Comment by Operyl

The current PoC in the public gets there via that method, and even then you don't need to call system() alone to cause hell on a host...