Path hijaking is used to manipulate the directory where the program will run. Let's consider a python program like the one below. A python script that runs job.sh written in bash language. Of course, in the real scenario, this python script will be more complicated. For easy understanding, I will continue with python as an example.
import os
os.system("./job.sh")#!/bin/bash
a program that does everyday work on the server like cron.
<some dangerous code>Bash scripts are often used on the server to shorten the duration of the processes and to automate the processes. Suppose that;
Let's see that when we run the **sudo -l** command, we can run the above python script with root privileges for our active user.
I can hear you saying I wish I could edit the job.sh file. In this case, we have to resort to path hijacking. Path hijacking changes the active path environment. In other words, it provides a manipulation as if I ran the program in the directory I want, not in the directory it is in. If I set my path to /tmp: the program will run any job.sh file in the /tmp directory.
Of course, although it is easy to explain, there are exceptions. Let's go through a machine on hackthebox together. Since the machine is active I will censor the machine name and ip address.
.
Here is a file called index.go that we can run with root privileges. Let's look at the source codes.
.
Running the deploy.sh file in it. I go to the /tmp directory and rewrite my own deploy.sh file to get a reverseshell.
.
I add a new directory to the path with Export. /tmp directory. So that it can read my deploy.sh even though my file is not in the same directory as it. Hijacking is done here.
.
