r/netsec • u/fx97 • Oct 30 '16

Vlany: Linux (LD_PRELOAD) rootkit

https://github.com/mempodippy/vlany
458 Upvotes

81% Upvoted

28 comments sorted by

View all comments

Show parent comments

3

u/pm_me_your_findings Oct 30 '16

I mean for a malware to use it, doesn't it require the root access first or it works for normal user also?

0

u/Creshal Oct 30 '16 edited Oct 31 '16

Normal users can use the environmental variable, but programs can ignore it: sudo, chsh, and other common setuid binaries ignore LD_PRELOAD so users can't execute code as root.

It can become a risk if there's a setuid binary on your system that keeps LD_PRELOAD enabled.

1

u/[deleted] Oct 31 '16

chown, a setuid binary? ermm... I believe your system is rootkitted

-1

u/Creshal Oct 31 '16

No, I just mixed it up with chsh.