Rating:

Apparently, the intended solution was "umask 0", convince the setuid program to create /etc/ld.so.preload, then overwrite that file to load shared libraries of your choosing into all programs.

Of course, I totally missed this solution, and went for the pwn instead :)

Original writeup (https://ubcctf.github.io/2019/07/cybrics-construction/).