CVE-2004-1054

This exploit leverages a PATH environment variable manipulation vulnerability in invscout to execute arbitrary commands as root. It creates a malicious 'uname' script in /tmp that copies and sets the SUID bit on /usr/bin/ksh, then executes it via the vulnerable binary.

This exploit leverages a directory traversal vulnerability in the `lsmcode` utility to execute arbitrary commands as root. It creates a malicious `Dctrl` script in `/tmp/aap/bin/` that copies `/bin/sh` to `/tmp/.shh` and sets the SUID bit, granting root privileges.