Educational Lab Only
This lab demonstrates alias-based command hijacking in a safe, simulated environment. These techniques are shown for defensive understanding. Modifying another user's shell configuration without authorization is illegal.
Briefing
When you type a command like ls, the shell does not immediately execute /usr/bin/ls.
It follows a resolution chain, checking aliases first, then functions, then builtins, and finally the $PATH.
An attacker who gains write access to a user's ~/.bashrc or ~/.bash_profile can inject a
malicious alias that shadows a legitimate binary. The user sees the command they expect, but the shell executes the attacker's payload.
1. Aliases
→
2. Functions
→
3. Builtins
→
4. $PATH lookup
Aliases sit at the top of the chain. They win every time.
MITRE ATT&CK
T1574 - Hijack Execution Flow
— Adversaries may execute their own payloads by hijacking the way operating systems run programs.
Alias injection is a sub-technique: persistence through shell profile modification.
Objectives
Verify command integrity
Inject malicious alias
Test the hijack
Detect the alias
Bypass with full path