glibc ld.so LD_AUDIT Local Privilege Escalation

This repository contains a single Metasploit module (Ruby file) that exploits a local privilege escalation vulnerability in the GNU C Library (glibc) dynamic linker (CVE-2010-3847 and CVE-2010-3856). The exploit abuses improper handling of the LD_AUDIT environment variable in setuid binaries, allowing an attacker to load arbitrary shared objects as root. The module checks for a vulnerable glibc version, the presence of a setuid executable (default: /bin/ping), and the existence of the libpcprofile.so library in a trusted path (commonly /lib). It uploads a malicious shared object and payload, manipulates file permissions, and executes the payload as root, providing full privilege escalation. The exploit is operational and tested on several Linux distributions. The code is structured as a standard Metasploit local exploit module, with options for specifying the SUID executable and writable directory. The main attack vector is local, requiring code execution on the target system. Key fingerprintable endpoints include the default SUID executable (/bin/ping), the writable directory (/tmp), the trusted library path (/lib), and the required libpcprofile.so shared object.