back to labs
Persistence: Rip Out the LD_PRELOAD Rootkit
MediumPersistence Hunting15 minThe brief
Every new process on this box is being hooked by a userland rootkit: /etc/ld.so.preload force-loads an attacker-planted library into everything that starts. Eradicate it — clear the preload registration AND delete the malicious library it points to.
cat /etc/ld.so.preload
Grading checks /etc/ld.so.preload no longer references the rootkit (it should be empty or gone) and the library file is deleted.
What you'll do
- Remove the rootkit's entry from /etc/ld.so.preload
- Delete the malicious preloaded library
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.