← Back Command Hijacking

PATH Hijacking

Educational Lab Only
This lab demonstrates PATH interception in a safe, simulated environment. Placing trojanized binaries on a production system without authorization is a criminal offense under the Computer Fraud and Abuse Act and equivalent statutes.

Briefing

When the shell resolves a bare command like ls, it walks the directories listed in $PATH from left to right, executing the first match it finds. An attacker who can write to any directory that appears before the legitimate binary's location can place a trojanized binary there. Every user who runs that command will silently execute the attacker's payload while seeing normal-looking output. This technique requires no root access and leaves a minimal footprint.

You have been granted access to a server under active compromise. The threat actor has placed a malicious ls wrapper in /tmp. Your task is to discover the technique, weaponize it, then restore the environment.

/tmp : /usr/local/bin : /usr/bin : /bin

With /tmp prepended, the shell finds the trojan first. The real binary at /usr/bin/ls is never reached.

MITRE ATT&CK
T1574.007 - PATH Interception by PATH Environment Variable — Adversaries may execute malicious payloads by hijacking environment variables used to load binaries. Prepending attacker-controlled directories intercepts legitimate command execution.

Objectives

Check PATH
Verify ls location
Inspect the trojan
Poison PATH
Test the hijack
Restore clean PATH
Terminal PATH is clean
0 / 6