My first thought was pretty similar:

cp /bin/sh chmod.new

cat /bin/chmod > chmod.new

mv chmod.new /bin/chmod