fprintf(console, "SU: %s %s\r\n", getlogin(), ttyname(2));
49: fclose(console);
50: }
51: }
52: setgid(pwd->pw_gid);
53: setuid(pwd->pw_uid);
54: if (pwd->pw_shell && *pwd->pw_shell)
55: shell = pwd->pw_shell;
56: homeis(pwd->pw_dir);
57: shellis(shell);
58: execl(shell, "su", 0);
59: printf("No shell\n");
60: exit(3);
61: }
62: badroot(gid,uid)
63: {
64: /*
65: if(gid!=10 || (uid > 15 && (uid!=40 && uid!=209 && uid!=203
66: && uid!=54 && uid!=245)))
67: return(1);
68: else
69: */
70: return(0);
71: }
72:
73: char **environ;
74:
75: homeis(hp)
76: char *hp;
77: {
78: register char *cp, *dp;
79: register char **ep = environ;
80: static char homebuf[128];
81:
82: while (dp = *ep++) {
83: for (cp = "HOME"; *cp == *dp && *cp; cp++, dp++)
84: continue;
85: if (*cp == 0 && (*dp == '=' || *dp == 0)) {
86: strcpy(homebuf, "HOME=");
87: strcat(homebuf, hp);
88: *--ep = homebuf;
89: return;
90: }
91: }
92: }
93:
94: shellis(sp)
95: char *sp;
96: {
97: register char *cp, *dp;
98: register char **ep = environ;
99: static char shellbuf[128];
100:
101: while (dp = *ep++) {
102: for (cp = "SHELL"; *cp == *dp && *cp; cp++, dp++)
103: continue;
104: if (*cp == 0 && (*dp == '=' || *dp == 0)) {
105: strcpy(shellbuf, "SHELL=");
106: strcat(shellbuf, sp);
107: *--ep = shellbuf;
108: return;
109: }
110: }
111: }
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.