Currently doing some vulnservers on Offensive Security's Proving Grounds Practice Labs. A vulnserver is a machine configured with vulnerabilities for testing/audit and research purposes.
I came across a machine that had a cronjob running /usr/sbin/ldconfig every 2 minutes and the machine also had an interesting SUID binary that when executed, outputs that it is missing a shared object library file. On the target host,
strace command is not installed, but instead, I used
ldd to test and analyze the said vulnerable SUID binary.
Once confirmed that the .so library file is missing, I thought of two ways to exploit such vulnerability. One worked, whereas the other did not. Both methods included compiling a .so file from a C source that will set uid to 0, and launch bash with privileges preserved
Possible Exploit Paths
Compiling the .so file in current working directory, and running the vulnerable SUID binary while setting
LD_LIBRARY_PATH=.(This method did not work)
Checking out /etc/ld.so.conf.d directory for the vulnerable binary configuration and see where it looks for its shared object library files. If I have access (and I do) I can compile the malicious .so file into the library path set forth by its configuration file inside
/etc/ls.so.conf.d/<binary>.conf. Wait until the cronjob runs, check with
lddagain and executing the SUID binary. (This worked)
- Why did the first method fail in escalating my privilege to root?
- Could it have worked if this was a different SUID binary; if this scenario is a binary dependent situation?
- From the OS point of view, what is the difference between the two methods of escalation, aside from the obvious that setting LD_LIBRARY_PATH while executing a command only affects the execution environment of the command and not subsequent executions (unless the variable is set again before execution)
MISC I understand that the cronjob itself was a BIG hint that the second method of exploitation is the intended way. However, I would like to know why the first (and somewhat easier) method did not work as intended?