ltrace - Privilege Escalation

ID: privesc-ltrace

Severity: high

Author: daffainfo

Tags: code,linux,ltrace,privesc,local

Description

ltrace is a debugging utility in Linux that is used to intercept and record dynamic library calls made by a process. It can be used to trace the library calls made by a program, which is helpful for debugging and understanding its behavior.

YAML Source

id: privesc-ltrace

info:
  name: ltrace - Privilege Escalation
  author: daffainfo
  severity: high
  description: |
    ltrace is a debugging utility in Linux that is used to intercept and record dynamic library calls made by a process. It can be used to trace the library calls made by a program, which is helpful for debugging and understanding its behavior.
  reference:
    - https://gtfobins.github.io/gtfobins/ltrace/
  metadata:
    verified: true
    max-request: 3
  tags: code,linux,ltrace,privesc,local

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      whoami

  - engine:
      - sh
      - bash
    source: |
      ltrace -b -L whoami

  - engine:
      - sh
      - bash
    source: |
      sudo ltrace -b -L whoami

    matchers-condition: and
    matchers:
      - type: word
        part: code_1_response
        words:
          - "root"
        negative: true

      - type: dsl
        dsl:
          - 'contains(code_2_response, "root")'
          - 'contains(code_3_response, "root")'
        condition: or
# digest: 4a0a00473045022077922ad21616e3942ba716a7c2bd2c9f3c6f483be29af7f0b76110b3955dd7e7022100b599bf979ea509d5ac2ad3fe5f7c42da158fbd094da97ff1a9c532ad116aefd6:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "code/privilege-escalation/linux/binary/privesc-ltrace.yaml"

View on Github