# T1574.006 - Hijack Execution Flow: LD_PRELOAD

## Description from ATT&CK

> Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as <code>LD_PRELOAD</code> on Linux or <code>DYLD_INSERT_LIBRARIES</code> on macOS.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.(Citation: Baeldung LD_PRELOAD)
> 
> Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. On Linux, adversaries may set <code>LD_PRELOAD</code> to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. For example, adversaries have used `LD_PRELOAD` to inject a malicious library into every descendant process of the `sshd` daemon, resulting in execution under a legitimate process. When the executing sub-process calls the `execve` function, for example, the malicious library’s `execve` function is executed rather than the system function `execve` contained in the system library on disk. This allows adversaries to [Hide Artifacts](https://attack.mitre.org/techniques/T1564) from detection, as hooking system functions such as `execve` and `readdir` enables malware to scrub its own artifacts from the results of commands such as `ls`, `ldd`, `iptables`, and `dmesg`.(Citation: ESET Ebury Oct 2017)(Citation: Intezer Symbiote 2022)(Citation: Elastic Security Labs Pumakit 2024)
> 
> Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges.

[Source](https://attack.mitre.org/techniques/T1574/006)

## Atomic Tests

- [Atomic Test #1: Shared Library Injection via /etc/ld.so.preload](#atomic-test-1-shared-library-injection-via-etcldsopreload)
- [Atomic Test #2: Shared Library Injection via LD_PRELOAD](#atomic-test-2-shared-library-injection-via-ld_preload)
- [Atomic Test #3: Dylib Injection via DYLD_INSERT_LIBRARIES](#atomic-test-3-dylib-injection-via-dyld_insert_libraries)

### Atomic Test #1: Shared Library Injection via /etc/ld.so.preload

This test adds a shared library to the `ld.so.preload` list to execute and intercept API calls. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the `glibc` package.

Upon successful execution, bash will echo `../bin/T1574.006.so` to /etc/ld.so.preload.

**Supported Platforms:** Linux

**auto_generated_guid:** `39cb0e67-dd0d-4b74-a74b-c072db7ae991`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| path_to_shared_library_source | Path to a shared library source code | path | PathToAtomicsFolder/T1574.006/src/Linux/T1574.006.c|
| path_to_shared_library | Path to a shared library object | path | /tmp/T1574006.so|

#### Attack Commands: Run with `bash`! Elevation Required (e.g. root or admin)

```bash
sudo sh -c 'echo #{path_to_shared_library} > /etc/ld.so.preload'
```

#### Cleanup Commands

```bash
sudo sed -i 's##{path_to_shared_library}##' /etc/ld.so.preload
```

#### Dependencies: Run with `bash`!

##### Description: The shared library must exist on disk at specified location (#{path_to_shared_library})

###### Check Prereq Commands

```bash
if [ -f #{path_to_shared_library} ]; then exit 0; else exit 1; fi;
```

###### Get Prereq Commands

```bash
gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source}
```

### Atomic Test #2: Shared Library Injection via LD_PRELOAD

This test injects a shared object library via the LD_PRELOAD environment variable to execute. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the `glibc` package.

Upon successful execution, bash will utilize LD_PRELOAD to load the shared object library `/etc/ld.so.preload`. Output will be via stdout.

**Supported Platforms:** Linux

**auto_generated_guid:** `bc219ff7-789f-4d51-9142-ecae3397deae`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| path_to_shared_library_source | Path to a shared library source code | path | PathToAtomicsFolder/T1574.006/src/Linux/T1574.006.c|
| path_to_shared_library | Path to a shared library object | path | /tmp/T1574006.so|

#### Attack Commands: Run with `bash`!

```bash
LD_PRELOAD=#{path_to_shared_library} ls
```


#### Dependencies: Run with `bash`!

##### Description: The shared library must exist on disk at specified location (#{path_to_shared_library})

###### Check Prereq Commands

```bash
if [ -f #{path_to_shared_library} ]; then exit 0; else exit 1; fi;
```

###### Get Prereq Commands

```bash
gcc -shared -fPIC -o #{path_to_shared_library} #{path_to_shared_library_source}
```

### Atomic Test #3: Dylib Injection via DYLD_INSERT_LIBRARIES

injects a dylib that opens calculator via env variable

**Supported Platforms:** macOS

**auto_generated_guid:** `4d66029d-7355-43fd-93a4-b63ba92ea1be`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| file_to_inject | Path of executable to be injected. Mostly works on non-apple default apps. | path | /Applications/Firefox.app/Contents/MacOS/firefox|
| source_file | Path of c source file | path | PathToAtomicsFolder/T1574.006/src/MacOS/T1574.006.c|
| dylib_file | Path of dylib file | path | /tmp/T1574006MOS.dylib|

#### Attack Commands: Run with `bash`!

```bash
DYLD_INSERT_LIBRARIES=#{dylib_file} #{file_to_inject}
```

#### Cleanup Commands

```bash
kill `pgrep Calculator`
kill `pgrep firefox`
```

#### Dependencies: Run with `bash`!

##### Description: Compile the dylib from (#{source_file}). Destination is #{dylib_file}

###### Check Prereq Commands

```bash
gcc -dynamiclib #{source_file} -o #{dylib_file}
```

###### Get Prereq Commands

```bash
gcc -dynamiclib #{source_file} -o #{dylib_file}
```