bofh wrote: > I don't get what you're talking about. If you overwrite the file > (vulnerable sshd) with a new one, the file gets replaced. > All the hardlinks > would point to the new file.
Copying to a file can be done in two distinct ways with different results for any other hard links to same file. cp overwrites the original inode install unlinks the original inode (after?) writing a new inode You probably get some "interesting" effects if it takes a long time to overwrite the executable file and that file is executed as it is being (partially) re-written.
