T1574.006_dynamic-linker-hijacking

T1574.006 Dynamic Linker Hijacking

Sub-technique of: T1574

High-Level Description

Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS. Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name. Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.

Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. On Linux, adversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. For example, adversaries have used LD_PRELOAD to inject a malicious library into every descendant process of the sshd daemon, resulting in execution under a legitimate process. When the executing sub-process calls the execve function, for example, the malicious library’s execve function is executed rather than the system function execve contained in the system library on disk. This allows adversaries to Hide Artifacts from detection, as hooking system functions such as execve and readdir enables malware to scrub its own artifacts from the results of commands such as ls, ldd, iptables, and dmesg.

Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges.

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)
• Defense Evasion (TA0005)

Platforms: Linux, macOS

What to Check

• Identify if Dynamic Linker Hijacking technique is applicable to target environment
• Check Linux systems for indicators of Dynamic Linker Hijacking
• Check macOS systems for indicators of Dynamic Linker Hijacking
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Shared Library Injection via /etc/ld.so.preload

This test adds a shared library to the ld.so.preload list to execute and intercept API calls. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the glibc package.

Upon successful execution, bash will echo ../bin/T1574.006.so to /etc/ld.so.preload.

Supported Platforms: linux Elevation Required: Yes

sudo sh -c 'echo #{path_to_shared_library} > /etc/ld.so.preload'

Dependencies:

• The shared library must exist on disk at specified location (#{path_to_shared_library})

Atomic Test 2: Shared Library Injection via LD_PRELOAD

This test injects a shared object library via the LD_PRELOAD environment variable to execute. This technique was used by threat actor Rocke during the exploitation of Linux web servers. This requires the glibc package.

Upon successful execution, bash will utilize LD_PRELOAD to load the shared object library /etc/ld.so.preload. Output will be via stdout.

Supported Platforms: linux

LD_PRELOAD=#{path_to_shared_library} ls

Dependencies:

• The shared library must exist on disk at specified location (#{path_to_shared_library})

Atomic Test 3: Dylib Injection via DYLD_INSERT_LIBRARIES

injects a dylib that opens calculator via env variable

Supported Platforms: macos

DYLD_INSERT_LIBRARIES=#{dylib_file} #{file_to_inject}

Dependencies:

• Compile the dylib from (#{source_file}). Destination is #{dylib_file}

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Dynamic Linker Hijacking by examining the target platforms (Linux, macOS).

2. Assess Existing Defenses: Review whether mitigations for T1574.006 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1028 Operating System Configuration

When System Integrity Protection (SIP) is enabled in macOS, the aforementioned environment variables are ignored when executing protected binaries. Third-party applications can also leverage Apple’s Hardened Runtime, ensuring these environment variables are subject to imposed restrictions. Admins can add restrictions to applications by setting the setuid and/or setgid bits, use entitlements, or have a __RESTRICT segment in the Mach-O binary.

M1038 Execution Prevention

Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.

Detection

Detection Strategy for Hijack Execution Flow: Dynamic Linker Hijacking

Risk Assessment

CWE Categories

References

• Apple Doco Archive Dynamic Libraries
• Baeldung LD_PRELOAD
• TheEvilBit DYLD_INSERT_LIBRARIES
• Intezer Symbiote 2022
• Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass
• Man LD.SO
• Elastic Security Labs Pumakit 2024
• TLDP Shared Libraries
• Timac DYLD_INSERT_LIBRARIES
• ESET Ebury Oct 2017
• Atomic Red Team - T1574.006
• MITRE ATT&CK - T1574.006