Escalation via shared object injection

In the previous section, Searching for SUID binaries, we identified the SUID binaries on the target system with linPEAS. However, in addition to listing the SUID binaries, linPEAS also performed additional vulnerability checks on the SUID binaries to determine whether they can be exploited.

Analyzing the linPEAS results closely reveals that linPEAS executes and checks the binaries with the strace utility to identify the shared objects utilized by the binary.

Note

strace is a Linux utility that is used to monitor and debug applications and processes and their interaction with the Linux kernel.

linPEAS runs each SUID binary with strace to identify the shared objects that are used by the binary and lists their respective locations, as highlighted in the following screenshot:

Figure 13.13 – linPEAS shared objects

As highlighted in the preceding screenshot, we can identify the suid-so binary as a potential...