LD_PRELOAD privilege escalation

The dynamic loader finds and loads executables and shared libraries when a program is run . By default, such shared libraries are in /lib and /usr/lib. The file /etc/ld. so. conf can be used to specifiy additional search paths.

etc/ld.so.preload File containing a whitespace-separated list of ELF shared objects to be loaded before the program . See the discussion of LD_PRELOAD above. If both LD_PRELOAD and /etc/ld.so.preload are employed, the libraries specified by LD_PRELOAD are preloaded first. /27 Ağu 2021

From the cache file /etc/ld. so. cache, which contains a compiled list of candidate shared objects previously found in the augmented library path . If, however, the binary was linked with the -z nodeflib linker option, shared objects in the default paths are skipped.

LD_LIBRARY_PATH is the default library path which is accessed to check for available dynamic and shared libraries . It is specific to linux distributions. It is similar to environment variable PATH in windows that linker checks for possible implementations during linking time.

1 Answer. LD_PRELOAD is an environment variable (part of the “environment” defined by the C library and Unix conventions ). That specific variable tells the dynamic linker how to behave.

ld.so does an actual open and mmap of all needed ELF files, both ELF file of your program and ELF files of all neeeded libraries. Also, it fills GOT and PLT tables and does relocations resolving (it writes addresses of functions from libraries to call sites, in many cases with indirect calls).

The LD_PRELOAD trick is a useful technique to influence the linkage of shared libraries and the resolution of symbols (functions) at runtime .9 Ağu 2020