How Shared Libraries Work on Linux
Perhaps not surprisingly, programs on Linux are structured in a different format
than what is used on Windows systems.
The most commonly used program format in Linux is
Executable and Linkable Format.
Windows on the other hand uses Portable Executable format.
A deep explanation of these formats is beyond the scope of this course.
For now, it’s enough to know that program formats differ
between Linux and Windows systems.
Programs on these two systems do have some things in common.
In particular, they are similar in how they share code
with other applications.
On Windows, this shared code is most commonly stored
in Dynamic-Link Library files.
Linux on the other hand uses Shared Libraries.
These libraries allow code to be defined separately from specific applications
and reused,
which means the libraries can be shared
between different applications on the system.
This is a benefit
in terms of storage space and reducing locations in code
where errors might occur.
It also provides a single place to update code
and affect multiple programs.
For this reason in particular,
it represents a valuable attack vector.
In short, a change to a shared library
can affect all programs that use it.
When an application runs on Linux, it checks for its required libraries
in a number of locations
in a specific order.
When it finds a copy of the library it needs,
it stops searching
and loads the module it finds.
The application searches for libraries in these locations,
following this order.
Because the locations and the order is known
we can potentially hijack or
place our own versions of shared libraries
places earlier in the chain
in order to control the application’s behavior.
First, let’s inspect the LD_LIBRARY_PATH variable
and how we can use it
to direct a program
to use a malicious version of a library
instead of the one originally intended.