Well , like I said, I am using it for security reasons. Now this would have been probably possible a few years ago. Does anyone know any workaround ? Or does anyone have any idea how modern exploits launch a rootshell ?

I don't think it's a comon or very effective technique to target existing bash sessions and then change uid.

What you want to do, IIRC, is to look for processes running as root. When these are found, you look for a buffer vulnerability which will allow you to run arbitrary code, which will naturally be run as root since the parent process is root.

Substitute arbitrary process for bash and you've got your root shell.

-- Panem et *burp* circenses

That's exactly what I am saying, but the process substituted in the string doesn't want to run setuid ;)

SLOWLY. :)

setuid is not a part of the game.

-- Panem et *burp* circenses

Yo, I probably just didn't quite explain myself in my message. The program I am trying to exploit is setuid. Now if the shell code points to executing bash,sh or tcsh it runs as the normal user (the one running the exploit, and not the vulnerable application which is setuid). Nevertheless, spawning a ksh works just fine. But what if the system doesn't have a ksh ?