srl
Miscellaneous Techniques
Techniques in this file do not fit neatly into SUID, sudo, or cron. They are grouped by what you control — a library path, an export, a socket, an environment variable, or a file permission — because that is how you will find them during enumeration.
1. Shared Object Hijacking — RUNPATH / RPATH / $ORIGIN A binary that uses a custom library can be enumerated with:
ldd /path/to/program readelf -d /path/to/program | grep -E 'RPATH|RUNPATH|NEEDED' RUNPATH and RPATH are baked into the binary and are searched before the default library paths. Unlike LD_LIBRARY_PATH, they are honoured for SUID binaries, which is what makes a writable RUNPATH directory a reliable escalation.