There's like several thousand words of exposition about how they found the right sequence of opens and closes to set up a signal handler, groom the address space, set the stack executable (another dlopen side effect!), and trigger the signal.
But what makes it :art: is this bit:
"As a last and extreme example of a remote attack against ssh-agent forwarding, we noticed that one shared library's constructor function (which can be invoked by a remote attacker via an ssh-agent forwarding) starts a server thread that listens on a TCP port, and we discovered a remotely exploitable vulnerability (a heap-based buffer overflow) in his server's implementation.”