Re: Exploiting Zolaris 2.4 ?? :)

[leif () netscape com (Leif Hedstrom)]

> David DeSimone writes:
> Even if a program can dump core into a writable directory, that is not
> the same thing as being able to overwrite a file.  If you make a symlink
> core -> /etc/passwd, the dump will only succeed if /etc/passwd is also
> writable by the setgid group.  If that's the case, then you are in

How about (as proposed in the first posting) creating /usr/sbin/rtc? Or,
if you have some patience, create a file in /etc/rc2.d (for instance)?

-- Leif