Chkrootkit Local Privilege Escalation – Chkrootkit before 0.50 will run any executable file named /tmp/update as root, allowing a trivial privsec.

Chkrootkit before 0.50 will run any executable file named /tmp/update as root, allowing a trivial privsec. WfsDelay is set to 24h, since this is how often a chkrootkit scan is scheduled by default.

You can download it from the following link: https://packetstormsecurity.com/files/download/134484/chkrootkit.rb.txt

Source: https://packetstormsecurity.com/files/134484/Chkrootkit-Local-Privilege-Escalation.html