> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/privesc/path-hijacking/path-hijacking-tar-linux-privilege-escalation.md). # PATH（tar）劫持 - Linux 权限提升 ## 这是什么 PATH 劫持利用了那些在调用命令时未使用绝对路径的特权程序或脚本。如果攻击者控制了更靠前的目录， `PATH`，特权进程可以执行攻击者的二进制文件。本页重点关注 **PATH 劫持（tar）** 并保持利用流程切合实际：识别条件，安全验证，然后运行证明影响所需的最小载荷。 ## 枚举在运行利用路径之前，先确认本地上下文和具体的错误配置。 ```bash echo $PATH strings | head ltrace 2>/dev/null ``` ## 示例 **带有 SUID 权限的二分查找** ```bash find / -perm -4000 2>/dev/null ``` 结果：发现了一个有趣的二进制文件：/ /\&#xNAN;**`/usr/bin/pandora_backup`**.

**使用……进行二进制分析 `ltrace`** 为了理解该二进制文件的工作方式，我们使用了 **`ltrace`** （一个系统调用跟踪工具）来观察该二进制文件发出的系统调用： ```bash ltrace /usr/bin/pandora_backup ``` 这使我们发现该二进制文件执行了 **`tar`** 命令，但没有为可执行文件使用绝对路径，这会带来潜在漏洞。换句话说，如果我们修改我们的 **`PATH`** 以包含一个名为 `tar`，它就会被执行，而不是原始文件。

**通过劫持 PATH 进行操作** **创建了一个恶意的 `tar` 文件：** 我们创建了一个名为 `tar` 在 `/tmp/` 目录并赋予执行权限 **SUID**的文件。该文件包含一条以提升权限打开 bash shell 的命令： ```bash chmod 4777 /bin/bash ``` **变量更改 `PATH`:** 为了强制系统使用我们恶意版本的 `tar`，我们修改了变量 `PATH` 以优先使用目录 `/tmp/` ```bash export PATH=/tmp/:$PATH ```

**易受攻击的二进制文件执行：** 在修改 `PATH`，我们执行了二进制文件 **`pandora_backup`**:

由于执行了我们修改后的 `tar`，一个具有提升权限的 Bash shell 已被打开，使我们获得了 `root` 访问权限。 --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/zh/privesc/path-hijacking/path-hijacking-tar-linux-privilege-escalation.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.