visitor@r00t:~$ uname -a ; id
SunOS r00t 5.7 Generic_106541-08 sun4u sparc SUNW,Ultra-5_10
uid=500(visitor) gid=10(staff)
visitor@r00t:~$ ls -l /usr/bin/fdformat
-rwsr-xr-x   1 root     bin         91296 Oct  6  1998 /usr/bin/fdformat
visitor@r00t:~$ cc -o ex ex.c
visitor@r00t:~$ ./ex 1264
[*] target   : /usr/bin/fdformat (setuid root, sun4u/sparc)
[*] ret addr : 0xffbef8a4   sp: 0xffbeff88   offset: 1264
[*] shellcode: \x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff\x90\x03\xe0\x20
[*] egg      : 600 x 0x01000000 (sparc nop) + 72 bytes shellcode
[*] smashing : 1300 bytes past 1024-byte buffer + saved %i7 ...
[+] r00t! euid=0 — spawning /bin/sh ...
# id
uid=0(root) gid=0(root)
# cd /var/www/pictures/archive
# ls -al
total 784640
drwxr-xr-x@ 29 root  root        928 Jun 10 08:42 .
drwxr-xr-x@ 19 root  root        608 Jun 10 08:48 ..
drwxr-xr-x@ 19 root  root        608 Aug 23  1997 L0phtParty97
drwxr-xr-x@ 10 root  root        320 Jul  9  1993 defcon
drwxr-xr-x@ 66 root  root       2112 Oct 15  1997 feh
drwxr-xr-x@  4 root  root        128 Jul 10  2004 grillathon
drwxr-xr-x@  4 root  root        128 Dec 27  1994 hohocon
drwxr-xr-x@  5 root  root        160 Aug  8  1997 hope
drwxr-xr-x@  4 root  root        128 Jun  1  1996 newhackcity
-rw-r--r--@  1 root  root  401705969 Mar  1 18:58 parmaster-memorial-chat.mp4
-rw-------@  1 root  root       7491 Jan 18 07:48 posse.rolodex
drwxr-xr-x@  4 root  root        128 Nov  1  1997 pumpcon
drwxr-xr-x@ 47 root  root       1504 Aug 10  1996 r00t1996
drwxr-xr-x@ 16 root  root        512 Jul 28  2017 r00t2017
drwxr-xr-x@ 31 root  root        992 Aug  9  2018 r00t2018
drwxr-xr-x@ 90 root  root       2880 Aug  8  2019 r00t2019
drwxr-xr-x@ 10 root  root        320 Mar  7  2019 r00t2019a
drwxr-xr-x@  4 root  root        128 Aug  8  2020 r00t2020
drwxr-xr-x@ 15 root  root        480 Aug  7  2021 r00t2021
drwxr-xr-x  14 root  root        448 Aug 12  2022 r00t2022
drwxr-xr-x  21 root  root        672 Aug 11  2023 r00t2023
drwxr-xr-x  17 root  root        544 Aug  9  2024 r00t2024
drwxr-xr-x  16 root  root        512 Aug  8  2025 r00t2025
drwxr-xr-x@  8 root  root        256 Jun  5  1992 summercon
# █