PrivEsc with LD_PRELOAD

Why?

You need root access on a Linux host.

When?

You have write access to the file-system, can set environment variables for root, and root runs processes.

How?

1. Craft a C program with an init function registered with .init_array.
2. Compile the C program as an .so binary for the matching architecture.
3. Write the binary to the target host's filesystem.
4. Set the LD_PRELOAD environment variable.
5. Wait for or trigger the root process execution.

Example

#include <unistd.h>

void init(int argc, char **argv, char **envp) {
    // PrivEsc hook
}

__attribute__((section(".init_array"))) typeof(init) *__init = init;