2

I understand the LD_preload trick, but in this tutorial(https://www.hackingarticles.in/linux-privilege-escalation-using-ld_preload/), they not only give the user the right to keep this environment variable, but also to run one command (find).

My question : isn't this step (allowing the user to run find) useless since there is always some suid binaries that run as euid0 for all users, so the attacker can LD_preload on these ?

2 Answers 2

0

This is by default disabled in linux for SUID or SGID binaries because of security concern. While executing SUID or SGID bit set binaries, both the LD_PRELOAD and LD_LIBRARY_PATH environmental variables get ignored. That's why we can't do the same trick here!

1
  • The link the OP referred to does not employ a suid binary. It assumes you have sudo access to a non-privileged binary and details how to get a shell out of that program using LD_PRELOAD.
    – doneal24
    Oct 31, 2022 at 13:25
0

The key point is to understand when does LD_PRELOAD kick in. It has to be when you are already in a privileged state (i.e. executing commands as root) so that the code inside shell.so will be executed while you are in that state (as root).

So in this case, if you execute e.g.

user@host$ LD_PRELOAD=/path/to/shell.so sudo find

(sudo being a SUID binary), you'll end up with a new shell but with user privileges. This is because LD_PRELOAD kicked in just before sudo was executed, at the time when you were just a user.

If, however, you execute:

user@host$ sudo LD_PRELOAD=/path/to/shell.so <any command>

then LD_PRELOAD kicks in just before <any command> is executed, but by that time you already have admin level privileges, given by the sudo command.

So, to answer your question, the command find here does not play a specific role to the privilege escalation per se; you can use any command you want. The crucial point is to get to admin level before LD_PRELOAD plays its part.

Another question that may arise by the discussion is that since you are already in admin level, why would you want to go through all this trouble in order to get a shell? Well, this technique applies to the cases that you are restricted as to which commands you can execute with elevated privileges. In the specific example you gave, it is supposed that you can only execute find as root. But if, for example, your sudoers file had something like this:

%sudo ALL=(ALL:ALL) NOPASSWOD: ALL

and you are in the sudo group, then you are practically an admin and you don't have to resort to privilege escalation to become one.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .