Background
Currently doing some vulnservers on Offensive Security's Proving Grounds Practice Labs. A vulnserver is a machine configured with vulnerabilities for testing/audit and research purposes.
I came across a machine that had a cronjob running /usr/sbin/ldconfig every 2 minutes and the machine also had an interesting SUID binary that when executed, outputs that it is missing a shared object library file. On the target host, strace
command is not installed, but instead, I used ldd
to test and analyze the said vulnerable SUID binary.
Once confirmed that the .so library file is missing, I thought of two ways to exploit such vulnerability. One worked, whereas the other did not. Both methods included compiling a .so file from a C source that will set uid to 0, and launch bash with privileges preserved /bin/bash -p
.
Possible Exploit Paths
Compiling the .so file in current working directory, and running the vulnerable SUID binary while setting
LD_LIBRARY_PATH=.
(This method did not work)Checking out /etc/ld.so.conf.d directory for the vulnerable binary configuration and see where it looks for its shared object library files. If I have access (and I do) I can compile the malicious .so file into the library path set forth by its configuration file inside
/etc/ls.so.conf.d/<binary>.conf
. Wait until the cronjob runs, check withldd
again and executing the SUID binary. (This worked)
Questions
- Why did the first method fail in escalating my privilege to root?
- Could it have worked if this was a different SUID binary; if this scenario is a binary dependent situation?
- From the OS point of view, what is the difference between the two methods of escalation, aside from the obvious that setting LD_LIBRARY_PATH while executing a command only affects the execution environment of the command and not subsequent executions (unless the variable is set again before execution)
MISC I understand that the cronjob itself was a BIG hint that the second method of exploitation is the intended way. However, I would like to know why the first (and somewhat easier) method did not work as intended?