Binecdaeuxspeothinetsvi(l0la.5g8e1rsvsw. h0o.52re6c)a, lalned ahcatdivtiwtyo-rmelaotreedytehaerms oesf fwoermreaolnedavuecraatigoensl(i9g.h9tvlys.w7e.8alytheiaerrs,)b, yco0n.0t5e5ntw-realalthedinidnedxirpecotinetxsp(o0.s5u8r1e vasl.so0.5a2p6p)e, arneddhtaodhtawvoe mbeoer...
{E7s@BBFW4C;X1H1d+&c?74x<%o*FZf5DP5m1U?j8=rrvNP_?Xbb z%~RWw3oLuF b7+IdHX4m5ziT#xrG=cTi2;+j`W-_`lI>*-=$~>szyCKm`wESeEk6 zC8W{jIU0uRu?pu?`=LNqi|axzHyjnLNYbk;Pp^OJ7bz=mMI|kTC>4E=LU*?#)ar9M z07q9SBsfR57bEOW<9Blz1M+t|N0XDg7hc!MI3_JW) Sj a8#l{`1^qdS(...
- the RDI register (the first argument of the function pointer that we overwrote, and hence the command argument of system()) points to the PROCTAB structure, whose contents we control; - we do not need to worry about the privilege dropping of /bin/sh, because w is not a set-user-...