Local privilege escalation in glibc static privileged binary library loading

This repository is a proof-of-concept (PoC) exploit for CVE-2025-4802, a vulnerability in GNU C Library (glibc) versions 2.27 to 2.38. The vulnerability allows an attacker to control the LD_LIBRARY_PATH environment variable, causing a statically compiled setuid binary that calls dlopen (directly or indirectly) to load an attacker-supplied shared object. The repository contains three C source files: - `main.c`: The main PoC binary, simulating a setuid root program that loads a shared object (`myso.so`) using dlopen, sets its UID to root, and calls a function from the loaded shared object. - `evil_library/evilso.c`: The malicious shared object, which defines a `hello` function that prints a message and then executes `/bin/sh`, effectively spawning a root shell. - `myso.c`: A benign shared object for demonstration, with a `hello` function that prints a safe message. The exploit demonstrates how an attacker can use a malicious shared object to gain root shell access by exploiting the vulnerable loading mechanism. The attack vector is local, requiring the attacker to control the environment and execute the vulnerable binary. The main fingerprintable endpoints are the use of `/bin/sh` (for privilege escalation) and the loading of `myso.so` via dlopen. The repository is a functional PoC and does not use any exploit frameworks.