[SOLVED] LD_preload for using other versions of libc, isn't working in pwntools

LD_preload for using other versions of libc, isn't working in pwntools

I want to use other versions of library for my pwn study in pwntools, but EOF error occurred.

I tried to solve this issue , changed ubuntu versions 3 times (18.04 desktop -> 14.04 desktop -> 18.04.0 server), reinstall python and pwntools 4 times. currently, versions are ubuntu 18.04.0 server, Python 2.7.15rc1, pwntools 3.12.2

I tried using other versions library for my pwn study in pwntools. like this:

    p = process("./binary_name",env={"LD_PRELOAD" : "./libc_name"})

and tried also

    env = {"LD_PRELOAD": os.path.join(os.getcwd(), "libc_name")}
    p = process("./binary_name",env=env)

and excute python code, Error occurred I already set the permisson of libc to chmod 777, but result is same.

    [*] Process './aeiou' stopped with exit code -4 (SIGILL) (pid 77469)
    Traceback (most recent call last):
    File "ex4.py", line 6, in <module>
    p.sendlineafter(">>","3")
    File "/home/synod2/.local/lib/python2.7/site- packages/pwnlib/tubes/tube.py", line 747, in sendlineafter
    ~~~~~~~~~~~~~~
    EOFError

I dont know why EOF error occurred. but, because of 3 differents version ubuntu give the same error, I think I missed install something. but I don't know what I missed!

Solution

Maybe you should try it on Ubuntu 16.

Obviously your binary file is dynamic linked. So when the program need to call some libc function such as read. It will pass some information to the dynamic linker, then the linker will calculate the real address of the read function.

but functions in libc has a version attribute. So if you try to use LD_PRELOAD on Ubuntu 18.04. the dynamic linker would try to find sth like read_2_27 in you 2.23-version-libc which only have read_2_23. so your program would fail to execute.

UPDATE:

another solution is to tell the excutable file to use the correct version of ld.so

elf file has a segment(INTERP) in which save the path to the ld.so to use. you can just change it to the path to ld.so you want to use.

BTW, you can find many version of ld.so in the repository