简体   繁体   中英

overriding getuid with LD_PRELOAD not working directly, but works in gdb

I was solving a challenge from nebula exploit exercise( https://exploit-exercises.lains.space/nebula/level13/ ). Since the compiled binary is dynamically linked, I thought of writing my custom getuid() to return 1000 and set LD_PRELOAD=custom_getuid. This does not seem to work when I directly execute the binary, but I'm able to bypass the check by executing in gdb, ltrace,strace. gdb is able to load my custom getuid. Can anyone explain this behaviour please? Thanks!

find the output of two approaches here

I found the issue, LD_PRELOAD does not affect suid binaries. So my binary has suid set to flag13 user.

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM