PATH hijacking is privilege escalation that exploits how Linux finds executables. When a privileged program (a SUID binary, a sudo-allowed command, or a root cron job) calls another command by name rather than by full path, the system searches the directories in the PATH variable in order. If an attacker can put a malicious binary of that name in a directory searched first, the privileged program runs the attacker’s code with its privileges. The fix is using absolute paths in privileged programs.
What PATH hijacking is
When you run cat, the shell looks through each directory in the PATH environment variable, in order, and runs the first cat it finds. That lookup is the weakness.
If a privileged program calls a command by name (for example a SUID binary that runs service or a script that calls ps), and the attacker controls a directory that PATH searches first, the attacker can plant a fake service or ps that runs as the privileged program’s user.
The abuse and payload
The attacker finds a privileged program that calls a binary by name, then hijacks the lookup:
- Identify a SUID binary or sudo command that runs another command relatively (inspect with
strings/ltrace). - Create a malicious binary named like the called command:
echo '/bin/bash -p' > /tmp/service && chmod +x /tmp/service - Put the attacker directory first in PATH and run the privileged program:
export PATH=/tmp:$PATHthen trigger it. - The privileged program finds
/tmp/servicefirst and runs the attacker’s shell as root.
Documented techniques shown for defenders.
How to defend
- Use absolute paths for every command inside SUID binaries, sudo-allowed scripts, and root cron jobs.
- Set a safe, fixed PATH in privileged scripts rather than inheriting the user’s.
- Use `secure_path` in sudoers so sudo ignores the user’s PATH.
- Avoid writable directories early in PATH, and never put
.(current directory) in PATH. - Review privileged programs for relative command calls.
References
- [1]MITRE ATT&CK: Privilege Escalation (TA0004)(MITRE)
- [2]NIST SP 800-115 Technical Guide to Security Testing(NIST)
- [3]Linux man-pages: setuid(2)(man7.org)