I learnt this trick from OpenBSD 2.5 (yes, a long time ago). I still remember getting root with a shell-script mp3 player that a friend coded because of this.

I learnt this trick from OpenBSD 2.5 (yes, a long time ago). I still remember getting root with a shell-script mp3 player that a friend coded because of this. The exploit was based in inserting some \$\( make_a_new_root_account_in_etcpassw \) inside the variable inside the test. As a result, both my friend and I stopped writing shell scripts as CGI and started learning perl just to do it.