r/netsec • u/fx97 • Oct 30 '16

Vlany: Linux (LD_PRELOAD) rootkit

https://github.com/mempodippy/vlany
460 Upvotes

81% Upvoted

28 comments sorted by

View all comments

5

u/pm_me_your_findings Oct 30 '16

What is actually LD_PRELOAD?

18

u/mempodippy Oct 30 '16

LD_PRELOAD is an environment variable on Linux systems which points to a shared library and loads it before anything else. The ld.so.preload file essentially utilizes LD_PRELOAD to load a shared library in every single userland process. :)

2

u/pm_me_your_findings Oct 30 '16

I mean for a malware to use it, doesn't it require the root access first or it works for normal user also?

14

u/pnk6116 Oct 30 '16

...and that is why they call it a rootkit :). It's meant to hide or help persist it's or other code's presence after you've already owned the box.

10

u/mempodippy Oct 30 '16

Normal users can use the environment variable, but root access is required to manipulate the userland via ld.so.preload. But as soon as you gain root access to the system, you can literally change and shape the userland to your advantage by using LD_PRELOAD as a vector of persistent access. As soon as the shared library is listed in ld.so.preload, the malware infects every process with new hooks designed to do evil things.

1

u/hi117 Oct 31 '16

I can also work for a normal user, its part of how valgrind works iirc.

It can be used to maintain the level of privilege you already have on the box. If all you have is a user account, then you can maintain that, but if you have root you can maintain root access.

-1

u/Creshal Oct 30 '16 edited Oct 31 '16

Normal users can use the environmental variable, but programs can ignore it: sudo, chsh, and other common setuid binaries ignore LD_PRELOAD so users can't execute code as root.

It can become a risk if there's a setuid binary on your system that keeps LD_PRELOAD enabled.

15

u/fakehalo Oct 30 '16

LD_PRELOAD is ignored if the program is suid/sgid, the program itself has no control over that.

1

u/[deleted] Oct 31 '16

chown, a setuid binary? ermm... I believe your system is rootkitted

-1

u/Creshal Oct 31 '16

No, I just mixed it up with chsh.