4 ms·

There's a claim upthread that a straightforward variation works against /etc/passwd.

• q3k 5mo ago
  You can also just use this to patch libc and turn close() into close-but-also-give-me-a-root-shell().