Control a privileged program's shared-library resolution

Needs: Actual privileged load from a controlled location, matching ABI/name and required symbols, plus a trigger

Shell commands

# Baseline
file /PATH/TO/BINARY
readelf -d /PATH/TO/BINARY 2>/dev/null | grep -E 'RPATH|RUNPATH|NEEDED'
ldd /PATH/TO/BINARY 2>/dev/null

# Baseline
grep -nE '^(import|from) |require\(|include|source |\. ' /PATH/TO/SCRIPT
/PATH/TO/python3 -c 'import sys; print("\n".join(sys.path))'

Prove the privileged interpreter uses the writable module/include before changing it. The interactive interpreter's search path may differ from cron/systemd/sudo.

Verify → Prove the selected library path and effective execution identity; retain dependency and trigger evidence.

If it fails → Static linking, secure-loader sanitization, a different selected library or missing symbols breaks the route. More detail ↓

If → then

A sudo rule explicitly preserves or permits a loader variable → Load a controlled library through a permitted sudo environment
Needs: Allowed variable setting/preservation, a dynamically linked permitted executable and a loader path that honors it
A new Linux foothold or an identity/privilege change → Establish Linux state and choose an escalation candidate
Needs: A working command channel and accurate effective identity, group, mount and process context
An existing C/C++ or platform-specific PoC matches the candidate → Compile and minimally adapt an existing native or memory-corruption PoC
Needs: Correct compiler/target architecture, runtime dependencies, documented payload constraints and validated exploit-specific constants

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Control a privileged program's shared-library resolution

USE WHEN: A privileged executable has an unsafe library dependency, RPATH/RUNPATH or plugin path
STARTING ACCESS: A verified Linux foothold with a known effective UID, groups and filesystem context
RESULT: Verified privileged initialization or behavior of a controlled shared object

Recognize the clue

Inspect the reviewed privileged executable's dependencies/search paths and permission-check the actual selected library directory.

readelf -d /PATH/TO/BINARY
namei -l /PATH/TO/LIBRARY_DIRECTORY

SYNTHETIC EXAMPLE OUTPUT

NEEDED: libAPP.so
RUNPATH: /CONTROLLED_LIBRARY_DIRECTORY

Means: A named dependency plus a potentially controlled search location is a loader-resolution candidate.

Confirm: Verify actual runtime selection, ABI/symbols, secure-execution rules, retained privilege and a trigger.

After validation: The higher-identity process actually loads the controlled compatible library: select that chain.
Ruled out in this context: A protected earlier library or secure-loader behavior prevents selection: reject the assumed path.
Still inconclusive: Static dependency output alone leaves actual privileged resolution unknown.

Troubleshooting: Static linking, secure-loader sanitization, a different selected library or missing symbols breaks the route.

Additional prerequisite checks

readelf -d /PATH/TO/BINARY
namei -l /PATH/TO/LIBRARY_DIRECTORY
file /PATH/TO/BINARY

Need a privileged dynamically linked consumer plus a missing/selected library resolved from a writable location or a preserved loader variable. Secure-execution mode strips many loader variables from SUID/SGID programs. Prefer readelf over executing an untrusted file through an unsafe ldd implementation.

For root-run scripts, inspect imports/includes and their actual search order. A writable current directory, module path or imported file can be a privileged input even when the main script is protected:

Prove the privileged interpreter uses the writable module/include before changing it. The interactive interpreter's search path may differ from cron/systemd/sudo.

Why it works

The dynamic loader resolves dependencies using context-specific rules. A writable directory is irrelevant if secure execution or an earlier trusted resolution prevents loading from it.

Worked example · hypothetical

Observation: a custom privileged binary references a library in a writable search location. Test: confirm resolution and ABI, then trigger a minimal controlled effect. Illustrative output: library initialization runs under the higher identity. Interpretation: the library-consumption chain is verified.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗