CVE-2004-0360

This exploit leverages a local privilege escalation vulnerability in Solaris 8/9's passwd command (CVE-2004-0360) using a ret-into-ld.so technique to bypass non-executable stack protections. It crafts a malicious environment variable and buffer to overwrite the return address, executing shellcode to gain root privileges.