Day 18: The Danger of Wildcards (*) & Library Injection 🕵️‍♂️

🛠️ The "Option Injection" Breakdown 1. When Filenames become Commands When a script runs rsync -av * /backup/ , the shell expands the * into a list of all files in the directory. If an attacker creates a file named -e , rsync interprets it as an option , not a file. The Exploit: Using -e or --checkpoint-action to force the program to execute a malicious script as root. The Fix: Never use naked wildcards in root scripts. Always use absolute paths or the -- separator to signal the end of command options. 2. Hijacking the Dynamic Linker ( LD_PRELOAD ) I practiced forcing a program to load a malicious .so (shared object) file before its legitimate libraries. By defining a void _init() function in C, I can execute code the moment the library is loaded. // root.c void _init () { setuid ( 0 ); system ( "/bin/bash" ); } Execution: sudo LD_PRELOAD=/tmp/root.so 3. Library Search Order Understanding how the loader finds libraries is key to Shared Library Hijacking. The typical order is: RPATH / R