Posts on: Path-Hijack

---

Environment variables are the configuration plane that every process inherits. When a privileged process — a root cron job, a systemd unit, a sudo-allowed command — trusts its inherited environment, a low-privileged user can often turn that trust into root. The critical question is always whether the variable survives into the privileged process, which depends on sudo’s environment handling, the scheduler’s reset behaviour, and the binary’s own sanitisation. Why These Attacks Work (and Often Fail) The single most common reason an environment-variable attack fails is that the privileged process does not actually inherit the attacker’s environment:

Windows services are the highest-yield privilege escalation surface on the platform because they run as LocalSystem while referencing four separate objects that a low-privileged user may be able to influence: Attack surface You control Exploitation Primary check Service binary The .exe on disk Replace the file, restart the service icacls on the binary Loaded DLL A DLL path the service searches Plant a DLL with the expected name Procmon NAME NOT FOUND Service DACL The service object sc config binPath=, restart accesschk -uwcqv Service registry key ImagePath / ServiceDll Edit the value, restart accesschk -kvuqsw Key distinction: A writable binary is a file-system problem. A modifiable service DACL is a service-object problem — you do not need write access to the binary’s directory. A writable registry key is a third, separate problem. Enumerate all four.