Dangerous
export LD_PRELOAD=/tmp/.helper.so && /usr/bin/idlinux · bash · Advanced
Forces a library from a world-writable directory to load ahead of the system libraries for the next process. Whoever controls that file controls what standard functions do, so the innocuous-looking id call becomes an execution vector.
Signals to notice
- LD_PRELOAD hijacks library resolution
- Library sourced from a world-writable directory
- Dot-hidden filename
Think you can spot these under time pressure?
Start Training