Educational Lab Only
This lab teaches the foundational shell lookup mechanics that all command hijacking techniques exploit. Understanding the resolution order is the prerequisite for defending against alias injection, function shadowing, and PATH hijacking.
Briefing
When you type a command, the shell does not immediately search $PATH.
It walks a strict four-level resolution chain, stopping at the first match.
Attackers weaponize this chain by planting overrides at the top levels.
This lab makes the chain tangible — you will add and remove overrides and watch the resolution point shift in real time.
1. Alias
Checked first
→
2. Function
Before builtins
→
3. Builtin
Compiled-in
→
4. $PATH
External binary
The highlighted step is where ls currently resolves. Watch it move as you work through the tasks.
MITRE ATT&CK
T1574 - Hijack Execution Flow
— Adversaries exploit shell resolution order to intercept commands. This lab covers the foundational
knowledge that enables alias injection (T1574), function shadowing, and PATH manipulation attacks.
Objectives
Identify shell builtins
Identify external commands
Create a function override
Create an alias override
Restore clean resolution