← Learn
Dangerous
export LD_PRELOAD=/tmp/.helper.so && /usr/bin/id

linux · bash · Advanced

Forces a library from a world-writable directory to load ahead of the system libraries for the next process. Whoever controls that file controls what standard functions do, so the innocuous-looking id call becomes an execution vector.

Signals to notice

  • LD_PRELOAD hijacks library resolution
  • Library sourced from a world-writable directory
  • Dot-hidden filename

Think you can spot these under time pressure?

Start Training

More Process Execution