Difference between revisions of "LD Preload"

Revision as of 19:59, 18 October 2011

Introduction

LD_PRELOAD in simplest terms is a way to "preload" a shared library. It's an option you pass to ld either using a config file or environment variable. It will be called, and overrides LIBC:LD_PRELOAD=./yourso.so some_command.It has to be an absolute path, you cannot do: LD_PRELOAD=yourso.so Unless it is in your ld path.

LD preload is built for runtime linking. It allows things like gcc, etc to link code and binaries against an object, shared object, or executable file. To keep it short & sweet, "printf()", is a part of LibC or glibc. libc.so.#.#.#, has the printf() function built-in, it also has an export table which contains addresses.

Shared libraries are libraries shared between multiple executables. They are linked dynamically at runtime instead of statically during compilation. For function names, a shared library lets multiple programs access the same function address instead of loading multiple instances of the same function into memory. This is done primarily for system performance as redundant copies of a function would unnecessarily consume system resources. LD_PRELOAD allows you to tell the runtime linker to load the specified shared library "first" giving it precedence over every other library.

LD_PRELOAD use is generally innocuous; tsocks and checkinstall use it among many other programs. However, it can easily be abused. There is a config file that usually lives in, "/etc/ld.so.preload", which will globally preload the contents. It contains the paths to shared libraries to preload. As a result, the entire userland, save statically compiled applications (rare), will use your overrided functions.The function address is stored in either a DWORD or a QWORD (depending on CPU arch and ram accessibility) and can be extracted from the export table using the function dlsym() .

There are a few other nasty things you can do, hooking ssh, hooking gpg, anywhere a user would enter sensitive information. You can preload functions like strcpy() etc, dump to files and you can retrieve the information later. It's just a matter of cracking open the target application and finding what calls are made on the sensitive data.

Simple Practical Example

If you have a program that asks for a users password then hashes it and compares it to a stored value. Lets say it calls: <syntaxhighlight lang="c">strcpy(password, user_input);</syntaxhighlight>

You hook strcpy so you'd grab the definition of strcpy:<syntaxhighlight lang="c">char *stpcpy(char *s1, const char *s2);</syntaxhighlight>

Notice strcpy() is defined as: <syntaxhighlight lang="c"> char *strcpy()</syntaxhighlight> as opposed to <syntaxhighlight lang="c">char strcpy()</syntaxhighlight> Strcpy is a pointer, and because of this, we can hook and override it.

Open up the man page and copy the function definition then add code to write the second argument to a file. So the preloaded library now contains:

<syntaxhighlight lang="c">char *stpcpy(char *s1, const char *s2){ FILE *fp = fopen(your_evil_filepath, 'a'); fpritnf(fp, "%s\n", s2); fclose(fp); }</syntaxhighlight>

Now, there is an obvious problem with this, strcpy doesn't work anymore and all the things that use it will break. So, what you have to do is either call the original, working version of strcpy or implement your own, since strcpy is simple. The former is preferable in most cases as it usually requires less code than rewriting the entire function. Unfortunately, calling the overridden function from within the preloaded library will not work. In order to call the original function, a new function that points to the original function must be declared. Fortunately, this is simple to do.

For strcpy, the function pointer prototype is: <syntaxhighlight lang="c">char *(*strcpy)(char *dest, const char *src);</syntaxhighlight>

Notice that because this is a function pointer there are two *. Also notice that the prototype matches strcpy's prototype. Now the function pointer must point to the original function. To do this, use the ld library function dlsym. Which is defined as: <syntaxhighlight lang="c">void *dlsym(void *handle, const char *symbol);</syntaxhighlight> The handle is the name of the library containing the original function; the symbol is the name of the function. There are two special pseudo-handles, RTLD_DEFAULT and RTLD_NEXT. The former will find the first occurrence of the desired symbol using the default library search order. The latter will find the next occurrence of a function in the search order after the current library. This allows one to provide a wrapper around a function in another shared library.

So to obtain a copy of strcpy that will persist after strcpy is overridden:

<syntaxhighlight lang="c">char *(*old_strcpy)(char *dest, const char *src); old_strcpy = dlsym(RTLD_NEXT, "strcpy");</syntaxhighlight>

Now the strcpy in the preloaded library looks like: <syntaxhighlight lang="c">char *stpcpy(char *s1, const char *s2){ FILE *fp = fopen(your_evil_filepath, 'a'); fpritnf(fp, "%s\n", s2); fclose(fp); return old_strcpy(s1, s2); }</syntaxhighlight>

It will now appear to behave normally.

Implementations

Jynx Rootkit