Exploiting SUID files with LD_PRELOAD and IFS

Question

I've been reading about IFS exploitation and LD_PRELOAD Privilege escalation by overriding functions. Although these are two completely different questions, I've decided to post them together and hope that isn't a problem. Though both of these are very old, I've been told that they can both still be used for privilege escalation and I would love to look into that. However, I've ran into some problems.

So, let's begin by making the SUID file, /tmp/suid.

#include <unistd.h>

int main() {
  system("/bin/date");
}

This calls /bin/date. The idea is that we can change the internal field separator and deceive the file into running something else with the privileges that it currently holds. This can be done (or can it?) by making a new file called bin contain the malicious code that the attacker put in a custom location. Then we change the $PATH variable and make it so that locations are first searched inside our custom path, where our malicious fake binary is located. Then by changing the internal field separator to '/', instead of running /bin/date the program will run /tmp/fakepath/bin with argument date, which can potentially trigger privilege escalation.

When I attempt the method described dankalia.com, it fails. /bin/date gets executed instead. If I just type bin date into the console the malicious binary does get started, but it doesn't when it's being invoked through /tmp/suid.

I thought that the vulnerability is patched and that it simply ignores the IFS variable, but then a post on stackoverflow got me interested. (C: IFS System() Vulnerability). Can anyone confirm to me if this works or not, and what I am doing wrong? Thanks.

As for the LD_PRELOAD, I'll keep it rather simple.

define _GNU_SOURCE
#include <stdio.h>

int puts(const char *str) {
  printf("lel");
}

Use the following command line to compile:

gcc –Wall –fPIC –shared –o puts.so puts.c –ldl

Then, override the function puts with preload tricks:

LD_PRELOAD=./puts.so ./vuln_program_that_uses_puts

This works quite well. However, when dealing with a SUID file and when we're talking about privilege escalation, this ain't happening. LD_PRELOAD doesn't work well with SUID files and for a good reason. I've been told that "you can get it to work but that it's hard". Ideas?

Thanks in advance, and sorry for the long questions.

Answer 1

I've been told that "you can get it to work but that it's hard". Ideas?

The operating system is wise to these sorts of tricks, and most are remediated now. Te general idea is setuid, sudo and friends don't use an unprivileged user's environment.

The following offers more reading:

• suid-binary vulnerabilities
• Breaking the links: Exploiting the linker

If all you want is a setuid binary to break into the system:

• shutdown the computer
• mount the hard drive
• rename ls (or other program like date)
• copy sudo to ls (or other program like date)
• unmount and reboot