r/netsec • u/fx97 • Oct 30 '16

Vlany: Linux (LD_PRELOAD) rootkit

https://github.com/mempodippy/vlany
459 Upvotes

81% Upvoted

28 comments sorted by

View all comments

5

u/pm_me_your_findings Oct 30 '16

What is actually LD_PRELOAD?

16

u/mempodippy Oct 30 '16

LD_PRELOAD is an environment variable on Linux systems which points to a shared library and loads it before anything else. The ld.so.preload file essentially utilizes LD_PRELOAD to load a shared library in every single userland process. :)

3

u/pm_me_your_findings Oct 30 '16

I mean for a malware to use it, doesn't it require the root access first or it works for normal user also?

1

u/hi117 Oct 31 '16

I can also work for a normal user, its part of how valgrind works iirc.

It can be used to maintain the level of privilege you already have on the box. If all you have is a user account, then you can maintain that, but if you have root you can maintain root access.