Local Privilege Escalation in glibc ld.so via LD_AUDIT $ORIGIN Handling

This repository contains a single Metasploit module (Ruby file) that exploits a local privilege escalation vulnerability in the GNU C Library (glibc) dynamic linker (CVE-2010-3847 and CVE-2010-3856). The exploit abuses improper handling of the LD_AUDIT environment variable in setuid binaries, allowing an attacker to load arbitrary shared objects as root. The module checks for a vulnerable glibc version, the presence of a setuid executable (default: /bin/ping), and the existence of the libpcprofile.so library in a trusted path (commonly /lib). It uploads a malicious shared object and payload, manipulates file permissions, and executes the payload as root, providing full privilege escalation. The exploit is operational and tested on several Linux distributions. The code is structured as a standard Metasploit local exploit module, with options for specifying the SUID executable and writable directory. The main attack vector is local, requiring code execution on the target system. Key fingerprintable endpoints include the default SUID executable (/bin/ping), the writable directory (/tmp), the trusted library path (/lib), and the required libpcprofile.so shared object.

This repository contains a single Metasploit module: 'glibc '$ORIGIN' Expansion Privilege Escalation'. The module exploits a local privilege escalation vulnerability (CVE-2010-3847) in the GNU C Library (glibc) dynamic linker on Linux systems. The exploit abuses the LD_AUDIT environment variable and the $ORIGIN expansion to execute arbitrary shared objects as root via a setuid binary. The module requires a readable setuid executable (default: /bin/ping) and a writable directory (default: /tmp) on the same filesystem partition. The exploit uploads a custom shared object and payload, manipulates file descriptors and hard links, and triggers the vulnerability to execute the payload as root. The module is operational and provides root access if successful. The code is written in Ruby and is designed to be used within the Metasploit framework.