Path Abuse

• PATH - http://www.linfo.org/path_env_var.html
  • contains absolute path
• the PATH env variable specifies the set of directories where an executable can be located.

Checking PATH details

• echo $PATH OR env | grep PATH
  
• creating a script in the path directory will make it executable from anywhere
• if we have can modify the PATH, we can replace a simple binary like ls with a reverse shell.

  touch ls
  echo 'echo "PATH ABUSE!!"' > ls
  chmod +x ls
  

• if we add our current directory that contains our scripts to the path, then we can call our binaries/scripts from anywhere.

  PATH=.:${PATH}
  export PATH
  echo $PATH