CVE-1999-0828

This exploit leverages a buffer overflow in UnixWare 7.1's `pkgcat` to execute arbitrary code with `dacread` privileges, allowing unauthorized access to `/etc/shadow`. It generates shellcode to spawn a program that reads the shadow file.

The exploit demonstrates an information leakage vulnerability in SCO UnixWare 7.1's package utilities (e.g., pkgparam), which can read arbitrary files (e.g., /etc/shadow) due to improper Discretionary Access Controls (DAC) via /etc/security/tcb/privs.

This exploit leverages a buffer overflow in UnixWare 7.1's `pkginstall` to execute arbitrary code with `dacread` privileges, allowing unauthorized access to `/etc/shadow`. The shellcode spawns a helper program that reads the shadow file.