spoof_homedir.c


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

#define _GNU_SOURCE
#include <dlfcn.h>
#include <pwd.h>
#include <sys/types.h>

/* shared library that replaces the home directory for root in a `getpwuid()` call
 * with a specific location
 *
 * inspired by https://rafalcieslak.wordpress.com/2013/04/02/dynamic-linker-tricks-using-ld_preload-to-cheat-inject-features-and-investigate-programs/
 *
 * Usage:
 * gcc -shared -fPIC -D 'FAKE_HOME="/path/to/fake/directory"' spoof_homedir.c -o spoof_homedir.so -ldl
 * LD_PRELOAD="./spoof_homedir.so" binary_to_spoof
 */

typedef struct passwd *(*orig_getpwuid_f_type)(uid_t uid);

struct passwd *getpwuid(uid_t uid) {
	orig_getpwuid_f_type orig_getpwuid;
	orig_getpwuid = (orig_getpwuid_f_type)dlsym(RTLD_NEXT, "getpwuid");

	struct passwd *result = orig_getpwuid(uid);
	if (uid == 0) {
		result->pw_dir = FAKE_HOME;
	}

	return result;
}