Given a binary and looking to abuse LD_PRELOAD (privilege escalation or persistence), what's a good way to list what functions can be hijacked when running the binary? Are there functions that should (almost) always be good hijacking candidates?

  • The readelf command can dump the linker tables, which includes both the functions exported by the ELF file as well as the imported functions. The latter can be hooked. Functions from glibc are good candidates.
    – amon
    Jul 31 at 7:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.